Home Malware Programs Worms Koobface

Koobface

Posted: December 5, 2008

Threat Metric

Threat Level: 5/10
Infected PCs: 6,469
First Seen: July 24, 2009
Last Seen: May 24, 2022
OS(es) Affected: Windows

Koobface is a worm that infects computers by using the messaging system of social networks like Facebook and MySpace. Other Koobface known variants are Boface, W32.Koobface, Net-Worm.Win32.Koobface.b, and W32/Koobface. The Koobface worm attacks profiles by sending an email to a user's Facebook inbox with subjects like "You look just awesome in this new movie" or "You look funny in this new video" and the email message provides a link to a malicious video website. The malicious video website will prompt the user to download the fake video codec file flash_player.exe under the assumption that the user needs to update the Flash program to view a video. The flash_player.exe is really a doorway meant to let Koobface infect your computer.

Once installed, Koobface downloads a program called tinyproxy.exe. Tinyproxy.exe loads a proxy server called Security Accounts Manager which Koobface uses to monitor traffic on TCP port 9090 and proxies all outgoing HTTP traffic. Koobface hijacks search results from search engines like Google, Yahoo, and MSN and replaces the results with links of malicious websites.

Koobface may redirect you to malicous websites that sell rogue security tools. Koobface has the ability to recreate itself after reboot. It is strongly recommended to remove Koobface from your system upon detection.

Aliases

Win-Trojan/Injecter.17920.ES [AhnLab-V3]Trojan.Dropper.Koobface.AEJ [McAfee-GW-Edition]DR/Koobface.AEJ [AntiVir]Trojan.DownLoad.40118 [DrWeb]TrojWare.Win32.TrojanDownloader.Injecter.ddn0 [Comodo]Worm.Koobface-125 [ClamAV]W32/Downldr2.FZRM [F-Prot]TrojanDownloader.Injecter.ddn [CAT-QuickHeal]Artemis!10377EFE296F [McAfee+Artemis]SHeur2.AOYT [AVG]Trojan-Downloader.Win32.Injecter.ddn [F-Secure]Win32/Koobface.NCD [NOD32]Worm.Koobface [Ikarus]Win32.HLLW.Facebook.755 [DrWeb]Worm.Generic.250945 [BitDefender]
More aliases (3069)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%WINDIR%\system32\swe.dll File name: swe.dll
Size: 64.51 KB (64512 bytes)
MD5: b008856fa107fb14dbfb01ac4bc7ff0a
Detection count: 1,426
File type: Dynamic link library
Mime Type: unknown/dll
Path: %WINDIR%\system32
Group: Malware file
Last Updated: November 8, 2010
%WINDIR%\system32\drivers\PDRV.sys File name: PDRV.sys
Size: 39.29 KB (39296 bytes)
MD5: 07e86b47b742f78855ea14b68f4b6fea
Detection count: 1,183
File type: System file
Mime Type: unknown/sys
Path: %WINDIR%\system32\drivers
Group: Malware file
Last Updated: September 7, 2010
%WINDIR%\system32\mas.dll File name: mas.dll
Size: 49.15 KB (49152 bytes)
MD5: 0ca69d528f881daf9553dd969b16a276
Detection count: 1,091
File type: Dynamic link library
Mime Type: unknown/dll
Path: %WINDIR%\system32
Group: Malware file
Last Updated: November 9, 2010
%WINDIR%\system32\drivers\mas.sys File name: mas.sys
Size: 28.03 KB (28032 bytes)
MD5: 2428166634a56621d224f2f8883ebb0d
Detection count: 1,031
File type: System file
Mime Type: unknown/sys
Path: %WINDIR%\system32\drivers
Group: Malware file
Last Updated: November 9, 2010
%APPDATA%\SystemProc\lsass.exe File name: lsass.exe
Size: 79.36 KB (79360 bytes)
MD5: 714fdafb2028b4c06ce8cef5691b081f
Detection count: 162
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\SystemProc
Group: Malware file
Last Updated: September 14, 2010
%programfiles%\webserver\webserver.exe File name: webserver.exe
Size: 14.33 KB (14336 bytes)
MD5: eeda586b324d69ebf6b537724ad122cb
Detection count: 91
File type: Executable File
Mime Type: unknown/exe
Path: %programfiles%\webserver
Group: Malware file
Last Updated: September 15, 2010
%windir%\system32\fio32.dll File name: fio32.dll
Size: 50.68 KB (50688 bytes)
MD5: c1448afa4012e692b85c2755a112c33c
Detection count: 90
File type: Dynamic link library
Mime Type: unknown/dll
Path: %windir%\system32
Group: Malware file
Last Updated: September 15, 2010
bill107.exe File name: bill107.exe
Size: 74.24 KB (74240 bytes)
MD5: 3325f9fdcdcf36a02b6a8f2ee525041a
Detection count: 86
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 27, 2010
bill110.exe File name: bill110.exe
Size: 77.31 KB (77312 bytes)
MD5: 4fb5e6eea077e43c95c65f072c608c91
Detection count: 86
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 18, 2010
bill109.exe File name: bill109.exe
Size: 72.7 KB (72704 bytes)
MD5: da5bbe0812987119fdcb282fe08c53b2
Detection count: 85
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 18, 2010
bill109.exe File name: bill109.exe
Size: 74.75 KB (74752 bytes)
MD5: 7e35f37167c894c5b4a9c29a1648dcf2
Detection count: 84
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 18, 2010
%PROGRAMFILES%\webserver\webserver.exe File name: webserver.exe
Size: 13.31 KB (13312 bytes)
MD5: 5e2754aadeeb72fce607726dec81b350
Detection count: 75
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\webserver
Group: Malware file
Last Updated: October 28, 2010
bill110.exe File name: bill110.exe
Size: 79.87 KB (79872 bytes)
MD5: 7dea858c6530e5875cd59d4bd6df1efd
Detection count: 73
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 3, 2010
bill110.exe File name: bill110.exe
Size: 58.36 KB (58368 bytes)
MD5: 1beb0cc256f81a2282d3915cfee0ee1d
Detection count: 72
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 3, 2010
%WINDIR%\system32\certoko.dll File name: certoko.dll
Size: 128 KB (128000 bytes)
MD5: 9392b9eaab4b07b1b1696f350caf7397
Detection count: 42
File type: Dynamic link library
Mime Type: unknown/dll
Path: %WINDIR%\system32
Group: Malware file
Last Updated: October 28, 2010
bill110.exe File name: bill110.exe
Size: 78.84 KB (78848 bytes)
MD5: f213646644b5943766db430f3ade0a27
Detection count: 40
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 25, 2010
bill112.exe File name: bill112.exe
Size: 76.28 KB (76288 bytes)
MD5: b3be5e20e18f3c28c56a902b9e13a88c
Detection count: 30
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 29, 2010
%WINDIR%\SysWOW64\drivers\PDRV.sys File name: PDRV.sys
Size: 48.12 KB (48128 bytes)
MD5: 2e04cdb6a5c912acfa21946c8d8b1ec2
Detection count: 23
File type: System file
Mime Type: unknown/sys
Path: %WINDIR%\SysWOW64\drivers
Group: Malware file
Last Updated: December 7, 2010
%PROGRAMFILES%\webserver\webserver.exe File name: webserver.exe
Size: 14.84 KB (14848 bytes)
MD5: 989db2f4fcda61a6fea51be24459c2b4
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\webserver
Group: Malware file
Last Updated: October 28, 2010
%WINDIR%\system\svchost.exe File name: svchost.exe
Size: 40.44 KB (40448 bytes)
MD5: 55d39b196e1ac496a355e9bc16de3ba1
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system
Group: Malware file
Last Updated: November 2, 2010

More files

Registry Modifications

The following newly produced Registry Values are:

File name without pathld14.exeRun keysCaptcha7

Related Posts

4 Comments

  • John Myers says:

    My computer wont allow me to download spyhunter and when I manually try to find in computer or all harddrives "Koobface" is not found. Please help me. Thank You, John Myers

  • Rhonda says:

    I have received all of the warnings this week about some kind of password stealing trojans being on my computer and then for $99.00 purchased Avast to fix the problem, and on my laptop another bunch of crap is going on and I purchased a program for $49.00 yesterday on Reg tool and am still trying to get it to work properly. I am so pissed, because I currently lost my job last week and I sure didn't need to spend that money.

  • jyoti jitender kaur says:

    my computer is not opening facebook due to virus. please help me to remove virus from my computer.

  • Clark Creery says:

    My wife's laptop downloaded all sorts of things and she could not get to anything, we called Microsoft Support and they charged us 299 to run both her computer and my laptop to look for and fix koobface. In Feb we had a similar infection and the microsoft group charged 99 dollars and their fix did not work, so they tried again and it worked so I filed a complaint with my credit card company. That is currently in litigation. I am a retired service member living on my retirement and i find by looking up this worm, everyone has a fix? I am very concerned with Microsoft. I tried their MRT program and it appears to do the same thing that their fix did and it was free. Daily I run CCleaner followed up by malware bytes. This really haunts me.

Loading...