Title: Koobface

Type: Worms

Remove Koobface. Removal instructions

Also known as: W32/Koobface,W32.Koobface,W32/Koobface.AZ,Boface

Severity scale:

(72 / 100)

Koobface worm is distributed on social networks, usually on MySpace and Facebook. It embeds itself on victim’s profile and displays links to malicious websites. The websites promote video codec which is actually the Koobface worm. Those sources might also install the worm without notifying visitors.

Koobface is also known as W32/Koobface, W32/Koobface.AZ, W32.Koobface and Boface. Once it gets on a machine, it checks if there are cookies of social networks. If it finds the cookies, it infects victim’s profile. If Koobface worm can’t find evidence of social networking websites, it simply erases itself.

Koobface also loads pop-ups that look like MS Windows error messages. The pop-up contains the following text: “Error installing Codec. Please contact support.”

Related files: Ld12.exe, fmark2.dat, fbtre6.exe, ld08.exe, freddy79

Koobface properties:
• Connects itself to the internet
• Hides from the user
• Stays resident in background

Automatic Koobface removal:

remover for Koobface

SpyHunter is recommended remover to uninstall Koobface. You should confirm using free trial that it detects current version of parasite.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manul removal instructions below.

If you failed to remove Koobface using SpyHunter please report this to us.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use.

STOPzilla

download | review

We are testing STOPzilla's efficiency at removing Koobface (2012-01-14 08:49:30)

Malwarebytes Anti Malware

download | review

We are testing Malwarebytes Anti Malware's efficiency at removing Koobface (2012-01-14 08:49:30)

Spyware Doctor

download | review | tutorial

We are testing Spyware Doctor's efficiency at removing Koobface (2012-01-14 08:49:30)

XoftSpySE Anti Spyware

download | review

Koobface manual removal:

FORUM:
Discuss Koobface in
spyware removal forum

Kill processes:
freddy79 fbtre6.exe mstre6.exe ld08.exe Ld12.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run\"systray" = "c:\windows\mstre6.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run\"systray" = "C:\Windows\fbtre6.exe"
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating

HELP:
how to remove registry entries

Delete files:
freddy79 fbtre6.exe fmark2.dat ld08.exe Ld12.exe

HELP:
how to remove harmful files

Information added: 2008-11-24 03:25:53
Information updated: 2012-01-14 06:12:15

Additional resources related to Koobface:

Attention: If you know or you have a website or page about Koobface removal, feel free to add a link to this list: add url

more resources

<Guest>

I also had to remove a file "freddy51" from the C drive as well.

Reply »

2009 07 27

rodi

Thanks, although this file has other anmes as well. Previously it was freddy46, freddy49. Now, it's freddy51. Later it could be freddy52, freddy53 and etc.

Reply »

2009 07 27

<Guest>

Removed Koobface using AVG, but still can Not connect to the Net using Internet Explorer even after changing the LAN Settings to automaic detect settings from Use a Proxy server. Please help

Reply »

2009 08 17

<Guest>

yah it's freddy64 now

Reply »

2009 09 17

<Guest>

it's freddy79. i was able to manually stop the processes, found the registry entries and deleted them but "freddy79" remains in C:Windows. If anyone has suggestions on getting it deleted, please post. It will no longer let you delete the file.

Reply »

2009 12 30

rodi

Thank you, we added freddy79 to the list too. Just download an automatic removal tool and run a system scan. I'm afraid that manual removal won't work for you.

Reply »

2009 12 31

<Guest>

i hate this stupid virus

Reply »

2010 01 05

<Guest>

I just cleaned this from a friend's laptop last night. It was up to freddy81.

Reply »

2010 01 28

<Guest>

im finding bills now, is that bad?

Reply »

2010 03 16

<Guest>

I don't find the fbtre6.exe, I find fbtre19.exe. Should I remove it?

Reply »

2010 03 21

<Guest>

Found it on mine as bill104.exe? Or is that another one?

Reply »

2010 03 24

<Guest>

Found as bill 106.exe

Reply »

2010 04 03

<Guest>

Koobface is nasty. It blocked me from many Internet sites by preventing DNS translation. I couldn't update my antivirus program (Avast). Ultimately I was able to rid myself of this beastie by running Microsoft's Malicious Software Removal tool (MRT.exe).

Reply »

2010 04 06

<Guest>

dies this affect mac users also? if so, how do i manually remove it on a mac? thanks

Reply »

2010 04 10

<Guest>

MUCH THANKS

Reply »

2010 04 11

hey

dident work :(

Reply »

2010 04 13

callum-MS-FB

ok just get avg or norton or a good anti virus and it will detect it and remove it

Reply »

2010 05 04

<Guest>

Avira (free) gets rid of Koobface

Reply »

2010 06 11

<Guest>

uhh, i found a bill something, but deleted it as soon as i found it (i run in safemode so i know what processz arnt suppose to be there) but i cant find it anywhere on my laptop, any help on where bill105 would be in the registry?

Reply »

2010 07 29

Akio

hey guys after i infected with koobface my Google Chrome cant login facebook and any google related sites. Is it also koobfaces effect??

Reply »

2011 08 23

Saleem

Avira gets rid of koobface.

Reply »

2011 11 19

nazi

Reply »

2011 11 19

Post Comment:

Attention: Use this form only if you have additional information about Koobface parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Latest spyware news:

Subscribe to news

Similar parasites:

Related discussions:

Compare spyware removers
Compare free products

HijackThis Log Analyzer Beta 2

Spreading the knowledge:

It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.