Koobface

Virus:   Koobface
REAL VIRUS
Origins:   Koobface is a piece of malware that circulates via messages sent through the social networking sites such as MySpace and Facebook. The Koobface e-mails arrive with subject lines such as "You look so amazing funny on our new video" and "You look just awesome in this new movie" and offer recipients links to video sites that appear to contain movie clips. When users follow the links and attempt to play those videos, however, they get error messages informing them that they need to download a file to update their Adobe Flash Flash software — and that download (flash_player.exe) contains malicious Koobface code:


Facebook sent the following instructions to users whose accounts may have been compromised:

We have detected suspicious activity on your Facebook account and have reset your password as a security precaution. It is possible that malicious software was downloaded to your computer or that your password was stolen by a phishing website designed to look like Facebook. Please carefully follow the steps provided:

Run Anti-Virus Software: If your computer has been infected with a virus or with malware, you will need to run anti-virus software to remove these harmful programs and keep your information secure. For Microsoft:

http://www.microsoft.com/protect/viruses/xp/av.mspx
http://www.microsoft.com/protect/computer/viruses/default.mspx
 

Additional information:
Koobface Remains Active on Facebook Koobface Remains Active on Facebook
(McAfee)

Last updated:   5 December 2008

The URL for this page is http://www.snopes.com/computer/virus/koobface.asp

Urban Legends Reference Pages © 1995-2009 by Barbara and David P. Mikkelson.
This material may not be reproduced without permission.
snopes and the snopes.com logo are registered service marks of snopes.com.

Sources:

    Kopytoff, Verne.   Koobface Computer Virus Attacks Facebook Users."
    San Francisco Chronicle.   5 December 2008.

    Wauters, Robin.   "Koobface Virus Still Making the Rounds on Facebook."
    The Washington Post.   5 December 2008.