by Melissa J Luther

Created on: December 15, 2008   Last Updated: December 18, 2008

On December 3, 2008 the Koobface worm re-emerged. Variants of Koobface have existed since July, affecting MySpace, Facebook and other social networking sites. The current variant only targets Facebook.

If you or your children use Facebook, or any social networking site, take a few minutes to familiarize yourself with this threat. Share this information with your children. Because children, especially teenagers, commonly share videos, they are the ones most likely to download this worm.

>How does Koobface work?<

The Koobface worm sends messages to an infected user's Facebook friends list with the subject, "You look funny in this new video," or a similar enticing line. The message contains a link to a supposed video site. This site displays a message that the video can not play because Flash player needs updating and includes a file to download, often called flash_player.exe or flash_update.exe.

If you attempt to install this file, you get a popup: "Error installing Flash Update". Meanwhile, Koobface downloads a program called tinyproxy.exe. This program, once installed, monitors your internet traffic and can steal password and log-in information. It also hijacks searches from major search engines to lesser known sites, including re-directs to sites offering free anti-virus downloads, which are actually more malware. It can also automatically download and install additional malware.

>Prevent Koobface<

The following tips are important guidelines for protecting your computer from all viruses and malware, not just the Koobface worm.

*Don't click on suspicious links: Learn to identify suspicious links. Often, they contain misspellings or do not link to the site they claim. Hover before clicking. If the link that appears in the lower frame of the browser does not match the text, don't click.

*Know your friends: Only click links from people you know and trust. And even then, double-check the link.

*Keep all Microsoft software updated. Microsoft regularly publishes patches for its software. Set Windows Update to automatically check for and install critical patches.

*Keep anti-spyware software updated: Up-to-date programs will detect and delete Koobface. Set this software to auto-update as well. Note that anti-spyware is not the same as antivirus, and you need both. Most of the major protection suites do include both.

*Use a firewall: A good firewall can prevent many infections.

>Remove Koobface<

If you have already fallen victim, prevent the worm from doing more damage by changing your Facebook password and running your antispyware program. Then, resolve to be more careful in the future.

Learn more about this author, Melissa J Luther.
Click here to send this author comments or questions.