Comments on: Update on Koobface Virus

By: Jack

Jack — Tue, 03 Nov 2009 19:05:50 +0000

Hi Selina,
Due to the age of this post, Koobface may well have taken on a very different form (I found it originally 11 months ago), so I can’t say whether or not you have the same problem. One thing you can try, though, is ensuring that “Show Processes From All Users” in the bottom left corner of the task manager is checked.

Hope this helps.

- Jack

By: Selina

Selina — Tue, 03 Nov 2009 11:24:59 +0000

Hello,

My computer has been infected with Koobface. However, I tried to look for tinyproxy.exe after clicking the Process tab after pressing Ctrl+Alt+Delete. Are there any other .exe to remove that are related to Koobface??

Regards,

Selina

By: Jack

Jack — Sat, 16 May 2009 17:20:47 +0000

Hi Bert,
Sorry about the delay in responding to you. I missed your comment. Please let me know if you are still having problems and I will be happy to assist you.

Jack

By: Bert

Bert — Sun, 08 Mar 2009 05:09:01 +0000

Hello Jack- I hope you can help me. About a week ago my PC-cillin quarantined a koobface virus (and a few since then). For the past week I have been getting redirected on my google searches, and have a ton of pop-ups all day long- the most annoying being an apparent free virus scan from Norton 360.

I have unchecked use a proxy server under tools, but I do not see tinyproxy or bolvar running in my task manager or anything that looks like it except for tmproxy which I think is part of PC-cillin. I have emptied my temporary files.

please help me! thanks for your time

By: Jack

Jack — Wed, 04 Mar 2009 04:28:15 +0000

Hello,
Thank you for contacting Tony’s Geek Tips.

Before I begin providing my opinion on how you might try to fix this problem, let me mention that this post was for an older version of the virus, which, although more than likely quite similar, will probably have differences. I’m more than happy to help you, of course. That’s why we’re here.

After reviewing the information you provided, there are a few more questions I would like to ask (most of which I covered in my post). At that point, I will offer my suggestions.

1. What are your specific symptoms?

2. Are there any processes running in your system that look like they may be related (e.g. boliver28.exe, tinyproxy.exe, etc.)?

3. Are there any startup items that look like they may be related (e.g. bolvar28)?

4. In your windows directory, as well as your windows\system32 directory, are there any .dll or .exe files that look like they have something to do with it (look in my post for examples)?

5. Is your browser configured to use a proxy (other than normal, if you normally use one – see post for details)?

6. Have you cleared your temporary internet files, cookies, cache, etc.?

This information will provide useful information to aid in solving your problems. Please do not publicly post information that could personally identify you, your computer’s information, etc (I know, yada yada legal stuff…).

Thanks,
Jack

By: Giovanne

Giovanne — Wed, 04 Mar 2009 00:34:06 +0000

hey,

thanks for your great site and informations.
I’m using firefox and windows XP.
i’ve tryied to follow all your procedings but yet i have problems with this thing! Some operations didn’t worked or were done in other ways (for finding or deleting for instance..) i think now to end it i have to locate the dll files but i don’t know how…
hope you would have time to answer me…
thanks you

By: Koobface Making It’s Rounds…Again « Tony’s Geek Tips

Koobface Making It’s Rounds…Again « Tony’s Geek Tips — Tue, 03 Mar 2009 16:46:13 +0000

[...] a client, your great-grandma, or your dog have been infected, you might want to take a look at the fix I posted back on December 4 the last time it broke out like this. As always, the contributors here [...]

By: Mike from UK

Mike from UK — Sun, 01 Feb 2009 22:47:59 +0000

Thank you Jeff
Iwas prompted by a Norton scan detecting koobface.
I followed all your steps and I only found the fmark2.dat file, no bolivar exe etc but it was enough to prevent the Norton scan saying I had koobface. My AVG Security V8 hadn’t detected anything but I wonder who was right?
Best wishes

By: Candice

Candice — Sun, 21 Dec 2008 02:05:46 +0000

Thank you VERY much! after spending quite a bit of fustrating time working on this your instructions worked perfectly.

By: Rob

Rob — Thu, 18 Dec 2008 18:49:45 +0000

oh, sorry, forgot, following your instructions i didn’t find f49f4d98.dat, but did see f49f4daa.dat. also created at the same date as fmark2.dat was fm123.dat, do these need to go also? (already deleted fmark2.dat)