Articles > Facebook users hit by 'Koobface' virus

In a nutshell, this is how it works:

1. You receive an EMAIL from Facebook apparently from one of your friends.
2. In the email it says something like this:
   

   ---

   "Mark sent you a message.
   
   Subject: What the hell are you doing on this tape?
   
   "L O L
   http://www.facebook.com/l.php?u=http://www.geocities.com%2Fclintonburch69%2Findex etc, etc...
   
   To reply to this message, follow the link below:
   http://www.facebook.com/n/?inbox/readmessage.php&t=10397 etc, etc...
   
   Want to control which emails you receive from Facebook? Go to:
   http://www.facebook.com/editaccount.php?notifications&md=bXNnO2Zyb etc, etc..."

   ---

3. If you click on the first link, it takes you to a seemingly legitimate site which appears to want to show you a video clip:
   
   
   
   It tells you that your version of Flash player is out of date, and tries to get you to update it. Only the update is not a Flash player update. It's the network worm itself and if you agree to install, you're infected. The worm can collect your credit card details when you make a purchase online, or steal them from a cookie from a previously-placed order.
4. The second link in the email takes you to the Facebook site to the message your friend apparently sent, except they didn't.

Removal

If you believe you're infected then first, disconnect your internet connection to prevent further damage. Then clean your PC of infections using an antivirus program or contact us for assistance.

Almost Caught

This is a tricky type of virus because it plays on the fact that it comes from a seemingly trustworthy source. I myself almost fell for it!

I was literally at the point of becoming infected (I almost clicked on the "Download Flash Player update") but was I was suspicious. So instead I updated my Flash Player from the legitimate source (I went to Google and typed in "Flash Player" which brought up the legitimate download sources, Adobe and Macromedia. Once I had updated it from there, I tried refreshing the video page I had landed on from the link in the email, but still it told me I needed to update my Flash Player, so now I was even more suspicious of foul play.

I typed into Google some of the symptoms I was faced with and low and behold, my suspicions were true - had I clicked on "Download Flash Player update" I would now be infected with the Koobface virus.

So remember the advice from our October 2007 TechTips: If In Doubt, Say No! RB