think have the facebook koobface worm.

ok this is my moms computer and get a popup from avira when turn computer on that there is worm/koobface.aeh detected. i click onto deny access so far. this computer is windows vista. what should i do? thank you.

Edited by james42519, 22 December 2009 - 01:55 AM.

We can establish if you have all of the koobface virus by, A. If your getting search redirects, B. You can see remote control of the computer, the remote controller is abusing it, and C. Your getting rouge anti-virus software installed. If so, then you have koobface. To stop this problem, do the following. Subscribe to this topic so when i reply, you don't have to keep checking up on the forum. Download MalwareBytes Anti-Malware on a CLEAN computer as koobface blocks access to known security websites. When downloaded, rename to zztoy.exe, and put it on a removable disk, e.g flash drive. Install the software and MAKE SURE YOU UPDATE THE SOFTWARE. Ok, then run a FULL SCAN, and then post us your log. I'll be waiting.

EDIT: The Microsoft Malicious Software Removal Tool will also be able to combat koobface as well. So give that a go.

Edited by cookmiester, 22 December 2009 - 05:19 AM.

ok took awhile. looks like it is not doing the stuff you said because antivirus is stoping it when it trys to start. here is the log and i click on remove selected. hope that was right.

Malwarebytes' Anti-Malware 1.42
Database version: 3409
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18865

12/22/2009 1:33:13 PM
mbam-log-2009-12-22 (13-33-13).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 266859
Time elapsed: 1 hour(s), 27 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\ProgramData\03184420 (Rogue.Multiple) -> Quarantined and deleted successfully.

Files Infected:
C:\Users\Diane\Desktop\RetrogamerSetup2.3.50.49.RGfox000.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Users\Diane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.

Edited by james42519, 22 December 2009 - 02:34 PM.

Ok, we have removed some of koobface by doing this now. The next phase i reccomend you do is on a clean computer again download SUPERantispyware, then run a scan with that, but update the software first. Then post your log of that and we will see what the next cause of action is. Oh and like i said on my first post. Use the Microsoft Malicious Software Removal Tool. http://www.microsoft.com/downloads/details...;displaylang=en

Note: Oh And After You Kill this Worm, You Might Want To Change Facebook , Twitter , Im And Email Passwords Just To Be safe