Koobface virus from Facebook

Please Help. Go this virus this morning from face book and no amount of google searches have helped. I have AVG antivirus free, and it won't let me access it to run a scan. I went into facebook and changed my password, then I was allowed acces AVG. I ran a full scan and ten infections came up, which were removed. I re started laptop but it's still there. I can't access Add/Remove programs in control panel, or vdeos etc. Can anyone Help?

Sounds like a nasty and very tricky one:


[broken link removed]

File Removal Procedures

The first step you need to take in order to delete Koobface is to stop the following processes:

• fbtre6.exe
• mstre6.exe
• freddy35.exe
• websrvx.exe
• captcha6.exe
• kaka.exe
• bolivar28.exe
• Ld12.exe
• %WinDir% \system32\splm\ncsjapi32.exe
• %WinDir%\system32\nScan\ecls.exe
• %WinDir%\system32\nScan\ekrn.exe
• %WinDir%\validate.inf

The next step in Koobface removal is to unregister the following DLL files:

• %WinDir%\system32\nScan\ekrnAmon.dll
• %WinDir%\system32\nScan\ekrnEmon.dll
• %WinDir%\system32\nScan\ekrnEpfw.dll
• %WinDir%\system32\nScan\ekrnScan.dll
• %WinDir% \system32\splm\kbdsapi.dll
• %WinDir% \system32\splm\lmfunit32.dll
• %WinDir% \system32\splm\mcaserv32.dll

To complete file removal, delete the following files and folders:

• fbtre6.exe
• mstre6.exe
• freddy35.exe
• websrvx.exe
• captcha6.exe
• kaka.exe
• Ld12.exe
• bolivar28.exe
• %WinDir% \system32\splm\kbdsapi.dll
• %WinDir% \system32\splm\lmfunit32.dll
• %WinDir% \system32\splm\mcaserv32.dll
• %WinDir% \system32\splm\ncsjapi32.exe
• %WinDir%\system32\nScan\ecls.exe
• %WinDir%\system32\nScan\ekrn.exe
• %WinDir%\system32\nScan\ekrnAmon.dll
• %WinDir%\system32\nScan\ekrnEmon.dll
• %WinDir%\system32\nScan\ekrnEpfw.dll
• %WinDir%\system32\nScan\ekrnScan.dll
• %WinDir%\system32\nScan\em000_32.dat
• %WinDir%\system32\nScan\em001_32.dat
• %WinDir%\validate.inf

Now your hard disk does not contain any instances of Koobface files. However, this fact needs to be certified by conducting a full system scan using genuine antivirus software such as Spyware Doctor with Antivirus.
Registry Removal Procedures

After file removal has been completed, it is necessary to delete the following registry entries as well in order to completely remove Koobface:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run\"systray" = "c:\windows\mstre6.exe"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run\"systray" = "C:\Windows\fbtre6.exe"
• HKEY_CURRENT_USER\AppEvents\Schemes\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Intelli Mouse Pro Version 2.0B\StubPath: "%WinDir% \System32\splm\ncsjapi32.exe"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*Intelli Mouse Pro Version 2.0B*: "%WinDir% \System32\splm\ncsjapi32.exe"
• HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden: "2"
• HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Intelli Mouse Pro Version 2.0B: "%WinDir% \System32\splm\ncsjapi32.exe"
• HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\RunOnce\*Intelli Mouse Pro Version 2.0B*: "%WinDir% \System32\splm\ncsjapi32.exe"
• HKEY_USERS\Software\Microsoft\Windows\nScan32\ExecuteDate: "14\8\2008"Apps\Explorer\Navigating

Now your computer is completely safe from Koobface. Even if this is true in most cases, by using the online computer repair service offered by www.onlinecomputerrepair.org chances are that Koobface will be properly removed as well as additional related problems fixed.
Conclusion

It is not recommended for inexperienced users to try and manually remove Koobface as any error made during removal could damage your system and your web browsing experience. Inexperienced users are advised to use a web-based repair service such as www.onlinecomputerrepair.org or legitimate antivirus software for safe and efficient Koobface removal.

What did you click in FB to dowload the virus, or do you know? Might be worth posting so others can avoid

See here also:

http://www.snopes.com/computer/virus/koobface.asp

It was to view a picture or video of myself, then it said to click to update my version of Adobe...thats when it happened. Manto...thanks for the post but you will have to explain to me how to do these steps...not very techy. Thanks

Okay when I press Ctrl, Alt and Del to get into Task manager, nothing happaens

I cant access this myself at the moment but eHow.com recommend the following step by step guide:

As you cant access your task manager the above guide may not be possible.

Hopefully this will help slookie.

www.411-spyware.com/koobface-b-worm

Also from Facebook:

Facebook has posted instructions on how to remove the infection.

I have tried that too but no joy. This is some dose...all my facebook contacts got it too. I cant access task manager, my AVG, webpages keep coming up with ACCESS DENIED. Aahhhh

I feel your pain, I had a similar one to this before: Very annoying.

ok, maybe try downloading the trial version of:

http://www.bestspywarescanner.net/

Apparantly it picks up on koobface but I dont know if the trial version will let you remove it? Hopefully it will.

Thanks for your help...but when I go to download something, it will download up to 100% and then it just stops...there's surely somone out there that this has happened to.

you could try get someone else to download it for you and then give it to you on a USB key and download it that way.

Ok last night I went into my wife's account on the laptop. All the icons were on the screen, and I could access AVG, Task manager etc. The internet still kept blanking on me, plus pop ups with virus warnings. Anyway i did a full scan, and ten Koobface viruses were found. They were deleted and I then emptied the area they were in. But this still didnt work. Also when I went into task manager, none af these were in it from Manto's Post..

The first step you need to take in order to delete Koobface is to stop the following processes:

• fbtre6.exe
• mstre6.exe
• freddy35.exe
• websrvx.exe
• captcha6.exe
• kaka.exe
• bolivar28.exe
• Ld12.exe
• %WinDir% \system32\splm\ncsjapi32.exe
• %WinDir%\system32\nScan\ecls.exe
• %WinDir%\system32\nScan\ekrn.exe
• %WinDir%\validate.inf

Am completely at a loss and I dont want to take it to a computer shop and pay them €60 or €70 for ten mins work to get rid of it.

I have got something nice information from here and it was really geneuine help and we need to help one another like this. I have one question regarding the virus software, which is the best virus software to safe internet!!

Slookie - I presume you went into the task manager and then to the 'processes' tab to look for those. Just making sure and apologies if it was basic. Did you also remove the registry entries as Manto states

Ya looked in processes tab and not there. But I can only access task manager on my wifes username and not on me...maybe they would be there if I could access it on mine. My frien who had the virus did a system restore to last week and his is fine now...i tried a restore to about 6 different daes in the past and it wouldnt restore for me. So annoying

Try starting the computer in safe mode, it might let you do more things, I'm no expert myself, but I removed a virus from someones PC a while ago and whilst I could not access anything or download anything, in safe mode the PC responded.

Got it sorted. Did a system restore to a date last week and it worked.