Comments on: How to remove Koobface worm (Removal guide)

By: inquirer

inquirer — Mon, 19 Apr 2010 12:11:58 +0000

Ok got it removed, you guys are great, thanks so much.

By: inquirer

inquirer — Mon, 19 Apr 2010 11:06:53 +0000

and to remove all the virus with malwarebyte, should you purchase???????????????

By: Patrik

Patrik — Sat, 17 Apr 2010 15:06:25 +0000

Dan, probably your computer is infected with a trojan that blocks Malwarebytes. Please open a new topic in our Spyware removal forum. I will check your PC.

By: Dan Compton

Dan Compton — Fri, 16 Apr 2010 22:43:10 +0000

I picked up the Koobface virus from Facebook. When i try 2 execute the removal i get an error message that says “Error:Could not open RunOnce key to register cleanup. Aborting execution!(error 0:the operation completed successfully.)” and i never get to the point of rebooting. Also, I am using Windows 7. Is this the right procedure for removal? Please help. Thank you.

By: Patrik

Patrik — Thu, 25 Mar 2010 14:02:50 +0000

Mallory, open a new topic in our Spyware removal forum. I will check your PC.

By: Mallory

Mallory — Wed, 24 Mar 2010 21:29:16 +0000

Downloaded MBAM and did the Avenger steps. Still cannot log in to websites. Help?

By: Patrik

Patrik — Wed, 24 Mar 2010 14:37:51 +0000

Katarina, try rename Avenger before running. Use any random name (asd125 for example).

By: Katarina

Katarina — Mon, 22 Mar 2010 22:42:46 +0000

it doesnt allow me to start avenger. And the command “Click Start -> Run -> type regedit and hit enter.
Registry editor opens.” doesn’t work. What to do?

By: JJ

JJ — Tue, 16 Mar 2010 20:38:47 +0000

Hey great post!!!
My boss somehow downloaded this worm yesterday.
She was having popups and could not log onto websites.
I pulled up task manager (vista no SPs).
Saw that bill103.exe was running…knew something was wrong and terminated it.
That was the tip of the iceberg…as you all know.
long story short…1 day later.
I ran through the process above (it is actually a Koobface variant). I deleted all file related. however…it is still on the system and i couldn’t update malwarebytes since the worm blocked it… I downloaded microsoft’s malicious software tool removal tool to a thumbdrive and ran it…it picked up one file that was missed by malwarebytes (koobface.gen!) quarantined and deleted. I then added SP1 for vista (just because it needed to be updated) and updated IE7 to 8 (I tried mozilla but it would not work at all). I rebooted between all scans and installs. I disabled all add ons for IE8 and cleared histories. I then opened malwarebytes again and was able to update it. once it was updated i rebooted. ran the entire process again above. This worm is replicating itself into new forms now it seems. malwarebytes picked up 9 new threats. q’d and deleted. ran microsoft mal tool removal again (to be safe) no results. ran malwarebytes again (no results). can’t be too safe. ipconfig’d to turnoff network connection (run cmd promtp as administrator, ipconfig /release). opened IE8. clicked on advanced and reset to factory defaults. enabled add ons. made sure certain security features that we need we enabled. saved. closed IE8. rebooted. opened IE8 and went to one of the sites that we need to log on to with secured info (bank info ..scary to think about it…). it works.

Couple things…Advanced SystemCare may have actually screwed the process up…I tried to see if that would clean registry/spyware and although it did it seemed to screw up everything but registry entries were all the same. my suggestion is don’t try a registry cleaner or Advanced System Care during process.
I also manually checked the registry through regedit…and had to delete systray entry.
Thank you all esp whoever posted this!!!

By: Chris

Chris — Fri, 12 Mar 2010 17:40:57 +0000

Thank you!