Protect Your Identity from Koobface Attack

Koobface is not just a pun on Facebook. It is a deadly virus that is affecting not only Facebook, but creating havoc also on MySpace, Twitter, Bebo, and other social networking websites. The process of infection is quite simple. You get a link from your friend claiming some sensational material asking you to click on that— generally it is some youtube.pl or ru link. Afterward, you are asked to install a newer version of flash, which is not what it claims to be. That is a virus. The latest variant of this virus claims to show you “Barack Obama Hillary Clinton – Sex Scandal”.

obama-clinton-facebook-scandal

Technically, it is not a virus. It is a worm that is used to steal your personal information, primarily your credit card. Safeguarding yourself against this should be your top identity protection strategy.

Variants of Koobface worm

There are several variants of Koobface virus. The identified ones are:

Variants	Attacks
Net-Worm.Win32.Koobface.a	MySpace
Net-Worm.Win32.Koobface.b	Facebook
WORM_KOOBFACE.DC	Twitter
W32/Koobfa-Gen	Facebook, MySpace, hi5, Bebo, Friendster, myYearbook, Tagged, Netlog, Badoo, and fubar

Don’t Panic!
If you have clicked any such link, as there is a way to fix this. Just follow the steps written below and you will remain safe.

Koobface manual removal

Step 1: Press Ctrl + Alt + Del to open task manager and kill the following processes:
fbtre6.exe
mstre6.exe
Step 2: Delete the following registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run\”systray” = “c:\windows\mstre6.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run\”systray” = “C:\Windows\fbtre6.exe”
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating
Step 3: Delete the following files
freddy79 fbtre6.exe fmark2.dat ld08.exe Ld12.exe
That’s it. You are safe. You can also search Google for “Koobface removal” to find automatic removal tool. You can also use Microsoft’s Malicious Software Removal Tool to remove Koobface.

Windows operating system is the only OS affected by this virus.

Comments

Defacing Sites via HTML Injections (XSS)

Defacing Sites via HTML Injections Defacing Sites via HTML Injections What Is HTML Injection: "HTML Injection" is called as the Virtual Defacement Technique and also known as the "XSS" Cross Site Scripting. It is a very common vulnerability found when searched for most of the domains. This kind of a Vulnerability allows an "Attacker" to Inject some code into the applications affected in order to bypass access to the "Website" or to Infect any particular Page in that "Website". HTML injections = Cross Site Scripting, It is a Security Vulnerability in most of the sites, that allows an Attacker to Inject HTML Code into the Web Pages that are viewed by other users. XSS Attacks are essentially code injection attacks into the various interpreters in the browser. These attacks can be carried out using HTML, JavaScript, VBScript, ActiveX, Flash and other clinet side Languages. Well crafted Malicious Code can even hep the ...

EKS Cluster and Create CSI Driver to store credentials in AWS Secrets Manager via SecretProviderClass

EKS Cluster | CSI Driver | SecretProviderClass | AWS Secrets Manager Setup EKS Cluster and Manage Credentials at runtime using CSI driver using SecretProviderClass and Secrets Manager Assuming you have Configured/Installed AWS CLI, EKSCTL, KUBECTL, HELM. CSI Basic Information: CSI (Container Storage Interface) widely used as a Storage Technology. Created by Google | Mesosphere | Docker. It has two two Plugins one runs on the Master Node (Centralized Controller Plugin) and another one on Worker Nodes (Decentralized headless Node Plugin). CSI communication protocol is gRPC. The communication between Container Orchestration to Controller Plugin (Master) and to Node Plugin (Worker Node) happens using gRPC . CSI Drivers : vendor specific compiled into Kubernetes/openshift binaries. To use a CSI driver, a StorageClass needs to be assigned first. The CSI driver is then set as the Provisioner for the Storage Class. CSI drivers provide three main service...

Linux Systems Performance/Observability (BPF (bpfcc-tools), BCC Tools

Linux System Performance/Observability Tools Linux Systems Performance/Observability (BPF (bpfcc-tools), BCC Tools Assuming you have Linux Server in place and have the required BPF aka BCC related packages installed on the system(s) for the required Linux distribution. BPF(eBPF) aka BCC Tools (bpfcc-tools) : BPF, which originally stood for Berkley Packet Filter is the dynamic tracing tools for Linux Systems. BPF initially used for the speeding up for the tcpdump expressions and since then it has been know as the extended Berkley packet Filter (eBPF). Its new uses are Tracing Tools where it provides programmability for the BPF Compiler Collection (BCC) and bpftrace front ends . Example: execsnoop, biosnoop etc is a BCC Tool. When facing production performance crisis these such list of tools comes handy to trace and fix the issue. However, it requires certain KERNEL level config options to be enabled such as CONFIG_FTRACE, CONFIG_BPF. Profiling tools typically re...

ROHIT PATEL

Search This Blog