Switchfast Blog - The Future of IT

Beware: Koobface.GK “Christmas Worm”

Thursday, December 10, 2009 by Michael Holley

Many of you may be familiar with the legendary social media bug Koobface, which garnered plenty of press during its initial rampage through social media. Well, it's back, in a brand new holiday-themed edition.

According to Panda Labs, the latest variant, Koobface.GK, is currently ruining computers via Facebook walls around the country. Koobface.GK is especially troublesome, compared to other malware, because it instantly breaks your computer.

Here's how it works:

Someone will post a link on your Facebook wall. That link brings you to a fake video player offering a Christmas greeting. If you click on the "player," your computer will download the worm. If the worm is downloaded successfully, it will produce a CAPTCHA image and threaten to reboot your computer if you don't solve it within three minutes. If you solve the CAPTCHA, Koobface.GK uses the information to create new domains to spread more quickly. If you don't solve it, your computer will not restart, but will instead be "rendered inoperable." The problem, of course, is that the worm presents a new CAPTCHA each time the previous one is solved, so the more you solve, you more you spread the virus while delaying the inevitable.

Below are two screenshots. The first is the "video player" to avoid clicking at all costs. The second is an image of Koobface.GK's CAPTCHA screen on Windows XP. You can read Panda Labs' original posting here.

Koobface.GK1