A worm spread evil code to Facebook users. Representative Facebook, Barry Schnitt said that the worm is not new, these worms have been present in August, and this worm variants is only to target Facebook users.

Meanwhile, Craig Schmugar, virus researchers and the threat of worms from McAfee Avert Labs, Koobfaces confirm that the worm is usually only attack to the social networking site. However, the Facebook site is another incident, he added. When users receive messages in Facebook inbox, there is a message titled, “You look funny in this new video” or other same things, and the recipient of the message you are encouraged to click on the link provided. If the link is clicked, it will go to a video site, which has a message that says that the update is required before Flash can play video files, and call execution of flash_player.exe.

A new mail virus has also been targeting Facebook users and to accompany victims to a site that asks the user to download a Trojan, which are wrapped by updating Adobe Flash. If the user to approve the installation of Flash, the worm Koobface will start downloading the program, called tinyproxy.exe, which will then load the proxy server, is called the Security Accounts Manager (SamSs), which will be active when user restarts the computer. Then Koobface will record the traffic in the port TCP 9090 and the proxy all outgoing HTTP traffic. Schmugar said that Koobface version also contains a botnet, as applicable components to install other applications in time.

Meanwhile, Schnitt said that the government has conducted a quick way to prevent the spread of the worm, by resetting account password in the infected user, delete spam messages, and coordinate with third parties to remove evil content from the website anywhere.