Facebook: is it a virus or phishing site ? - boards.ie
Boards.ie uses cookies. By continuing to browse this site you are agreeing to our use of cookies. Click here to find out more x
Post Reply  
 
Thread Tools Search this Thread
23-04-2012, 13:49   #1
mateoo
Registered User
 
Join Date: Oct 2009
Posts: 12
Facebook: is it a virus or phishing site ?

Hi,

I have been using Facebook as usual last week without any problems. On Friday evening I have tried to access FB again (I think I might have log out) and since then this is what I am getting. If I click on one of the offers I am taken to salecorp.net page and they want my phone number.

http://imageshack.us/photo/my-images...booklogin.png/

None of the links such as language change or Careers or Help work. Each link url is http://www.facebook.com/# If I put my email and password and hit enter nothing happens - I have to click on Login button then the popup comes up. It will come up even if the login fields are blank.

If I google facebook.com I can see links to Help and other pages but when I try to go to any of those link my browser shows the following:

http://imageshack.us/photo/my-images...knotfound.png/

However I can login to FB from my Iphone.

I really have no idea what's going on. I have scanned my computer with antivirus reinstalled all the web browsers and it's the same thing.

Anyone have any ideas ? Was I reported as spammer by someone or ? I don't even post anything on FB just chat to few friends so it all seem very odd.

Last edited by mateoo; 23-04-2012 at 13:54.
mateoo is offline  
Advertisement
23-04-2012, 18:23   #2
BrianD
Closed Account
 
Join Date: Nov 2001
Posts: 7,145
Looks like you might have some Malware onboard. HAve you tried using something like Malware Bytes and do a scan with it. I suspect that when you type in Facebook.com that you are being presented with that page and popup?

I wouldn't try logging in via that PC!

It looks like you may have this malware - Ice IX

http://www.trusteer.com/blog/faceboo...dit-card-fraud

http://www.networkworld.com/news/201...ok-257906.html

No idea how to remove it though!
BrianD is offline  
23-04-2012, 19:22   #3
mateoo
Registered User
 
Join Date: Oct 2009
Posts: 12
Hi Brian,

Thanks for pointing me towards this. I have installed malwarebytes and yes, it does give me the warning about some dodgy site that has been blocked. It gives the IP 188.120.231.117

I've found this information

It makes very little sense to me unfortunately. The problem still exists. Can't get it removed, have SpyBot S&D installed, run the malware removing tool from Microsoft, Exterminate-It (which crashed during the scan), eset NOD and Malwarebytes, they all give negative results and the problem persists...

Hope format will do the trick.
mateoo is offline  
25-04-2012, 13:23   #4
biko
Percolator
 
biko's Avatar
 
Join Date: Jul 2005
Location: Galway
Posts: 44,835
Seems to be something to do with botnet.exe
Search the PC using normal search Is there a file like botnet.exe?
Some more info on http://www.threatexpert.com/files/botnet.exe.html
Since this looks to be a malware I'll push it over to virus forum.
They will guide you through removal.
biko is offline  
26-04-2012, 22:35   #5
vogel
Registered User
 
Join Date: Sep 2011
Posts: 23
It's infected alright, it may be just your hosts file but if you haven't reformatted run DDS post the 2 logs and I'll take a look.
vogel is offline  
Advertisement
29-04-2012, 14:50   #6
Tom Cruise
Closed Account
 
Join Date: Apr 2012
Posts: 121
I got a e mail saying pics of me naked are all over facebook ha ha.
I have no naked photos of myself anywhere so its a scam.
You cant trust these e mails.
Tom Cruise is offline  
Post Reply

Quick Reply
Message:
Remove Text Formatting
Bold
Italic
Underline

Insert Image
Wrap [QUOTE] tags around selected text
 
Decrease Size
Increase Size
Please sign up or log in to join the discussion

Thread Tools Search this Thread
Search this Thread:

Advanced Search



Share Tweet