Boards.ie

mateoo · 23-04-2012, 13:49

Hi,

I have been using Facebook as usual last week without any problems. On Friday evening I have tried to access FB again (I think I might have log out) and since then this is what I am getting. If I click on one of the offers I am taken to salecorp.net page and they want my phone number.

http://imageshack.us/photo/my-images...booklogin.png/

None of the links such as language change or Careers or Help work. Each link url is http://www.facebook.com/# If I put my email and password and hit enter nothing happens - I have to click on Login button then the popup comes up. It will come up even if the login fields are blank.

If I google facebook.com I can see links to Help and other pages but when I try to go to any of those link my browser shows the following:

http://imageshack.us/photo/my-images...knotfound.png/

However I can login to FB from my Iphone.

I really have no idea what's going on. I have scanned my computer with antivirus reinstalled all the web browsers and it's the same thing.

Anyone have any ideas ? Was I reported as spammer by someone or ? I don't even post anything on FB just chat to few friends so it all seem very odd.

BrianD · 23-04-2012, 18:23

Looks like you might have some Malware onboard. HAve you tried using something like Malware Bytes and do a scan with it. I suspect that when you type in Facebook.com that you are being presented with that page and popup?

I wouldn't try logging in via that PC!

It looks like you may have this malware - Ice IX

http://www.trusteer.com/blog/faceboo...dit-card-fraud

http://www.networkworld.com/news/201...ok-257906.html

No idea how to remove it though!

mateoo · 23-04-2012, 19:22

Hi Brian,

Thanks for pointing me towards this. I have installed malwarebytes and yes, it does give me the warning about some dodgy site that has been blocked. It gives the IP 188.120.231.117

I've found this information

It makes very little sense to me unfortunately. The problem still exists. Can't get it removed, have SpyBot S&D installed, run the malware removing tool from Microsoft, Exterminate-It (which crashed during the scan), eset NOD and Malwarebytes, they all give negative results and the problem persists...

Hope format will do the trick.

**biko** · 25-04-2012, 13:23

Seems to be something to do with botnet.exe
Search the PC using normal search Is there a file like botnet.exe?
Some more info on http://www.threatexpert.com/files/botnet.exe.html
Since this looks to be a malware I'll push it over to virus forum.
They will guide you through removal.

vogel · 26-04-2012, 22:35

It's infected alright, it may be just your hosts file but if you haven't reformatted run DDS post the 2 logs and I'll take a look.

Tom Cruise · 29-04-2012, 14:50

I got a e mail saying pics of me naked are all over facebook ha ha.
I have no naked photos of myself anywhere so its a scam.
You cant trust these e mails.

23-04-2012, 13:49	#1
mateoo Registered User Join Date: Oct 2009 Posts: 12 Adverts \| Friends	Facebook: is it a virus or phishing site ? Hi, I have been using Facebook as usual last week without any problems. On Friday evening I have tried to access FB again (I think I might have log out) and since then this is what I am getting. If I click on one of the offers I am taken to salecorp.net page and they want my phone number. http://imageshack.us/photo/my-images...booklogin.png/ None of the links such as language change or Careers or Help work. Each link url is http://www.facebook.com/# If I put my email and password and hit enter nothing happens - I have to click on Login button then the popup comes up. It will come up even if the login fields are blank. If I google facebook.com I can see links to Help and other pages but when I try to go to any of those link my browser shows the following: http://imageshack.us/photo/my-images...knotfound.png/ However I can login to FB from my Iphone. I really have no idea what's going on. I have scanned my computer with antivirus reinstalled all the web browsers and it's the same thing. Anyone have any ideas ? Was I reported as spammer by someone or ? I don't even post anything on FB just chat to few friends so it all seem very odd. Last edited by mateoo; 23-04-2012 at 13:54.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

23-04-2012, 18:23	#2
BrianD Closed Account Join Date: Nov 2001 Posts: 7,145 Adverts \| Friends	Looks like you might have some Malware onboard. HAve you tried using something like Malware Bytes and do a scan with it. I suspect that when you type in Facebook.com that you are being presented with that page and popup? I wouldn't try logging in via that PC! It looks like you may have this malware - Ice IX http://www.trusteer.com/blog/faceboo...dit-card-fraud http://www.networkworld.com/news/201...ok-257906.html No idea how to remove it though!

23-04-2012, 19:22	#3
mateoo Registered User Join Date: Oct 2009 Posts: 12 Adverts \| Friends	Hi Brian, Thanks for pointing me towards this. I have installed malwarebytes and yes, it does give me the warning about some dodgy site that has been blocked. It gives the IP 188.120.231.117 I've found this information It makes very little sense to me unfortunately. The problem still exists. Can't get it removed, have SpyBot S&D installed, run the malware removing tool from Microsoft, Exterminate-It (which crashed during the scan), eset NOD and Malwarebytes, they all give negative results and the problem persists... Hope format will do the trick.

25-04-2012, 13:23	#4
biko Percolator Join Date: Jul 2005 Location: Galway City Posts: 36,867 Adverts \| Friends Mod: Blogs / Wikis / Social Networks, Galway City, Nordic, West, Motoring	Seems to be something to do with botnet.exe Search the PC using normal search Is there a file like botnet.exe? Some more info on http://www.threatexpert.com/files/botnet.exe.html Since this looks to be a malware I'll push it over to virus forum. They will guide you through removal.

26-04-2012, 22:35	#5
vogel Registered User Join Date: Sep 2011 Posts: 23 Adverts \| Friends	It's infected alright, it may be just your hosts file but if you haven't reformatted run DDS post the 2 logs and I'll take a look.

29-04-2012, 14:50	#6
Tom Cruise Closed Account Join Date: Apr 2012 Posts: 121 Adverts \| Friends	I got a e mail saying pics of me naked are all over facebook ha ha. I have no naked photos of myself anywhere so its a scam. You cant trust these e mails.