Facebook Virus
Written by Tomas Meskauskas on (updated)
What is Facebook?
Facebook Virus is a generic name for all Facebook social network-related viruses. The list of Facebook-related malware is rather long. These viruses are typically proliferated via Facebook messenger - criminals hijack random user accounts and proliferate viruses via private messages. Note that the behavior of these viruses is not identical.
As mentioned above, extensive malware is distributed via the Facebook social network. Although behavior differs, most of this malware has at least one thing in common: it typically records sensitive data (keystrokes, logins/passwords, etc.) We also stated that these viruses are typically proliferated using random user accounts.
Cyber criminals design malicious scripts to hijack Facebook accounts and send various links to all contacts. In most cases, these links appear legitimate, since criminals also insert text and emojis to make the messages more believable and friendly.
In fact, after clicking these links, users' friends often visit malicious websites or execute other scripts that infect their computers and web browsers. In some cases, users are redirected to fraudulent sites that offer "fantastic deals", however, criminals employ these sites only to to extort money from unsuspecting users and/or steal confidential information.
In addition, some Facebook viruses are distributed using posts on Facebook walls. Hijacked Facebook accounts post deceptive posts on their (or friends') timelines, however, as with private messages, these posts also contain links to malicious sites. The result is identical.
An older, popular example of a Facebook virus is "Ryanair Scam". First released in 2016, the scam model is simple: users receive a message stating that the Ryanair airline is celebrating its 35th birthday and, therefore, users can supposedly win tickets for two free flights.
This company was founded in 1994 and, thus, at time of the "Raynair Scam" release, the airline was 32-years-old. The post contains a fake boarding pass with the Ryanair logo and redirects to a variety of other malicious sites that encourage users to fill in forms requiring personal details.
Unsuspecting users are often tricked and actually provide this information, thereby putting their privacy at risk - cyber criminals can easily misuse personal data (e.g., banking information, etc.) with the intention of generating revenue.
Another popular Facebook virus is called "Ray Ban Scam". Criminals proliferate private messages with malicious links that promote dubious websites that supposedly sell Ray Ban eye-wear at very low prices, however, after submitting payment, users receive nothing in return and lose their money.
In most cases, users infected with this virus have a type of 'keygen' (which gathers various passwords and sends them to cyber criminals' servers) installed on their computers.
This malware also employs hijacked accounts to promote these websites (for example, it creates events, chat groups, posts deals on the timeline, and tags victims' friends, etc.) In the case of such an infection, immediately change your account passwords and cancel all submitted payments/transactions.
| Name | Facebook malware |
| Threat Type | Trojan, Password stealing virus, Phishing malware, Spyware |
| Related Domain(s) |
m.facebook.com-vm-auwlyduxgo.brahimsfood[.]com |
| Symptoms | Trojans are designed to stealthily infiltrate victim's computer and remain silent thus no particular symptoms are clearly visible on an infected machine. |
| Distribution methods | Infected email attachments, malicious online advertisements, social engineering, software cracks. |
| Damage | Stolen banking information, passwords, identity theft, victim's computer added to a botnet. |
| Malware Removal (Windows) | To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
First noticed in South Korea, the most recent (and probably, most sophisticated) Facebook Virus is designed to infect computers with cryptocurrency-mining malware called Digmine. The malware, however, is now considered to be a worldwide problem. Cyber criminals spread Digmine via private messages.
It only targets users using the Google Chrome web browser or Messenger desktop applications (users with mobile devices cannot be infected). Criminals hijack user accounts and send a message to all contacts. The message contains a "video_[random_digits].zip" file (e.g., "video_5833.zip").
Other users are typically tricked into believing that it is a compressed video file, however, it is a malicious executable that, once opened, connects to developers' Command and Control (C&C) server and starts the infection chain, essentially downloading a number of files (malicious Google Chrome attachments and Digmine miner).
The program then stealthily install the malicious extensions and runs or re-runs Google Chrome (note that it only works if the user maintains the "Stay Logged In" feature). In addition, the script configures auto-run settings for Digminer, so it automatically runs on each system boot. The extension is used to continually spread the malicious zip file.
Furthermore, Digmine misuses system resources to mine Monero cryptocurrency. All these actions are performed without users' consent. In addition, mining consumes many system resources, reducing response times to the point where the system becomes impossible to use, whilst other applications crash or do not even load.
If your computer has been infected with this malware, immediately reset the Google Chrome browser (malicious extensions typically prevent users from removing installed plug-ins and, thus, resetting is the best option) and scan your system with a legitimate anti-virus suite. We also recommend that you read the article, cryptocurrency-mining viruses.
How did Facebook viruses infiltrate my computer?
As mentioned above, Facebook viruses are often distributed via private messages or deceptive Facebook posts. Both typically contain links to malicious websites or scripts (stored on various servers).
Many users click links, especially when they are sent or posted by close friends. Clicking links promoted by Facebook viruses exposes systems to risk of various infections and compromises users' privacy.
How to avoid installation of malware?
To prevent this situation, be very cautious when opening pages promoted on Facebook. If a friend sends a private message or posts a suspicious link on your Facebook wall, you are strongly advised to demand confirmation if the link is legitimate. Message your friend to ensure that you only visit legitimate sites - if the friend does not respond, never click any promoted link.
Note that these messages typically include a personal text or images (e.g., your profile picture). For example, it may say "Hey *user name*, is it really you?" together with a link leading to an unknown website. Criminals include this kind of text to make spam messages appear legitimate. You are also advised to use account-security tips given by Facebook Support.
Keep your installed applications up-to-date and use a legitimate anti-virus/anti-spyware suite. The key to computer safety is caution. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.
List of examples of other Facebook viruses:
"Congratulations! Your profile has been selected by Facebook" Scam;
"Your page will be unpublished" Virus;
Facebook "Following Me" Scam;
Facebook "hahaha" Virus;
Facebook Automatic Wall Post Virus;
Facebook Change Color Virus;
Facebook Child Porn Virus;
Facebook French Tech Support Scam;
Facebook Friend Request Virus ;
Facebook Message Virus;
Facebook Money Scam;
Facebook Stalker Virus;
Facebook Suspension Virus;
Facebook Video Virus;
Faceliker Virus;
Invitation Facebook Virus;
Jayden K. Smith Scam;
Screenshots of deceptive posts promoting various Facebook viruses or scams:
Screenshot of a malicious website which is disguised as a genuine Facebook login page. After clicking various links users are redirected to similar pages which ask to "confirm the identity" by logging in. Websites of this type save entered login/password in a database and cyber criminals instantly gain access to victim's account.
Malicious websites can be distinguished in two main ways: 1) their design might slightly differ from the genuine one, and; 2) the URL address (domain) is random (typically long) string, not the genuine facebook.com (see the example below):
Text presented within this website:
Facebook Account Confirmation
Dear user,
Your Facebook account must be confirmed today in order to avoid disabling! This process is quick and must be done by all of our users as an extra security measure. If you fail to confirm your account today it will be limited and then disabled!
Screenshot of the second page of the same site:
| Name | m.facebook.com-vm-auwlyduxgo.brahimsfood[.]com |
| Threat Type | Fake Facebook login website, phishing site. |
| Detection Names | G-Data (Phishing), Sophos AV (Malicious), Full List Of Detections (VirusTotal) |
| Serving IP Address | 101.99.66.162 |
| Sibling Domains | mail.brahimsfood[.]com, server.brahimsfood[.]com, webdisk.brahimsfood[.]com, webmail.brahimsfood[.]com |
| Symptoms | Seeing advertisements not originating from the sites you are browsing. Intrusive pop-up ads. Decreased Internet browsing speed. |
| Distribution Methods | Deceptive pop-up ads, potentially unwanted applications (adware) |
| Damage | Decreased computer performance, browser tracking - privacy issues, possible additional malware infections. |
| Malware Removal (Windows) | To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
Example of a Facebook-themed spam email which promotes a questionable site (a1bum_fac3book.es-es[.]icu):
Text presented within:
Subject: Facebook - A sua conta foi temporariamente bloqueada por razões de segurança
Caro utilizador,Alguém noticiou recentemente uma foto no seu álbum do Facebook.
Os dados de imagem comunicados: IMG_20170103_162800.jpg - Data: 21/06/2020 às 15:50
Uma imagem no seu álbum foi acusada de conter conteúdo inadequado. Se não concordar que o conteúdo é inadequado ou pornográfico, acesse o link e remova a bandeira de violação ou de objecção.
Ao acessar o link, você terá acesso ao usuário que denunciou seu álbum.
Faça login no link abaixo para remover o sinalizador de violação imediatamente.
VER IMAGEM RELATADA
INFORMAÇÕES DO RECLAMANTEFacebook, Inc. ATTN: Privacy Operations 1601 Willow Road Menlo Park, CA 94025
Instant automatic malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
- What is Facebook?
- STEP 1. Manual removal of Facebook malware.
- STEP 2. Check if your computer is clean.
How to remove malware manually?
Manual malware removal is a complicated task, usually it's better to let antivirus or anti-malware programs do it automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows. If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here's an example of a suspicious program running on user's computer:
If you checked the list of programs running on your computer, for example using task manager and identified a program that looks suspicious you should continue with these steps:
Download a program called Autoruns. This program shows auto-start applications, Registry and file system locations:
Restart your computer into Safe Mode:
Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.
Video showing how to start Windows 7 in "Safe Mode with Networking":
Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup. Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu".
Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings". Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.
Video showing how to start Windows 8 in "Safe Mode with Networking":
Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".
In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.
Video showing how to start Windows 10 in "Safe Mode with Networking":
Extract the downloaded archive and run Autoruns.exe file.
In the Autoruns application click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure click the "Refresh" icon.
Check the list provided by Autoruns application and locate the malware file that you want to eliminate.
You should write down it full path and name. Note that some malware hides their process names under legitimate Windows process names. At this stage it's very important to avoid removing system files. After you locate he suspicious program you want to remove right click your mouse over it's name and choose "Delete"
After removing the malware through Autoruns application (this ensures that the malware won't run automatically on the next system startup) you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the file of the malware be sure to remove it.
Reboot your computer in normal mode. Following these steps should help remove any malware from your computer. Note that manual threat removal requires advanced computer skills, it's recommended to leave malware removal to antivirus and anti-malware programs.
These steps might not work with advanced malware infections. As always it's better to avoid getting infected that try to remove malware afterwards. To keep your computer safe be sure to install latest operating system updates and use antivirus software.
To be sure your computer is free of malware infections we recommend scanning it with Combo Cleaner Antivirus for Windows.
Outstanding!
▼ Show Discussion