Facebook: is it a virus or phishing site ?

mateoo

Hi,

I have been using Facebook as usual last week without any problems. On Friday evening I have tried to access FB again (I think I might have log out) and since then this is what I am getting. If I click on one of the offers I am taken to salecorp.net page and they want my phone number.

http://imageshack.us/photo/my-images/99/facebooklogin.png/

None of the links such as language change or Careers or Help work. Each link url is http://www.facebook.com/# If I put my email and password and hit enter nothing happens - I have to click on Login button then the popup comes up. It will come up even if the login fields are blank.

If I google facebook.com I can see links to Help and other pages but when I try to go to any of those link my browser shows the following:

http://imageshack.us/photo/my-images/337/facebooknotfound.png/

However I can login to FB from my Iphone.

I really have no idea what's going on. I have scanned my computer with antivirus reinstalled all the web browsers and it's the same thing.

Anyone have any ideas ? Was I reported as spammer by someone or ? I don't even post anything on FB just chat to few friends so it all seem very odd.

BrianD

Looks like you might have some Malware onboard. HAve you tried using something like Malware Bytes and do a scan with it. I suspect that when you type in Facebook.com that you are being presented with that page and popup?

I wouldn't try logging in via that PC!

It looks like you may have this malware - Ice IX

http://www.trusteer.com/blog/facebook-facelift-ice-ix-malware-injects-fake-page-commit-credit-card-fraud

http://www.networkworld.com/news/2012/040312-ice-ix-malware-tricks-facebook-257906.html

No idea how to remove it though!

mateoo

Hi Brian,

Thanks for pointing me towards this. I have installed malwarebytes and yes, it does give me the warning about some dodgy site that has been blocked. It gives the IP 188.120.231.117

I've found this information

It makes very little sense to me unfortunately. The problem still exists. Can't get it removed, have SpyBot S&D installed, run the malware removing tool from Microsoft, Exterminate-It (which crashed during the scan), eset NOD and Malwarebytes, they all give negative results and the problem persists...

Hope format will do the trick.

biko

Seems to be something to do with botnet.exe
Search the PC using normal search Is there a file like botnet.exe?
Some more info on http://www.threatexpert.com/files/botnet.exe.html
Since this looks to be a malware I'll push it over to virus forum.
They will guide you through removal.

vogel

It's infected alright, it may be just your hosts file but if you haven't reformatted run DDS post the 2 logs and I'll take a look.

Tom Cruise

I got a e mail saying pics of me naked are all over facebook ha ha.
I have no naked photos of myself anywhere so its a scam.
You cant trust these e mails.