Facebook virus on a rise with a new “Look what I found” scam in May 2022Threat SummaryFacebook malware, hoaxes, and scams: all versionsFacebook Messenger virusIt’s you Facebook virusFacebook Video virusFacebook Friend Request virusFacebook Change Color virusFacebook Stalker virus“Your page will be unpublished” scamFacebook Ray Ban scamCongratulations! Your profile has been selected by Facebook! virusLook What I Found virusDistribution of Facebook malwareRemove Facebook virus right awayRevoke app permissionsSecure a hacked Facebook account and reclaim access to it
This article is filled with comprehensive descriptions of a variety of the most prevalent malware variants associated with the social network as well as in-depth Facebook virus removal guidelines. Therefore, start looking through the list of provided viruses, scams and hoaxes and find out whether your account is in danger and what your further actions should be. Facebook malware can be split into three main categories that have their own characteristics. You can find descriptions of these categories down below. Now that you are familiar with types of Facebook virus, it is time to list the most popular versions of the said malware and find out what can be done in order to cleanse your social media account as well as the computer from the malware that’s been bothering you recently. Usually, it is enough to change your FB password, delete associated malicious or spyware-type program, modify your privacy settings, although in other cases you will need to configure app permissions and carry out advanced malware removal instructions. Deleting Facebook-related malware is not an easy task, and at this point, we’d like to recommend using anti-spyware, anti-malware or antivirus software for scanning your computer and eliminating the threat automatically. Do not forget to visit facebook.com/hacked and follow official instructions by the social media network to secure your account. Another good software that our team recommends using is RESTORO (secure download link) which is known for its capabilities to repair virus-damaged Windows OS files without the need to reinstall the operating system.
Threat Summary
REPAIR VIRUS DAMAGE
Facebook malware, hoaxes, and scams: all versions
Facebook Messenger virus
Usually, accounts infected with this kind of virus start automatically sending malicious links along with deceptive messages to the victim’s friends via Messenger. The deceptive messages typically consist of a few words or a short phrase, which is meant to arouse the victim’s curiosity and convince one to click on the provided link. The link may be shortened or created in a way to display a logo containing the victim’s profile image. Below, you can see examples of deceptive Facebook messages that spread the self-replicating virus:
[Name] video :o;This video is yours?, very bad video;Hey, i just made a photoshop of you, check it out :P;Watch the video by clicking on the picture which belongs to you. ..1;Hello [name], what are you doing in this video?? LOL No comment!;Omg hahah have you seen this photo u got tagged in LOL —->;Ohh! det är verkligen du?;Ci sei tu nella foto del video?;I think you are in this video;Look what I found…;Hahaha;Similar lines.
As you can see, each of these lines is intended to draw victim’s attention or make one believe that the content behind the provided link is related to him/her and possibly hurts one’s reputation. The message conveys a sense of urgency and tricks the victim into clicking the malicious link without thinking. Now, there are several scenarios of what can happen after clicking such link. It can either take you to a fake website promising you to show a certain video; however, there is no content related to you. However, in order to view the video you were warned about by the virus, you will be asked to install a malicious file or simply a browser extension. In another scenario, you can be taken to a phishing page that asks to confirm your Facebook login details. Be careful, because these phishing pages transmit all your personal details to scammers who then hack your account and use it for further distribution of the virus. One of the latest malware versions tries to trick unsuspecting users with a fake Youtube video link, which leads to a malicious web page that mimics the real video streaming platform. Recently, the infamous Locky virus used the same Facebook Message virus strategy to spread across the social network and present a malicious file to victims. The malicious message suggested opening a file called Photo_[random digits].svg. Bear in mind that SVG file type has an ability to carry an embedded content such as JavaScript code. Such code points the victim to an external site that looks like Youtube. However, the phishing website has a different URL and then triggers a pop-up asking to install a suspicious extension (supposedly required to view the content). The extension then attacks all victim’s friends by sending them the same malicious link via Messenger. The malicious extension (which is known to be hiding under “Ubo” or “One” name) then installs Nemucod malware downloader on the compromised PC. Consequently, the malware downloader drops Locky ransomware on the system, causing complete encryption of personal victim’s data.
It’s you Facebook virus
“It’s you, or “Is That you” is yet another social media virus that has been circulating around the platform’s messenger for a few years already, and is still active in 2020. The scam scheme goes as follows – the victim clicks on a malicious link sent to him/her via FB messenger, gets infected and then continues to spread the virus message to his/hers own friends. This virus chain is extremely dangerous as the link comes not from some stranger, but a person you have in your friends’ list. The list of lines used by scammers are listed below:
Is that you?It’s you;It looks like you;Is this your mom?This video belongs to you?[name] it’s you?
Beware that this virus’ functionality is automated, which means that it automatically adjusts the message text by inserting person’s name or other available details into it. You should definitely NOT click the link, or your account will become yet another robot in the chain used to spread the malware further.
Facebook Video virus
The virus is surprisingly similar to the previously described Messenger virus. However, there may be some differences between them. Malicious video virus might not only contact victim’s via Messenger but might also post fraudulent links and content on victim’s timeline. Users find it frustrating as simply deleting these fake posts seems helpless. In other cases, the posts do not even show up for the victim. The malicious video virus may post deceptive links on victim’s timeline featuring one’s profile picture and a catchy phrase, such as one of the following:
My Private Video;My Video;Private Video;My First Video;[Victim’s name] Video.
If you noticed similar links appearing on your timeline, or if your friends have warned you of it already, it means that there is a malicious program acting on your behalf using your Facebook account. It is important to identify and remove it, as well as revoke permissions for questionable apps connected with your social media account. You can find detailed instructions on how to remove Facebook virus of this type below the article.
Facebook Friend Request virus
The so-called Facebook Friend request virus covers several deceptive techniques used by criminals to swindle money from the Facebook user or get as many personal details about the victim as possible. If you noticed Facebook sending friend requests automatically, you should know that one or several apps connected with your account have permissions to do so. In such situation, it is best to revoke app permissions for suspicious applications that you started using recently. If you cannot solve the “Facebook adding friends for me” problem by yourself, please follow the instructions provided below the article to identify and solve the issue causing a headache for you. Another problem associated with this Facebook virus is an increased number of strangers trying to add you to their friends’ lists. We would like to remind you that adding strangers and allowing them to access your profile as they’re your friends gives them an opportunity to see your photos and certain information that you do not share publicly. Be aware that scammers can use collected details to create fake copies of your profile and use them to contact your friends asking for money. In addition, the fraudsters might try to sell certain data about you on the dark web. To secure your privacy, change your sharing settings to friends only and not public. Clearly, stay away from strangers trying to become your “friends” on this social network.
Facebook Change Color virus
No, you cannot change the color of your Facebook using any third-party apps. You can only do the light or dark mode via FB itself. Therefore, try to stay away from deceptive applications that suggest such feature. Some of these programs were identified as fraudulent or even malicious. First revealed by The Cheetah Mobile CM Security Researcher lab, the scam scheme targets social network users willing to change the color of their online profiles. Clicking on a malicious app called Facebook Color Changer leads to a phishing site. Researchers say that the redirect occurs due to a vulnerability in FB page itself. The malware first suggests viewing a tutorial on how to change the color of Facebook; meanwhile, it steals “Access Tokens” which allow connecting with the victim’s Facebook friends. In case the victim refuses to view the provided video, the malware attempts to enter the victim’s computer system as a pornography video player (only in case the victim is using PC). In situations when the victim uses an Android device, a deceptive phone antivirus will be presented for the victim. Users infected with this type of malware should scan their devices immediately and change their passwords as soon as possible.
Facebook Stalker virus
Facebook Stalker virus is yet another malicious application that tricks the victim into visiting a malicious website. Deceptive posts usually promise to reveal data related to people viewing your profile frequently, which is fascinating, since the majority of us would like to find out who checks out our profiles often. Unfortunately, Facebook keeps this secret, and none third-party apps can reveal such information for you. Therefore, programs promising you that should be considered deceptive. You might come across eye-catching posts on Facebook that may contain one of the following catchphrases and lead to FBStalker26.com:
Fb Stalkers revealed!;See who’s viewing your profile;WICKED! Now you can see who views your profile… i saw my top profile stalkers, and my ex is still creeping on me everyday;
Keep in mind that interaction with scam sites can lead to sad consequences. NEVER agree to provide any sensitive data, or it will reach scammers who might attempt to use it for illegal means. If your curiosity tricked you into visiting a phishing website or providing app access to one of those “see who’s viewing your profile” type apps, please follow instructions below the post to remove Facebook virus from your device and account completely.
“Your page will be unpublished” scam
The scam first emerged in December 2016. Users of the social media network noticed strange pages appearing with names similar to the ones provided below:
Team Advert;Advert Solution;Ads Department Social;Advert Indo;Ads-Info.
The fake pages pretend to be official Facebook authorities that inform page owners about particular problems. These fake pages repost particular posts from page owners and add a comment, saying that the page will soon be unpublished. In order to prevent it from happening, the victim supposedly has to confirm login details via a provided link. Of course, the link leads to a phishing page that grabs all the info that the victim enters and uses it to hack victim’s account along with the page. Later on, stolen valuable accounts can be sold on the dark web or used to spread other scams. Typically, scammers hunt for victims who have a lot of likes on their pages, as such pages can be successfully used for scamming people since they look more reputable than unpopular ones. Keep in mind that the social network never sends relevant information via posts. In case there is a problem with your account or a page that you’re managing, you are going to receive an official notification that will lead you to Facebook Support’s page providing information regarding the problem.
Facebook Ray Ban scam
Dreaming about a pair of pricey Ray-Bans? If so, you shouldn’t get hooked by a scam circulating on the social media network. In 2016, users of Facebook were targeted by scammers who used hacked profiles to share phishing links of fake Ray-Ban online shops offering massive discounts for popular eyewear models. The hacked profiles were used to share a link to an e-shop and tag a certain amount of victims on it. The fake shops offered incredible discounts as high as 90%. While victims were at risk of losing tens of dollars on fake goods, their bank card details, as well as personal information (name, address, phone number), were at risk, too. Although the scam seems to be over in 2017, we can’t guarantee that there won’t be similar ones, especially before summer 2018. Therefore, stay vigilant. Experts have already noticed Ray-Ban scammers attacking victims via email.
Congratulations! Your profile has been selected by Facebook! virus
Users who encounter Congratulations! Your profile has been selected by Facebook! fake pop-up in their browsers should realize that it does not come from the giant social media network, but rather from an adware program installed on their computers. The message typically reads: Below the promising message, you will see a list of so-called gifts such as new iPhones, gift cards, and similar prizes. Keep in mind that clicking “Select” might take you to a phishing site or suggest installing a malicious app on your computer. In other cases, you might be asked to fill in your personal details such as name and e-mail address. Later on, these can be used to send you spam. The best way to stop these pop-ups from showing up is to scan the system and detect the ad-supported virus that’s bothering you on a daily basis.
Look What I Found virus
The Look What I found Facebook virus became extremely prevalent in spring of 2022. This phishing scam targets friends of social media users who have already clicked on the malicious link. The malware then uses compromised accounts to send out deceptive links along the “look what I found” line to all of victim’s friends. The clickbait line used in this scam is usually translated into user’s native language when messaging one’s friends. Once the victim clicks on the deceptive URL, one will be taken to a phishing page mimicking Facebook’s login page. If the victim unknowingly enters the login credentials, the criminals will use the information to access the target’s Facebook account and send the malicious message to all of one’s friends. If you ever receive a similar message from one or more of your friends and can see that the message includes a suspicious-looking link, DO NOT CLICK ON IT. Instead, inform your friend about the virus that’s affecting their account, because most of the time, users do not notice that their account is used to send out messages at first. You can see two examples of the “Look what I found” phishing scam sent to our team member by several Facebook friends. Users affected by this malware should change their password immediate and review Facebook application permissions. Another good idea is to set up two-factor authentication on the account, which helps to keep hackers away from your account even if they manage to find out your login credentials.
Distribution of Facebook malware
In order to protect yourself from scams and malware, you need to familiarize yourself with common techniques scammers use to attack unsuspecting victims. Most of the time, fraudsters use social engineering and phishing techniques to hack social media accounts. However, you might lose access to your account or at least provide scammers with an opportunity to control your news feed and post or message friends on your behalf after providing specific permissions to deceptive apps on Facebook. In such situations, the victim must revoke app permissions for aggressive applications that previously requested your permission to control your posts and messages. You can also be infected or hacked by clicking on malicious links that scammers share via the popular social networking platform. Therefore, we suggest avoiding clickbait titles that urge you to click on them and also avoid clicking suspicious shortened links sent by your friends. If that is a friend you trust, ask them whether they actually sent the link. Their account may have been infected, and the message you received is an outcome of it. In addition, be careful when opening emails sent by strangers. If you ever receive an email asking you to confirm your Facebook login details, page information or your email address,
Remove Facebook virus right away
The instructions provided below will help you to remove Facebook virus manually. There are several methods that apply to different kind of viruses. We have also added a guide on what to do in case your account was hacked or compromised. Please read the given tutorial with caution and contact us in case you have questions regarding Facebook virus removal. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.
Revoke app permissions
If you have allowed several apps access certain information and functions via your profile, and now it is time to prevent them from using these permissions further. Here is what you need to do: To remove the unwanted program from your computer, use these instructions below to uninstall associated programs or apps from your Windows or Mac computer. Then scroll down for instructions how to clean each affected web browser individually.
Remove Facebook virus from Windows
Windows 10/8.1/8 users Click on the Windows logo to open Windows menu. In search, type control panel and select the matching result. Then go to Programs and Features. Windows 7 users First, open Windows menu by clicking on the icon in the lower left corner of the screen. Then go to Control Panel and find section called Programs. Click on the Uninstall a program option under it. Windows XP users In Windows XP, click Start > Control Panel > Add or Remove Programs. Uninstall unwanted programs Once in Programs and Features, look through the list of installed programs. You can click on Installed on tab to sort the programs by their installation date. Right-click on suspicious programs you can’t remember installing and choose Uninstall. Follow instructions provided by the Uninstall Wizard, click Next and finally Finish to uninstall the unwanted program from your PC.
Remove Facebook virus from Google Chrome Remove suspicious Chrome extensions Change Start Page settings Change default search settings Remove push notifications from Chrome If you want to get rid of the annoying ads and so-called push-notifications viruses, you must identify their components and clean your browser. You can easily remove ads from Chrome by following these steps: Reset Google Chrome browser
Remove Facebook virus from Mozilla Firefox Remove unwanted add-ons from Firefox Change Firefox Homepage Alter preferences in Firefox Remove annoying push notifications from Firefox Suspicious sites that ask to enable push notifications gain access to Mozilla’s settings and can deliver intrusive advertisements when browsing the Internet. Therefore, you should remove access to your browser by following these simple steps: Reset Mozilla Firefox
Remove Facebook virus from Microsoft Edge Remove suspicious extensions: Change MS Edge Start Page and default search engine: Turn off push notifications in Edge If you keep receiving pop-up ads or other promotional content while browsing on Microsoft Edge, your browser might be corrupted by a potentially unwanted program (PUP). You have to clean it — follow these easy instructions: Clear browsing data
Remove Facebook virus from Safari Uninstall suspicious Safari extensions Change Safari Homepage and default search engine Remove push notifications on Safari Some suspicious websites can try to corrupt your Safari by asking to enable push notifications. If you have accidentally agreed, your browser will be flooded with various intrusive advertisements and pop-ups. You can get rid of them by following this quick guide: Reset Safari
Remove Facebook virus from Internet Explorer TIP: If you are still using IE, we strongly advise using Microsoft Edge or a different browser because Microsoft is no longer providing technical or security support for IE browser. Remove suspicious extensions from IE Change default search provider and remove suspicious ones Change IE Home Page Block pop-up notifications on Internet Explorer Suspicious websites can gain access to your Internet Explorer browser through push notifications. If you enable them even by accident, you will start receiving numerous annoying ads and other advertising content while browsing. The easiest way to remove push-notification viruses is by performing the following steps: Reset Internet Explorer
Alternative software recommendations
Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.
System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.
Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.
Secure a hacked Facebook account and reclaim access to it
If your Facebook profile was hacked, you should do the following:
