Geek's Advice

Facebook virus on a rise with a new “Look what I found” scam in May 2022

Facebook virus is term used to describe malware, scams and hoaxes that are distributed via Facebook or Messenger app. Being one of the most popular social networking services, the social media platform creates a perfect environment for scammers and cybercriminals to dive in for potential victims, especially during these challenging times. The attackers typically target victim’s private information or login credentials which can be used to swindle money from unsuspecting users, or redirect them to infectious domains that serve malware payloads. One of the latest phishing scams targets victim’s Facebook friends with a clickbait message saying “Look what I found” and including a phishing link.

This article is filled with comprehensive descriptions of a variety of the most prevalent malware variants associated with the social network as well as in-depth Facebook virus removal guidelines. Therefore, start looking through the list of provided viruses, scams and hoaxes and find out whether your account is in danger and what your further actions should be.

Facebook malware can be split into three main categories that have their own characteristics. You can find descriptions of these categories down below.

1. Facebook virus is a term that describes various illegal methods used to hijack user’s FB account to use it for malicious purposes, such as spreading viruses to Messenger contacts, ask people for money in behalf of a victim and similar.
2. Facebook hoaxes. These hoaxes are to blame for annoying messages appearing on your news feed. Usually, they are deceptive and simply spread lies, for example, that FB is about to become a paid service, or that Facebook is limiting your news feed for 26 people. Typically, hoax posts urge people to copy and paste the message and not to share it. This way, the hoax origin is harder to find and it is much harder to end those false claims spreading on the social network.
3. Facebook scams. Be aware of deceptive links and pages appearing on the social network. These typically lead to malicious or phishing pages that dig for sensitive data. In a different scenario, you can lose money (see the Ray Ban scam case).

Now that you are familiar with types of Facebook virus, it is time to list the most popular versions of the said malware and find out what can be done in order to cleanse your social media account as well as the computer from the malware that’s been bothering you recently. Usually, it is enough to change your FB password, delete associated malicious or spyware-type program, modify your privacy settings, although in other cases you will need to configure app permissions and carry out advanced malware removal instructions.

Deleting Facebook-related malware is not an easy task, and at this point, we’d like to recommend using anti-spyware, anti-malware or antivirus software for scanning your computer and eliminating the threat automatically. Do not forget to visit facebook.com/hacked and follow official instructions by the social media network to secure your account.

Another good software that our team recommends using is RESTORO (secure download link) which is known for its capabilities to repair virus-damaged Windows OS files without the need to reinstall the operating system.

Threat Summary

REPAIR VIRUS DAMAGE

Facebook malware, hoaxes, and scams: all versions

Facebook Messenger virus

Usually, accounts infected with this kind of virus start automatically sending malicious links along with deceptive messages to the victim’s friends via Messenger.

The deceptive messages typically consist of a few words or a short phrase, which is meant to arouse the victim’s curiosity and convince one to click on the provided link. The link may be shortened or created in a way to display a logo containing the victim’s profile image. Below, you can see examples of deceptive Facebook messages that spread the self-replicating virus:

• [Name] video :o;
• This video is yours?, very bad video;
• Hey, i just made a photoshop of you, check it out :P;
• Watch the video by clicking on the picture which belongs to you. ..1;
• Hello [name], what are you doing in this video?? LOL No comment!;
• Omg hahah have you seen this photo u got tagged in LOL —->;
• Ohh! det är verkligen du?;
• Ci sei tu nella foto del video?;
• I think you are in this video;
• Look what I found…;
• Hahaha;
• Similar lines.

As you can see, each of these lines is intended to draw victim’s attention or make one believe that the content behind the provided link is related to him/her and possibly hurts one’s reputation. The message conveys a sense of urgency and tricks the victim into clicking the malicious link without thinking.

Now, there are several scenarios of what can happen after clicking such link. It can either take you to a fake website promising you to show a certain video; however, there is no content related to you. However, in order to view the video you were warned about by the virus, you will be asked to install a malicious file or simply a browser extension.

In another scenario, you can be taken to a phishing page that asks to confirm your Facebook login details. Be careful, because these phishing pages transmit all your personal details to scammers who then hack your account and use it for further distribution of the virus.

One of the latest malware versions tries to trick unsuspecting users with a fake Youtube video link, which leads to a malicious web page that mimics the real video streaming platform.

Recently, the infamous Locky virus used the same Facebook Message virus strategy to spread across the social network and present a malicious file to victims. The malicious message suggested opening a file called Photo_[random digits].svg. Bear in mind that SVG file type has an ability to carry an embedded content such as JavaScript code.

Such code points the victim to an external site that looks like Youtube. However, the phishing website has a different URL and then triggers a pop-up asking to install a suspicious extension (supposedly required to view the content). The extension then attacks all victim’s friends by sending them the same malicious link via Messenger.

The malicious extension (which is known to be hiding under “Ubo” or “One” name) then installs Nemucod malware downloader on the compromised PC. Consequently, the malware downloader drops Locky ransomware on the system, causing complete encryption of personal victim’s data.

It’s you Facebook virus

“It’s you, or “Is That you” is yet another social media virus that has been circulating around the platform’s messenger for a few years already, and is still active in 2020. The scam scheme goes as follows – the victim clicks on a malicious link sent to him/her via FB messenger, gets infected and then continues to spread the virus message to his/hers own friends. This virus chain is extremely dangerous as the link comes not from some stranger, but a person you have in your friends’ list. The list of lines used by scammers are listed below:

• Is that you?
• It’s you;
• It looks like you;
• Is this your mom?
• This video belongs to you?
• [name] it’s you?

Beware that this virus’ functionality is automated, which means that it automatically adjusts the message text by inserting person’s name or other available details into it. You should definitely NOT click the link, or your account will become yet another robot in the chain used to spread the malware further.

Facebook Video virus

The virus is surprisingly similar to the previously described Messenger virus. However, there may be some differences between them. Malicious video virus might not only contact victim’s via Messenger but might also post fraudulent links and content on victim’s timeline. Users find it frustrating as simply deleting these fake posts seems helpless.

In other cases, the posts do not even show up for the victim. The malicious video virus may post deceptive links on victim’s timeline featuring one’s profile picture and a catchy phrase, such as one of the following:

• My Private Video;
• My Video;
• Private Video;
• My First Video;
• [Victim’s name] Video.

If you noticed similar links appearing on your timeline, or if your friends have warned you of it already, it means that there is a malicious program acting on your behalf using your Facebook account. It is important to identify and remove it, as well as revoke permissions for questionable apps connected with your social media account. You can find detailed instructions on how to remove Facebook virus of this type below the article.

Facebook Friend Request virus

The so-called Facebook Friend request virus covers several deceptive techniques used by criminals to swindle money from the Facebook user or get as many personal details about the victim as possible. If you noticed Facebook sending friend requests automatically, you should know that one or several apps connected with your account have permissions to do so. In such situation, it is best to revoke app permissions for suspicious applications that you started using recently.

If you cannot solve the “Facebook adding friends for me” problem by yourself, please follow the instructions provided below the article to identify and solve the issue causing a headache for you.

Another problem associated with this Facebook virus is an increased number of strangers trying to add you to their friends’ lists. We would like to remind you that adding strangers and allowing them to access your profile as they’re your friends gives them an opportunity to see your photos and certain information that you do not share publicly.

Be aware that scammers can use collected details to create fake copies of your profile and use them to contact your friends asking for money. In addition, the fraudsters might try to sell certain data about you on the dark web. To secure your privacy, change your sharing settings to friends only and not public. Clearly, stay away from strangers trying to become your “friends” on this social network.

Facebook Change Color virus

No, you cannot change the color of your Facebook using any third-party apps. You can only do the light or dark mode via FB itself. Therefore, try to stay away from deceptive applications that suggest such feature. Some of these programs were identified as fraudulent or even malicious.

First revealed by The Cheetah Mobile CM Security Researcher lab, the scam scheme targets social network users willing to change the color of their online profiles. Clicking on a malicious app called Facebook Color Changer leads to a phishing site. Researchers say that the redirect occurs due to a vulnerability in FB page itself. The malware first suggests viewing a tutorial on how to change the color of Facebook; meanwhile, it steals “Access Tokens” which allow connecting with the victim’s Facebook friends.

In case the victim refuses to view the provided video, the malware attempts to enter the victim’s computer system as a pornography video player (only in case the victim is using PC). In situations when the victim uses an Android device, a deceptive phone antivirus will be presented for the victim. Users infected with this type of malware should scan their devices immediately and change their passwords as soon as possible.

Facebook Stalker virus

Facebook Stalker virus is yet another malicious application that tricks the victim into visiting a malicious website. Deceptive posts usually promise to reveal data related to people viewing your profile frequently, which is fascinating, since the majority of us would like to find out who checks out our profiles often.

Unfortunately, Facebook keeps this secret, and none third-party apps can reveal such information for you. Therefore, programs promising you that should be considered deceptive. You might come across eye-catching posts on Facebook that may contain one of the following catchphrases and lead to FBStalker26.com:

• Fb Stalkers revealed!;
• See who’s viewing your profile;
• WICKED! Now you can see who views your profile… i saw my top profile stalkers, and my ex is still creeping on me everyday;

Keep in mind that interaction with scam sites can lead to sad consequences. NEVER agree to provide any sensitive data, or it will reach scammers who might attempt to use it for illegal means. If your curiosity tricked you into visiting a phishing website or providing app access to one of those “see who’s viewing your profile” type apps, please follow instructions below the post to remove Facebook virus from your device and account completely.

“Your page will be unpublished” scam

The scam first emerged in December 2016. Users of the social media network noticed strange pages appearing with names similar to the ones provided below:

• Team Advert;
• Advert Solution;
• Ads Department Social;
• Advert Indo;
• Ads-Info.

The fake pages pretend to be official Facebook authorities that inform page owners about particular problems. These fake pages repost particular posts from page owners and add a comment, saying that the page will soon be unpublished. In order to prevent it from happening, the victim supposedly has to confirm login details via a provided link. Of course, the link leads to a phishing page that grabs all the info that the victim enters and uses it to hack victim’s account along with the page.

Later on, stolen valuable accounts can be sold on the dark web or used to spread other scams. Typically, scammers hunt for victims who have a lot of likes on their pages, as such pages can be successfully used for scamming people since they look more reputable than unpopular ones.

Keep in mind that the social network never sends relevant information via posts. In case there is a problem with your account or a page that you’re managing, you are going to receive an official notification that will lead you to Facebook Support’s page providing information regarding the problem.

Facebook Ray Ban scam

Dreaming about a pair of pricey Ray-Bans? If so, you shouldn’t get hooked by a scam circulating on the social media network. In 2016, users of Facebook were targeted by scammers who used hacked profiles to share phishing links of fake Ray-Ban online shops offering massive discounts for popular eyewear models.

The hacked profiles were used to share a link to an e-shop and tag a certain amount of victims on it. The fake shops offered incredible discounts as high as 90%. While victims were at risk of losing tens of dollars on fake goods, their bank card details, as well as personal information (name, address, phone number), were at risk, too.

Although the scam seems to be over in 2017, we can’t guarantee that there won’t be similar ones, especially before summer 2018. Therefore, stay vigilant. Experts have already noticed Ray-Ban scammers attacking victims via email.

Congratulations! Your profile has been selected by Facebook! virus

Users who encounter Congratulations! Your profile has been selected by Facebook! fake pop-up in their browsers should realize that it does not come from the giant social media network, but rather from an adware program installed on their computers. The message typically reads:

Facebook Newsfeed
Congratulations! Your profile has been selected by Facebook!
Every Thursday we select one lucky user from [country name] to get an exclusive gift from our sponsors.
As a thank you for your participation, you may select which gift you want to get. It’s that simple!
Note: These gifts may be taken down at any time so act fast.

Below the promising message, you will see a list of so-called gifts such as new iPhones, gift cards, and similar prizes. Keep in mind that clicking “Select” might take you to a phishing site or suggest installing a malicious app on your computer. In other cases, you might be asked to fill in your personal details such as name and e-mail address.

Later on, these can be used to send you spam. The best way to stop these pop-ups from showing up is to scan the system and detect the ad-supported virus that’s bothering you on a daily basis.

Look What I Found virus

The Look What I found Facebook virus became extremely prevalent in spring of 2022. This phishing scam targets friends of social media users who have already clicked on the malicious link. The malware then uses compromised accounts to send out deceptive links along the “look what I found” line to all of victim’s friends. The clickbait line used in this scam is usually translated into user’s native language when messaging one’s friends.

Once the victim clicks on the deceptive URL, one will be taken to a phishing page mimicking Facebook’s login page. If the victim unknowingly enters the login credentials, the criminals will use the information to access the target’s Facebook account and send the malicious message to all of one’s friends.

If you ever receive a similar message from one or more of your friends and can see that the message includes a suspicious-looking link, DO NOT CLICK ON IT. Instead, inform your friend about the virus that’s affecting their account, because most of the time, users do not notice that their account is used to send out messages at first.

You can see two examples of the “Look what I found” phishing scam sent to our team member by several Facebook friends.

Users affected by this malware should change their password immediate and review Facebook application permissions. Another good idea is to set up two-factor authentication on the account, which helps to keep hackers away from your account even if they manage to find out your login credentials.

Distribution of Facebook malware

In order to protect yourself from scams and malware, you need to familiarize yourself with common techniques scammers use to attack unsuspecting victims. Most of the time, fraudsters use social engineering and phishing techniques to hack social media accounts.

However, you might lose access to your account or at least provide scammers with an opportunity to control your news feed and post or message friends on your behalf after providing specific permissions to deceptive apps on Facebook. In such situations, the victim must revoke app permissions for aggressive applications that previously requested your permission to control your posts and messages.

You can also be infected or hacked by clicking on malicious links that scammers share via the popular social networking platform. Therefore, we suggest avoiding clickbait titles that urge you to click on them and also avoid clicking suspicious shortened links sent by your friends. If that is a friend you trust, ask them whether they actually sent the link. Their account may have been infected, and the message you received is an outcome of it.

In addition, be careful when opening emails sent by strangers. If you ever receive an email asking you to confirm your Facebook login details, page information or your email address,

Remove Facebook virus right away

The instructions provided below will help you to remove Facebook virus manually. There are several methods that apply to different kind of viruses. We have also added a guide on what to do in case your account was hacked or compromised. Please read the given tutorial with caution and contact us in case you have questions regarding Facebook virus removal.

OUR GEEKS RECOMMEND

Our team recommends removing malware using a professional antivirus software and then using the following tool to repair virus damage to Windows system files:

REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Revoke app permissions

If you have allowed several apps access certain information and functions via your profile, and now it is time to prevent them from using these permissions further. Here is what you need to do:

1. Log in to your Facebook (ideally, via your browser, not mobile device – this way, it will be easier);
2. Click on the little arrow pointing downwards (you can find it in the upper right corner of Facebook, in the blue menu bar) and select Settings.
3. Now, choose Apps from the list on your left.
4. Here, you will see a lengthy list of apps that you’re logged in with Facebook. Hover your mouse over suspicious ones, and you will see a grey X appearing on them. Click it and then select Remove to prevent the app from accessing your profile and your timeline ever again.

Secure a hacked Facebook account and reclaim access to it

If your Facebook profile was hacked, you should do the following:

1. Visit facebook.com/Hacked page.
2. Follow the instructions to secure your account.
3. If you used the same password that you used for your FB account elsewhere (email, Skype, etc.), change it immediately.
4. Make sure that the email used to restore your Facebook password is the correct one. Hackers could have changed it for you!

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.