Solved Facebook says there is a virus, scans clean, but computer acting weird

[Mellon Head]

Some friends of mine are a retired couple in Mexico. They have two computers, one a desktop, one a laptop. I'm sorry but I don't have current spec details, though I am pretty sure this is not a hardware issue as it is affecting both computers.

To the point:
The laptop is used on Facebook. The user has suddenly become unable to either share or post anything since accessing her Zoo app on FB. There is a message that comes up stating that her computer "could" be infected by a virus or a malicious browser extension, whenever she tries to post or share. This is happening with both IE and Chrome.

The desktop was fine until this morning when she used it to access FB using Chrome. Now it is exhibiting the same issue.

Also, she took some screenshots and tried to send them to both me and my partner using Hotmail. Both came back with failures to deliver as the "addresses were invalid" We receive email from her all the time and this sudden address issue is unusual.

The computers have been scanned with Malware Bytes, MSE, and Super AntiSpyware. All scans showed clean. It is currently unknown if this problem affects other websites.

I'm stumped and I could really use some advice, please. Even just questions that I can ask them for more information would help.

 

[torchwood]

First thought
Try a restore point.
Dont believe FB has any kind of Virus protection in it that would cause the pop-up.
As its on BOTH, certainly smacks of malware, get them to scan it with Eset, dissable any other AV and run via IE.

Roy

 

[Mellon Head]

Thanks for the suggestions Roy. I'll get them to scan with ESET and see what happens.

Btw, these are the messages they are getting:







I'm pretty sure these aren't legit. Unfortunately, she clicked the "Get Started" button.

 

[Callender]

A couple of utilities that "might" help:

https://www.avast.com/browser-cleanup

https://www.zemana.com/Download - fully functional free trial. Advanced settings allow scanning of all browser extensions.

​

 

[Eric3742]

May suggest to uninstall this "Zoo app on FB"
Do reboot, scan using Superantispyware &or any others.
Reboot and do create a system restore point.
Then install "Zoo app" on FB.

May unintentional include additional software &or advert, if any, when doing that installation &or using.
Ensure to do it step by step, and do read, at the point of install.

Sometimes, uninstall and then re-install may have to remove certain bug &or virus.
As it may have been hijack during installation.
Nowadays, it is common that include Banks website are hijack.

 

[Callender]

Also get them to run a scan with Farbar Recovery Scan Tool.

Must be run as administrator (right click options)

Get them to post the results from FRST.txt and addition.txt (saved in the same directory that the tool is run from)

 

[Mellon Head]

Oddly enough, the situation seems to have resolved itself. All scans including ESET have come up clean and Facebook is behaving normally.

I had a look around on the net, and it seems that this is not an isolated issue. Facebook has partnered with some anti-virus manufacturers (like MacAffee) to offer anti-virus services when your account shows what they call suspicious activity:

https://www.facebook.com/help/226527600691713

Some, on a website that I can't locate today, have suggested it's collusion on the part of MacAffee and Facebook to get you to buy the anti-virus package, but I see no evidence of that in my searches. Just tinfoil hat thinking.

Anyway, I'm going to mark this as solved. I thank all of you for your help and suggestions. Much appreciated!

 

[groze]

Mellon Head am I reading that facebook site correctly. Is facebook using two virus protection programs at the same time. That in itself could cause a problem.

 

[Mellon Head]

Mellon Head am I reading that facebook site correctly. Is facebook using two virus protection programs at the same time. That in itself could cause a problem.

I think they want you to download one or the other, or both. It's a little unclear, but FB seems to do this for what they call "unusual account activity" rather than actually running a virus scan on your account. Once they have flagged your account, then they offer the choice of virus checkers. An unfamiliar user might be tempted to use both at the same time, so I can see your concern.