BleepingComputer.com: Trying to resolve problem with Facebook account

Hi all:

I'm trying to resolve a situation that I've got with my Facebook account. Somehow, the account has either been hacked, hijacked, zombified, whatever -- anyhow, it's been sending out bogus messages to everyone in my Friends list, pointing them to a nasty virus-infesting site called "http://www.now-christmas.com" that was followed by three random letters (the first time; the second time it did this, it used four letters).

I have run Norton's Anti-Virus on my C: drive, to no avail -- the only thing it found was a slew of tracking cookies. Same song, second verse with my perpetual go-to product, Malwarebytes's Anti-Malware -- it didn't find ANYTHING.

I followed the recommendation at the start of this forum and ran the TCPView utility; the results of that scan are included below.

I'm running WinXP Home, SP3, and I believe that all updates to the OS are current.

If anyone has any suggestions on how I can get rid of this, I'd REALLY appreciate it. So far, my Facebook friends have been understanding, but I am sensing that their patience is running thing. I'd also like to know what happened to get my computer into this prediciment in the first place.

Thanks in advance for your help!

Jon

 tcpview.txt (2.17K)
Number of downloads: 3

This post has been edited by Jon Westcot: 27 December 2010 - 07:01 PM

What a big bummer - this happened to me on Friday, Christmas Eve and I wasn't even on my computer. Thankfully my son, who is major tech savvy, caught it and told me to change my Facebook password. As for my people in my contact list, I think some of them just ignored it, a few trusted it was from me and had to jump through some hoops. I posted a message on my Wall that I DID NOT send it and to ignore. I have been diligently checking my computer (scans, diagnostics) prior to this for a different situation and my computer is clean/virus free. I tried contacting Facebook, what a joke, about this but unless you can decipher their help topics it's a complete waste of time. All in all, I think some baddy just wanted to ruin everyone's Christmas - not nice! Ultimately those posts on my Facebook Wall will fall off - but what a waste of time and energy - oh, I searched for the www.now-christmas.com and this was the only thing that came up so far - surely we are not the only two people on the planet this has happened to...sigh - Happy New Year!

I too have searched on the internet for references to www.now-christmas.com and I'm shocked there isn't more information. I use a mac and rarely get on Facebook. But my partner uses Windows XP and gets on Facebook for Farmville and occasionally logs into my account for Farmville. Twice in the last week I've seen a link go out to all my friends on Facebook for www.now-christmas.com with a few letters after. Some of my friends clicked on the link and they report that it totally messed up their computers, all Microsoft I'm sure. I posted on my wall not to click on the link and that I didn't send it.

My partner's computer became so infected that it was unusable so I'm sure this is where the problem originated. But running McAffe virus scan even before it was totally infected didn't find any problems. I wound up using a bootable usb key with AVG on it and even that scan didn't find anything. But after deleting her profile via the windows mounted partition from the bootable usb key running linux, I was able to get her computer running again.

As for me, I went through the process of deleting my facebook account. It takes two weeks before it is fully deleted, however. During this time you have to be very careful not to log in to any service that uses facebook connect. I will go through the process of recreating my facebook account after it has been deleted. I agree with you. We can't be the only one's affected by this and someone out there has to know more about it. It affected many of my facebook friends.

Thank you so much dkblinux98 for your input - I don't play any Facebook games, and have told my contacts not to even send me anything game related. I have a PC and prior to this haven't had a prob with Facebook - over 6 years since my first grandson was born, but I hear you on the PC security issues. My son moved over to Mac for his job several years ago, and I would too except my job requires PC and would terminate my contract if I tried to use a Mac. Anyway, you sound very savvy, your partner is lucky to have your help. Fortunately I didn't encounter any problems other than being the Facebook victim, but one of my contacts had to do a System Restore (yuck) - shame shame shame on whoever did this, course they are really awful human beings to start with - Happy New Year!