Virus scare via a Facebook email, anyone else get one?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri Jan 09, 2015 12:34 am

So, I got an official-looking facebook email in my baiter account. That email is only ever used with the lads, it's not connected to anything at all (like facebook, twitter, etc) so the only people that have it are the lads.

So I got this email and I went to right-click on the link to copy/paste the URL into notepad to see what site it's trying to take me to (I know better) but my dog was on my lap being a butthead and I accidentally clicked the link and it opened a new tab and everything froze. So after minutes of shutting down, trying to get back online, running virus scans etc., my other half comes home and I tell him about it and show him the email. He's a computer nerd for a living so he's the right guy for the job. I had already checked the email headers out but when he dissected the headers he said it actually does look like it came through the Facebook website (user in Singapore). I forwarded the email to Facebook with full headers because I don't think that's possible.

Anyway, to make a longer story short, he got to looking at the facebook.com link in the email because it actually is a very long Facebook link and he noticed something right away. It has my specific email address not linked to anything publicly right there in it. This is the link but I've edited it slightly so that my identity is hidden. He has seen this before and says that what it is trying to do is basically a social networking identity theft. So I really miffed a lad or something.

This is the link:

Quote:

facebook.com/merge_accounts.php?e=3D<THIS WAS MY EXACT EMAIL ADDRESS> and then there was a bunch of characters after that.

It froze up everything in my computer and it wouldn't even shut down.

Anyway, I just wanted to tell my story to let others know this is going around. Hopefully Facebook will take care of it on their end. But has anyone else gotten this? By the way the email was all in French and I'm not French.

Posted: Fri Jan 09, 2015 12:43 am

I have not received one but thank you for the heads up on it!

I used to get emails from Pay Pal all the time when I ran an online business. They basically told me that I had a payment waiting for me and to click the link. I knew better since the email did not have my account name anywhere on it.

I would always send the email and headers to PP and would always get a reply saying they investigated and it was a phishing site, which I think yours might have been to, to get access to your FB account. My point here is, PP took the time to email me back to confirm that they checked it out and the result. Great customer service IMO. Do a lot of people report it? Probably not, but if I don't report it than who will? Kind of like doing this, every little bit helps out in the grand scheme of things!

I guess it goes to show you that it pays to be educated like we are learning here because just when we think we got the lads figured out, they throw something new at us.

Good thing you have a hubby that knows about this. I got some GD Cinema P Adware thing going on and when I think I have removed it, a day later it comes back! ARGH! Trying more cleaning right now for it! PITA!

Posted: Fri Jan 09, 2015 12:57 am

I should mention that I use Malware Bytes & AVG and the alarms didn't go off when I clicked and after I rebooted all of my cache, cookies and history in IE were wiped clean.

I ran Malware's scanner and it didn't find anything and then I ran AVG and it found 4 files.

Posted: Fri Jan 09, 2015 2:51 am

I installed about 10 different ones and none did nothing. I did a search on google and solved it (for now) in about 3 seconds! Should have done that from the beginning I guess!

Baiting Guru Joined: 10 Oct 2010 Posts: 3876

I don't think that this is a trojan horse.

do you have a facebook-account linked with that email address? if so, you might have just added another email address as recovery-address to your facebook-account.

if that really works this way, it's a neat way for a lad to take over your facebook-account and pump out tons of mails to your contacts that you are stredded under hash conditions in west africa and you immediately require money through a wu-transfer, since you lost your passport, drivers licence and so on...

Posted: Fri Jan 09, 2015 1:21 pm

No, fortunately I was smart enough to not link my baiter emails to anything, not even fake social accounts. Without my hubby looking at the .php code itself, he is speculating here, but he says it appears that what the script was doing was trying to assume that there was a facebook account with that email address. If it found one it would "hijack" it by clearing the cache in IE so that I would be prompted to log back into it and they would in essence take over my account.

Luckily nothing outside of IE has been touched and since there's no such Facebook account all is safe on my computer. I think I know which lad it was because this one was particularly hostile and kept accusing me of being a "joker". I think he was trying to see if I was real. So be on the lookout. I'm glad no one else got this one because that was my first thought was that maybe it was a mass email sent out to a bunch of baiters. I'm relieved to see that's not the case, but I could see where this could nab an innocent victim!

Posted: Fri Jan 09, 2015 1:41 pm

Any techies that would like to take a look at the code and do some investigative work, you're welcome to PM me and I can send it. Maybe you can figure more out.

Baiting Guru Joined: 10 Oct 2010 Posts: 3876

could you please post more of that email? (didn't find a similar one in my catcher).

but I found that:

http://help.goodsie.com/discussions/problems/1835-facebook-page-like-code-not-working-in-the-page-only-size-problems

maybe facebook just tries to connect more and more mail-accounts to the same facebook-account.

Posted: Fri Jan 09, 2015 2:27 pm

Quote:

facebook.com/merge_accounts.

This is very suspicious.

Posted: Fri Jan 09, 2015 2:48 pm

Robert Heinrich, should I PM you or do you want me to post it here on the thread?

I'm not sure how they accomplished it but my guess is that someone with a developer account on Facebook created an "app" for this. There's no way my lad is sophisticated enough for this, he's a Benin boy. We googled all we could on this and couldn't find much.

Posted: Fri Jan 09, 2015 2:55 pm

Can you post the headers minus your details.

Posted: Fri Jan 09, 2015 3:07 pm

Email header:

Quote:

Delivered-To: <snipped>
Received: by 10.194.38.40 with SMTP id d8csp112921wjk;
Thu, 8 Jan 2015 13:26:42 -0800 (PST)
X-Received: by 10.70.128.131 with SMTP id no3mr18307088pdb.18.1420752386398;
Thu, 08 Jan 2015 13:26:26 -0800 (PST)
Return-Path: <[email protected]>
Received: from mx-out.facebook.com (outmail029.prn2.facebook.com. [66.220.144.156])
by mx.google.com with ESMTPS id ge1si10373563pbc.32.2015.01.08.13.26.25
for <<snipped>>
(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
Thu, 08 Jan 2015 13:26:26 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 66.220.144.156 as permitted sender) client-ip=66.220.144.156;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 66.220.144.156 as permitted sender) smtp.mail=invite+AaXR0ZXJiaXR0ZXJiaXR0eWJpdEBnbWFpbC5jb20@facebookmail.com;
dkim=pass [email protected];
dmarc=pass (p=REJECT dis=NONE) header.from=facebookmail.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=facebookmail.com;
s=s1024-2013-q3; t=1420752385;
bh=27unhNzax3IDgkWKHjTWlbSQVKdKu0CbnxTtR/O08Nk=;
h=Date:To:From:Subject:MIME-Version:Content-Type;
b=kNmxrxx42RjbHoExoGJOQgl8lmQYPGb4G0H6BQgnIiU3PUCxM3KS43WVFJe9OYcdq
Mh6hKMMbrnzvKQhbhelJa7TLGVZPfGA/qRYWf+M/h6Z3F8dL1eh7cz7HKcRv9Jv7I9
SZ65CTJliQpIYNRwCPId0IawdiiEjmUSdKkGp7Gg=
Received: from facebook.com (Pp/Nwwmq6rGagiVuvnCJmWbCRbJWMUKP/3Jyblpyws463C1XnNFh5pTwCztM3457 10.103.99.93)
by facebook.com with Thrift id ffc779ce977c11e494150002c9dff22e-438d12a0;
Thu, 08 Jan 2015 13:26:25 -0800
X-Facebook: from 2401:db00:10:a0ba:face:0:2a:0 ([MTI3LjAuMC4x])
by async.facebook.com with HTTP (ZuckMail);
Date: Thu, 8 Jan 2015 13:26:25 -0800
Return-Path: [email protected]
To: <snipped>
From: "John Ben" <[email protected]>
Reply-to: John Ben <[email protected]>
Subject: Regarde mon profil Facebook
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
Errors-To: [email protected]
X-Facebook-Notify: general_invite; mailid=HMTg2MTg0NDk1Oml0dGVyYml0dGVyYml0dHliaXRAZ21haWwuY29tOjg
List-Unsubscribe: <https://www.facebook.com/o.php?k=AS1jV3p9QRZ4fDXi&e=<mybaiternamesnipped>%40gmail.com&mid=HMTg2MTg0NDk1Oml0dGVyYml0dGVyYml0dHliaXRAZ21haWwuY29tOjg>
X-FACEBOOK-PRIORITY: 1
X-Auto-Response-Suppress: All
Message-ID: <[email protected]>

And these are the links within the code of the email that I'm talking about (again with my info removed)

Quote:

facebook.com/o.php?k=AS1jV3p9QRZ4fDXi&e=<mybaiternamesnipped>%40gmail.com&mid=HMTg2MTg0NDk1Oml0dGVyYml0dGVyYml0dHliaXRAZ21haWwuY29tOjg

Quote:

facebook.com/merge_accounts.php?e=3<mybaiternamesnipped>%40gmail.com&c=3DAQBOuw7AADGIGcfCRHfN74Z0hUuQCfV4ZZEcvnlv1pp06A&source=3Dunknown

*Edited to add that the only thing missing from the links above is the https://www

Posted: Fri Jan 09, 2015 3:21 pm

It has come from Facebook and not spoofed

ipTRACKERonline.com wrote:

Header Analysis Quick Report Originating IP: 66.220.144.156 Originating ISP: Facebook City: Menlo Park Country of Origin: United States * For a complete report on this email header goto ipTRACKERonline

It could just be that a lad is inviting you to join Facebook - what does the body of the mail say?

Posted: Fri Jan 09, 2015 3:44 pm

Yeah, I know that's why I got concerned but when I clicked on the link, it froze up my computer and then when I was able to reboot it all of my history, cache and cookies in IE were wiped clean. Give me a minute, I'm gonna clean my info out of the code of the email and I can post all of it.

I wish it were a real one but here are the red flags:

In the email there is no link to the profile that supposedly invited me

In the email there are no actual links to Facebook except for the two links I posted, usually there are additional links to like help, unsubscribe, etc. in the body. None are there

The timeline:

After the click opened a new tab everything immediately froze. We couldn't even get the computer to shut down. It took over 10 minutes for us to get the computer to boot back up and when we did, everything in IE was wiped clean.

I'll post the email in just a sec.

I should mention that we did use another computer and clicked the link so that hubby could see what it did and the exact same thing happened again, but when it rebooted AVG gave us a warning that it detected and stopped several threats.

Posted: Fri Jan 09, 2015 4:33 pm

Update: So I've been doing more digging. I logged into another computer and tried the same thing again (never used the other one for baiting). It didn't freeze up. So I came back to this computer, clicked the link .... froze up and the whole thing started all over again. Re-running my virus scanners again.

The computer that we tried last night froze up too, and that is a computer I've also used for baiting.

So called hubby and now he says maybe it wasn't the email that set this off and that the timing just happened to be when I clicked on a Facebook email. He thinks it would have happened even without that so I went back to the other computer I've baited on and opened an email from Instagram, clicked and it didn't freeze. I clicked on a Twitter link, no freeze. Clicked on a Linked In link and it froze. Same thing exactly. After getting it back up, IE was wiped clean.

I'm running virus scanners again, on all of my computers, it's not finding anything so far. Has anyone had anything like this? If it's a virus wouldn't my scanners find it? And since it's only happening on the computers I've baited with, does this mean I downloaded it from one of the lads or is this a coincidence too? I really thought that this was from the Facebook email, but now I don't know where it could have came from.

Can anyone help me?

Posted: Fri Jan 09, 2015 4:54 pm

Malwarebytes is usually pretty good at finding anything nasty - is it fully up to date? And the same with AVG?

Did you actually right click on the link when you posted the destinations or just copy the text? It could be going somewhere nasty and then redirecting to Facebook.

Posted: Fri Jan 09, 2015 5:24 pm

I meant to right-click on it but accidentally left-clicked when my hand slipped and that's when a new tab opened up and all of this started. And now I'm only scaring myself more googling all of it and finding virus this and virus that. I don't want to keep calling the other half at work, sorry I'm such a pain in the ass.

Posted: Fri Jan 09, 2015 5:26 pm

When I copied/pasted it directly from the code to post here. Do you think that could be it? But wouldn't it have done it on the 3rd computer we tried?

Posted: Fri Jan 09, 2015 5:57 pm

OK, just wanted to let you know that I'm going to set it aside until the other half gets home. My firewall is going nuts now in AVG. I'm doing nothing but driving myself nuts. Shutting her down and letting him deal with it. I'll post an update if we find out what it is. Thanks for trying to help all, I really appreciate it. Looks like no matter how safe you're baiting there's still something that can happen and I learned a valuable lesson.

Posted: Fri Jan 09, 2015 7:43 pm

Well, I learned a very valuable lesson and just a warning to others to learn from my own stupidity. The other computer is still down but we know what I did.

I got curious about a phishing email after getting one a day for like 5 or 6 day. Yes, I checked the link out. That was Wednesday. The link was a blank page but it was a funky domain, just a bunch of random letters. I immediately closed the window and didn't think of it again. Yesterday, instead of the phishing email I got a new Facebook invite. The Facebook email was legit, but probably sent by the same lad as the phishing emails because it looks like whatever file I downloaded Wednesday was put into action when I clicked on the Facebook link (I didn't know viruses could do that!). It wasn't the email that was bad, I guess that file was looking for that action. Who knew?

Anyway, long story short, luckily (or unluckily) my computer processor couldn't handle the load and totally crashed before the virus could completely install itself. What we can tell from the bits is it looks like it was a keylogger. Hubby is going to go through logs and registries to be sure but this computer is now safe while the other one probably is, but he's going to do a more thorough search later.

I did send a Facebook invite from my RL profile to my catcher account so he can compare the emails just to be sure, but we're pretty sure my dumbass is the one that did all of this. Like I told my mentor, I thought I was being safe and I do have my "no clicking" rules and what not but just breaking my own rule one time could have totally fried that laptop, this laptop and could have infected even my sons' computers because it's all networked and we share crap all the time.

The moral of the story? Don't break your own rules and fellow baiters, if you get some odd emails followed by a linkedin, Facebook, meetme or tagged invite, don't click!

Sorry for the PITA posts today, I knew better, dumb idea and even dumber consequences of my actions. Feeling like quite an idiot right now Embarassed

Posted: Fri Jan 09, 2015 7:45 pm

I don't know if someone already advised you of this, so...
It is a very good idea never to click on any link sent to you in an email you are not expecting to get--even if the email comes from a party you know.

Rememberthat malware protection can protect only against software it knows about. New stuff is being engineered avery day. Some viruses or trojans can be sleepers that do not start their nasyness right away.

The fact that your system flaked out after you first selected the link is alarming, but not proof positive that something is amiss.

A good rule of thumb is that no link sent to you from a stranger will help you in any way.

Posted: Fri Jan 09, 2015 8:02 pm

Thank you for the advice. No, I know. Believe me, I know I was dumb for doing it, I just let my curiosity get the better of me because it was a different format. I worked in the internet industry so I knew better then to do it. I have kicked myself in the ass so much today that it's bruised!

Looking at the logs that's why the computer froze, the processor is old (I haven't upgraded my laptop since I retired) and it was too much load on it. Had it been one of the newer laptops it would have been much worse.

Like I said, I learned my lesson on why curiosity killed the cat and I will never do something as stupid as this again.

Posted: Fri Jan 09, 2015 8:52 pm

metamit Wrote:

Quote:

curiosity killed the cat

I told you not to hire him but did you listen?

Posted: Fri Jan 09, 2015 9:42 pm

Metanut,

No need to apologize and you are certainly not a PITA (that is reserved for lads only you know!).

If nothing else, your saga has been an education on what NOT to do! That can only help us in the long run.

I for one have always been guilty of clicking "next" fast when installing stuff, and that is probably why I ended up with the Cinema P Adware in my computer. Fortunately, it has stopped screwing things up, hopefully for good!

As for the computer, follow the simple instructions in my avatar if you have other problems! I find that works quite good!

Virus scare via a Facebook email, anyone else get one?	View next topic View previous topic