Facebook Chat Virus: how to manage and remove it

Update on July 27th, 2011.

Have you clicked a link in FaceBook chat and now your computer is infected? Have you received a strange message with a link in FaceBook chat and you don't know what is it? This is a good starting point to find more about.

How the virus works

Since December, there is a virus crawling through the FaceBook Chat: a worm, to be more accurate

What is this virus?

Pretty easy: like almost all the infections you can get through a social network, it is just a simple message you'll receive in FaceBook Chat. One of your friend will send you this message, which is something like "foto :-)", "pic :)" and a link to the photo itself. Presumably.

DON'T click it.

Whatever thing could happen, don't click that link. Never.

What to do, then? The first thing is "Don't panic". Until now, nothing bad happened: you've only received a message with a potential virus, but the virus is not in your computer, yet. Simply close that chat window and everything will be fine. And DON'T click the link.

As a second step, I'd suggest you to write a message to your friend, the one who sent you the link with the virus. It's not mandatory, but it's a nice thing from you. DON'T copy the link in the message: just write "I got a strange link from you" and explain what happened and everything will be fine. If you got the link from his/her Facebook profile, this means that your friend is already infected by that virus and now the virus itself is trying to spread, without your friend ever notice it. If you inform him/her, you'll surely do him/her a favour and you'll help avoiding that other friends will be infected by the virus

Now, what happens if you click the link?

First of all, you made a really bad move. But well, it can happen. Maybe you involuntarily clicked it, or you really trusted your friend, who knows. It would be better to be more cautious in the Web, but by now you did it. Time to find a solution. Let's see.

If you click the link, you'll be send to a fake FaceBook page, which says that the picture you were looking for has been moved, for whatever reason. If you want to see the picture, you must click on a button, which looks exactly like a common FaceBook button, like the one you usually click in order to activate an app. Have you clicked it? Great! Now, your computer has just won a new virus.

Clicking on that fake button, you haven't activated any app and you haven't seen any picture, since no picture ever existed! It was a trick, made by the one who programmed the virus: a bait, in order to make you click and install the virus in your computer. Maybe the virus has a name, which looks like a real photo from FaceBook, but the truth is that it's not a photo: it's an executable file, which will install itself in your computer as soon as you click and accept.

This kind of virus is usually called "Worm": it is a virus often hidden in a fake web page, which spreads itself through the Web, from a computer to another. Those pages are clearly fake, but very similar to an original page and they can deceive an inattentive user. After infected your computer, this virus will keep working, trying to spread through all of your contacts, using the same trick which already worked with you: fake links and fake pages.

A worm virus works like this. Their name comes exactly from it: worm, since they crawl from a computer to another, digging through fake pages.

How to remove it

You got yourselves infected. And now?

And now you must clean up your computer, in order to erase the virus and bound the damages it already did.

First of all, you must scan you whole hard disk with a good and updated antivirus. All the hard disk, folder after folder. You can never be too cautious about it.

Usually this is not enough. You need a specific software, in order to remove this kind of virus. There are many of them, as for example Malwarebytes, which is also downloadable in a free version. You can download it by clicking here.

Another mirror site to download it:

http://malwarebytes-anti-malware.softonic.it/

Download it, install it and scan all your computer with it, too: then, follow the instructions. Next time, please be more careful and avoid to blindly click any link you find.

One last thing, but very important.

Once you have removed the virus and your computer is clean, change all of your passwords. Change the answers to the questions for recovering your passwords. You can't be sure whether your passwords have already been stolen or not, but it's better to play safe. For sure, someone had a chance for putting his nose inside your computer, potentially finding and copying all of your data stored inside of it, passwords included. Maybe he did it, or maybe not, but why should you risk?

Change your passwords and you'll be safer.

UPDATE 07/27/2011

It seems like there is a new version of this virus (or maybe of a different virus: I haven't yet had a chance tu analyse it). Anyway, the main difference is that this new virus can talk a little more with you: it's not a simple "Hey, look at this: *link", but it's a more evolved bot, which can do a little chit chat, before sending you a link. For example:

Virus; hi. how are you?
User: answer
Virus: good. Wanna laugh?
User: answer
Virus: It is you on the video ?)) want to see?)

...then, here comes the link (remember, please: thou shall not click the link!).
You should be able to remove it with Malwarebytes, just like the other one.