9

I am not sure if this is the correct community for this post. If not please refer me to the correct one.

I am getting a "Your computer needs to be cleaned" error message when trying to login into Facebook on a specific laptop with 2 specific accounts. these two accounts are working perfectly fine on another PC and a third account is working without any problem on that PC. Facebook then offers to continue and install one of two programs to handle the threat. one of which is f-secure and the other is Trend-Micro. It seems wired to me that Facebook not only recommends specific brands but two that I have never header of. after a short research online I have found that half the posts says it is legit and the other half points out its a virus and offers unsuccessful (so far) methods for removing it. i have tried a malwarebyte and ESET scan as well to no avail.

Please help me figure out what to do.

Improve this question
1

3 Answers 3

Reset to default
9

The message means that Facebook has received some unusual requests from your computer, like for example a large number of attempts to guess passwords for different accounts or attempts to post spam. So Facebook assumes that you have some kind of malware on your computer and recommends you to install a malware scanner to get rid of it. For more information check this article on facebook.com.

F-Secure and Trend Micro are quite well-known malware scanners, but not particularly better or worse than all the others on the market. Why does Facebook recommend those two? Only they know. Maybe they have an advertising deal, or maybe some admins at Facebook just like them. Whatever reason, when you don't trust the links provided by Facebook and don't trust my links either, just look up their websites in your preferred search engine.

However, Facebook can not know what kind of malware exactly you have on your computer, so there is no guarantee that these scanners will be able to find and clean it. And we have even less information about what malware you could have than Facebook does, so we can not offer you any advise except the usual procedure which will work on almost any malware: Format your computers hard drives, reinstall the operating system from scratch and restore your personal data from your backups. You do have backups, don't you?

Improve this answer
6
  • I have a backup but i prefer not to format due to a Microsoft office account issue. That answers my question though, thanks a lot.
    – Maxim
    May 21, 2016 at 23:49
  • 2
    Do you have any references to backup that Facebook is in fact doing this? Some of the search results I get seem to suggest these messages are actually fraudulent.
    – Alexander O'Mara
    May 22, 2016 at 0:19
  • 1
    @AlexanderO'Mara That popup being fraudulent makes absolutely no sense. The screenshots I have seen show that they appear on the https site, so we can rule out a MITM injecting it. That leaves only an injection through a compromised web browser, but when an attacker already got so far that they compromised the browser they really don't need to trick the user into any more interaction. And even when it would be necessary: It would be stupid for a malware to tell the user that they have a malware infection. There are far less conspicuous pretexts to trick the user into clicking something.
    – Philipp
    May 22, 2016 at 2:33
  • Unless the message is actually coming from a Facebook app, malicious ad, or something. Some more research into it suggests it's probably real, though the lack of official info on it seems odd.
    – Alexander O'Mara
    May 22, 2016 at 2:59
  • 2
    @AlexanderO'Mara facebook.com/notes/facebook-security/…
    – MonkeyZeus
    May 23, 2016 at 15:58
0

This is probably an example of the fake malware detected malware, trying to trick you into downloading and installing a "cleaner" that is actually malware.

Improve this answer
1
  • It is not. Look for my comments in the answer. It was legit.
    – Maxim
    May 28, 2016 at 7:54
0

This is most likely a fake warning. Happened to me and this is how I mitigated it:

1. Change your browser's user agent string to look something like this 

*Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.51.22 (KHTML, like Gecko) Version/5.1.1 Safari/534.51.22*

This can be done in a number of ways, but i did it with a browser plugin called PrefBar for Firefox. user agent switcher

That way you 'fool' Facebook you are on a Mac via the user agent string. Upon trying to log on it now will prompt you to confirm with a mere "OK" that you do not have viruses, instead of forcing you to download the redundant and un-necesarry extra online scanner. (I already have "Kaspersky Internet Security 2017" so i don't need two AVs.)

2. Facebook will see the fake user agent and instead of offering you to download the windows based online scanner will simply present you with a menu - asking "Did you run antivirus for Mac?" And you can press "Yes i did" and it lets you in for good.

3. Then revert back the user agent to its usual state "Real UA"

4. [Optional] Change your password and run a full AV scan with your own AV or with a separate live CD-based AV

5. [Optional] Run an extra malware scan with Malware bytes in conjunction with your current AV.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .