Why only Spybot detected this Trojan? I removed this parasite using Spybot. However, and in couple days I got it again.
Why only Spybot detected this Trojan? I removed this parasite using Spybot. However, and in couple days I got it again.
Last edited by tashi; 2012-07-09 at 15:17. Reason: Moved from malware removal, no logs presented
Hello lionb,
Please open Spybot Search & Destroy > Help > About and let us know the version and date of last definitions.
Also the operating system and other security programs installed.
Best regards.
Microsoft MVP Reconnect 2018-
Windows Insider MVP 2016-2018
Microsoft Consumer Security MVP 2006-2016
Spybot - Search & Destroy 1.6.2.46
Latest detection update 7/4/2012
McAfee Security Center, MalwareBytes - Anty-Malware
Last edited by lionb; 2012-07-10 at 00:41.
So far so good. But I did not get answer on my major question. Why only Spybot detected Fraud.Facebook.Messenger Trojan? I searched Google and figured out that other people had the same problem and the same question. Does it mean that Spybot mistreated some legitimate software? I do not believe that other antivirus software missed this problem. No one of them even mentioned that problem.
Hello,
Fraud.Facebook.Messenger is a fake messenger for the social network Facebook.
It installs itself to the computer pretending to be a messenger for Facebook.
It compromises the system security and is likely to steal Facebook login information.
Best regards
Sandra
Team Spybot
Hi!
I was wondering about this Fraud.Facebook.Messenger. I have downloaded and installed this from Facebook. I've using it for a while and yesterday I ran Spybot and it said I had fraud facebook messenger. I deleted like 90 entries but it couldn't delete all. Then of course Facebook Messenger stopped working and I have to boot and delete remaining pieces what Spybot couldn't fix right away.
I tried again download from the same Facebook page and installed that messenger. It still says that it is fraud. So Facebook is distributing fraud Facebook Messenger? That is odd. This can't be false positive?
Screenshot Fraud.Facebook.Messenger
Hello,
For those wondering if they have received a false positive: How to report Possible False Positives
Best regards,
Microsoft MVP Reconnect 2018-
Windows Insider MVP 2016-2018
Microsoft Consumer Security MVP 2006-2016
Actually Facebook is doing a lot of fraud.
But we will look into this and compare the messengers and see if there is reason to modify our detection in regards of a false positive.
The results of the analysis are as follows:
Messenger really belongs to Facebook and it is not a Trojan horse.
Therefore we will change our categoration of the Facebook Messenger from Trojan to PUPS for possibly unpopuplar software because of the following reasons:
- does not check OS version (installs on unsupported OS)
- does not show EULA and Privacy
- uninstall leaves one of the 3 FacebookUpdate.exe with its autorun function intact
- FacebookUpdate.exe and its autorun delete themselves after running in background for a while
- uninstall opens a facebook site which can only be viewed if logged in