Facebook as a Pipeline

I use Facebook to promote my writing, as many IWW members do. I happen to be "friended" in three different networks.

This morning I received a note from a trusted correspondent about a Facebook posting. I didn't look at it carefully. It took me to Facebook, but it noted that to "fulfill" the link, I would be taken off site.

Again I was not careful. The site looked like a version of YouTube, and it noted that I needed to install a new version of a flashplayer.

I went from being careless to being stupid. I installed it --

-- and in doing so I installed an elaborate and nearly indestructible phishing program called Anti-virus Trigger, which is apparently so new that my anti-virus program didn't recognize it as malware.

It took me three hours to clean my computer, which I did by ...

• Booting in Safe Mode.
• Deleting the Trigger program via the Control Panel (which didn't remove it entirely).
• Doing a System Restore to a point before I received the message.
• Running SpyBot Search and Destroy.
• Oddly, the program had changed the Proxy Server in Firefox as well so that any attempt to enter the Internet would be shunted through the malware site where the URLs were slightly altered.
• That meant downloading a new copy of Firefox using Internet Explorer.
• The new copy still had the improper Proxy Server, which can only be corrected through Options/Advance/Cofigure How Firefox Accesses the Internet/Auto-detect.

I've been a web'ophile for a dozen years, and this is only the second -- but the worst time -- I've been burnt.

• Here's a Windows XP/Vista Security Blog with more information about removing Anti Virus Trigger.