Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Is there a spambot hiding on my Mac?

orvn

orvn

macrumors 6502
Original poster
Jan 11, 2011
263
0
Toronto, Canada
My Facebook account appears to be sending SPAM links via message to groups of friends. Note the sample screenshot below from a friend's account.

I'm wondering if the culprit is a SPAM bot on my Mac. How could I test for this?


* * *​

Details:

I'm a really cautious internet user.

I don't click on suspicious URLs, us, my Firefox add-ons are all very reputable and I went into my Facebook right away, changed my password and blocked every app except those from major publishers.

A day later the SPAM links were sent out again.

I can't actually see the SPAM messages I'm sending out within Facebook (to groups of 6 friends at a time), but I get email notifications in Gmail that contain any message I send or receive.

One of the links that I'm SPAMMing out appears as follows:

Code: 
http://facebook.com/l.php?u=http://roobyjotero.com/wp-content/plugins/creatives.php?uowc

This "roobyjotero.com" appears to be an older Wordpress install that has been compromised. Several pages on this site redirect to the target SPAM domain.
​

142gfa8.png
 
I'm not certain what you mean here. Facebook messages are being sent from your Facebook account to other Facebook users? If that is so, then disconnect your computer from the internet for an extended time. If these messages continue to go out, as I suspect they will, then it has nothing to do with your computer. If they stop, then resume once you have connected, then it's a possibility you have a rogue Facebook-Message-Sending-Bot lurking on your Mac.
 
BrianBaughn said:
I'm not certain what you mean here. Facebook messages are being sent from your Facebook account to other Facebook users? If that is so, then disconnect your computer from the internet for an extended time. If these messages continue to go out, as I suspect they will, then it has nothing to do with your computer.
Click to expand...

They definitely only occur when my machine is connected. Sorry, that's something I ought to have mentioned in my original post.

BrianBaughn said:
If they stop, then resume once you have connected, then it's a possibility you have a rogue Facebook-Message-Sending-Bot lurking on your Mac.
Click to expand...

Yes, hence the thread.

The issue is that I can't find the bot. Any ideas? Tried ClamXAV. Contemplating the new Avast! for OS X.
 
orvn said:
The issue is that I can't find the bot. Any ideas? Tried ClamXAV. Contemplating the new Avast! for OS X.
Click to expand...
Unless you installed it yourself or let someone else install it, it's extremely unlikely that you have any spambot or other malware on your Mac.
 
GGJstudios said:
Unless you installed it yourself or let someone else install it, it's extremely unlikely that you have any spambot or other malware on your Mac.
Click to expand...

It appears to only distribute the SPAM when I'm logged in to Facebook and have a tab open.. Ideas? Could be a Firefox issue, but I have no rogue addons.
 
orvn said:
It appears to only distribute the SPAM when I'm logged in to Facebook and have a tab open.. Ideas? Could be a Firefox issue, but I have no rogue addons.
Click to expand...
The JavaScript Blocker extension on Safari or the NoScript extension for Firefox allows control over what JavaScripts can run on a site. You might try that to block any unwanted scripts.
 
Having the same problem

I'm having the same problem with my FB account and trying to find any answers. It's been going on for three days. Same kind of links - weird blogs with "creatives.php" at the end.

I do not have a Mac, but I use FB on my iPad, iPhone 5 and home PC.

The messages seem to go to about 8 - 10 people at a time. I only know about it because I get email notifications when one of them "leaves" the conversation.

----------

Also I do not use Firefox. Using Chrome on the PC and of course Safari on IOS 6 devices.
 
Last edited:
I should mention

I should mention a crazy theory I have, though... This all started about the time I joined a hotel WiFi network a few days ago...
 
hanten said:
I should mention a crazy theory I have, though... This all started about the time I joined a hotel WiFi network a few days ago...
Click to expand...

If you didn't use the https version of the login which isn't the default, then someone on the network could have sniffed your login credentials.
 
I guess in my example, I use https on the web version -- and the official apps on IOS 6 devices. I changed passwords and revoked permission to every app except Spotify and I was still pushing out spam this afternoon.
 
hanten said:
I guess in my example, I use https on the web version -- and the official apps on IOS 6 devices. I changed passwords and revoked permission to every app except Spotify and I was still pushing out spam this afternoon.
Click to expand...

How complex is your password?

Upper and lower case alphabet?

Numbers?

And symbols?

At least one of each with minimum length of 8 characters?
 
munkery said:
How complex is your password?

Upper and lower case alphabet?

Numbers?

And symbols?

At least one of each with minimum length of 8 characters?
Click to expand...

Yes, I use LastPass to generate secure passwords and FB is very strong. Way more than 8 characters and using all types of characters.
 
I guess I don't think it's a password problem. I've changed it three times in the last three days. I've required devices to declare themselves. I've cancelled all actives sessions....
 
hanten said:
I guess I don't think it's a password problem. I've changed it three times in the last three days. I've required devices to declare themselves. I've cancelled all actives sessions....
Click to expand...

Maybe the Facebook web app has been compromised. It has been before.

This would explain many users being affected without malware being involved.
 
Any updates to this? I saw the same problem about a week ago. I changed my password several times and it didn't help - so I deactivated my Facebook account for a week.

I just reactivated it yesterday and again today, I apparently sent out messages.

I have uninstalled all Facebook apps, run virus/spam checkers on all computers and changed my password again multiple times. I'm totally stumped.

:confused:
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back