news feed problems

Unfortunately, the problem is still there, actually my facebook went nuts after I ran all those scans, the most of the news are old news, I'm not sure if there are any real "new" news anymore, maybe one or two. I got some new antivirus programs from a friend, I ran it, found another 4 Trojans. Somebody told me to check the netstat -a, if there are any listening or connected foreign ip addresses, I found some but I'm not an expert in this, so I don't really know what does this mean. The facebook ip address is always there, even if I haven't logged in, or even opened the facebook page. Ok, so that' s everything that happened in the last few days...any suggestions?

Try running another scan to make sure your computer is clean. Sometimes more than one scan is needed to do the job right.

Also if you could provide us screenshot(s) of your problem we may better be able to assist you (you can white out any and all personal data if necessary).

Regards,

ok, the netstat is changing all the time, it shows web sites i didn't even open, here is one sample:

TCP acer-3a83c4d72d:1034 localhost:27015 NAVÁZÁNO
TCP acer-3a83c4d72d:1038 localhost:2804 NAVÁZÁNO
TCP acer-3a83c4d72d:2804 localhost:1038 NAVÁZÁNO
TCP acer-3a83c4d72d:3646 localhost:3647 NAVÁZÁNO
TCP acer-3a83c4d72d:3647 localhost:3646 NAVÁZÁNO
TCP acer-3a83c4d72d:3649 localhost:3650 NAVÁZÁNO
TCP acer-3a83c4d72d:3650 localhost:3649 NAVÁZÁNO
TCP acer-3a83c4d72d:27015 localhost:1034 NAVÁZÁNO
TCP acer-3a83c4d72d:3398 64.12.24.168:https NAVÁZÁNO
TCP acer-3a83c4d72d:3417 by1msg3275916.phx.gbl:1863 NAVÁZÁNO
TCP acer-3a83c4d72d:3887 www.qksrv.net:http TIME_WAIT
TCP acer-3a83c4d72d:3888 84.53.175.80:http NAVÁZÁNO
TCP acer-3a83c4d72d:3891 www.05.03.ash1.facebook.com:http NAVÁZÁNO
TCP acer-3a83c4d72d:3892 www.05.03.ash1.facebook.com:http NAVÁZÁNO

NAVAZANO means connected

I've noticed that the facebook's ip appear when I log on to the icq or msn.

yeah, and I ran a few more scans, the trojan was still there, so I managed to find it manually and deleted it.

Run the scan again. Still infected ?

no, I ran it afterwards, and it was clean.

and a moment ago I asked my friend to check her netstat for the facebook (she has a fb account too) ip and she doesn't have it there at all (when she is not logged in).

So..you're saying that, in the netstat page, you're getting connections to "random" websites, including when you go on facebook, while you're friend's computer / connection is clean?

And that "random connections" issue happens while you're SURE you do not have any internet page(s) open, correct?

Sounds to me like your computer is still infected, which probably explains the behaviour of your facebook.

Do you have access to another, non-infected computer (ie. family computer, etc) ?

I'm saying that on the netstat page I'm connected to the facebook even if I'm not on the facebook (I'm logged out and the page is not open) and yes, there are connections to web sites I've never been on. And yes, my friends netstat is clean. Actually, I'm in London right now, and I've been staying in a student accommodation, but they have a pc here, and I think I could use it.

well, i checked the pc, and tried the netstats on my other friends comp and both are clean, i'm the only one with permanent facebook log on on the netstat...

Using the "public" or your friend's pc, change your facebook password. After that DO NOT login to facebook from your computer for the next few days.

Using the public / friend's computer, monitor your facebook for the next few days and see if there are any changes to it.

Unfortunately, I couldn't use nor the public neither my friends comp in the last few days, but suprisingly my facebook's cleared up, I found only one old story among the new ones, my friends box got a bit stuck, it doesn't change the friends and I can't change the number of them from 6 to 9 or 12, but anything else is working just fine. The connection to the facebook on netstat page is still there, it's there almost all the time, even when every other connection I closed down dissapear, I don't know if I should be concerned about this, I've read somewhere that if the same connection appear continuously on your netstat and you know that your not using the site, it most highly means that you have a trojan, and a remote someone is connected to you through that website.

Yup...you've got the right idea, ie. If there's connections to sites you are not on (not just facebook) that should be a point of concern to you. It might be mean a trojan / remote hacking, but definitely something is wrong with your computer.

yeah, I thougt so, but I'm not really sure what to do about it. I can't really get back to him/her. Some of my friends suggested rebooting.

it's kinda interesting; netstat shows that I'm connected to 2 facebook websites (not always, sometimes it's just one), is that even possible?

ok, I decided to reboot, I don't see any other less complicated option, thank you all for your time and advice:), especially you funnytim (the last man standing:).

I have one last question, is there a possibility that it was all caused by a feed reader? I know that the trojan and the worms couldn't, but the connection on the netstat?

Yea I wonder where those other people went

Rebooting may solve the problem in the short term (which it didn't for you anyway) however it will not solve the problem in the long term, ie. the infection will still be there.

It's very possible indeed that it may have been caused by a feed reader, so be sure you don't have any feed readers running when checking.

Regardless of whether your facebook problem "clears up" or not, I suggest you fully make sure your computer is not infected to protect yourself both now and in the future. I can get more info for you if you wish to proceed in that direction

thank you very much:), i will definetely need some better protection after what happened.
I uninstalled the feed reader I had, and the connection to facebook disappeared. Then I installed a different feed reader and everything was fine. After that I reinstalled the feed reader I had before and the connection reappeared. So, it's caused by this particular feed reader. I wonder why, it's a simple feed reader add-on by firefox.

Do some quick research about the feeder on the internet. If the feeder is good, ie. no reports of malware or something , then everything should be good.

How is your facebook account?

The feed reader seems to be fine, I've found 2 websites that say that it is absolutely spyware, malware, etc. free. My facebook account is still the same, I'm suspecting that the Trojan might be still here, because last time I cleaned the computer the news feed cleared up and it was ok for a little while, but after some time, it went crazy again. And there is another thing - half of the page is in czech language, when I changed the whole account to a different language, some of the stories were still in english, it went half and half again.

something amazing happened, few hours ago i wrote that |"my news feed went nuts" in the section "what are you doing" on my facebook account and now my news feed is perfect, no old news, no different language.

Your first problem - about the account changing to "half and half" language, seems to point fingers at facebook for it being their fault. Therefore I would consider contacting them and asking them to check your account (give them your registered email).

If nothing is wrong, then about the news feed problem, it still sounds very much like someone is tricking you, ie. logging your password, then going onto your account and modifying it.

If you can get access to another computer again,

Quote :

Using the "public" or your friend's pc, change your facebook password. After that DO NOT login to facebook from your computer for the next few days.

Using the public / friend's computer, monitor your facebook for the next few days and see if there are any changes to it.

Actually, I already wrote them about my problem, that was the first thing I did, but they didn't write back (and didn't do anything about it). I wrote them again today, so I'm curious if they respond.

well, they haven't answered yet, but it looks better the half half language problem disappeared, but the old stories are still there. Actually I had to reboot anyway, yesterday I found about 30 Trojans, and it was really bad. I found another one after the reinstall, deleted it, now, it looks like the whole comp is clean. I don't understand the quantity of the Trojans, I have had the same antivirus for a long time and never had any problems before.