This week I've been trying to help a friend of a friend with her computer. The problem is that from time to time, her Facebook account starts posting posts, from her, that tells people how they can get a free iPhone by googling for a specific code and following the initial link that pops up.
Here's an example of what the message looks like, the original one is in Norwegian, so I translated it, but I also changed the code, I don't want anyone to propagate this spam any further with my help:
Hi :D A few days ago it was mentioned on TV that you can get the new iPhone X for free in a very simple manner :) Just type this code into a Google search: HXC1234XYZ and click on the first link available at the top.......
My question is simply this: Does anyone know which mechanism they use for this specific thing? I am trying to rid her computer or whatnot of this problem so that her account no longer gets these posts.
Bear in mind that I'm specifically not asking for how to troubleshoot this problem in the general sense, that's too broad, I want to know if anyone know exactly what is posting this very specific post so that I can remove that specific problem.
Here's what I looked at:
- Installed software, couldn't see anything out of place
- Installed plugins in her browser, there was one there, "Important Browser Update", this was firefox. Firefox updates itself, I removed this one but I don't know conclusively that it was this plugin.
- Tightened her security
- Reset her Facebook and email password, and raised the complexity of her passwords from "laughable" to "strong"
- Disabled the ability of all 3rd party apps or websites to connect to her Facebook account (Settings, Apps and websites, Preferences, Apps, websites and games), this was "turned on", I turned it off.
- Removed two applications that were listed on the Facebook page as active (Settings, Apps and websites, Active apps and websites), Seedr and Pinterest (the latter is most likely the real deal but since she cannot remember ever using this app I removed it)
- Made sure Windows was updated
Since I don't know exactly what causes the specific post in question, I don't know if these measures are enough or if there's something else I need to do.