Facebook Suspension virus: what the message is and how to remove the risk

There is usually nothing to remove, because the Facebook Suspension message is a phishing e-mail and not a program. It does its harm if you click the link and type your password. If you did, go to facebook.com/hacked, reset the password, sign out devices you do not know and remove unknown apps in Settings.

If the link also made you install a plug-in or a program, remove it in Installed apps or your browser's extensions page, then run a Microsoft Defender scan. If you only read the e-mail, report it to phish@fb.com and delete it; nothing was installed.

No. It is a phishing message that claims to come from the Facebook security team and says your Page broke the Terms of Service.

Three things show it: the sender, facteamsupport@supportpages.online, is not on Facebook's list of mail domains (fb.com, facebook.com, facebookmail.com, instagram.com, meta.com, metamail.com); the text has mistakes such as "out Terms of Services" and "link blow"; and it asks you to verify through a link.

Facebook says it never asks for your password in an e-mail. Real security e-mails are listed under Recent emails in your Facebook settings, and the fake one is not.

Probably, but check two things. Typing nothing means the sender did not get your password. A page can still try to make you install something, so look at your browser's extensions and at Installed apps for anything new from the time you clicked.

If the page redirected you to a site that offered a security plug-in, as it did for a reader in 2016, and you installed it, remove it. If there is nothing new, delete the e-mail and report it to phish@fb.com. Changing your password anyway costs a minute and closes the question.

Act at once from a device you have used for Facebook before. Go to facebook.com/hacked and report the account as compromised, which Facebook allows even when you can still sign in. Reset the password, then change it on any other account that used the same one, starting with your e-mail.

In Settings, open Where you're logged in and log out devices you do not know, check the activity log and delete posts you did not write. Then switch on two-factor authentication. Tell friends not to open anything odd that arrives from you.

We do not know. A reader wrote on 29 August 2016 that the first click on the link gave a one-time server error, and the second sent the reader to a website offering security plug-ins. We did not open the link and no copy of that site was kept, so we cannot say what it installed.

A page that pushes a plug-in after a fake account notice is not a Facebook page, and its offer should be refused. If someone installed it, remove it in Installed apps or the browser's extensions page, change the Facebook password and run a Microsoft Defender scan.

No, reading the e-mail is not enough. An e-mail with this text is made of words and a link; current mail programs do not run a program because you opened a message. The risk is in what you do next:

• clicking the link
• typing your password
• installing what a page offers

If you opened the message and closed it, delete it and use the Report phishing button. If you opened an attachment, which this message did not have, the situation is different and a full scan is worth running. For the message in this guide, only the link matters.

Look at the sender's domain first. Facebook says its mail comes only from fb.com, facebook.com, facebookmail.com, instagram.com, meta.com and metamail.com, or subdomains of them. Then confirm that Facebook sent it: open facebook.com/recent_emails/security, or Settings & privacy > Settings > Accounts Center > Password and security > Recent emails.

Security e-mails of the last year are listed there. Never trust a team name or a postal address in the footer, and remember that Facebook will never ask for your password in an e-mail or send one as an attachment.

Send it to phish@fb.com, which is the address Facebook gives for suspicious e-mails and messages that claim to come from it. Also use the Report phishing option in your mail program: in Outlook choose Report > Report phishing, and in Gmail open the three-dot menu and pick Report phishing.

Then delete the message. If you lost money, call your bank, and if you believe a crime was committed, Facebook recommends telling local law enforcement. Do not open attachments or links while reporting.

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For Facebook Suspension virus, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.