ALERT: Steam Accounts Phished

KillerZebra

KillerZebra

Forum Admin
Contributor
Some of our admins and members have gotten their accounts hacked and are now sending out links to everyone on their friends list containing a link to dropbox and a message "explain these pictures".

This link contains a zipped file with 2 .scr-files, which are executable and will install one or more trojans on your computer.

We will never add someone and send them a link to download something.

We advise you to not open the .rar-file. If you do, you will risk your account getting hacked. Please ignore the Steam Message.

Remember, Skial will never send you a link to download something. You should not trust an admin, or anyone, with a link where you should download a file.

This phishing attempt is not secluded to Skial, it has been seen all over Steam. This is just a friendly warning from Skial.


If you already fell for this phishing attempt, please do the following.
1. Disconnect from the internet
2. Run a virus scan (I suggest Malwarebytes)
3. Navigate here C:\Users\<account>\AppData\Roaming\DClogs and delete it.
I believe this is where the hack hides, I am not 100%.​
4. Change your password to Steam, and your email.
5. Contact Valve
 
Last edited:
KillerZebra

KillerZebra

Forum Admin
Contributor
Most likely not. But I would do steps 1,2,3 just in case. If you virus scanner comes back with something, do step 4.
 
SarcasticWisdom

SarcasticWisdom

Australian Skial God
Contributor
KillerZebra said:
Most likely not. But I would do steps 1,2,3 just in case. If you virus scanner comes back with something, do step 4.
Click to expand...

Did scan and didn't have that folder so I'm assuming I'm good, changing my password as this posts


and if i do get hacked, the most valuable thing in my inv is worth a key or two
step up ur game hackers
 
KillerZebra

KillerZebra

Forum Admin
Contributor
You should be fine.

I got hacked yesterday. But I was still logged into my account, So i reacted in time to save it. (i hope) I logged out last night and i successfully logged in today.

What happened was I changed my password, but It wouldn't let me log into my steam account online. (ex. steam community from browser). When I typed in my password, it said invalid. I deleted the C:\Users\<account>\AppData\Roaming\DClogs and suddenly I could log in again. With the password I used before. That is why I think the trojan hides out there. But It might of just of been a coincidence.

Someone else who got phished said he had that location and deleted it. While someone who didn't get phished didn't have it. Another reason why i think it lives there.
 
Toxik

Toxik

Moderator
Contributor
Quick question, can your account get hacked even if you didn't click any suspicious link?
 
KillerZebra

KillerZebra

Forum Admin
Contributor
Well yeah but the person would really need to know what they are doing. I doubt someone who could do that would waste their time on Steam accounts
 
[YDEK] fi$hy k!tty

[YDEK] fi$hy k!tty

Rage-Inducing Forum Troll
Contributor
I got this last night from Soapy :\

Rue and Sarcasm helped me sort it out, and it looks like I still have my account. Malwarebytes found stuff in folders similar to what Zeebs said, and while they're all gone now, I hope I'm not being followed around by a keylogger or some kind of remote access thing D:
 
111111

111111

Legendary Skial King
Contributor
[YDEK] fi$hy k!tty said:
I got this last night from Soapy :\

Rue and Sarcasm helped me sort it out, and it looks like I still have my account. Malwarebytes found stuff in folders similar to what Zeebs said, and while they're all gone now, I hope I'm not being followed around by a keylogger or some kind of remote access thing D:
Click to expand...
That's exactly what I'm fearful of. Anyone know if it be possible for a keylogger or something similar to be implanted and remain undetected in some fashion?
 
FireGame

FireGame

Positively Inhumane Poster
Yeah, I saw this too... and unfortunately dl'ed it. My comp couldn't figure out how to open it though, will it still be a problem? (I'm running a scan either way, and I'll be changing my steam pw when it's done...)
 
Drum

Drum

Australian Skial God
Contributor
Mapper
I would recommend using
SasnarDash said:
That's exactly what I'm fearful of. Anyone know if it be possible for a keylogger or something similar to be implanted and remain undetected in some fashion?
Click to expand...
You can do a boot-time scan if you want. Malwarebytes + Spybot S&D should pick up pretty much everything, unless you have something far more serious.

FireGame said:
Yeah, I saw this too... and unfortunately dl'ed it. My comp couldn't figure out how to open it though, will it still be a problem? (I'm running a scan either way, and I'll be changing my steam pw when it's done...)
Click to expand...
You should be changing every single password anyways due to Heartbleed.
 
Pengy

Pengy

Legendary Skial King
Interrogator said:
Wow I'm just a little surprised at how many people around here fell for this
Click to expand...
It's honestly a force of habit. Whenever I see any kind of link, I always have to physically pause and not click on it, because it's just so natural for me to open something right away. That's why the box that says you're going to a potential threat is alwasy nice to have on. DL'ing things is a whole other thing though.
 
Genocide

Genocide

Legendary Skial King
Contributor
mittens said:
You can download detailed instructions on how to remove this virus from your PC as well as simple malware removal tool here [unsafe link removed]
Click to expand...
WARNING!! DO NOT FOLLOW LINK FROM MITTENS!!!

It is incredibly suspicious that he posted the same exact thing 3 times.
This is most likely another attempt at phishing more accounts.
 
mittens

mittens

Gaben's Own Aimbot
Contributor
Genocide said:
Why does your link text there not match the destination of your link?
Click to expand...
It's safe to click.

When the popup appears just hit "Accept" then when it asks to run as a system administrator click "Yes."

Then the program will run through and clear out any malicious software.
 
  • Like
Reactions: JohnnyGaloshes
You must log in or register to reply here.
Top Bottom