Trojan Detected while steam tried to open a site

[Morggin]

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 9/28/19
Protection Event Time: 2:14 PM
Log File: f2f079dc-e234-11e9-a6ac-bc14ef65ed9e.json

-Software Information-
Version: 3.8.3.2965
Components Version: 1.0.627
Update Package Version: 1.0.12685
License: Premium

-System Information-
OS: Windows 10 (Build 18362.356)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Category: Trojan
Domain: steam.naeu.qtlglb.com
IP Address: 157.185.145.132
Port: [61412]
Type: Outbound
File: \\.\Globalroot\Device\HarddiskVolume7\Steam\Steam.exe



(end)

[Morggin]

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/resources/registry/whois/tou/
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/
#
# Copyright 1997-2019, American Registry for Internet Numbers, Ltd.
#


NetRange: 157.185.128.0 - 157.185.191.255
CIDR: 157.185.128.0/18
NetName: QUANTIL-NETWORKS
NetHandle: NET-157-185-128-0-1
Parent: NET157 (NET-157-0-0-0-0)
NetType: Direct Allocation
OriginAS: AS54994
Organization: QUANTIL NETWORKS INC (QN-21)
RegDate: 2016-06-28
Updated: 2017-08-17
Ref: https://rdap.arin.net/registry/ip/157.185.128.0


OrgName: QUANTIL NETWORKS INC
OrgId: QN-21
Address: 1840 Enterprise Way
City: Monrovia
StateProv: CA
PostalCode: 91016
Country: US
RegDate: 2017-07-10
Updated: 2018-04-18
Ref: https://rdap.arin.net/registry/entity/QN-21


OrgAbuseHandle: ABUSE7085-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: [phone]
OrgAbuseEmail: [e-mail]
OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE7085-ARIN

OrgTechHandle: NETWO8505-ARIN
OrgTechName: Network Support
OrgTechPhone: [phone]
OrgTechEmail: [e-mail]
OrgTechRef: https://rdap.arin.net/registry/entity/NETWO8505-ARIN

OrgNOCHandle: NETWO8505-ARIN
OrgNOCName: Network Support
OrgNOCPhone: [phone]
OrgNOCEmail: [e-mail]
OrgNOCRef: https://rdap.arin.net/registry/entity/NETWO8505-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/resources/registry/whois/tou/
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/
#
# Copyright 1997-2019, American Registry for Internet Numbers, Ltd.
#

[Zekiran]

What exactly are you trying to link to?

Because Steam doesn't carry viruses of any kind.

Where did you get this link on steam? Did someone send it to you?

[墓后煮屎💩者]

it's kind of kidding

[Morggin]

My Antivirus reported it when i tried to connect while it was down at 2:15 or so today.

[Zekiran]

Originally posted by Morggin:

My Antivirus reported it when i tried to connect while it was down at 2:15 or so today.

Again that doesn't even begin to answer my question. What link? Connect to Steam while it's down? Nope, if that was the case there would be tens of thousands of this same thread.

Also again: steam is not a virus, so I'd strongly suggest you whitelist steam from your virus scan anyway.

[Muppet among Puppets]

Originally posted by Zekiran:

Also again: steam is not a virus, so I'd strongly suggest you whitelist steam from your virus scan anyway.

If you do that, make sure it is the real steam exe......

[Zekiran]

Originally posted by Muppet among Puppets:

Originally posted by Zekiran:

Also again: steam is not a virus, so I'd strongly suggest you whitelist steam from your virus scan anyway.

If you do that, make sure it is the real steam exe......

Well that, yes. The OP indicated it was a "link". Which is in no way, Steam.

[Muppet among Puppets]

Originally posted by Zekiran:

Originally posted by Muppet among Puppets:

If you do that, make sure it is the real steam exe......

Well that, yes. The OP indicated it was a "link". Which is in no way, Steam.

The origin of that connection was a steam exe.
I do not recognize the path it is in. So it must be checked if that is the steam exe in the intended steam folder

[Crashed]

Originally posted by Muppet among Puppets:

Originally posted by Zekiran:

Well that, yes. The OP indicated it was a "link". Which is in no way, Steam.

The origin of that connection was a steam exe.
I do not recognize the path it is in. So it must be checked if that is the steam exe in the intended steam folder

And not some dodgy hack.

[Dr.Shadowds 🐉]

OP mind answering Zekiran questions.

Because there's a lot of gray area with your story.

[Zekiran]

Yeah still: clicking to open Steam *does not and has never* involved "a link" to some shady website.

OP has never stated WHERE that site was attempting to be opened from, how they reached that link, or anything else.

I'm guessing they got some chat or popup from an already existent malware on their rig, because... like I said, if this was something that had been sent from Steam - literally ten million people would have noticed it like they did in the rest of the forums over the last 18 or 20 hours...

[Muppet among Puppets]

Originally posted by Zekiran:

Yeah still: clicking to open Steam *does not and has never* involved "a link" to some shady website.

OP has never stated WHERE that site was attempting to be opened from, how they reached that link, or anything else.

I'm guessing they got some chat or popup from an already existent malware on their rig, because... like I said, if this was something that had been sent from Steam - literally ten million people would have noticed it like they did in the rest of the forums over the last 18 or 20 hours...

Random links do not open with steam.
A steam exe connected to that url.
While steam was down......

Originally posted by Morggin:

My Antivirus reported it when i tried to connect while it was down at 2:15 or so today.

[Morggin]

Look guys i'm just reporting that my Antivirus Malware Bytes reported some activity related to Steam. Take it as you see it presented and consider Antivirus for your machines. I don't understand why Malware Bytes flagged 4 such events when the service was down. For all i know they may be false positives, But it seemed rather strange that my AV starts reporting this stuff and low and behold steam was trying to connect to Domain: steam.naeu.qtlglb.com which looks suspect in my book. Which is why i also posted a whois lookup on the IP it resolves to.

[cSg|mc-Hotsauce]

And here I was on the whole time and my MBAM premium said nothing. Full scan with archives yesterday and nothing

[Morggin]

Here is another from 2:19 PM on 9/28/2019 at around the time Steam stopped responding.

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 9/28/19
Protection Event Time: 2:19 PM
Log File: 977c6560-e235-11e9-98be-bc14ef65ed9e.json

-Software Information-
Version: 3.8.3.2965
Components Version: 1.0.627
Update Package Version: 1.0.12685
License: Premium

-System Information-
OS: Windows 10 (Build 18362.356)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Category: Trojan
Domain: steam.naeu.qtlglb.com
IP Address: 157.185.145.132
Port: [61775]
Type: Outbound
File: \\.\Globalroot\Device\HarddiskVolume7\Steam\Steam.exe



(end)