Virus in Steam - as GIFT

[Thanos]

Today I get a GIFT form user named CASINOMAN. Its a Virus, what blocked my PC, and ordered me to pay cca 100 USD to unlock. The pc cannot be started normally, the virus is always active and blocking my PC.

I ask Steam Team to take steps against it!

I wil make steps in the Police Department.

Please inform me what will happen and how will you solve this serious problem!

Tahnks

[Thanos]

This is what I got. Started automatically. (yes I have up-todate virus scenner):

"Your friend Casinoman has given you a gift subscription to the game Dota 2 on Steam, the leading digital distribution platform for PC games. Steam lets you purchase full retail versions of games delivered straight to your desktop, complete with automatic updates and in-game community features. Take a tour of Steam to learn more."

Once again: It is a VIRUS, what destroyed my PC, with a very dangerous attention the I have to pay to unlock my PC.

[Sloppy Seconds]

If you don't know somebody and they are just giving you something out of the blue, why would you accept it? But whatever, do follow up with the proper authorities on the matter, since this person is trying to extort you.

[krystianpants]

I believe they call it "virtual" natural selection.

[Spawn of Totoro]

A virus can not be sent through Steam. You don't recive any file from someone, it is downloaded from Steam directly.

You get a virus from somewhere else.

http://lifehacker.com/5962320/how-to-get-rid-of-a-virus-even-when-your-computer-wont-boot?utm_source=kotaku.com&utm_medium=recirculation&utm_campaign=recirculation

There are links there where you can download and burn an AV disk (use a diffrent computer). You can set your computer to boot from the disk and it will load and scan. It bypasses the OS so the viruse won't run and you can clear it out.

[Sloppy Seconds]

Originally posted by Spawn of Totoro:

A virus can not be sent through Steam. You don't recive any file from someone, it is downloaded from Steam directly.

You get a virus from somewhere else.

http://lifehacker.com/5962320/how-to-get-rid-of-a-virus-even-when-your-computer-wont-boot?utm_source=kotaku.com&utm_medium=recirculation&utm_campaign=recirculation

There are links there where you can download and burn an AV disk (use a diffrent computer). You can set your computer to boot from the disk and it will load and scan. It bypasses the OS so the viruse won't run and you can clear it out.

In all honesty, if this guy is trying to get money from him, he should really be going to the police.

[Thanos]

A virus cannot be sent....its seems it can! Thats why I wrote it here!

(btw, the name of the virus is DOTA 2!---funny, eh?)

[Thanos]

Sloppy!, Yes, I will. But Steam should do something too! We dont need this kind of users! Or if so, then I dont need Steam...!

[Spawn of Totoro]

No one can send or recive files through Steam. Any files you download are from Steam an virus free. You got it from somewhere else.

What files are vailable from users (mods) are not files that can contain a virus.

[Dipl.-Ing. Weird]

I think you're quoting an e-mail message that was made to look like it was sent from Steam (or via Steam). Just as banks can't prevent phishing messages pretending to be from them, Valve cannot prevent people making fake e-mails that are nearly identical to those of Steam.

[Silv3r9]

"ransomware" can infect your computer through Java or Adobe applications (even skype worms) and attach itself to one of your programs and make it look like a legitimate company is demanding you pay money to unlock your PC. It's actually a huge scam operation for what I read (I had no idea about this until today) o.O

There is a video on one of the anti-virus sites that explains what this crap is and how to get rid of it (and how to avoid getting it in the first place/again).

[Araxis]

You did not get this through Steam. You got it from an e-mail that was dressed up to look like Steam. Steam has nothing to do with this. You were stupid and now you're paying for it. Learn how to identify scams and phishing links.

[KeumFlyWithMe]

Seriously you're not getting anywhere, you know what helps? POST A SCREENSHOT, GIVE US A LINK TO THE SCREENSHOT OF STEAM BEING RESPONSIBLE. thank you

[Thanos]

Originally posted by Sean Pickett:

Seriously you're not getting anywhere, you know what helps? POST A SCREENSHOT, GIVE US A LINK TO THE SCREENSHOT OF STEAM BEING RESPONSIBLE. thank you

OK! Seriously: how to upload here a screenshot of the email, waht conatins the steam message?

[Satoru]

Do a prnt-screen then use any one of a dozen image hosting sites. flickr works fine

However it really isn't relevant you need to do the following:

1) Ensure SteamGuard is enabled on your account
2) Use yahoo/gmail
3) Use SMS authentication on yahoo/gmail. Or use google authenticator with gmail
4) Ensure you email password is COMPLEX and NOT REUSED anywhere on the Internet
5) Save off all your data
6) FORMAT YOUR COMPUTER
7) Install anti-virus BEFORE YOU GET INFECTED
8) Be more wary of phishing links.

[Thanos]

Originally posted by Dr. Weird:

I think you're quoting an e-mail message that was made to look like it was sent from Steam (or via Steam). Just as banks can't prevent phishing messages pretending to be from them, Valve cannot prevent people making fake e-mails that are nearly identical to those of Steam.

Oh mate! The story is quite simple:

- Yesterday I started to play Black Ops 2. When I entered the game, I got a message (in the game) via Steam: "One of your friend sent you a GIFT. Do you want accept it?" The name of the gift is: Dota 2.
- Well, its really a name of a game. So I accepted the gift, because a "Friend" had sent me, and becasue Steam is a thrusted application on my Windows 7 PC.

- I played BO2 for a while, and I have left the game to desktop.

- I opened Internet Explorer, and opened en official Hunagrian site (the biggest news site in HUN).

- And suddenly my screen disapeared, and I got a whole-screen message, something like this:
"In the name of the Hungarian Police Department we LOCK your PC (IP: xxxxx), becasue you have illegal data on your PC. If you want to UNLOCK, then you have to pay 25.000.- HUF (cca 100 USD) to bla-bla-this-and-this-bank account number. If you dont pay, you will have 400.000.- penalty, or jail."

Some times a message box apeared: "rundll32.exe want to access your user profile. Do you accept it?"

Of course I ansared: NO!

So....I think this is really a criminal situation, and I will do everything against it.

And why am I cring here? Because the message was this (via Steam), by my "friend":

"Hello, now I damn you a Virus, named Dota 2! :D Surprise!"

Watch the smile!

After all, that screen cannot be deleted/destroyed, did not disapeared. Taskmanager could not be run. Alt+Ctrl+Del worked, but taskmanager apeared only for a half second, then disapeared, so the task could not be stopped. Virus cleaners cannot disable, because the command was something like this: rundll32.exe mndmnmdndndmnd.exe. and Virus cleaner watch only the rundll32.exe, what is legal windows software.

After restarting the PC, the screen still appear, and still cannot be deleted.

Thats all of my story.

Is can show the picture of hte email, what Steam sent me, conaining the attention, that I got a GIFT.

So...whats now? Police already involved. But what will steam do against this kind of attacks, and against this kind of users?

btw: the name of that user is: CASINOMAN

This is Steam user.