I got hijacked through a TeamSpeak3 invite for Team Fortress 2

[Plutonian Prime]

So I got an invitation from some random to join him in a competetive round of TF2 and join a room via TeamSpeak3, I'm a huge tf2 player and I thought it was a bit surprising, but nothing too suspicious, seeing as how he had a relative active profile, with games and playtime, so I joined, but it turned out I had "missing audio files".

And I haven't used TeamSpeak in ages so I was like "yo man it says my audio files are missing", and he was 'kind' enough to provide me with trojan files that corrupted my steam client, hacked my email, changed my assigned telephone and removed my authentificator. And I know I was totally dumb for falling for that, but I really was not familiar with this type of scam.

Now, I quickly managed to change passwords on email, delete all steam files, quickly contacted the Steam Support and they managed to recover my account within a day, which was very nice and I appreciate that.

Now, the part that I need help with - I'm not sure what they did with my account. All my items are there, no my money was spent, no weird activity or anything. Is there like a way to make sure everything is safe? Or any tip on fully getting rid from the trojan files? I'm not sure wether or not they were in my system still, cause Kaspersky said it was totally clean, but then I manually found the damned audio folder myself, I'm even paranoid about re-downloading the client...

[DirtyFishy]

Well you could always wipe your system.

[mimizukari]

Buy MBAM and your choice of top tier anti virus (kaspersky/bitdefender), run full scans with both including a rootkit scan, and leave them on with their live protection, since if you fall for anything like this, you need live protection modules.

[Plutonian Prime]

Publicado originalmente por DirtyFishy:

Well you could always wipe your system.

I mean that's a bit extreme, any other tip lol?

[Plutonian Prime]

Publicado originalmente por Shiki Ryougi:

Buy MBAM and your choice of top tier anti virus (kaspersky/bitdefender), run full scans with both including a rootkit scan, and leave them on with their live protection, since if you fall for anything like this, you need live protection modules.

Hey I was tired, and had no idea how to use teamspeak, I only ever used discord, I swear this is like the first time my account ever got hijacked, I usually don't fall for these...

But yeah thanks for advice

[mimizukari]

Publicado originalmente por Headless Horsemann (Blade):

Publicado originalmente por DirtyFishy:

Well you could always wipe your system.

I mean that's a bit extreme, any other tip lol?

No, it's not extreme, anti virus can't pick up everything, you SHOULD do a full reformat.

[Capii]

I had something very similar to this. He told me to download missing textures, and it turns out that what i downloaded was a R.A.T (Remote Access Trojan). I Wiped my system about 2 times. I am still paranoid.

[Plutonian Prime]

Publicado originalmente por Shiki Ryougi:

Publicado originalmente por Headless Horsemann (Blade):

I mean that's a bit extreme, any other tip lol?

No, it's not extreme, anti virus can't pick up everything, you SHOULD do a full reformat.

Yeah, I guess you're right, buddy. Better safe than sorry! Thanks, man, you're so supportive and motivational, I really dig that about you!

[mimizukari]

Publicado originalmente por Donk:

I had something very similar to this. He told me to download missing textures, and it turns out that what i downloaded was a R.A.T (Remote Access Trojan). I Wiped my system about 2 times. I am still paranoid.

and the absolute safest bet, is to buy a new hd entirely. seriously, viruses are malicious, but only a very rare few survive a reformat.

also RAT -> Remote Administration Tools

[Capii]

Publicado originalmente por Shiki Ryougi:

Publicado originalmente por Donk:

I had something very similar to this. He told me to download missing textures, and it turns out that what i downloaded was a R.A.T (Remote Access Trojan). I Wiped my system about 2 times. I am still paranoid.

and the absolute safest bet, is to buy a new hd entirely. seriously, viruses are malicious, but only a very rare few survive a reformat.

Well I mean, If HE was the one who "made it" could it really be that bad?

[mimizukari]

Publicado originalmente por Donk:

Publicado originalmente por Shiki Ryougi:

and the absolute safest bet, is to buy a new hd entirely. seriously, viruses are malicious, but only a very rare few survive a reformat.

Well I mean, If HE was the one who "made it" could it really be that bad?

yes? because he didn't make it, most likely, tons of tools out there for scriptkiddies to send and off the top of my head I can think of three major rats that bypass practically everything.

[Plutonian Prime]

Publicado originalmente por Shiki Ryougi:

Publicado originalmente por Donk:

Well I mean, If HE was the one who "made it" could it really be that bad?

yes? because he didn't make it, most likely, tons of tools out there for scriptkiddies to send and off the top of my head I can think of three major rats that bypass practically everything.

So should I get a new hd then too lol?

[mimizukari]

Publicado originalmente por Headless Horsemann (Blade):

Publicado originalmente por Shiki Ryougi:

yes? because he didn't make it, most likely, tons of tools out there for scriptkiddies to send and off the top of my head I can think of three major rats that bypass practically everything.

So should I get a new hd then too lol?

run a scan with malwarebytes anti-malware, rogue killer, adware cleaner(also from mbam peeps), and then post your situation on bleeping computer forums, they'll walk through a total cleaning if you have anything left infected. @donk you should also check bleeping computer forums and explain your situation, they have lots of people who help.

[Plutonian Prime]

Publicado originalmente por Shiki Ryougi:

Publicado originalmente por Headless Horsemann (Blade):

So should I get a new hd then too lol?

run a scan with malwarebytes anti-malware, rogue killer, adware cleaner(also from mbam peeps), and then post your situation on bleeping computer forums, they'll walk through a total cleaning if you have anything left infected. @donk you should also check bleeping computer forums and explain your situation, they have lots of people who help.

Wow, man, you're like a total expert! Thanks, bud! You're really the greatest, y'know that? You could probably even make this a paid consultation service, you're doing such a great job explaining this in great detail!

[Plutonian Prime]

btw, it might help people to know, that if you think your steam client is being weird - when it promts you to enter your steam guard code - it'll appear as though its in a scratchy font or just look unusual, that's a clear sign your info is being phished!

[Muppet among Puppets]

Publicado originalmente por Headless Horsemann (Blade):

and removed my authentificator

Where did you store the recovery code?