About the .scr file - malware

[`ptzxc]

Will deleting this file and changing steam and email passwords enough?

[BetaSword]

Solidus1983 の投稿を引用：

Yep new one out. Heading to screen-pictures which is also a fake site. Runs the same pattern as most facebook scams i.e infects upon clicking link then fires the same link to everyone else in the friend lists. DO NOT CLICK THE LINK!

That's why I didn't include the entire Link in my initial post.

Also I've had over a dozen attempts of stealing Account-Informations from me, some Numbers that I remember:
Steam(3 times),Diablo3-Account(about 4 Times), Bank of America(5 Times, was never on the American Continent), as well as Post-Services(3 times).
Mu Online (1 time, Admittably a successful one, as it disguised itself as an official Site for some Bonus-Content)

The Very first attempt to steal my Steam-Account was "STEAM Support Herr Loders",. while the Name "Herr Loders" suggests to me that he's from Germany like me, all his words were written in english, as well as his attempt, with a Site, that he said would lett me add Games that I like for free to my Cart, then I should log in with my Steam-Login-Informations. Of Course my words right after these Lines showed how angered I was about that obvious attempt.
Well he seemed calm, and said that he would get me banned for my words.
After he ended his Chat-Session, I reported it directly to the Support here.

I've luckily managed to keep my eMails safe tough.

[Solidus1983]

I also haven't given the full link either to make sure no one can click it, I have now reported the domain to the Registra which happens to be OVH Systems as the Details for the owner looks to also be fake and hopefully something will be done about it.

[BetaSword]

Solidus1983 の投稿を引用：

I also haven't given the full link either to make sure no one can click it, I have now reported the domain to the Registra which happens to be OVH Systems as the Details for the owner looks to also be fake and hopefully something will be done about it.

Well, it doesn't matter how well he tries to mask himself.
Somewhere, the Provider(in this case: Google) of such sites like googleusercontent is actually keeping Informations on any uploads like the Virus-Upload, saving that one.
With that, it's possible to get that persons IP-Adress, and using that the Provider.
Provider+IP+Timeframe of the Upload=Actual User on that Provider, and where he lives.
Even if he's using a WLAN, you're most-likely to check his Hardware-IP(also known as MAC-Adress), and with that, it's possible to directly identify the Computer of the Uploader, directly linking the anonymous Links, shared across the internet with anyone having access to the specified computers and the hacker.

[Chocke_me]

this is treu

[Solidus1983]

lets just hope domain registra does something about it.

[Feffe]

ciao stronzoni scrivo questo messaggio per l'obbiettivo

[Solidus1983]

@fedej00 my italian is a bit rusty what to do you "i Write this message to the target?"

[TopFrenulumSex]

What exactly does the virus do?

[Oslith]

YUP. i got my cs:go weapons stolen and the guy is now selling everything he stole. GABEN! STEAM SUPPORT! WHERE ARE YOU!

[Miku]

thx

[Bt]

Hey man, i would not bother formatting your computer in my own opinion, but did you have malwarebytes running at the time you clicked on the srf file? Look at this. https://blog.malwarebytes.org/fraud-scam/2014/11/rogue-scr-file-links-circulating-in-steam-chat/
Malwarebytes is a full virus protector unlike what some people will tell you.

[BobTheSkrull]

Malware Bytes is kickass. A few of my friends have been 'sending' these to me too. Anyone know why people are sending these? My first guess is that they're accounts have been hacked or something, but I can't be certain. It seems odd that it's happening all at once.

Would password changing be a good idea anyways?

[Sir Skillzy]

It is best to take safety precautions with your Steam account. It is recommended that you change your Steam password and possibly your security details.
If you feel that your account has been tampered with, then you should contact Steam Support regarding your issue.

[kittysphynx]

The same happened to me. I'd recommend scanning the whole computer with the best antivirus available, change passwords, scan again. Then don't log in on important accounts for a few days.
PS: I didn't even know something like this exists before now. It means, I didn't click any links, but I got the same messages from my friend, and he claims I sent him one too. Though I can't see that message being sent by me, he's also the only one saying I sent a link like that.

[HLCinSC]

First, reset your password this will impose a 5 day restriction on your account for trading and the market preventing the guy from stealing your inventory.

Now, let's pick two good anti-malware removers. I will recommend one and let you research/choose the other. The first is malwarebytes. It is a good, reliable, free program that has a good track record. You can download it for free from https://www.malwarebytes.org/ . The second is your choice.

First, you are going to want to download and install and update them with the latest threat definitions. We are going to go ahead and do this because we are going to run them in Windows Safe Mode without networking (sometimes just called regular safe mode).

To find out how to put your computer in safe mode google it or follow the directions on this link: http://www.computerhope.com/issues/chsafe.htm . Windows 8 users can do it directly from the update/recovery settings by selecting advanced startup.

Windows Safe Mode without networking, will allow your computer to boot with just the essentials Windows needs to run. This will help keep any malware that may auto-start with Windows from doing so, which may keep it from repairing or replicating itself as it is removed/deleted. The "without networking" part prevents any of the malware from calling home and downloading or sending more data.

You are going to run the deepest scan possible for both programs (not at the same time though). Select it to scan for all kinds of threats in all drives, files, and folders. It should take a good while for each scan. Remove any threats unless you are sure they are false identifications.

Restart your computer (again in safe mode without networking), and run one of the scans one more time to make sure the threats were actually removed.

After you are confident your computer is no longer infected, change any passwords you may have entered since a couple of day prior to when you noticed the spam messages being sent.