Hijacked Account; Items lost

[Mr Nice Guy]

So... please don't say "Tell Steam Support".

I already have, exactly one week ago (give or take a few hours), and have waited patiently. However, I started to lose patience around ~Monday and am very worried I've lost my items for good...

I changed my password after scanning my PC for viruses (found one, removed it) but I already had SteamGuard etc. up...

I've provided proof of my account and, until yesterday, my items had not left the person's inventory. No, I didn't trade someone. I got phished (stupid of me to click a link, eh?) so yeah...

Anyway, the items have gone now, and Steam still haven't replied. Am I right in thinking I have now lost all my items, since they can't "reverse" the trade or whatever they do? I provided picture evidence with all the items lost, including the player's name, but as said he/she no longer has the items...

Also, how long does it normally take for Steam to reply? I searched around, people were saying Hijacked accounts are either very soon, or take a week or so to reply to. I already submitted everything before the Bot mail (SteamSupport bot) told me to change my email/password & provide account ownership for my account... Is there something I've done wrong?

Thanks, Dan

[kain]

wow. im a 3rd year computer science major..... did you even read my post? for ♥♥♥♥♥ sake...

i said ive ran 5 different scanners.... INCLUDING MALWARE ANTIBYTES!!!!
hitman pro
currently running avast.

i had to plug in a hard drive into my system. i didnt download ♥♥♥♥.

[Barney Calhoun]

also clean your HOSTS file by going to C:\Windows\System32\Drivers\Etc and open the file named "HOSTS" as administrator with a text editor. It should look like the following(between the quotations):
"
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost
"

If it does not look like this, remove everything inside the old hosts file and put this^ in(everything between the quotes).

[kain]

i think you forgot to read this.."ive ran at least 5 different anti-viruses, rootkits ETC.... none of them really scan steams web browser. "...

scanners ARE NOT picking it up. this is some other type of ♥♥♥♥♥♥♥♥♥.

ive looked in my start up programs, all over MSCONFIG, and running services, and running programs. nothing jumps out at me.

im not your average PC user.

ok, were getting somewhere. ill try that

[kain]

HOSTS file is the same as yours.

[kain]

ive got a 256 gig SSD as my C drive
i HAD a 2 tera WD black i used for steam games and steam it self.... it JUST failed (probably because of this damned virus) so it is now out of my system.
and ive got a 1 tera WD blue.

a few virus scanners (malware anti bytes IIRC) do not scan all drives. and to really get a good scan, the files need to be being used by windows. if the file is on my WD blue... im screwed.

im going to try to copy all my important ♥♥♥♥ to my WD blue drive. then unplug it.
if i still get the issues.... ill just reformat my SSD. no problems.

but if i unplug the WD blue and no longer get any problems.... well, its not going to be fun.

[ATM]

badge

[kain]

but ya. the forst thing i ran was mbam. normal and chamilion or whatever their hidden stuff is.

sorry for jumping on ya.... this is just dumb as heck.

[Barney Calhoun]

I'm not sure how to proceed here and I've unfortunately got something going on right now, but at least turn off Windows "Autorun" and "Autoplay" features. They instantly execute anything inside a drive you insert without asking for your consent.

In MBAM you do have the option of selecting a drive to do a deep scan on.

[kain]

well avast is doing everything i could tell it to do (rootkits, memory stuff) and i made it even scan my USB thumb drives.

[Rain Man]

ok

[Satoru]

Format the drive if multiple AV products cant find the infection it's a lost cause to 'fix'.

All you'll ever be able to say is that AV prodcuts couldnt find the infection, not that your system is clean.

Nuke it from orbit and call it a lesson learned.

[kain]

ya, after re-installing it still did the same damn thing..... redirected me from steam discussions to XXXXXXXXXXX

DO NOT CLICK THAT LINK! it tells you your flash player is outdated... it isnt, it will downlaod a virus.

anyway, after this scan gets done im going to try the "unplug non-system drive and re-format" method.

is their any way to look at what extensions the steam browser has? or to view its flash and java installations?

[Satoru]

Цитата допису Kain (420?):

ya, after re-installing it still did the same damn thing..... redirected me from steam discussions to

DO NOT CLICK THAT LINK! it tells you your flash player is outdated... it isnt, it will downlaod a virus.

anyway, after this scan gets done im going to try the "unplug non-system drive and re-format" method.

is their any way to look at what extensions the steam browser has? or to view its flash and java installations?

Can you remove the URL as it's not really necessary for anyone to see it and someone will likely click it.

Steam has no extensions and such realistically that you can look at. It runs of the Chromium Framework.

All the virus is doing is a javascript injection which is pretty standard fare for what you're seeing.

Likely it's sipmly 1 of a hundred things that your system is infected with though.

[Muppet among Puppets]

The safest and often fastest bet for safety is
format and reinstall.

Security is to prevent things from happening. Not just cleaning out the footsteps of intruders.

[kain]

well... if steam works off the chrome code... then why cant a fudge with chrome java/flash and fix it for steam? im not sure how it shares or works. (im not sure if i even like if it is this open to ♥♥♥♥♥♥♥♥ you cant find using scanners)

also. when it rediects me, i cant press the back button or do anything. it jsut "locks" steam up.

i say "locks" because i can click on my library. but my profile, store page, and community pages are locked down.

the URL bar updates... but the loading wheel just sits and spins and spins