Print

Add to Reputation:  

What do you think of this post?

I agree I disagree  
Comment:

[RogerMooreSucks]

Hello everyone. There is a new virus going around and it is pretty serious and i feel obligated to tell you all. This is how it works. There's a link, that APPEARS to end in ".png", under the pretense of your friend sending you a screenshot. If you click this link, it will download a .scr file, which will hijack your steam account. Your steam account will start to send the same link to your friends.

What to do Don't click links ending "sshot721.png", or any link from "screen-lighting" website. This is the only website they are using at the moment, so it's the one you should definitely not click. They may start using other websites though, so be vigilant.

Turn on Download Notifications in Chrome. Chrome has a feature which will ask you if you want to download a file, before downloading it. By default, this is OFF. You can turn this feature on by going to "Settings", "Advanced Settings", and clicking the checkbox on "Ask where to save each file before downloading." This feature is enabled by default on Firefox.

I almost fell victim to it along with Graslu and ESP Hawaiian. Be vigilant people.

Ask your friend if they sent that link In a lot of cases, the friends have managed to retain access to the account. Since it is automatic, ask your friend if they sent the link to you. If they say no, then you know they are infected. If they do not answer, presume the same."

[Graslu]

But who said I almost fell for it? :0 I DIDN'T.

[RogerMooreSucks]

But who said I almost fell for it? :0 I DIDN'T.

You can't lose.

[killermonkey]

Good find Roger, thanks for sharing. I'm surprised scr viruses still exist! That is so windows 95.

[Rodney 1.666]

Much appreciated.

+1

[Mangley]

Just to add, it's not only .png, I've also seen .jpg used. I assume any URL can potentially redirect to a .scr file.

If you're in any Steam groups such as CSGO, DOTA 2 or TF2, you will probably find yourself targetted more frequently as phishers browse the user group's member pages targetting players for their valuable inventory items.

A lot of bot accounts won't have a profile set up and the username will be [unassigned]. Chances are if a random person adds you it's a phisher.

[Kratos]

Sigh, another reason I need to switch to Linux

[namajnaG]

Sigh, another reason I need to switch to Linux

As long as you remain wary, you shouldn't have much problems.

[Troy]

I had this happen today and I can confirm that it's real.

[Enzo.Matrix]

So the simple answer is to not have any friends.

[Emilia]

I'm not sure if it is a new thing, but yesterday, the virus had two friends leave dodgy links on my Steam profile.

[Wake[of]theBunT]

Err... Weird. Is not logging on in a while providing a safety? I want to keep my 6 digit

[Rodney 1.666]

There seems to be a new variant of this, linking to a "screenshoters.com" in chat.

[Graslu]

Err... Weird. Is not logging on in a while providing a safety? I want to keep my 6 digit

You can keep it.  The only way to get your account "infected" is by downloading the file they send you (scammers or infected friends). Some of these will steal your CS:GO inventory AND send the message to every online friend, sometimes it's just the message,  so I guess it does something outside Steam,  too.

If you get any message like "hey u need it?  - scammerwebsite" or "WTF - anotherweirdpage" just tell your friend and delete the comments. Normally these messages are written like that, so it's easy to spot.

[Mangley]

If you haven't already done so make sure to verify your email address and enable Steam Guard in Steam's settings. This will make it so any computers that try to log into your Steam account will require email verification before being allowed to continue, you can also revoke access to machines that already have access through this system.