+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: Steam is trying to be stolen (/showthread.php?tid=3633223)
Steam is trying to be stolen - kannibleklown - Jul 19, 2013
As the title says, I have been getting emails from steam guard saying someone is trying to get onto my account, and they need the code. Now every time I have changed my password, I don't save it anywhere, nor do I ever enter it anywhere other then steam itself. I just don't know what to do, they always seem to get my password no matter how long and complex my password is. Now I don't think this is a rat, or a keylogger of any sort, because if it was i would assume they would be able to get my email address and password in order to finish the process of obtaining my steam, but I use Gmail and I constantly check the "recent activity" tab and nothing is ever there but my own ip. If anyone could help at all that would be greatly appreciated.
* - Spacе - Jul 19, 2013
Just to see if there is no FUD infections run a Quick Scan with malwarebytes then report back with the log it makes.
* - Slizza - Jul 19, 2013
If this keeps happening in the future after you've solved it I recommend setting up a two key encryption and making sure your steam is hooked up to a gmail (Gmail has a bit encryption of over 200 as sites like hotmail have as little as 32.) Then after you've done that select two key encryption and insert your phone number.
What this does is when an un-authorised computer tries to access steam it asks your phone for confirmation if you text back saying it's not authorised they will lock your steam until you log in.
Works like a charm.
* - Zestful - Jul 19, 2013
change your password , run a Quick Scan with malwarebytes
* - kannibleklown - Jul 19, 2013
(Jul 19, 2013 10:50 PM)Spacе Wrote: Just to see if there is no FUD infections run a Quick Scan with malwarebytes then report back with the log it makes.
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Database version: v2013.07.20.01
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Rental City :: KANNIBLEKLOWN [administrator]
7/20/2013 2:00:36 AM
mbam-log-2013-07-20 (02-00-36).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 212862
Time elapsed: 2 minute(s), 39 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
* - Tutelary - Jul 19, 2013
If you don't use it yet: Get Keyscrambler. It's likely there is some sort of RAT/keylogger on your computer and it's repeatedly getting your password. Using a Keyscrambler will scramble your keylogs and if there is indeed malware on your computer, when they attempt to view keylogs, they'll get scrambled, undecipherable text. I use it ever since I got my account stolen, and it works wonders.
* - kannibleklown - Jul 19, 2013
(Jul 19, 2013 11:05 PM)Lakai Wrote: If you don't use it yet: Get Keyscrambler. It's likely there is some sort of RAT/keylogger on your computer and it's repeatedly getting your password. Using a Keyscrambler will scramble your keylogs and if there is indeed malware on your computer, when they attempt to view keylogs, they'll get scrambled, undecipherable text. I use it ever since I got my account stolen, and it works wonders.
If it was the case that I had a RAT/keylogger wouldn't they be able to get access to my email also in order to complete the theft?
* - Truth - Jul 19, 2013
Its prob a steam logger.
I recommend to get Comodo firewall and see if anything is connection to your PC
* - Tutelary - Jul 19, 2013
(Jul 19, 2013 11:17 PM)kannibleklown Wrote: If it was the case that I had a RAT/keylogger wouldn't they be able to get access to my email also in order to complete the theft?
Most email providers have 2 step verification. If you have this, then it likely stopped it. But still.
* - kannibleklown - Jul 19, 2013
(Jul 19, 2013 11:26 PM)TryAgain Wrote: Its prob a steam logger.
I recommend to get Comodo firewall and see if anything is connection to your PC
Did this, and didn't notice anything suspicious.
* - Spacе - Jul 20, 2013
Nothing found in your logs, I could give a check over Teamviewer if you would like. Other whys, Run a scan with the follow.
* - Panthers - Jul 20, 2013
If you end up not finding anything and its not a Rat or what not it could be someone you know. If I was you I would change your password and not let anyone know or see you enter it. Just select remember password before you login to steam so you will not have to type it anymore. You could also download a key scrambler.
* - Shadow Walker - Jul 21, 2013
Run Wireshark to see any out going connections