[lux]

Spreader account(s) - http://steamcommunity.com/id/PolonskiTV http://steamcommunity.com/groups/PolosFans

Spreader may not be original owner, may of been the 'hacker' using compromised accounts.


Malwarebytes Scan - http://puu.sh/hgyp6/ed7913d02d.png

Trying to infect members through asking them to stand in for a CS:GO team, saying you'll be reward an AWP Asiimov. He gives you an IP to connect to and you get disconnect saying to download the anti-cheat (http://csgo-anticheat.com) upon downloading the exe from (https://docs.google.com/uc?id=0B5dFp2816...t=download) it restarts explorer.exe and steam.exe - this program replaces C:\Program Files (x86)\Steam\Steam.exe" with a trojan. it also replaces the uninstall keys for Steam Apps, along with HKU\S-1-5-21-3399925662-2895248853-3734835112-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Steam

DO NOT DOWNLOAD ANYTHING FROM THIS SITE. Please help in reporting this member for Suspected Hijaker and paste this information in.

This Trojan also modifies hosts (C:\Windows\System32\Drivers\etc\hosts) to include these:
27.0.0.1 store.steampowered.com
127.0.0.1 steamcommunity.com
127.0.0.1 mail.google.com
127.0.0.1 mail.ru
127.0.0.1 yandex.ru
127.0.0.1 yandex.ua
127.0.0.1 rambler.ru
127.0.0.1 ukr.net#

These block access to the websites, meaning you cannot change your password.

Email from steam regarding sign-in: Access from computer: 109.207.195.132 (UA)

Someone come witch hunting.

who.is on csgo-anticheat.com

Admin Name: Yuriy Andih
Admin Organization: Girm LTD
Admin Street: ul.Vilenda, 66, kv.21
Admin City: Kiev
Admin State/Province: MOSCOW STATE
Admin Postal Code: 07148
Admin Country: RU
Admin Phone: +380939952974
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: Email Masking Image@bk.ru

--- Who.is from steacommunity.com ---

Admin Name: Yuriy Andih
Admin Organization: Imergen LTD
Admin Street: ul.Vilenda, 66, kv.21
Admin City: Smolensk
Admin State/Province: Smolensk state
Admin Postal Code: 940660
Admin Country: RU
Admin Phone: +79147238862
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: girl_1990@mail.ua

Yuriy also owns get-screenshot.com, SteamCommunitCy.com, get-screen.com, and sTeaCommunity.com
I think this guy is running a little something.

Spoiler:

@Oni, @roger_smith

Mind moving this to serious discussion, please.

[roger_smith]

@lux moved. Good luck

[Alex]

Who the fuck would fall for this ...

[lux]

Who the fuck would fall for this ...

When a friend you've played with multiple times says "I need you to stand in for a tournament final" to me at 2AM, and I accept seeing the awp asiimov as a prize, and I go to connect to the game server and get disconnect with something like "failed to connect, required anti-cheat", and then after than I realised.

It's the fact it exists.

[ねこまっしぐら]

Dang it, I like calling people. But I do not have international calling. I'm here struggling :-(.

[lux]

UPDATE:

I don't think Polonski was behind this. I've spoken to and played with him before, he's British and had good English skills. When I was asked to play, the English was very broken and he appeared to not understand, I put this down to it being the early hours of the morning.

I think this Ukrainian guy is running it all, and signing into compromised accounts, and messaging their friends, rinse and repeat.

The real target here is "Yuriy Andih".

[rod]

Thanks for the heads up mate

[Sikom]

@rod please don't grave dig