+- Sinisterly (https://sinister.li)
+-- Forum: General (https://sinister.li/Forum-General)
+--- Forum: The Lounge (https://sinister.li/Forum-The-Lounge)
+---- Forum: Serious Discussion (https://sinister.li/Forum-Serious-Discussion)
+---- Thread: Legends WARNING CS:GO NEW HIJACKING TROJAN SITE (/Thread-Legends-WARNING-CS-GO-NEW-HIJACKING-TROJAN-SITE)
WARNING CS:GO NEW HIJACKING TROJAN SITE - lux - 04-17-2015
Quote:Spreader account(s) - http://steamcommunity.com/id/PolonskiTV http://steamcommunity.com/groups/PolosFans
Spreader may not be original owner, may of been the 'hacker' using compromised accounts.
Malwarebytes Scan - http://puu.sh/hgyp6/ed7913d02d.png
Trying to infect members through asking them to stand in for a CS:GO team, saying you'll be reward an AWP Asiimov. He gives you an IP to connect to and you get disconnect saying to download the anti-cheat (http://csgo-anticheat.com) upon downloading the exe from (https://docs.google.com/uc?id=0B5dFp2816GcMVGVuZ0N2T0dfRkE&export=download) it restarts explorer.exe and steam.exe - this program replaces C:\Program Files (x86)\Steam\Steam.exe" with a trojan. it also replaces the uninstall keys for Steam Apps, along with HKU\S-1-5-21-3399925662-2895248853-3734835112-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Steam
DO NOT DOWNLOAD ANYTHING FROM THIS SITE. Please help in reporting this member for Suspected Hijaker and paste this information in.
This Trojan also modifies hosts (C:\Windows\System32\Drivers\etc\hosts) to include these:
27.0.0.1 store.steampowered.com
127.0.0.1 steamcommunity.com
127.0.0.1 mail.google.com
127.0.0.1 mail.ru
127.0.0.1 yandex.ru
127.0.0.1 yandex.ua
127.0.0.1 rambler.ru
127.0.0.1 ukr.net#
These block access to the websites, meaning you cannot change your password.
Email from steam regarding sign-in: Access from computer: 109.207.195.132 (UA)
Someone come witch hunting.
who.is on csgo-anticheat.com
Quote:Admin Name: Yuriy Andih
Admin Organization: Girm LTD
Admin Street: ul.Vilenda, 66, kv.21
Admin City: Kiev
Admin State/Province: MOSCOW STATE
Admin Postal Code: 07148
Admin Country: RU
Admin Phone: +380939952974
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: Email Masking Image@bk.ru
--- Who.is from steacommunity.com ---
Admin Name: Yuriy Andih
Admin Organization: Imergen LTD
Admin Street: ul.Vilenda, 66, kv.21
Admin City: Smolensk
Admin State/Province: Smolensk state
Admin Postal Code: 940660
Admin Country: RU
Admin Phone: +79147238862
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: girl_1990@mail.ua
Yuriy also owns get-screenshot.com, SteamCommunitCy.com, get-screen.com, and sTeaCommunity.com
I think this guy is running a little something.
Spoiler:
RE: WARNING CS:GO NEW HIJACKING TROJAN SITE - roger_smith - 04-17-2015
@lux moved. Good luck
RE: WARNING CS:GO NEW HIJACKING TROJAN SITE - Alex - 04-17-2015
Who the fuck would fall for this ...
RE: WARNING CS:GO NEW HIJACKING TROJAN SITE - lux - 04-17-2015
(04-17-2015, 03:56 AM)Alex Wrote: Who the fuck would fall for this ...
When a friend you've played with multiple times says "I need you to stand in for a tournament final" to me at 2AM, and I accept seeing the awp asiimov as a prize, and I go to connect to the game server and get disconnect with something like "failed to connect, required anti-cheat", and then after than I realised.
It's the fact it exists.
RE: WARNING CS:GO NEW HIJACKING TROJAN SITE - ねこまっしぐら - 04-17-2015
Dang it, I like calling people. But I do not have international calling. I'm here struggling :-(.
RE: WARNING CS:GO NEW HIJACKING TROJAN SITE - lux - 04-17-2015
UPDATE:
I don't think Polonski was behind this. I've spoken to and played with him before, he's British and had good English skills. When I was asked to play, the English was very broken and he appeared to not understand, I put this down to it being the early hours of the morning.
I think this Ukrainian guy is running it all, and signing into compromised accounts, and messaging their friends, rinse and repeat.
The real target here is "Yuriy Andih".
RE: WARNING CS:GO NEW HIJACKING TROJAN SITE - rod - 08-23-2015
Thanks for the heads up mate
RE: WARNING CS:GO NEW HIJACKING TROJAN SITE - Sikom - 08-23-2015
@rod please don't grave dig