Trojan spreading through fake image links via Steam Friends and Profile Pages!

No problem. It seems to be getting people just because of the entire friends list + image link combo. Pretty sneaky really.

More like : https://www.youtube.com/watch?v=VQH-Za6jhsI

Assuming we're using google chrome. I use Opera (with WebOfTrust added), but my NOD32 antivirus blocked it before WOT even had to warn me about the reliability of the site. Apparently it automatically tried to do some kind of weird stealth download of a file pretending to be an old screensaver file (.scr) when it was blocked. I didn't even get any prompts when it was intercepted, so I'm not entirely sure how it would react across different browsers.

Yeah, I was just replying to it.

Basically you don't even need to see or open the file. My antivirus halted me from entering the site and blocked it's attempt at auto-downloading before I even got a prompt. That might suggest that it sneaks in without any input needed from you. In my case, it was an .SCR file, which screensavers are packaged into. Or at least, they were, back when I used to download that kind of thing.

If you have opened that link, just because you haven't seen anything doesn't mean you haven't been 'had'. Message your friends and ask them to confirm if you sent them a weird link, and then either way, scan your computer and change your password. Don't risk your account's safety. Also : tell the person who sent you the message too, they might not even be aware they've been infected.

I suppose that's one way to protect yourself-

i giggled

I thought it was funny until I realized you lied, mr ten friends. ;P

Well, not everybody spends a great deal of time on forums or random videogaming news sites. I checked the top two pages of threads and didn't find anything on it, so I figured I'd post something given it was currently doing a number on people I knew.

If it's still an active thing in circulation that people aren't 100% informed on then there is still good cause to have the information bumped. Nobody in my friends list seemed to have been aware of this particular shade of malware, so it served it's purpose, thanks <3

Indeed, now I receive 1 bot friend reqest every 48h

Fag scammers? Is that you, Chris Brown?

+1

Right. Right. Because all malware require you to actively, manually download and run something. It's not like there have been 'quiet' invasions of computers since way back in the days of hclean32.

For example, my browser never automatically downloads anything unless it is part of the website itself. This is a common tactic for malware, having it's harmful items masked as part of the site itself. I mean, those little advertisements you see along the sides of some sites have served as a vector for infection before, even on high-profile, legitimate sites that simply had adbars. Not every form of infection comes in a handy little email called "FREE IPOD" with a file called "NOT A VIRUS.xls" that you have to run before it does anything bad. :P

Granted, I can't say a great deal about this individual thing because the site itself was halted from even opening (and I wouldn't have opted to save and run a totally unrelated, unidentified file when linked to a jpg), but your idea of how infections spread is a little outdated.

Yeah, one of the reasons it actually hit my friend when he clicked the link was because he had disabled his AV for an hour to try increase his download speeds or something. Perhaps this isn't quite the dangerous malware I'm making it out to be, but when a friend gets hit when they aren't technologically illiterate, it makes me flinch, y'know?

Fine, changed it.

Although what a friend would typically do is entirely down to what kinds of company you keep. It's not too unusual to receive an image link with little context from some of my friends, as saying too much often gives the humour away.

+1

And yet you're forgetting that people only tend to look up things like Spybot S+D or Malwarebytes in response to having encountered something malicious. Even if you have a strong sense of safety precaution on the internet, you're still eventually going to walk face-first into a first encounter of your own. Saying "it's their own fault" for having thought an antivirus/firewall would be enough is pretty blinkered thinking really.

And since when is an image link from a friend considered "shady"?
Maybe you don't realise, but a lot of online friends share links with each other FAR more suspect than a direct link to a hosted image, dude. Normally, an image file isn't the first suspect when it comes to malware. We're not talking .EXE, .JS or .XLS here, man. In the case of this one, you don't even get to know it's an .SCR file unless your antivirus detects and stops it, giving you a pop-up for action (or info on what it did to the file).

If you actually read what was said, nobody is opening random .SCR files.

...where memes are misused.

Oh-ho, a fatal flaw. I wouldn't have thought it would even open a message window for the infected party to see. I mean, having a screen full of open windows would be a massive telltale sign. Thanks for the info.

When I got that message from a friend (I always click to check because I have to confirm every download anyway; you get an .scr file, which is the extension used instead of .exe for Windows screensavers - it is still a perfectly ordinary .exe, though), I told him he was infected. He immediately changed his name to $name DON'T OPEN ANY LINKS FROM ME. Should be warning enough.

:D :D c=z good joke :D

lol, that's a nice story, thank you :)

+1

TL;DR: "Interweb noobs, be careful of falling for Trojan spreading through Steam Friends!"

"There are things that will never look real"
So every time a steam friend gives you an image link, you quiz them about it to make sure that it was really them who sent it? It primarily occurs when the friend is online, and if you're in the habit of discussing random online humour / news then it doesn't immediately ring any alarm bells unless there are specific signs. I only managed to avoid it because I hadn't talked to the guy in about a year. Had it been anyone else I would have probably opened it.

Plus you and other people who keep implying it's a mere matter of intelligence forget about how a normal opening message from a friend goes down : http://i59.tinypic.com/2mg2uth.jpg
Hell it can even happen mid-conversation, which makes it even more confusing (though more likely they will notice something is wrong). Again, consider the nature of the trojan itself. Sometimes the type of disguise is what gets people.

Yeaaah. You'd think that the UAC might catch something like that. My friend was just unlucky because he was trying to increase his download speeds by temporarily disabling his antivirus when it happened. Sods law, right? :P