[ Closed ] WARNING - Your steam account is in danger!!!

Hello guys, I have some bad news.

So, I found a server called *snip*, at the address of *snip*. The server requires a password, and has some people playing. I visited their site,*snip*, just becouse I was curious. They say that they want you to download their client and provide a direct download link. After downloading and unpacking I was suprised by the presence of H-Client, that required admin rights. That was the moment, when I thought that something was wrong. Afaik, no client requires admin permissions, there is no need to. I decided to setup a virtualbox running windows 7. After running, small console program was run.

Currently, Im not sure what it does, but I'm pretty sure it's nothing good. First symptoms were:
- Disabled task manager
- Disabled system restore (recovery), removed all recovery points
- Hosts file edited (pointing steampowered to loopback address)

I also checked autostart programs, but nothing seemed changed there. I believe that some valuable information was sent to hackers, but I didn't run a wireshark to see what was sent and where.

Im not a proffesional, probably somebody with bigger experience should check this.
Please ban this ip from masterserver - it's probably just a fake server that doesn't even run teeworlds.

In the next post I'll show you how to remove the symptoms of this injector, not sure if thats all you need to do.

Task manager:
- Click Start and type "regedit"
- Navigate to following key in the left menu: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
- Find DWORD value DisableTaskMgr on the right panel
- Double click on it, change to 0

Disabled system restore
- Go to the control panel -> System -> System Protection
- Choose your system disk, click configure
- Click on the first radio button and adjust the slider to few gigabytes
- Ignore the error (I'm not sure if it does anything)

Hosts file edited
- Click start, type in "notepad"
- Right click on the notepad, choose run as administrator
- Click open, in the upper bar copy-paste "%systemroot%\system32\drivers\etc\"
- In the file name bar type "hosts" and press enter.
- You will see a list of domains with 127.0.0.1 address next to them
- Erase the contents of this file
- Save the file

// removed links, no need to advertise that - Oy