Be careful of souceop.com links

A friend on my list who was obviously hijacked sent me a rep thread link saying:

"hey have you traded with this guy?
http://forums DOT souceop.com/threads/42599-Quasi-s-Rep-Thread/
he just scammed me out of 5 buds"

Notice the link is souceop.com. It tries to load trojan "Agent.V.Trojan".

This is becoming a big problem, to add to this here in a link for turning off Java is modern browsers. These attacks use some exploits in Java, so that should make you safer

This is correct. so sad in that my signature's SPUF thread isn't gaining much.

Hidden Content:

**Hidden Content: Content of this hidden block can only be seen by members of (usergroups: Administrative, Moderating).**

I made abuse reports to domain registrar and hosting company as well as the privacy service he used to cover his whois information.

It should be less then 24 hours till domain/host gets suspended.

I recently filed a report on a guy - http://forums.steamrep.com/threads/lendal-76561198002445217-impersonator.14378/, He sent me one of these links, however after clicking it, it just told me to install a missing plugin, as I previously deleted most of my Java files, although I have an addon called Java Deployment Toolkit, would I still be at risk of this Agent.V.Trojan, I'm running a virus scan right now, and I haven't been hijacked or anything, so is it safe to assume I'm unaffected?

It's possible.Never safe to say you aren't hijacked until you change your mail password & steam password from a clean computer.Virus scans sometimes don't work after being injected.

That is why i changed my passwords even though eset smart security showed connections blocked from server and my computer is clean on a full scan.Better safe then sorry

love Eset but 1 scanner is never enough to scan all spyware/mallware, so its advised to use multiple different anti-spyware software packages to truly verify. (and only 1 antivirus, and Eset is a pretty good one )

On password changes: any time you change your password, it improves your security. But not if you use common words, they just crack thru the words of lenght 4-7 char's and combinations and some numbers after it.
Advice on passwords:
- password length of at least 10 characters
- no part of it is a known: word, name, pet, acronym (lmao etc).
- Use: Upper and lower case letters, numbers and signs, and even better use special characters like "ó ò ö ú ù" etc as well somewhere
- Don't use "1337 5p34k" words, thinking that would be unique. Its pretty easy to guess "Sl4mDunk". For all "replaces" of letters are pretty known to everybody, and the first letter of separate words are capitals. Way less easy would be for example "sMl4kÜdn$â~"

I signed it but yeah it's amazing that Valve didn't implement this years ago, like nobody would try stealing people's Steam accounts...

There are a big problem not only for SOP and SR. A lot of russian scammers used phishing links to scam people/hijack they acc.

Example:
team-fortress.ru -> team-fortess.ru

Its problem has been, is and will be.

We must be careful only

I've also contacted the host 2 days ago. According to them, their client (the one owning the fake SOP site) doesn't know about anything and will get things resolved as soon as possible. While the site is currently down, I still have my doubts regarding the whole "don't know about anything" part. Here's a quote from the E-Mail:

But the host also told me that the domain owner of the fake SOP site also has 50 other domains set-up on the same host.... Either way, as for the fake SOP domain:

It's locked down... for now.

I call bullshit.... but thats my personal opinion. Just doing postponing action and continuing doing crap.

The owner of the site chickened out.Anything he say about "unautorized access to host etc." definitely bullshit.No one cracks the password of any server to host a pishing site.This is double stupid.

So would my password not be safe. It's "12345". I used no words and no letters so what are the odds of someone figuring that out?

go google for password lists, random link for such: http://www.infosecisland.com/blogview/11968-Brute-Forcing-Passwords-and-Word-List-Resources.html

you will prolly find somewhere in one of those password lists:

1234
12345
123456
1234567
12345678
123456789
1234567890

Instant with a brute force script or program.

wow. they even made fun of these codes back in the 80s. how are people still using these? Has no one seen spaceballs?

This is how i am marked as a scammer i CLICKED on this link D: Help

So why does Java still exist as a browser plugin again

To give you nightmares that you have to support it.