Accepted 76561197971166092 Trojan Hacker

Scammer:
|steamID: Trading Ballcap (Harvest Moon)!
|steamID32: STEAM_0:0:5450182
|steamID64: http://steamcommunity.com/profiles/76561197971166092
|customURL:
|steamrepURL: http://steamrep.com/profiles/76561197971166092

Reporter:
|steamID: -=GHS_HUA=- Mr. Valentine
|steamID32: STEAM_0:0:50959178
|steamID64: http://steamcommunity.com/profiles/76561198062184084
|customURL: http://steamcommunity.com/id/ValentineMr
|steamrepURL: http://steamrep.com/profiles/76561198062184084

I was just relaxing and I get a random add, this guy tells me that there is a TF2 Duplicator that is in the TF2 workshop. Immediately I get weary and doubt everything this guys says. He then sends a link, saying to download it and it will replicate my backpack. I asked him for proof and he kept saying that all I needed to do was download it. I then look up the guy and he's not marked on steam rep but he's banned on outpost. People were stating he hacked to get his only hat. He currently only has 70 Ish hours in TF2. I then noticed he was in one of our server trying to get people to take the link, I banned him from the server and followed him to another server and warned the people there, I met OG Gingey there and it turns out he was also following the Trojan man, and he is the one who figured out that it was a Backdoor Trojan.


Chat Log: (DON'T CLICK ON THE LINKS IN THE LOG):

Code:

-=GHS_HUA=- Mr. Valentine: Hello.
Trading Ballcap (Harvest Moon)!: yo
Trading Ballcap (Harvest Moon)!: dude
Trading Ballcap (Harvest Moon)!: its the item duplcaicator
Trading Ballcap (Harvest Moon)!: creates keys for you
Trading Ballcap (Harvest Moon)!: in your backpack
Trading Ballcap (Harvest Moon)!: https://dl.dropboxusercontent.com/s/7zq10zkcxglmxni/TF2 Item Duplicator (2013) By TF2 Mafia.exe?token_hash=AAFAG8f9BaRNho2c1Zcl67lyX-E4RUWa6-_q8A-E0tOm0A&dl=1
v
Trading Ballcap (Harvest Moon)!: https://dl.dropboxusercontent.com/s/7zq10zkcxglmxni/TF2 Item Duplicator (2013) By TF2 Mafia.exe?token_hash=AAFAG8f9BaRNho2c1Zcl67lyX-E4RUWa6-_q8A-E0tOm0A&dl=1
Trading Ballcap (Harvest Moon)!: click run
Trading Ballcap (Harvest Moon)!: the instructions are in the program file
-=GHS_HUA=- Mr. Valentine: Phising links?
Trading Ballcap (Harvest Moon)!: no
Trading Ballcap (Harvest Moon)!: this is a real program
Trading Ballcap (Harvest Moon)!: made by tf2 workshop
-=GHS_HUA=- Mr. Valentine: Really now?
Trading Ballcap (Harvest Moon)!: ya
-=GHS_HUA=- Mr. Valentine: Prove it.
Trading Ballcap (Harvest Moon)!: click it and ill tell you how
Trading Ballcap (Harvest Moon)!: its a program
Trading Ballcap (Harvest Moon)!: says tf2 on it
Trading Ballcap (Harvest Moon)!: has the tf2 icon
-=GHS_HUA=- Mr. Valentine: Tell me without having me click on it.
Trading Ballcap (Harvest Moon)!: okay
Trading Ballcap (Harvest Moon)!: well when u download it
Trading Ballcap (Harvest Moon)!: it opens up
Trading Ballcap (Harvest Moon)!: and it says
Trading Ballcap (Harvest Moon)!: tf2 item duplicator
-=GHS_HUA=- Mr. Valentine: That's not proving it.
Trading Ballcap (Harvest Moon)!: its got the tf2 icon on the exe
Trading Ballcap (Harvest Moon)!: u click it
Trading Ballcap (Harvest Moon)!: and it asks for a link to your backpack
Trading Ballcap (Harvest Moon)!: u enter it in
Trading Ballcap (Harvest Moon)!: it brings up ur back back and duplicates
-=GHS_HUA=- Mr. Valentine: Why would the TF2 workshop allow a duplicator?
Trading Ballcap (Harvest Moon)!: it makes keys
Trading Ballcap (Harvest Moon)!: its an exploit
Trading Ballcap (Harvest Moon)!: that they havent patched yet
Trading Ballcap (Harvest Moon)!: and it only work for keys
-=GHS_HUA=- Mr. Valentine: Or a way to get into people's backpacks and steal their items.
-=GHS_HUA=- Mr. Valentine: or hack their accounts.
Trading Ballcap (Harvest Moon)!: no
Trading Ballcap (Harvest Moon)!: its a legit item duplicator
-=GHS_HUA=- Mr. Valentine: Give me definitive proof.
Trading Ballcap (Harvest Moon)!: okay
Trading Ballcap (Harvest Moon)!: download it
-=GHS_HUA=- Mr. Valentine: No.
Trading Ballcap (Harvest Moon)!: it has instructions
-=GHS_HUA=- Mr. Valentine: Without downloading it.
-=GHS_HUA=- Mr. Valentine: Prove that is it not a way that it isn't a way to hack my account, or steal items.
-=GHS_HUA=- Mr. Valentine: Also why are you even promting a item duplicator?
-=GHS_HUA=- Mr. Valentine: Alt account?
Trading Ballcap (Harvest Moon)! is now playing Team Fortress 2. Click here to join.
-=GHS_HUA=- Mr. Valentine: http://www.tf2outpost.com/user/303132
-=GHS_HUA=- Mr. Valentine: Gotcha.
-=GHS_HUA=- Mr. Valentine: http://www.tf2outpost.com/trade/10121845

Also I have added a report to Steam.

Here to confirm. This dude went into the [TF2-Traders] Server and began spouting off his BS last night. I quickly added him and followed.
He sent me the same link.

http://i.imgur.com/9b9YZsy.png
Photo Proof.

Curious as i am, i downloaded the above link. Even a freakin AVG Free Trial caught this nasty program.

Its a program (.exe) nothing else.
Its called 'TF2 Backpack Duplicator By TF2Mafia' more or less~

He kept repeating that there were instructions once you opened it how i could be walked through it by him once i started it.
I ran it in a V-box and sure enough it was a backdoor trojan.

For those who dont know, a Backdoor Trojan allows someone to remotely access your computer. i.e. steal your s✿✿✿.

This dude goes everywhere spamming this link, baiting unusual hat owners into duplicating their hats.
And im pretty sure thats how he got his Harvest Ballcap.

Hello!!!
Thank you for your report! An SR admin will review yours in a while!

Thank you very much!

Many thanks

- made the links not-clickable (please use [code] tags )
- reported the link to dropbox.
- Accepted report.

http://files.steamrep.com/1/2013-04/2013-04-21_12-38-43.png

Found 2 alts:

|steamID: randy
|steamID32: STEAM_0:1:58967299
|steamID64: http://steamcommunity.com/profiles/76561198078200327
|customURL:
|steamrepURL: http://steamrep.com/profiles/76561198078200327

|steamID: fRa1LZoRRRRR!
|steamID32: STEAM_0:1:19082273
|steamID64: http://steamcommunity.com/profiles/76561197998430275
|customURL:
|steamrepURL: http://steamrep.com/profiles/76561197998430275

Hidden Content:

**Hidden Content: Content of this hidden block can only be seen by members of (usergroups: Administrative, Moderating).**

/edit (25-04-2013): The dropbox account has been banned for, and I quote, "This user has been banned for Terms of Service violation."