1. There is no such thing as a "pending" ban or Steam admin. Anyone threatening your account is a scammer trying to scare you. Read more.

Accepted 76561197971166092 Trojan Hacker

Discussion in 'Archived Reports' started by Mr. Valentine, Apr 18, 2013.

  1. Mr. Valentine

    Mr. Valentine New User

    Messages:
    75
    Steam:
    STEAM_0:0:50959178
    Scammer:
    |steamID: Trading Ballcap (Harvest Moon)!
    |steamID32: STEAM_0:0:5450182
    |steamID64: http://steamcommunity.com/profiles/76561197971166092
    |customURL:
    |steamrepURL: http://steamrep.com/profiles/76561197971166092

    Reporter:
    |steamID: -=GHS_HUA=- Mr. Valentine
    |steamID32: STEAM_0:0:50959178
    |steamID64: http://steamcommunity.com/profiles/76561198062184084
    |customURL: http://steamcommunity.com/id/ValentineMr
    |steamrepURL: http://steamrep.com/profiles/76561198062184084

    I was just relaxing and I get a random add, this guy tells me that there is a TF2 Duplicator that is in the TF2 workshop. Immediately I get weary and doubt everything this guys says. He then sends a link, saying to download it and it will replicate my backpack. I asked him for proof and he kept saying that all I needed to do was download it. I then look up the guy and he's not marked on steam rep but he's banned on outpost. People were stating he hacked to get his only hat. He currently only has 70 Ish hours in TF2. I then noticed he was in one of our server trying to get people to take the link, I banned him from the server and followed him to another server and warned the people there, I met OG Gingey there and it turns out he was also following the Trojan man, and he is the one who figured out that it was a Backdoor Trojan.


    Chat Log: (DON'T CLICK ON THE LINKS IN THE LOG):

    Code:
    -=GHS_HUA=- Mr. Valentine: Hello.
    Trading Ballcap (Harvest Moon)!: yo
    Trading Ballcap (Harvest Moon)!: dude
    Trading Ballcap (Harvest Moon)!: its the item duplcaicator
    Trading Ballcap (Harvest Moon)!: creates keys for you
    Trading Ballcap (Harvest Moon)!: in your backpack
    Trading Ballcap (Harvest Moon)!: https://dl.dropboxusercontent.com/s/7zq10zkcxglmxni/TF2 Item Duplicator (2013) By TF2 Mafia.exe?token_hash=AAFAG8f9BaRNho2c1Zcl67lyX-E4RUWa6-_q8A-E0tOm0A&dl=1
    v
    Trading Ballcap (Harvest Moon)!: https://dl.dropboxusercontent.com/s/7zq10zkcxglmxni/TF2 Item Duplicator (2013) By TF2 Mafia.exe?token_hash=AAFAG8f9BaRNho2c1Zcl67lyX-E4RUWa6-_q8A-E0tOm0A&dl=1
    Trading Ballcap (Harvest Moon)!: click run
    Trading Ballcap (Harvest Moon)!: the instructions are in the program file
    -=GHS_HUA=- Mr. Valentine: Phising links?
    Trading Ballcap (Harvest Moon)!: no
    Trading Ballcap (Harvest Moon)!: this is a real program
    Trading Ballcap (Harvest Moon)!: made by tf2 workshop
    -=GHS_HUA=- Mr. Valentine: Really now?
    Trading Ballcap (Harvest Moon)!: ya
    -=GHS_HUA=- Mr. Valentine: Prove it.
    Trading Ballcap (Harvest Moon)!: click it and ill tell you how
    Trading Ballcap (Harvest Moon)!: its a program
    Trading Ballcap (Harvest Moon)!: says tf2 on it
    Trading Ballcap (Harvest Moon)!: has the tf2 icon
    -=GHS_HUA=- Mr. Valentine: Tell me without having me click on it.
    Trading Ballcap (Harvest Moon)!: okay
    Trading Ballcap (Harvest Moon)!: well when u download it
    Trading Ballcap (Harvest Moon)!: it opens up
    Trading Ballcap (Harvest Moon)!: and it says
    Trading Ballcap (Harvest Moon)!: tf2 item duplicator
    -=GHS_HUA=- Mr. Valentine: That's not proving it.
    Trading Ballcap (Harvest Moon)!: its got the tf2 icon on the exe
    Trading Ballcap (Harvest Moon)!: u click it
    Trading Ballcap (Harvest Moon)!: and it asks for a link to your backpack
    Trading Ballcap (Harvest Moon)!: u enter it in
    Trading Ballcap (Harvest Moon)!: it brings up ur back back and duplicates
    -=GHS_HUA=- Mr. Valentine: Why would the TF2 workshop allow a duplicator?
    Trading Ballcap (Harvest Moon)!: it makes keys
    Trading Ballcap (Harvest Moon)!: its an exploit
    Trading Ballcap (Harvest Moon)!: that they havent patched yet
    Trading Ballcap (Harvest Moon)!: and it only work for keys
    -=GHS_HUA=- Mr. Valentine: Or a way to get into people's backpacks and steal their items.
    -=GHS_HUA=- Mr. Valentine: or hack their accounts.
    Trading Ballcap (Harvest Moon)!: no
    Trading Ballcap (Harvest Moon)!: its a legit item duplicator
    -=GHS_HUA=- Mr. Valentine: Give me definitive proof.
    Trading Ballcap (Harvest Moon)!: okay
    Trading Ballcap (Harvest Moon)!: download it
    -=GHS_HUA=- Mr. Valentine: No.
    Trading Ballcap (Harvest Moon)!: it has instructions
    -=GHS_HUA=- Mr. Valentine: Without downloading it.
    -=GHS_HUA=- Mr. Valentine: Prove that is it not a way that it isn't a way to hack my account, or steal items.
    -=GHS_HUA=- Mr. Valentine: Also why are you even promting a item duplicator?
    -=GHS_HUA=- Mr. Valentine: Alt account?
    Trading Ballcap (Harvest Moon)! is now playing Team Fortress 2. Click here to join.
    -=GHS_HUA=- Mr. Valentine: http://www.tf2outpost.com/user/303132
    -=GHS_HUA=- Mr. Valentine: Gotcha.
    -=GHS_HUA=- Mr. Valentine: http://www.tf2outpost.com/trade/10121845

    Attached Files:

  2. Mr. Valentine

    Mr. Valentine New User

    Messages:
    75
    Steam:
    STEAM_0:0:50959178
    Also I have added a report to Steam.
    DataStorm likes this.
  3. OG Gingey ♫ Heinous

    OG Gingey ♫ Heinous New User

    Messages:
    2
    Steam:
    STEAM_0:0:20599514
    Here to confirm. This dude went into the [TF2-Traders] Server and began spouting off his BS last night. I quickly added him and followed.
    He sent me the same link.

    http://i.imgur.com/9b9YZsy.png
    Photo Proof.

    Curious as i am, i downloaded the above link. Even a freakin AVG Free Trial caught this nasty program.

    Its a program (.exe) nothing else.
    Its called 'TF2 Backpack Duplicator By TF2Mafia' more or less~

    He kept repeating that there were instructions once you opened it how i could be walked through it by him once i started it.
    I ran it in a V-box and sure enough it was a backdoor trojan.

    For those who dont know, a Backdoor Trojan allows someone to remotely access your computer. i.e. steal your s✿✿✿.

    This dude goes everywhere spamming this link, baiting unusual hat owners into duplicating their hats.
    And im pretty sure thats how he got his Harvest Ballcap.

    Attached Files:

  4. Sjru

    Sjru SteamRep Admin

    Messages:
    17,469
    SteamRep Admin:
    STEAM_0:1:13315037
    Steam:
    STEAM_0:1:13315037
    Hello!!!
    Thank you for your report! An SR admin will review yours in a while!

  5. Mr. Valentine

    Mr. Valentine New User

    Messages:
    75
    Steam:
    STEAM_0:0:50959178
    Thank you very much!
  6. OG Gingey ♫ Heinous

    OG Gingey ♫ Heinous New User

    Messages:
    2
    Steam:
    STEAM_0:0:20599514
    Many thanks
  7. DataStorm

    DataStorm Retired Staff

    Messages:
    3,448
    - made the links not-clickable (please use [code] tags )
    - reported the link to dropbox.
    - Accepted report.

    http://files.steamrep.com/1/2013-04/2013-04-21_12-38-43.png

    Found 2 alts:

    |steamID: randy
    |steamID32: STEAM_0:1:58967299
    |steamID64: http://steamcommunity.com/profiles/76561198078200327
    |customURL:
    |steamrepURL: http://steamrep.com/profiles/76561198078200327

    |steamID: fRa1LZoRRRRR!
    |steamID32: STEAM_0:1:19082273
    |steamID64: http://steamcommunity.com/profiles/76561197998430275
    |customURL:
    |steamrepURL: http://steamrep.com/profiles/76561197998430275

    Hidden Content:
    **Hidden Content: Content of this hidden block can only be seen by members of (usergroups: Administrative, Moderating).**
    /edit (25-04-2013): The dropbox account has been banned for, and I quote, "This user has been banned for Terms of Service violation."