I'm not sure this is the right place for this kind of topic, so please direct me where this belongs if I am mistaken.
I am a victim of a fraud/hack/whatever you call it. Someone used my own PC to steal money from me (virtual items, total worth around $50).
How this happened: I received an invite to "check out an item", link downloaded a "screensaver" file (.scr). Info about the file I knew:
0. It had a trumbnail that looked like a picture.
1. Windows said its a Screensaver.
2. Avast scan said: "No threat detected" by Avast Free Antivirus.
3. It was 11:30 PM so I wasn't being too careful as I usually am.
So I just went and launched it. In mere seconds I receive a message all my money and all my items are gone.
Don't get me wrong, I'm not blaming Avast in this and not demanding compensation for your failed free anti-virus, which can't tell a script from a screensaver. This was entirely my fault not heeding to the warning of my intuition. Already contacted service provider's support to give me back my items.
The purpose of this topic is to prevent this happening to other people, if I can. Details:
I received a link, visiting this link gave me a downloaded .scr file. Screensaver format, if you ask Windows. No threat detected by Windows. Curious me as it has a trumbnail that looks like a picture. So I launch this file and it does the following:
1. Hacks into my Steam client (software e-shop client).
2. Buys something on "community market" for all my money on account (it had to be able to communicate with an outside source to find that "max money I can spend" and put an item for respective amount). I'm down to $0.01.
3. Cancels all of my Steam Market offers for certain item (selling offers) and trades them to a random person.
This is all done in mere seconds, without me seeing anything happen.
This situation is very bad for both Anti-virus software which does not detect .scr files as a threat (I read elsewhere that no antivirus detects them), and for Steam, which already knows about this problem (they posted a warning... deep into support forum where people go AFTER they're scammed). I'll solve things with Steam separately, I'm here to provide feedback on Avast, and make a suggestion on how to improve the protection. Its simple, really:
Avast should block all *.scr files from launching, unless user says they know where the file came from. Just warn me that this file is suspicious and it could be potential threat and I'll never open it. Even if it came with Windows. Or at least I won't open it outside of some sandbox environment.
Originally, I wanted to send this file for analysis (I know for sure this file is responsible for hacking), but I do not know how to do that (if you do, please do this for me). All I found is a link to Avast Community Forums. So I'm putting the file with my explanation here. Hopefully, it'll help Avast find such suspicious files and warn users about it. If you know how to send the file to Avast, please do so in my place.
How do I know this file is responsible? I launched it right before I got hacked. Hack happened from within my PC as I never got a warning that I am logged in elsewhere and never authenticated another PC (any new PC has to authenticate with mail) to launch Steam client. The only way to get access to my account under such conditions is to use my own PC, and this file is the only executable I know of that I did not launch for years prior to yesterday (most of my software is something I purchased years ago).
I'm posting the file in hopes Avast can analyze it and figure out how to detect similar type of scamming/hacking attempt and block it, as well as detect this kind of threat in files.
Be warned: if you use Steam, and accidentally launch this file, it'll steal your belongings!
File extension changed to *.txt (added .txt on top of .scr) to prevent accidentual launch.
Sorry for such a long explanation, just wanted to make it as clear as possible.
