Viral Content Warning: "BlackOps XProject [v1.1]"

[[MPGH]Jim Morrison]

If you downloaded the attachment from the, "BlackOps XProject [v1.1]" thread and ran it you may have been infected and had several of your passwords stolen.
After analyzing the file the following things have been observed:

• Logs your PC and IP.
• File goes for your Firefox, Google Chrome, and Opera logins and possibly history.
• Goes for some of your Steam user info and configurations files, this may allow them to automatically login to your Steam account but I'm not sure so don't quote me on it. It looks for these Steam files in particular, there may be more.
  \config\config.vdf
  \config\loginusers.vdf
  \config\SteamAppData.vdf
• The file starts itself whenever you turn on your computer under a different name, "sR.exe"
• The file may block the Task Manger from being opened.
• It may mess with your mouse movements and or lock the mouse.

@Liz @arunforce @Dave84311
If you can pull the list of all the users who downloaded the file please mention them here.

Manual Fix:

• It may block the task manager from being opened but if it doesn't, start the task manager then end the program it should be named whatever you ran it as. By default: xPirat BlackOps XProject.exe
• Navigate to this folder: C:\Users\<YOUR USERNAME>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
• Delete sR.exe
• Install MalwareBytes and Avira, make sure to run full scans with both.
• Check the task manager for both instances of the virus which should be, "xPirat BlackOps XProject.exe" and "sR.exe"
• Once you're sure no instances of the file are running, you can leave your Skype below and I'll double check, change ALL of your passwords and clear all of your web browser(s') history and stored passwords. Passwords should never be stored because of how easily malicious programs can just grab them, it's a good habit to start memorizing them instead of storing them.
• If you are scared to perform these steps because you're afraid you'll mess up your computer, just leave your Skype below and I'll do it for you.
  Major credits to @master131 for most of the analyzing.

If you have downloaded and ran the file please leave your Skype here so I can contact you and help you. At MPGH user safety is our number one concern and we're sorry this file managed to slip through, we apologize.
Sincerely,
~The MPGH Staff Force.

[[NEWACCOUNT]Yano]

Wondering why it got approved then

[Gab]

Wondering why it got approved then

Cuz @NormenJaydenFBI can't moderate properly

[[MPGH]Jim Morrison]

Cuz @NormenJaydenFBI can't moderate properly

I don't even have this section.

[Gab]

I don't even have this section.

Stop with the excuses you toasthole

[baptiste28]

Hello,

I'm french, sorry for my bad english. I use Google Translate.

I got the Dave message that I had been infected.
I have launched the infected file, July 14. But the application had planted at startup. All that I could find, they are 3 text files and a screenshot of my Windows desktop in my Windows temporary folder. These three files contained my passwords stored in my browser Opera, Chrome and Firefox. As for the screenshot, it was taken automatically launch the malicious program.

I looked in my Windows logs, and I saw only errors in the program. Nothing else suspicious since.

Do you think my passwords have been sent? How to know?
I already did a scan with MalwareBytes, by checking out the box "Rootkit", and I have found nothing.

I am planning to do a scan with Avira, I'll let you know.

Thank you for your kindness to members, I'm stupid not to have tested the software in a virtual machine before.

[Minnesota Dabs]

Thanks for the credits Normen.

/s

[[MPGH]Jim Morrison]

Hello,

I'm french, sorry for my bad english. I use Google Translate.

I got the Dave message that I had been infected.
I have launched the infected file, July 14. But the application had planted at startup. All that I could find, they are 3 text files and a screenshot of my Windows desktop in my Windows temporary folder. These three files contained my passwords stored in my browser Opera, Chrome and Firefox. As for the screenshot, it was taken automatically launch the malicious program.

I looked in my Windows logs, and I saw only errors in the program. Nothing else suspicious since.

Do you think my passwords have been sent? How to know?
I already did a scan with MalwareBytes, by checking out the box "Rootkit", and I have found nothing.

I am planning to do a scan with Avira, I'll let you know.

Thank you for your kindness to members, I'm stupid not to have tested the software in a virtual machine before.

Please post your Skype here if you can.

[baptiste28]

My Skype is :
baptiste28000

[Skullkill17]

Skull-was-killed ((

[baptiste28]

Oh, you download too the file :'(

I have finish my Avira scan, and no virus.

Normen, i'm ready

[Mamadank]

Downloaded it and ran it a few days ago, checked Temp folder, checked Task Manager, ran scans on Avira and MB and AVG, all clear changing my passwords just in case though

[wassabi_person]

I downloaded the file... I can PM you my skype if needed, im not sure if i ran it though. But better safe then sorry :/

[baptiste28]

Thx to NormenJaydenFBI for help, my PC is OK

[X DeTh x JaKeX]

Yeah I can verify it takes the steam passwords. It stole my steam account of 171 games, but I got access back to it. Wasn't sure what was going on but I'm at ease now. Running every antivirus I can find tomorrow and also manually checking to make 100% sure that it's fixed. Thanks you guys for letting me know what's going on.