Steam Games and Malware

[atlasmike]

Ok, has anyone had any problems with Steam gaming and malware? I had two computers come into the shop. Both had Steam and both had internet blocked. One computer I did the a last known good and it fixed the problem, but the other one is more perplexing. It shows that i have a wireless connection, I can update Microsoft Defender, download and install Windows updates but I can't install malwarebytes, FireFox or access any website through any browser that is on the pc. Most scans I have tried have failed because they can't updated. Any event, has anyone come across Steam games and malware? I think the best answer is to wipe and reinstall, but I have not heard back from my customer yet, so I wanted to try some different things before I hear back from him. Any Suggestions? What I have tried is a winsock reset. Pulled hard drive out and scanned in a dock with Malwarebytes which found some stuff but no virus. I tried to reset all the default settings in all the browsers. In crisis aversion tool the DNS flush says that DNSAPI.dll is not there. I ran adwcleaner and after that, now it wont recognize the USB wifi dongle and it says that there no no connections and not connected when it come s to the NIC as if the driver isn't there, but the both the USB and the NIC drivers are there in the device list.

 

[cypress]

I haven't run across this issue before. I've done a couple clean up on some gamer clients but none of this nature. I would scan for rootkits. Slave the hard drive like you have done and run MBAR, Emisosoft.

 

[atlasmike]

I haven't run across this issue before. I've done a couple clean up on some gamer clients but none of this nature. I would scan for rootkits. Slave the hard drive like you have done and run MBAR, Emisosoft.

Will do, right away.

 

[cypress]

Post back with outcome, also once everything is said and done run Tweaking AIO repair tool. I have a feeling there is still some stubborn malware stuck on this machine.

 

[MotzTech]

I would try running Kasperksy rescue disk as well. On a side note, I highly doubt steam is at fault here. It's a fairly common app and gamers also tend to be a bit more daring on what sites they visit and what they download, so tend to get infected more.

 

[Romaniac]

Sorry, but Steam having anything to do with this is very very very unlikely.

Is your only connection that 2 computers that had steam had malware...?

 

[altrenda]

Sorry, but Steam having anything to do with this is very very very unlikely.

Is your only connection that 2 computers that had steam had malware...?

While getting malware directly from a Steam game is unlikely, there have been examples of malware being spread in Steam chat, and Steam does recommend turning off AV before connecting. https://support.steampowered.com/kb_article.php?ref=6057-YLBN-1660

But, as said above, gamers are fearless and will click on almost anything if it promises a cool demo or preview.

 

[atlasmike]

Post back with outcome, also once everything is said and done run Tweaking AIO repair tool. I have a feeling there is still some stubborn malware stuck on this machine.

I ran MBAR and Kaspersky TDSS and that found nothing as well.

 

[cypress]

I myself even being on the Steam chat have gotten bogus links while playing here and there so this is not uncommon like @altrenda said.

@atlasmike Try running the Kapersky Rescue disk like mentioned above or Avast Boot time scanner. Another product would be Rogue Killer. Still sounds like some malware is lingering.

 

[ohio_grad_06]

Second the comment about running Avast boot scan. Then start off with Rogue Killer and run your normal routine from there.

 

[atlasmike]

Sorry, but Steam having anything to do with this is very very very unlikely.

Is your only connection that 2 computers that had steam had malware...?

Both has the same symptoms, blocked internet access. One was as if the driver wasn't there but is had the NIC driver n the device manager. The other had a network connection with internet access and I could updated Windows Defender and download and install Windows updates but could not use any web browser or install any software that needed access to the net to install or update. After I ran adwCleaner that now is just like the first machine, NIC driver in device manager but no connection showing a NIC at all. Just like when you reload windows on a fresh install and the NIC driver isn't there. But It shows in the device manager. I also went to look into the firewall to see if it was on. It isn't and I clicked "use recommended settings" and says that "Windows Firewall can't change some of your setting. Error Code 0x80070424" which is a missing DLL. So I look that up, I go into services and Windows Firewall isn't in there to start it.

 

[MDD1963]

There was a flurry of discussion over a few systems with difficult/stubborn DNSAPI issues over at bleepingcomputer a few weeks back, where DNSAPI.dll was needing replacement due to infection, if memory serves....unsure if the issue here is related, of course, but the DNSAPI caught my eye...

 

[MDD1963]

Steam account is harmless....

Folks allowing assorted downloads from some hacker's honeypot server, not so much......

(A guy at another forum is still trying to figure out how someone gained full GUI access thru his Teamviewer, and was surfing PAYPAL via his Chrome while he was out of the house; he isn't sure if his VPN, Teamviewer, or a potential Steam download months earlier might have been at fault, and, is not positive TV was even the avenue of control...)

 

[ComputerRepairTech]

It shows that i have a wireless connection, I can update Microsoft Defender, download and install Windows updates but I can't install malwarebytes, FireFox or access any website through any browser that is on the pc.

This sounds familiar, check event log, is there any issue with one of the services?

Edit: I cant remember exactly I do want to say it was something relevant to dns but this was years ago. I remember I could still connect to the computer remotely which surprised me but dont recall if it was screenconnect or teamviewer that I had connected with.

 

[atlasmike]

Thanks for all your help guys. I am just going to back up his personal data and use the system image recovery. As a business I can't lollygag anymore. I see things like this as a challenge. Fixing a computer and keeping it intact is really cool to me and with help fro people here on this forum, I can achieve that quite abit. This thing may even have a Zero Day bug in it, who knows. I even took it to my buddies shop down the street who has been working on PC's since the 80's and he even couldn't figure it out. So thanks again guys.

 

[cypress]

Thanks for all your help guys. I am just going to back up his personal data and use the system image recovery. As a business I can't lollygag anymore. I see things like this as a challenge. Fixing a computer and keeping it intact is really cool to me and with help fro people here on this forum, I can achieve that quite abit. This thing may even have a Zero Day bug in it, who knows. I even took it to my buddies shop down the street who has been working on PC's since the 80's and he even couldn't figure it out. So thanks again guys.

Welcome. Once you spend a little too much time on it you gotta make that decision to keep going or nuke a pave. Had an issue that was kicking my butt last week. Did a nuke and pave and all is well. Hopefully it all works out great for you.