Friend's Steam Account Hacked (URGENT)

[RobinHood2005]

I don't know where to post this but I'm posting this here because the users of this forum have been helpful in the past and I've heard that Steam tends to be slow to help.

 

My friend's Steam account was recently hacked, so we tried to recover it. When we were given the option to recover it via a code sent to an email address, the email that was shown was one that we did not recognise (it must have been the hacker's). Since we obviously did not have access to said email, and my friend's dad (who controls the PayPal account associated with the Steam account) was not willing to log into PayPal to provide proof of ownership due to security concerns, we were taken to a page on which we were given a code and the option to 'self-lock' the account. The page also said that we were supposed to be getting emailed instructions of when to unlock the account and how, but we never received an email. Presumably, this means that the hacker received an email, which makes me call into question how effective the self-locking method is and how it works.

 

NOTE: My friend's profile has gone almost completely blank (as in, the only things visible are his name and profile pic). Aside from this happening, the hacker doesn't seem to have been active since we self-locked the account. Could this be proof of the self-lock working?

 

NOTE 2: My friend changed his email account password and his dad changed his PayPal password. His PC was also fully scanned with the free version of Avast, but since free Avast isn't the best security software out there, the concerns persist.

 

Question: Would it be safe to try the PayPal proof method on another PC that we know isn't compromised, say, mine? What are the ramifications of attempting this at all?

Please advise, as I need urgent help.

[RobinHood2005]

UPDATE: sent a help request to Steam. Hopefully they'll respond ASAP.

[HeyYou]

How was the account hacked? Was your friend duped into attempting to log in via some email link?

 

If the machine is clean, verifying via paypal should be safe.

[RitualBlack]

If your friend used steam guard and checked for a SSL certificate issued to Valve Corp when signing in through the *correct* URL you wouldn't have any issues. Two factor authentication and common sense prevents just about any user preventable problem. Even if somehow a key-logger got onto your PC they would also have to have access to your phone to get into the account.

 

Be sure to set things up correctly in future. I am guessing this was probably to do with CS:GO/Dota 2/TF2 trading also since that is where majority of accounts are compromised (if so, stay away from 3rd party sites, especially with trade restrictions Valve is doing)

 

As for your self-lock, it is also not steams fault. Since the account was compromised and the details were changed of course the hacker will get the email. Don't you think it would be a bit problematic if you could just send a request to lock anybodies account?

[tekmage]

Why was your friend's Steam Guard turned off?