Since this discussion started on 1st of April and still goes on, I decided to reply as well.
Basically, I want to warn you to beware the user "Hippie Tech". Either his account was hacked or he hot his legendary status deliberately to do this...
Anyways, here is my very sad
true story.
I saw his post regarding the virus and immediately reacted. I ran antivirus just to be safe and everything was clean (inluding 3 different versions of Ascension Coin wallet).
Then I clicked on bitcointalk user "Hippie Tech" to see his post history and immediately
12 million BTC were stolen from my account:
http://i.imgur.com/vSawB9l.pngI executed task manager and what do I see...
THIS!
http://i.imgur.com/IXktS1Q.pngWhat's interesting is that I also immediately received password reset emails on my Apple Watch from all exchanges at the same time: btc-e, cryptsy, mintpal, mtgox, poloniex...
Anyways, I warned you! Something is not right there.
In short. Its finally happened peoples. lol I HAVE BEEN HACKED !
I first became suspicious 2-4 days ago, then decided to test it out with some CANNdy flavoured bait.
200 CANN wasn't enough but 3200 WAS ! lol
TXid : cd276e4d9619e5e201e60ded1c438bf3d2a5c52f6c4a7bea595d3c213327eb41
EDIT :
https://chainz.cryptoid.info/cann/address.dws?CTSFTDzKSonarDJgpuRxukPrECXrby1eSe.htmhttp://img.techpowerup.org/150401/ASNscammed.jpgI woke up and noticed that my email account was up and the new/temp password from Polo or Ccex was selected and thought "WTF !!".
I did not request the password resets.
http://img.techpowerup.org/150401/ASNpassRESET.jpgCheck the processes with taskmanager and you will see the client is running as service.exe*32 and/or crcss.exe*32 and/or some other name. Right click the process and choose "open file location" when you are ready to delete it.
http://img.techpowerup.org/150401/ASNtrojan2024.jpgIf deleted, it will rewrite itself to the program files(x86) folder after the system is rebooted.
http://img.techpowerup.org/150401/ASNtrojan.jpgThe file responsible for this was found in one of the user's temp/Windows Live/ ID folders. EDIT This stopped after I disabled then deleted service.exe (and everything else) from the temp folder.
Terminating one of those .exe*32 processes caused my right to automatically reboot.
Congrats asshole(s) !
Please step forward so that the world may know your inbred shitcoin stained face !
How did you managed NOT to get hacked before if you haven't use 2FA, Sandboxie or VM? Anyone who don't launch random wallets in a controlled Sandboxie, VM or on a remote machine with a throwaway OS is pretty much asking for getting hacked.
Who knows. I've often wondered that myself.
Just to be clear, the coins were taken from my freshly baited wallet and not from Polo, Ccex or Bter.
@all
While we're waiting for an explanation, please check your "program files(x86) and the youruser/appdata/local/TEMP folders.
Perhaps these files were injected with a virus on your own computer which has been infected for awhile now?
Can you zip your versions of .exe and .dll and upload for investigation or perhaps try virustotal both your files?
Because obviously the official wallet distribution is clean.
I do not believe that the pc was infected previous to this because the hacker went for my most recently used /traded coins.
https://bitcointalksearch.org/topic/m.10926344Here is the download link I used and if there was anything left over, it was erased when the drive was cleaned and formatted.
Some XAI and 350k DGB was also taken.
http://img.techpowerup.org/150402/ASNtrojan3.jpg