http://blockexplorer.com/address/1Go93RSbJ5Ky8poq1NA9eWKfxPd55vKVos
This address was stolen, sent 15Afx45asCysyNd9HE7xeZTkzLgDq2JCEx 94.83BTC.
Stealing is going on...
Topic: Attention! This address is stealing BTC now! (Read 5175 times)
my client sent 0.46 btc to this address today.. by itself.
im on win7x64 with latest updates, scanned the whole pc, checked open ports and autoruns.. and nothing.
i need help cus this is serious, if my antivirus and 4 anti-troyan apps say my windows is clean and it clearly isnt, there is something wrong.
im on win7x64 with latest updates, scanned the whole pc, checked open ports and autoruns.. and nothing.
i need help cus this is serious, if my antivirus and 4 anti-troyan apps say my windows is clean and it clearly isnt, there is something wrong.
Try MS System Sweeper
http://connect.microsoft.com/systemsweeper
I have run it on a number of computers at the office and home. I have seen reports of people finding Root Kits (RKs) that normal AV is not picking up. You burn it to a CD and boot from the CD.
dban is a bit overkill if you just want to wipe the MBR and destroy data on a drive. A single zero pass would be fine 
Takes a hell of a lot less time!
Takes a hell of a lot less time!It does have that option. I used the so called "least secure" option of a zero pass on a 100 gb HD and it took 2 hours max. Some of the erase options dban offers are insane.
Just use a linux liveCD and run:
DISCLAIMER: DO NOT "test" THESE COMMANDS ON A SYSTEM YOU DON'T WANT TO DESTROY!!!!!
dd if=/dev/zero of=/dev/sdX
where X is the device
Did this to a 1TB drive not long ago, took maybe 4 hours... maybe a little more.
You could also do a (psuedo)random data write with
dd if=/dev/urandom of=/dev/sda
Since we were talking about these rootkit viruses within the MBR.. If you just wanted to kill the MBR:
dd if=/dev/null of=/dev/sdX bs=446 count=1
and to remove both the MBR and the partition table (which you'd have to rebuild if you wanted to use the partitions again!):
dd if=/dev/null of=/dev/sdX bs=512 count=1
DISCLAIMER: DO NOT "test" THESE COMMANDS ON A SYSTEM YOU DON'T WANT TO DESTROY!!!!!
I'd imagine these rootkits would get back into the MBR as soon as windows boots again, so I don't think this would fix it without at least killing the processes/services which it depends on in windows.
Interesting virus.. very nasty
I'm gonna do some checking on all my systems. Guess its perfectly possible that poeple are losing their wallets to this rootkit/botnet - they could easily send a command to the infected machines to search for wallet.dat and send email/send it somewhere. Obviously I'm just guessing! But AFAIK you could end up infected just by visiting the wrong website :/Dude, I hate you so much! It totally wiped out my computer!
Man. Before two weeks ago I wasn't that concerned about security. This forum has made me super paranoid about network and PC security. Thanks a lot, guys.
Is there any way to detect this virus?
dban is a bit overkill if you just want to wipe the MBR and destroy data on a drive. A single zero pass would be fine Takes a hell of a lot less time!
Takes a hell of a lot less time!It does have that option. I used the so called "least secure" option of a zero pass on a 100 gb HD and it took 2 hours max. Some of the erase options dban offers are insane.
Just use a linux liveCD and run:
DISCLAIMER: DO NOT "test" THESE COMMANDS ON A SYSTEM YOU DON'T WANT TO DESTROY!!!!!
dd if=/dev/zero of=/dev/sdX
where X is the device
Did this to a 1TB drive not long ago, took maybe 4 hours... maybe a little more.
You could also do a (psuedo)random data write with
dd if=/dev/urandom of=/dev/sda
Since we were talking about these rootkit viruses within the MBR.. If you just wanted to kill the MBR:
dd if=/dev/null of=/dev/sdX bs=446 count=1
and to remove both the MBR and the partition table (which you'd have to rebuild if you wanted to use the partitions again!):
dd if=/dev/null of=/dev/sdX bs=512 count=1
DISCLAIMER: DO NOT "test" THESE COMMANDS ON A SYSTEM YOU DON'T WANT TO DESTROY!!!!!
I'd imagine these rootkits would get back into the MBR as soon as windows boots again, so I don't think this would fix it without at least killing the processes/services which it depends on in windows.
Interesting virus.. very nasty
I'm gonna do some checking on all my systems. Guess its perfectly possible that poeple are losing their wallets to this rootkit/botnet - they could easily send a command to the infected machines to search for wallet.dat and send email/send it somewhere. Obviously I'm just guessing! But AFAIK you could end up infected just by visiting the wrong website :/Dropbox didn't require a login password for a while a couple weeks ago. Anyone storing a wallet file on dropbox should've promptly transferred the bitcoins to a new wallet file.
Are you serious? They don't run automated tests on something critical like authentication? That's retarded.
And no more messages from nakowa?
I'm telling you.....again my theory....
Everytime a "BTC stolen" story gets bumped to the bottom of the page or off the page a new one pops up. Legit? I don't know.
But it's like clock work. It's like the troll brigade just wants that front page of threads to be tainted with scandal. I don't buy it. Or I should say, I'm very skeptical.
I'm telling you.....again my theory....
Everytime a "BTC stolen" story gets bumped to the bottom of the page or off the page a new one pops up. Legit? I don't know.
But it's like clock work. It's like the troll brigade just wants that front page of threads to be tainted with scandal. I don't buy it. Or I should say, I'm very skeptical.
What do you have in mind?
I updated some info by editing the original post.
You're not skeptical, you are dark.
Don't you see the blockexplorer link I've post?
I lost all my BTC. However, do you think I should cry for it everyday?
In fact, I'm busy on updating my BitcoinX (An AutoIt Shell for the official bitcoin client for windows. ) http://forum.bitcoin.org/index.php?topic=23791
Because I have to work on a virtual machine - I'm using a Macbook air, I had no time to back here for crying...
Well obviously after you had your good cry you were still reading the board!! Your only statement is against me and you call me "dark" (whatever that means) for being skeptical and pointing out a trend.
I'm not calling you a liar. People are getting robbed and I sympathize. I was compromised as well within three days of getting into BTC but I think someone was punishing me for something stupid I did. We all know it's happening.
Nonetheless, I'm skeptical. I and a few others exposed an obvious scam right on the board here so there are reports like yours that are false. If you're going to bring it to the board back up your claim.
Otherwise you are just spreading fear and pessimism and in my world that would be considered "dark".
dban is a bit overkill if you just want to wipe the MBR and destroy data on a drive. A single zero pass would be fine Takes a hell of a lot less time!
Takes a hell of a lot less time!It does have that option. I used the so called "least secure" option of a zero pass on a 100 gb HD and it took 2 hours max. Some of the erase options dban offers are insane.
dban is a bit overkill if you just want to wipe the MBR and destroy data on a drive. A single zero pass would be fine Takes a hell of a lot less time!
Takes a hell of a lot less time!
Here is an utility that I recommend people use to "nuke" their HD:
http://www.dban.org/
It is free software btw.
http://www.dban.org/
It is free software btw.
useful article, cept it doesn't tell you how to detect it lol
The advice seems to be - nuke your hard drive and reinstall!
The advice seems to be - nuke your hard drive and reinstall!
This address is receiving stolen BTC!
15Afx45asCysyNd9HE7xeZTkzLgDq2JCEx
http://blockexplorer.com/address/15Afx45asCysyNd9HE7xeZTkzLgDq2JCEx
and this one:
1GB8MHka8SXSFbJMViwkP6ANufts1qGnhF
http://blockexplorer.com/address/1GB8MHka8SXSFbJMViwkP6ANufts1qGnhF
All my BTC have transferred to this address hours ago!
------------
I'm using mac osx, and I have made an encrypted disk image to store the wallet.
A possible leak is that I used same account name and password at MtGox and Dropbox, from the first, the password is compromised, and from the last, the wallet backup is stolen, even though I zipped the wallet file with a long password...
15Afx45asCysyNd9HE7xeZTkzLgDq2JCEx
http://blockexplorer.com/address/15Afx45asCysyNd9HE7xeZTkzLgDq2JCEx
and this one:
1GB8MHka8SXSFbJMViwkP6ANufts1qGnhF
http://blockexplorer.com/address/1GB8MHka8SXSFbJMViwkP6ANufts1qGnhF
All my BTC have transferred to this address hours ago!
------------
I'm using mac osx, and I have made an encrypted disk image to store the wallet.
A possible leak is that I used same account name and password at MtGox and Dropbox, from the first, the password is compromised, and from the last, the wallet backup is stolen, even though I zipped the wallet file with a long password...
There is a new rootkit MBR virus, karpersky is almost "give up" (I hope they don't, keep it up guys!)
Infected approx 4.5million, this virus is on your harddrive MBR, it's almost impossible to detect,
In my personal oppinion, this kind of viruse cannot be detected & removed with "standard procedure".
I hope you guys are not get invected with these virus. It's P2P type of virus.
Check it out : http://www.computerworld.com/s/article/9218034/Massive_botnet_indestructible_say_researchers?taxonomyId=82&pageNumber=1
Have you run any namecoin binaries?
Can you elaborate on why running namecoin binaries in general (and not just any binary) is risky?
A few other people claiming to be hacked that I've tried to hammed detail out of (it is like pulling teeth, I might buy the conspiracy), mentioned using a namecoin binary.
And no more messages from nakowa?
I'm telling you.....again my theory....
Everytime a "BTC stolen" story gets bumped to the bottom of the page or off the page a new one pops up. Legit? I don't know.
But it's like clock work. It's like the troll brigade just wants that front page of threads to be tainted with scandal. I don't buy it. Or I should say, I'm very skeptical.
I'm telling you.....again my theory....
Everytime a "BTC stolen" story gets bumped to the bottom of the page or off the page a new one pops up. Legit? I don't know.
But it's like clock work. It's like the troll brigade just wants that front page of threads to be tainted with scandal. I don't buy it. Or I should say, I'm very skeptical.
I'm not normally one to go for conspiracy theory type stuff, but the point you raise is a possibility that can't be ruled out at the moment. It's suspicious how these guys often ask for money, and almost never provide enough info to troubleshoot. When prodded for more details they suddenly post a message with what they believe to be the loophole by which they were hacked, but without a trail of evidence to make it plausible enough to stop troubleshooting/investigating. If I were hacked I know I'd be a lot more systematic about wanting to find out exactly what went wrong, and I'd be a lot more cooperative with the people on the message boards who were trying to help me investigate what happened.
They should just all be pushed into a separate forum and urged to stick to a template if they want to get any help. Yet another case for having a bitcoin forum with better moderation.
And no more messages from nakowa?
I'm telling you.....again my theory....
Everytime a "BTC stolen" story gets bumped to the bottom of the page or off the page a new one pops up. Legit? I don't know.
But it's like clock work. It's like the troll brigade just wants that front page of threads to be tainted with scandal. I don't buy it. Or I should say, I'm very skeptical.
I'm telling you.....again my theory....
Everytime a "BTC stolen" story gets bumped to the bottom of the page or off the page a new one pops up. Legit? I don't know.
But it's like clock work. It's like the troll brigade just wants that front page of threads to be tainted with scandal. I don't buy it. Or I should say, I'm very skeptical.
What do you have in mind?
I updated some info by editing the original post.
You're not skeptical, you are dark.
Don't you see the blockexplorer link I've post?
I lost all my BTC. However, do you think I should cry for it everyday?
In fact, I'm busy on updating my BitcoinX (An AutoIt Shell for the official bitcoin client for windows. ) http://forum.bitcoin.org/index.php?topic=23791
Because I have to working on a virtual machine - I'm using a Macbook air, I had no time to back here for crying...
Do you think you could answer the additional questions people have so we could continue in trying to figure out how you were hacked?
It doesn't help your case that right now you are doing what a lot of other "I was hacked" posters do when pushed for more details the "I was hacked" -- being evasive. (by not providing the info being requested by those trying to help you out)
And no more messages from nakowa?
I'm telling you.....again my theory....
Everytime a "BTC stolen" story gets bumped to the bottom of the page or off the page a new one pops up. Legit? I don't know.
But it's like clock work. It's like the troll brigade just wants that front page of threads to be tainted with scandal. I don't buy it. Or I should say, I'm very skeptical.
I'm telling you.....again my theory....
Everytime a "BTC stolen" story gets bumped to the bottom of the page or off the page a new one pops up. Legit? I don't know.
But it's like clock work. It's like the troll brigade just wants that front page of threads to be tainted with scandal. I don't buy it. Or I should say, I'm very skeptical.
What do you have in mind?
I updated some info by editing the original post.
You're not skeptical, you are dark.
Don't you see the blockexplorer link I've post?
I lost all my BTC. However, do you think I should cry for it everyday?
In fact, I'm busy on updating my BitcoinX (An AutoIt Shell for the official bitcoin client for windows. ) http://forum.bitcoin.org/index.php?topic=23791
Because I have to work on a virtual machine - I'm using a Macbook air, I had no time to back here for crying...
And no more messages from nakowa?
I'm telling you.....again my theory....
Everytime a "BTC stolen" story gets bumped to the bottom of the page or off the page a new one pops up. Legit? I don't know.
But it's like clock work. It's like the troll brigade just wants that front page of threads to be tainted with scandal. I don't buy it. Or I should say, I'm very skeptical.
I'm telling you.....again my theory....
Everytime a "BTC stolen" story gets bumped to the bottom of the page or off the page a new one pops up. Legit? I don't know.
But it's like clock work. It's like the troll brigade just wants that front page of threads to be tainted with scandal. I don't buy it. Or I should say, I'm very skeptical.
I'd say they are pretty good. Do you think none of the programmers working at dropbox know about bitcoin?... "Hey guys, I just published that password code, see you after lunch!" ... (quick trip to starbucks to download a few wallet.dat files) ... "hey guys, I found a problem with the password code... oops!"
Dropbox staff can access your files directly, no need to introduce a password bug.
We hope to solve this very soon .... http://www.bitprotection.info more coming soon...
Jump to: