Topic: BTC stolen from electrum wallet (Read 2574 times)
I use an old laptop for bitcoin related thing. Reinstalled windows myself, chrome browser, then a antivirus software and that is it. No java, no shareware, just use electrum and blockchain wallet via chrome. Please do not install any other altcoin wallet either.
If I always used safekeys to enter password for creation/withdrawal from electrum, would that make me 100% safe?
Anyone who tells you something is 100% safe is lying.
You might be 99% safe, 93% safe or 60% safe, no one knows... but I would garner a guess that safekeys would keep you MORE safe than you are NOT using it.
The most important thing is to scan your system regularly with malware bytes and run something like Microsoft Security Essentials... Also, Disable Javascript in your browser, and whenever you come to a legit site (like youtube etc) you can click "add to exceptions" and it will let you view that page with javascript. If a sketchy site requires javascript. Do NOT activate it.
I recommend safe paper wallets made offline if you're not too good with computers.
If I always used safekeys to enter password for creation/withdrawal from electrum, would that make me 100% safe?
Well i deleted all the files that came up from the report, should I be safe now? And what so I do now for a new wallet? I don't really trust electrum but I guess it had nothing to do with it. Is it safe to make a new wallet with that program?
Let me say this: Electrum is a free piece of software that is open source. You should only trust it as much as you trust a collective group of people on the internet (everyone using Electrum and vouching for it), OR your ability to understand python code.
I personally trust my ability to read/code in python, so I don't need to trust Thomas or anyone telling me "this is a good program." I can verify this by myself.
As for this incident. I hate to say it, but your computer was compromised, and currently there is no piece of software for wallet that can protect you from a computer with a trojan.
If you deleted all the files from the report, I would say "maybe" you're safe. A good hacker could make a new form of trojan not traceable by malware detection, and then put in a second "dumb" trojan so that you will scan for it, find it, delete it, then continue on normal feeling safe... but you're not.
The best thing to do is ALWAYS ASSUME YOUR COMPUTER IS COMPROMISED.
If you want to keep your coins safe, buy a USB memory stick with over 8 GB and install Ubuntu on it, and boot your Electrum from there.
http://pastebin.com/YhUj6fzt
Thank you.
You're welcome, I originally wrote that in Japanese for my friends here in Japan, and I translated into English so I'm sorry if it's hard to understand.
If you have any questions about the process feel free to ask.
If you want to keep your coins safe, buy a USB memory stick with over 8 GB and install Ubuntu on it, and boot your Electrum from there.
http://pastebin.com/YhUj6fzt
http://pastebin.com/YhUj6fzt
+1, and OP if you have Java enabled in your browser, disable it.
Here are some more tips
https://bitcointalksearch.org/topic/keep-your-system-updated-and-stay-secure-tips-to-avoid-viruses-trojans-203876
Well i deleted all the files that came up from the report, should I be safe now? And what so I do now for a new wallet? I don't really trust electrum but I guess it had nothing to do with it. Is it safe to make a new wallet with that program?
Let me say this: Electrum is a free piece of software that is open source. You should only trust it as much as you trust a collective group of people on the internet (everyone using Electrum and vouching for it), OR your ability to understand python code.
I personally trust my ability to read/code in python, so I don't need to trust Thomas or anyone telling me "this is a good program." I can verify this by myself.
As for this incident. I hate to say it, but your computer was compromised, and currently there is no piece of software for wallet that can protect you from a computer with a trojan.
If you deleted all the files from the report, I would say "maybe" you're safe. A good hacker could make a new form of trojan not traceable by malware detection, and then put in a second "dumb" trojan so that you will scan for it, find it, delete it, then continue on normal feeling safe... but you're not.
The best thing to do is ALWAYS ASSUME YOUR COMPUTER IS COMPROMISED.
If you want to keep your coins safe, buy a USB memory stick with over 8 GB and install Ubuntu on it, and boot your Electrum from there.
http://pastebin.com/YhUj6fzt
Thank you.
Well i deleted all the files that came up from the report, should I be safe now? And what so I do now for a new wallet? I don't really trust electrum but I guess it had nothing to do with it. Is it safe to make a new wallet with that program?
Let me say this: Electrum is a free piece of software that is open source. You should only trust it as much as you trust a collective group of people on the internet (everyone using Electrum and vouching for it), OR your ability to understand python code.
I personally trust my ability to read/code in python, so I don't need to trust Thomas or anyone telling me "this is a good program." I can verify this by myself.
As for this incident. I hate to say it, but your computer was compromised, and currently there is no piece of software for wallet that can protect you from a computer with a trojan.
If you deleted all the files from the report, I would say "maybe" you're safe. A good hacker could make a new form of trojan not traceable by malware detection, and then put in a second "dumb" trojan so that you will scan for it, find it, delete it, then continue on normal feeling safe... but you're not.
The best thing to do is ALWAYS ASSUME YOUR COMPUTER IS COMPROMISED.
If you want to keep your coins safe, buy a USB memory stick with over 8 GB and install Ubuntu on it, and boot your Electrum from there.
http://pastebin.com/YhUj6fzt
Well, here is the report.
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 01/04/2014
Scan Time: 9:17:54 PM
Logfile:
Administrator: Yes
...
Processes: 1
Trojan.MSIL, C:\Users\Damien\AppData\Roaming\Adobe\AdobeUpdate.exe, 2644, , [ba7479ac88f3df57e729af99629fc040]
It appears likely that you have a Trojan/Malware on your computer posing as AdobeUpdate.
http://www.virusradar.com/en/MSIL_BattleBot.A/description
This was very likely used by a remote intruder to take a copy of your wallet file(s) and to run a keylogger that captured your password.
Well i deleted all the files that came up from the report, should I be safe now? And what so I do now for a new wallet? I don't really trust electrum but I guess it had nothing to do with it. Is it safe to make a new wallet with that program?
Well, here is the report.
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 01/04/2014
Scan Time: 9:17:54 PM
Logfile:
Administrator: Yes
...
Processes: 1
Trojan.MSIL, C:\Users\Damien\AppData\Roaming\Adobe\AdobeUpdate.exe, 2644, , [ba7479ac88f3df57e729af99629fc040]
It appears likely that you have a Trojan/Malware on your computer posing as AdobeUpdate.
http://www.virusradar.com/en/MSIL_BattleBot.A/description
This was very likely used by a remote intruder to take a copy of your wallet file(s) and to run a keylogger that captured your password.
If someone gives you a private key as a "prize" you should always sweep from it, not import it, because they control that address as well if your wallet ever happens to use it as a change address.
OP can you confirm whether this address is a deterministic one that Electrum gave you or is this an imported public address/private key pair?
cbeast thanks for the explanation!
All the addresses I used were ones generated by electrum
If someone gives you a private key as a "prize" you should always sweep from it, not import it, because they control that address as well if your wallet ever happens to use it as a change address.
OP can you confirm whether this address is a deterministic one that Electrum gave you or is this an imported public address/private key pair?
cbeast thanks for the explanation!
If someone gives you a private key as a "prize" you should always sweep from it, not import it, because they control that address as well if your wallet ever happens to use it as a change address.
3befa4d5c84ce1518327911d436b8852996da47f091d4c725a2ebca4fef98f52 is when OP received this amount on address 1jgxSfpvEeKo6PQTZXqLM9J3sH34UJZN9 and f5b06763dc780608dd63b44ed4b6a20097ed66b45c59177710cd692230fcbecb is when same amount was stolen from this address.
There is still a little hope that someone close to you decided to prank you on April 1st,
There is still a little hope that someone close to you decided to prank you on April 1st,
It is really interesting that transactions f5b06763dc780608dd63b44ed4b6a20097ed66b45c59177710cd692230fcbecb and 3befa4d5c84ce1518327911d436b8852996da47f091d4c725a2ebca4fef98f52 both had outputs of 0.35298503 BTC. This suggests that two seperate wallets share the same private key. That is practically impossible unless a hacker got into your computer or you were using advanced key management features improperly.
Care to elaborate on the bolded section?
Also the OP is using Electrum. I'm not sure electrum offers advanced key management features. Which feature are you referring to?
Just trying to learn here.
Thanks for your input.
It is really interesting that transactions f5b06763dc780608dd63b44ed4b6a20097ed66b45c59177710cd692230fcbecb and 3befa4d5c84ce1518327911d436b8852996da47f091d4c725a2ebca4fef98f52 both had outputs of 0.35298503 BTC. This suggests that two seperate wallets share the same private key. That is practically impossible unless a hacker got into your computer or you were using advanced key management features improperly.
Care to elaborate on the bolded section?
Also the OP is using Electrum. I'm not sure electrum offers advanced key management features. Which feature are you referring to?
Just trying to learn here.
Thanks for your input.
It looks like address 1jgxSfpvEeKo6PQTZXqLM9J3sH34UJZN9 is your compromised address, but I wouldn't assume it's the only one. I think there is an option to freeze individual addresses, but the safest thing to do is sweep each individual private key to a new wallet.
I myself quarantine and delete all. Restart my comp then scan again for peace of mind.
I personally use the "watch only" feature of electrum so that my private keys are not stored on the computer.
You backed up onto a USB stick. Did you ever back up onto the hard drive? Default path?
Was your computer on and electrum running when the theft occured?
I am curious whether this loss is due to some form of malware or whether the "12 word seed" used to create Electrum wallets has been broken.
Finally as cbeast said, the transaction outputs are anomalous and suggest someone could've physically accessed your computer. Is this a possibility?
I personally use the "watch only" feature of electrum so that my private keys are not stored on the computer.
You backed up onto a USB stick. Did you ever back up onto the hard drive? Default path?
Was your computer on and electrum running when the theft occured?
I am curious whether this loss is due to some form of malware or whether the "12 word seed" used to create Electrum wallets has been broken.
Finally as cbeast said, the transaction outputs are anomalous and suggest someone could've physically accessed your computer. Is this a possibility?
Where should I go from here? Quarantine/delete all the potential threats? reformat pc? throw it out? shoot myself in the head?
It is really interesting that transactions f5b06763dc780608dd63b44ed4b6a20097ed66b45c59177710cd692230fcbecb and 3befa4d5c84ce1518327911d436b8852996da47f091d4c725a2ebca4fef98f52 both had outputs of 0.35298503 BTC. This suggests that two seperate wallets share the same private key. That is practically impossible unless a hacker got into your computer or you were using advanced key management features improperly.
How do you acquire your coins? Online exchange, mining, localbitcoin.com?
Also, Damien, what version of windows do you use?
Sorry for your loss
Please let us know how the Malware bytes scan turns out.
Also, Damien, what version of windows do you use?
Sorry for your loss
Please let us know how the Malware bytes scan turns out.
Well, here is the report.
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 01/04/2014
Scan Time: 9:17:54 PM
Logfile:
Administrator: Yes
Version: 2.00.0.1000
Malware Database: v2014.04.01.10
Rootkit Database: v2014.03.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Chameleon: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Damien
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 268552
Time Elapsed: 16 min, 46 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled
Processes: 1
Trojan.MSIL, C:\Users\Damien\AppData\Roaming\Adobe\AdobeUpdate.exe, 2644, , [ba7479ac88f3df57e729af99629fc040]
Modules: 0
(No malicious items detected)
Registry Keys: 51
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\CLSID\{31DBE255-DED2-6664-AFE4-95F62E8195DE}, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31DBE255-DED2-6664-AFE4-95F62E8195DE}, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31DBE255-DED2-6664-AFE4-95F62E8195DE}, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\YoutubeAdblocker.YoutubeAdblocker, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\YoutubeAdblocker.YoutubeAdblocker.1.0, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\YoutubeAdblocker.YoutubeAdblocker, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\YoutubeAdblocker.YoutubeAdblocker.1.0, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{31DBE255-DED2-6664-AFE4-95F62E8195DE}, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{31DBE255-DED2-6664-AFE4-95F62E8195DE}, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{31DBE255-DED2-6664-AFE4-95F62E8195DE}, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{31DBE255-DED2-6664-AFE4-95F62E8195DE}, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{31DBE255-DED2-6664-AFE4-95F62E8195DE}, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\CLSID\{31DBE255-DED2-6664-AFE4-95F62E8195DE}\INPROCSERVER32, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\CLSID\{92175CF4-E534-6917-802D-73D1993E9B67}, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{92175CF4-E534-6917-802D-73D1993E9B67}, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{92175CF4-E534-6917-802D-73D1993E9B67}, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\gRReaAttsavEur.gRReaAttsavEur, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\gRReaAttsavEur.gRReaAttsavEur.2.7, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\gRReaAttsavEur.gRReaAttsavEur, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\gRReaAttsavEur.gRReaAttsavEur.2.7, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{92175CF4-E534-6917-802D-73D1993E9B67}, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{92175CF4-E534-6917-802D-73D1993E9B67}, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{92175CF4-E534-6917-802D-73D1993E9B67}, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{92175CF4-E534-6917-802D-73D1993E9B67}, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{92175CF4-E534-6917-802D-73D1993E9B67}, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\CLASSES\CLSID\{92175CF4-E534-6917-802D-73D1993E9B67}\INPROCSERVER32, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.TopArcadeHits.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{CF190686-9E72-403C-B99D-682ABDB63C5B}, , [71bd61c4710a1f172b151b2462a0817f],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{4820778D-AB0D-6D18-C316-52A6A0E1D507}, , [1f0f68bd4e2d82b4ca799ba712efac54],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{CA41BB14-E67B-1653-C57B-5CA99418A866}, , [a48a889d92e94beb7ac9083aac55dc24],
PUP.Optional.DigitalSites.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DSite, , [0826fe27304bf145e4c8c267bc45c040],
PUP.Optional.FunMoods.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Funmoods, , [c16d0f16c5b656e0a78a521ac1412ed2],
PUP.Optional.HDVidCndec.A, HKLM\SOFTWARE\WOW6432NODE\HDvid Codec V6.0, , [3cf23ee76912ca6c62454b1b30d20ef2],
PUP.Optional.SaveSense.A, HKLM\SOFTWARE\WOW6432NODE\SaveSenseLive, , [77b70223c0bb191dc7eca1ee46bdb24e],
PUP.Optional.TornTV.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Torntv V6.0, , [26082bfa37440d290cc1b0b4e31f9b65],
PUP.Optional.1ClickDownload.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\1ClickDownload, , [dc529f86fc7f74c235d58002c2414ab6],
PUP.FunMoods, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Funmoods, , [31fdc263bebdd1659de0d39f3fc31be5],
PUP.Optional.SaveSense.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SaveSense, , [7faf66bfe893db5b426d1c73828133cd],
PUP.Optional.SaveSense.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SaveSenseLive, , [17179d884d2e2412931d533ca55e35cb],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, , [35f9e342e299a98dea63563f44bf0af6],
PUP.Optional.ValueApps.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CONDUIT\ValueApps, , [58d6899c1b60c76ff4f2dc8e80823bc5],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [98968e974d2e49ed9ed125453ec45fa1],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [0925ba6baccf59dd436ed2aeb74ca060],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\installdaddy, , [ef3f6db8c1babf775d3f324f927124dc],
PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\TYPELIB\{E2343056-CC08-46AC-B898-BFC7ACF4E755}, , [f935fc2987f40d298b8ed87c649ec33d],
PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\INTERFACE\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}, , [f935fc2987f40d298b8ed87c649ec33d],
PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\INTERFACE\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}, , [f935fc2987f40d298b8ed87c649ec33d],
PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\INTERFACE\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}, , [f935fc2987f40d298b8ed87c649ec33d],
PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}, , [f935fc2987f40d298b8ed87c649ec33d],
PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}, , [f935fc2987f40d298b8ed87c649ec33d],
PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}, , [f935fc2987f40d298b8ed87c649ec33d],
PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{E2343056-CC08-46AC-B898-BFC7ACF4E755}, , [f935fc2987f40d298b8ed87c649ec33d],
Registry Values: 3
Trojan.MSIL, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Adobe Update, C:\Users\Damien\AppData\Roaming\Adobe\AdobeUpdate.exe, , [ba7479ac88f3df57e729af99629fc040]
PUP.Optional.NextLive.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|NextLive, C:\Windows\SysWOW64\rundll32.exe "C:\Users\Damien\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l, , [ed4135f0037874c21a7365e70cf52ad6]
PUP.Optional.InstallCore.A, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0H1L1J1L1S1R1N, , [0925ba6baccf59dd436ed2aeb74ca060]
Registry Data: 1
PUP.Optional.Conduit, HKU\S-1-5-21-1765719292-827427354-1992714951-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://search.conduit.com?SearchSource=10&CUI=UN13507171334195564&UM=2&ctid=CT3289075, Good: (http://www.google.com), Bad: (http://search.conduit.com?SearchSource=10&CUI=UN13507171334195564&UM=2&ctid=CT3289075),,[2e002ef72457a88eaf05c54a44c0619f]
Folders: 20
PUP.Optional.Updater, C:\Users\Damien\AppData\Roaming\DigitalSites\UpdateProc, , [52dcff26a0db40f67743bab0b151b54b],
PUP.Optional.FunMoods.A, C:\Users\Damien\AppData\Roaming\Funmoods\UpdateProc, , [c16d0f16c5b656e0a78a521ac1412ed2],
PUP.Optional.Conduit.A, C:\ProgramData\Conduit\IE, , [98963ee7ee8dd660a0d3b69cf9096b95],
PUP.Optional.Conduit.A, C:\ProgramData\Conduit\IE\CT3287810, , [98963ee7ee8dd660a0d3b69cf9096b95],
PUP.Optional.Conduit.A, C:\ProgramData\Conduit\IE\CT3289075, , [98963ee7ee8dd660a0d3b69cf9096b95],
PUP.Optional.Conduit.A, C:\ProgramData\Conduit\IE\CT3289847, , [98963ee7ee8dd660a0d3b69cf9096b95],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive, , [d35bab7a7506e155fb5d054e788a16ea],
PUP.Optional.SaveSense, C:\Program Files (x86)\SaveSenseLive\CrashReports, , [d35bab7a7506e155fb5d054e788a16ea],
PUP.Optional.SaveSense, C:\ProgramData\SaveSenseLive, , [eb43e93c64172313a1b8f85b62a0c33d],
PUP.Optional.SaveSense, C:\ProgramData\SaveSenseLive\Update, , [eb43e93c64172313a1b8f85b62a0c33d],
PUP.Optional.SaveSense, C:\ProgramData\SaveSenseLive\Update\Log, , [eb43e93c64172313a1b8f85b62a0c33d],
PUP.Optional.SaveSense, C:\Users\Damien\AppData\Roaming\SaveSense, , [3fefe1448dee4fe763f77fd49c667987],
PUP.Optional.SaveSense, C:\Users\Damien\AppData\Roaming\SaveSense\UpdateProc, , [3fefe1448dee4fe763f77fd49c667987],
PUP.Optional.SaveSense.A, C:\Users\Damien\AppData\Local\SaveSenseLive, , [61cd0a1bf487b77fc599ca890ff3b64a],
PUP.Optional.SaveSense.A, C:\Users\Damien\AppData\Local\SaveSenseLive\CrashReports, , [61cd0a1bf487b77fc599ca890ff3b64a],
PUP.Optional.Visualbee, C:\Users\Damien\AppData\Local\VisualBeeExe, , [2c0271b4afcccf67582bd87ba0620ff1],
PUP.Optional.NextLive.A, C:\Users\Damien\AppData\Roaming\newnext.me, , [59d5141174073ef80a95d2816f932ad6],
PUP.Optional.NextLive.A, C:\Users\Damien\AppData\Roaming\newnext.me\cache, , [59d5141174073ef80a95d2816f932ad6],
PUP.Optional.Multiplug, C:\Program Files (x86)\YoutubeAdblocker, , [f935fc2987f40d298b8ed87c649ec33d],
PUP.Optional.YoutubeAdblocker.A, C:\ProgramData\YoutubeAdblocker, , [7eb04ed70f6c211560d363f39d6545bb],
Files: 40
Trojan.MSIL, C:\Users\Damien\AppData\Roaming\Adobe\AdobeUpdate.exe, , [ba7479ac88f3df57e729af99629fc040],
PUP.Optional.NextLive.A, C:\Users\Damien\AppData\Roaming\newnext.me\nengine.dll, , [ed4135f0037874c21a7365e70cf52ad6],
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\YoutubeAdblocker\EczE2YPQl.x64.dll, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\YoutubeAdblocker\EczE2YPQl.dll, , [f13d2df899e2eb4b0b380f33c43db44c],
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\greatsaveer\y.x64.dll, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\greatsaveer\y.dll, , [e34b1a0bcdae80b655eeff43c93809f7],
PUP.Optional.MultiPlug.A, C:\ProgramData\YoutubeAdblocker\17o36WPGCu.exe, , [1f0f68bd4e2d82b4ca799ba712efac54],
PUP.Optional.MultiPlug.A, C:\ProgramData\greatsaveer\jL.exe, , [a48a889d92e94beb7ac9083aac55dc24],
PUP.Optional.DigitalSites.A, C:\Users\Damien\AppData\Roaming\DSite\UpdateProc\UpdateTask.exe, , [0826fe27304bf145e4c8c267bc45c040],
PUP.Optional.OneClickDownloader.A, C:\Users\Damien\Downloads\hdvid_codec_chrome.exe, , [ff2fed380576ae889e6287832bd6f50b],
PUP.Optional.NextLive.A, C:\Users\Damien\AppData\Local\genienext\nengine.dll, , [bd71f035a5d6a88ea0edaf9d8d74d927],
PUP.Optional.Pricegong, C:\Users\Damien\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pricegong.conduitapps.com_0.localstorage, , [cc6248dd6813ea4c5d6a4226eb17cd33],
PUP.Optional.Pricegong, C:\Users\Damien\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pricegong.conduitapps.com_0.localstorage-journal, , [7ab48f96c7b426107d4ab2b6679b9769],
PUP.Optional.Updater, C:\Users\Damien\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe, , [52dcff26a0db40f67743bab0b151b54b],
PUP.Optional.Updater, C:\Users\Damien\AppData\Roaming\DigitalSites\UpdateProc\config.dat, , [52dcff26a0db40f67743bab0b151b54b],
PUP.Optional.Updater, C:\Users\Damien\AppData\Roaming\DigitalSites\UpdateProc\info.dat, , [52dcff26a0db40f67743bab0b151b54b],
PUP.Optional.Updater, C:\Users\Damien\AppData\Roaming\DigitalSites\UpdateProc\STTL.DAT, , [52dcff26a0db40f67743bab0b151b54b],
PUP.Optional.Updater, C:\Users\Damien\AppData\Roaming\DigitalSites\UpdateProc\TTL.DAT, , [52dcff26a0db40f67743bab0b151b54b],
PUP.Optional.FunMoods.A, C:\Users\Damien\AppData\Roaming\Funmoods\UpdateProc\config.dat, , [c16d0f16c5b656e0a78a521ac1412ed2],
PUP.Optional.FunMoods.A, C:\Users\Damien\AppData\Roaming\Funmoods\UpdateProc\info.dat, , [c16d0f16c5b656e0a78a521ac1412ed2],
PUP.Optional.FunMoods.A, C:\Users\Damien\AppData\Roaming\Funmoods\UpdateProc\src.dat, , [c16d0f16c5b656e0a78a521ac1412ed2],
PUP.Optional.FunMoods.A, C:\Users\Damien\AppData\Roaming\Funmoods\UpdateProc\STTL.DAT, , [c16d0f16c5b656e0a78a521ac1412ed2],
PUP.Optional.FunMoods.A, C:\Users\Damien\AppData\Roaming\Funmoods\UpdateProc\TTL.DAT, , [c16d0f16c5b656e0a78a521ac1412ed2],
PUP.Optional.FunMoods.A, C:\Users\Damien\AppData\Roaming\Funmoods\UpdateProc\UpdateTask.exe, , [c16d0f16c5b656e0a78a521ac1412ed2],
PUP.Optional.HDVidCodec.A, C:\Windows\Tasks\HDvid Codec V6.0-chromeinstaller.job, , [fc32ba6b215a20167037cfc020e3d030],
PUP.Optional.HDVidCodec.A, C:\Windows\Tasks\HDvid Codec V6.0-updater.job, , [47e7ac791f5cd0669710652ac43f7e82],
PUP.Optional.Conduit.A, C:\ProgramData\Conduit\IE\CT3287810\UninstallerUI.exe, , [98963ee7ee8dd660a0d3b69cf9096b95],
PUP.Optional.Conduit.A, C:\ProgramData\Conduit\IE\CT3289075\UninstallerUI.exe, , [98963ee7ee8dd660a0d3b69cf9096b95],
PUP.Optional.Conduit.A, C:\ProgramData\Conduit\IE\CT3289847\UninstallerUI.exe, , [98963ee7ee8dd660a0d3b69cf9096b95],
PUP.Optional.SaveSense, C:\ProgramData\SaveSenseLive\Update\Log\SaveSenseLive.log, , [eb43e93c64172313a1b8f85b62a0c33d],
PUP.Optional.SaveSense, C:\Users\Damien\AppData\Roaming\SaveSense\UpdateProc\config.dat, , [3fefe1448dee4fe763f77fd49c667987],
PUP.Optional.SaveSense, C:\Users\Damien\AppData\Roaming\SaveSense\UpdateProc\info.dat, , [3fefe1448dee4fe763f77fd49c667987],
PUP.Optional.SaveSense, C:\Users\Damien\AppData\Roaming\SaveSense\UpdateProc\STTL.DAT, , [3fefe1448dee4fe763f77fd49c667987],
PUP.Optional.SaveSense, C:\Users\Damien\AppData\Roaming\SaveSense\UpdateProc\TTL.DAT, , [3fefe1448dee4fe763f77fd49c667987],
PUP.Optional.SaveSense, C:\Users\Damien\AppData\Roaming\SaveSense\UpdateProc\UpdateTask.exe, , [3fefe1448dee4fe763f77fd49c667987],
PUP.Optional.NextLive.A, C:\Users\Damien\AppData\Roaming\newnext.me\nengine.cookie, , [59d5141174073ef80a95d2816f932ad6],
PUP.Optional.NextLive.A, C:\Users\Damien\AppData\Roaming\newnext.me\cache\spark.bin, , [59d5141174073ef80a95d2816f932ad6],
PUP.Optional.Multiplug, C:\Program Files (x86)\YoutubeAdblocker\EczE2YPQl.dat, , [f935fc2987f40d298b8ed87c649ec33d],
PUP.Optional.Multiplug, C:\Program Files (x86)\YoutubeAdblocker\EczE2YPQl.tlb, , [f935fc2987f40d298b8ed87c649ec33d],
PUP.Optional.YoutubeAdblocker.A, C:\ProgramData\YoutubeAdblocker\17o36WPGCu.dat, , [7eb04ed70f6c211560d363f39d6545bb],
Physical Sectors: 0
(No malicious items detected)
(end)
Why do people have to take what's not theirs... 
Sickening.
Sickening.
Another precaution you can take against keyloggers is an on-screen keyboard that hides anything you enter into a password field. I usually type all sensitive information with Neo's SafeKeys. It's a small easy to install program, that gives me another layer of peace of mind.
There's many much more robust password programs out there, but I like the simplicity of just typing them in myself. Even if you run a malware detector, it's possible that which ever one you use will let some malware through.
Always assume you have malware installed.
There's many much more robust password programs out there, but I like the simplicity of just typing them in myself. Even if you run a malware detector, it's possible that which ever one you use will let some malware through.
Always assume you have malware installed.
thank you for the valuable info kind sir
Another precaution you can take against keyloggers is an on-screen keyboard that hides anything you enter into a password field. I usually type all sensitive information with Neo's SafeKeys. It's a small easy to install program, that gives me another layer of peace of mind.
There's many much more robust password programs out there, but I like the simplicity of just typing them in myself. Even if you run a malware detector, it's possible that which ever one you use will let some malware through.
Always assume you have malware installed.
There's many much more robust password programs out there, but I like the simplicity of just typing them in myself. Even if you run a malware detector, it's possible that which ever one you use will let some malware through.
Always assume you have malware installed.
How do you acquire your coins? Online exchange, mining, localbitcoin.com?
Also, Damien, what version of windows do you use?
Sorry for your loss
Please let us know how the Malware bytes scan turns out.
Also, Damien, what version of windows do you use?
Sorry for your loss
Please let us know how the Malware bytes scan turns out.
Through online exchange. My windows version is 7 home premium. I will let you know what the scan tells me.
How do you acquire your coins? Online exchange, mining, localbitcoin.com?
Also, Damien, what version of windows do you use?
Sorry for your loss
Please let us know how the Malware bytes scan turns out.
Also, Damien, what version of windows do you use?
Sorry for your loss
Please let us know how the Malware bytes scan turns out.
Hi, please use imgur.com for uploading screenshot.
Ps: Scan your pc with malware byets anti malware and
did you have saved unencrypted wallet backup somewhere or saved seed in some insecure place like email?
Ps: Scan your pc with malware byets anti malware and
did you have saved unencrypted wallet backup somewhere or saved seed in some insecure place like email?
thanks for the help. I did have a backup on a usb that was attached to the pc while the coins were stolen but it was still protected by the same password for withdrawal no? seed is only on paper no where is it saved on pc.
It's odd that they are seemingly random amounts.
Hi, please use imgur.com for uploading screenshot.
Ps: Scan your pc with malware byets anti malware and
did you have saved unencrypted wallet backup somewhere or saved seed in some insecure place like email?
Ps: Scan your pc with malware byets anti malware and
did you have saved unencrypted wallet backup somewhere or saved seed in some insecure place like email?
Someone found out your private key? Keylogger? Virus?
Can anyone shine a light on how this happened??? I had a decent password to my understanding (~15 characters with numbers and symbols).
I've never had an issue and suddenly an hour ago my coins got withdrawed on six seperate transactions to the same address until they finally were all depleted..
heres a screenshot
https://i.imgur.com/LWXNChd.png
Im a noob so don't understand why the make it so complicated to post an image..
The coins were all sent to this address: 17avcFVaa9dWNXiEx9ALChvN77py9dmHwC
I've never had an issue and suddenly an hour ago my coins got withdrawed on six seperate transactions to the same address until they finally were all depleted..
heres a screenshot
https://i.imgur.com/LWXNChd.png
Im a noob so don't understand why the make it so complicated to post an image..
The coins were all sent to this address: 17avcFVaa9dWNXiEx9ALChvN77py9dmHwC
Jump to: