Topic: Electrum wallet virus (Read 916 times)

I should but i can't. I'm sure about the sed words, sure about the password. I make three copies of it. I have only 3 wallets, i check the password of each and the seed , everything is in the right place. I try old versions of electrum. I try in a second pc.
I don't know what to do seriously. I am sure the wallet is corrupted, because normally i can restore an older version. On this particular wallet, i can't.
My only chance, it's maybe to restore the old password but i don't know if it's possible and how to do it.

I only use this wallet when i change the version. I am sure that when i install first the 3.4 version and 24 hours later the 3.5 version with changing the password, it makes something about the wallet and the password...

Regardless of your password or wallet file being corrupted... You should still be able to recover using the seed. The fact that your seed is coming up with an empty wallet, leads us to the only logical conclusion. Which is that, unfortunately, some how you have ended up using a different wallet than the one you copied the seed down for. Possibly a wallet file that you had already  generated before creating the one that you have the seed for... But then by accident you started using the first wallet which you didn't have the seed for.

How many files are in the "wallets" directory if you select "file -> open"?

If you have multiple... Do any of the other wallet files contain the same addresses as the wallet restored with your seed?

No one seed. Only one.
No , i don't imported multibit seed on electrum. I transfer my bitcoins from multibit wallet to electrum wallet. It was 1 year ago.
Since, i did not have any problem. All begins with first installation of electrum 3.04 and next electrum 3.05 and when i change my password.

i really think my wallet.dat is corrupted.

I'm a bit confused about this... So, you have 2 seeds? Why do you have 2 seeds?

You should have had one before the upgrade and you should be using the same one after the upgrade.

Was your old seed an old MultiBit HD seed that you imported to Electrum? If so, you would have used the BIP39 seed option... When you do this, Electrum doesn't check the seed for correctness, so you need to be extra careful when typing it in. Also, just checking that when you restored from seed after the upgrade that you changed the derivation path from the default of m/44'/0'/0' to m/0' right?

Or when you migrated from MultiBit did you create a new Electrum seed and moved the coins from old addresses to new addresses?

Not during the upgrade, after the upgrade. It was a security problem. So i change it.
I'm sure 100 % of my password. VERY VERY SURE. I have the seed before the upgrade and the new one.
I check everything 10 times, believe me. I'm not kidding with this kind of stuff.

I had a similar problem with Multibit. And that's why i transfer all on Electrum. Now, i'm stuck with 2.5 btc on the wind.
I don't know what to do. I try with btcrecover but i can't make it works... I'm desperate..
Thanks electrum

Oh, so you actually changed your password during the upgrade? Then it sounds like you have mis-typed your password when you were entering the new one... maybe you had capslock on my mistake? or if you used the "shift" key to type uppercase/symbols then you may have inadvertently typed some extra uppercase or accidental lowercase letters or typed a letter instead of a "symbol" etc...

In this case, btcrecover might be very helpful... it can automatically try various combinations of common "typing errors"... especially if you are fairly confident you know what the password SHOULD be.

As for the seed words... I'm wondering if during the upgrade, you got the seed words for a new unused default wallet by mistake? and not the seed words for your actual wallet. Where/how did you double check the seed words? and did you not have an earlier backup of the seed words written down somewhere?

It is also possible that you've simply spelled one of the words wrong and it just happens to make a valid seed. Some of the words are very similar and it is easy to mix them up (kid, kind, kit, kite etc)

If you know of one of the first few btc addresses from the wallet, btcrecover also has a "seed recovery" option that might be able to identify errors in your seed if it is simply one or two wrong words (this won't work if it is just completely the wrong seed however)

Good point. I try it , but it's not default wallet or other one.
When i put the new version, i changed my password. I wrote it. And i check again the seed words and i wrote it.
I'm sure 100 % of my seed words and my password. I tried everything except using btcrecover... This is a shame.

Who have any solutions, it will be great and i will a reward for getting my wallet back.

If you look in the wallets folder (http://docs.electrum.org/en/latest/faq.html#where-is-my-wallet-file-located), are there other wallet files there? It's possible that you were not using the "default_wallet" with the earlier version of Electrum, and when you updated to the newer version, on first start, it defaulted back to "default_wallet", hence why your password is not working.

As for the seed restoring an empty wallet, have you ever used your seed words to restore your wallet before? It would seem you have a "valid" seed, but not the seed for your wallet I've seen several users over the last few months who have written down a valid seed but have some how ended up using a different wallet... So, when they try and restore from seed, they get an empty wallet.

I used the same official electrum, i check it. I have a big problem with it.

There are no viruses in Electrum that remove the installed applications of antivirus. I used the official update of Electrum for but I have no problem. I think your downloaded software is infected or you download unknown wallet. So download the official wallet and used Electrum , do not worry.

1 / Last time was the 8 th january.
2 / I have the seed words. When i put them, i have my wallet back, but no money on it, no transactions, no history, nothing...
3 / Standard Wallet
4 / 2.8 to 3.04 first and 24 hours later 3.05 all from the Electrum official Website. I did all the verification, i was very suspicious about the new version...

Something wrong with Electrum and this story...Be very careful and thanks for any help.

Then the password you are typing in is incorrect. When was the last time you used the password you are trying to open the wallet? Was it months ago? or was it yesterday?


How exactly are the seed words "doesn't works"? Is it giving an error? Is the "next" button not available... is it just showing a 0 balance? do you see any transaction history?

What sort of wallet was it? Standard? MultiSig? 2FA?

What wallet version did you upgrade from? What version have you just installed?

Can you confirm you downloaded the file from: https://electrum.org/#download and did you check the digital signature?

I gat the new version of Electrum... Now impossible to open my wallet with the right password...
And when i try to recover it wth the seed words, it doesn't works...

Great job, what i have to do now ?

No... it is just the way that GPG works... you can import keys, but not TRUST them... until you explicitiy trust the key you will see something like:



NOTE: THIS IS A GOOD SIGNATURE! The signature checks out, and the file is signed with the signature... YOU just haven't trusted it yet.


If you "trust" ThomasV... then you can sign the key, saying that you vouch for Thomas and he is legit and all things signed with his key are legit... then you will see something like this:




The important thing is that you DON'T see a red warning like this:


If you see "Invalid Signature" then that is BAD!

I did verifying signature's process with GPG Kleopatra. electrum 3.0.5 verified but says the data could not be verified. Is there any problem with Electrum 3.0.5?

I don't see it either. could you give us a screenshot?
Maybe electrum.org is hacked.

Version 3.0.5 got released about 13 hours ago, as a follow up to 3.0.4 (which mostly shut down the vulnerability) [1].
No way you got 3.0.5 for a long time now. You might verify the signature of your current version to exclude the possibility of a malicious application.

[1] Release notes: https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES

Huh? It has been showing 3.0.5 for me for a long time. Try clearing your cache.

Somewhat confusingly... the links on the "download" page still link to version v3.0.3 downloads!!?!

For the record, the v3.0.5 downloads are here: https://download.electrum.org/3.0.5/

Seems, like my chrome is "broken", or my ISP is caching stuff again to be "helpful"... *sigh*...

This warning is written at the top of the electrum website home page. I don't know how you missed it.

https://electrum.org/#home



The release notes on the electrum github explain that version 3.0.4 didn't completely fix the vulnerability, so version 3.0.5 was quickly released a day later.

https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES

Very strange Electrum 3.04 seems a phising link for me...They say to update but i can't read nothing on electrum official website.

Yeah, It happend immediately after installing Electrum and GPG thing, I don't know which one is the culprit. I managed to restore my system..
But I'm still using Electrum 2.xx.
I'm afraid of using the gpg verifier because It might happen again. So I'll backup my system and try Electrum 3.0.3.

Generally speaking, no. Its relatively hard to replace the information on that site. However, it is by no means, impossible if you have a zero day exploit or is a huge organisation with vast resources (ie. Governments).
No. There's no such thing as real or fake. If you were to download from there and verify the signature, it would be just like saying you trust ThomasV and he is correct.

If you need to verify: https://bitcointalksearch.org/topic/m.25624488.

Quick question guys:

I'm not very good with computers and I therefore have troubles understanding how to verify a signature. I read everywhere that you need to do this when downloading Electrum 3.0.4
Would it be incredibly dangerous to therefore skip that step, as long as I make sure I only download Electrum from the official website https://electrum.org/#download ?
After all, the version on there has to be the original, real one for sure? Any yes, some people will now probably answer that you can never be sure, but as long as I can be 99,9999999% sure then it's fine for me.

stop being dramatic, Electrum is not compromised and it certainly has NOTHING to do with this topic.

what happened is that any version below 3.0.3 has a vulnerability that may be compromised if
- you have Electrum open
- you haven't set a password
- at the same time you visit a website that is looking for this exploit and runs a script using the RPC commands to steal your private keys

Warning, read the news header in here, do not use Electrum 3.0.3 because it is compromised, update your Electrum clients immediately.

It's not enough to tell people to "be sure it's really from the official site."

This is what is necessary.

A) Locate the official site, such as by looking at bitcoin talk.org. NOT GOOGLE.

B) Type the URL in. Do not click on a link.

C) DL the program and verify the PGP signature.

Do it, get used to it. Do it again just for practice.

.pyc are compiled python files (modules loaded in scripts).
Did you already try to do a full scan of your pc with your AV?

How is this problem related to electrum? Did this problem start occuring after you installed electrum?
If so, did you check the signature or at least the checksum?

You can find the signature for the current windows installer [1] and the standalone executable [2] on their official site, just like the ThomasV's PGP key [3].
You can verify your files (if you have gpg installed) with gpg --verify electrum-3.0.3.exe.asc electrum-3.0.3.exe in your command line.

[1] https://download.electrum.org/3.0.3/electrum-3.0.3-setup.exe.asc
[2] https://download.electrum.org/3.0.3/electrum-3.0.3.exe.asc
[3] https://pgp.mit.edu/pks/lookup?op=vindex&search=0x2BD5824B7F9470E6

Hey guys, I know It's an old thread, but my antivirus
finds new infected files every 5 minutes

always in the same directory.. I can't do a system restore because it's windows 8.1 recovery error 0x80070005

And every single infected file ends with .pyc
e.g.: bitcoin.pyc

i've accidentally tried again to download electrum and i haven't had that problem again

thanks, I know that bitcoin site but I would like to know, if Electrum is considered the best for Win10, what's the second one? A person suggested me Jaxx but on Quora they said it was badly coded and that has been hacked etc. I prefer not to install something on my cellphone nor installing other OS on my laptop but in the near future I plan to buy an hardware wallet. However, is it so dangerous to keep them on Coinbase? I've read there that they are insured and that they store the 98% of the customer's funds in a cold storage

I downloaded v3.0.3 yesterday... tried to run it... Windows popped up a big red box saying that it was blocked... Something about it not being signed software... Defender and MalwareBytes both detected nothing... I verified the digital signature of the file using GPG and signature... Re-ran it, and clicked the "proceed anyway" button on the big red warning box

I assume the warning was because it wasn't a "windows" signed application... probably requiring payment to Microsoft

https://bitcoin.org/en/wallets/desktop/windows/

https://bitcoin.org/en/wallets/hardware/

You can also consider using Mobile wallets but study first what is that all about.


Windows Defender is not that sensitive in terms of malwares and small virus. I don't know what's the catch here so to verify that, I downloaded Electrum just now and my Windows Defender didn't detect such malwares.

Do you know how to use Linux? It does not really need a highly technical person to use it. I suggest you try Bitkey. It is a bootable Linux operating system with all your Bitcoin storage needs preinstalled.

https://bitkey.io/

thanks to everybody, you have been all very kind. Could you suggest me another good wallet that I could try?

I think it's not legit the electreum because most of us are scam and it's too much to use here because everyone has to use it just because of the time and tired of it because the electreum does not have an exchanger marketcap, I just say no to this facebook scam and do not waste time here because it does not pay anything.

Since you have said it's from the official site, then its to be sure its really from the official site. If its there, then there is nothing to worry about. A lot of people uses this software and it is yet to fail which its expected to stay that way. I have downloaded it but on Windows 8.1 which I haven't had any issue whatsoever even with a very strong anti virus until I discontinue its use. Just go trace the source, validate it, then make exception for your antivirus or better still download the android version.

We cannot stress this enough to the new users.

Learn how to use PGP and checksums for verifying anything you download online, even if it is from a trusted source. Windows users especially.

With that in mind, I believe we should get ready for the newbies. Bitcoin's new found popularity among the mainstream will take them here to ask questions and complain. Haha.

first make sure that you have actually downloaded the correct file!
the real one is this:
https://download.electrum.org/3.0.3/electrum-3.0.3-setup.exe
then verify the  signature of what you have downloaded by using the file signature:
https://download.electrum.org/3.0.3/electrum-3.0.3-setup.exe.asc
and the signers public key:
https://pgp.mit.edu/pks/lookup?op=vindex&search=0x2BD5824B7F9470E6

if you did that and the signature was correct then you can be sure that your antivirus is detecting a false positive. simply ignore it (add Electrum to exclusion list of your AV or use another AV). it is not the first time they have detected Electrum as a trojan or something.

It is like my antivirus. It  delete something that i just download from official website.
But i think we have to put the wallet in exception of the antivirus and no need to worry about the walletbit is safe.

Windows deffender is too sensitive, you can check more accurately on the VIRUSTOTAL site, if the red number shows 0 then the wallet is safe, this is very common on the desktop wallet

I just heard about the virus when you upload your wallet,
sayarasa virus is not happening from the download you do
but it is downloaded from the website where you download the electrum wallet.
try to download it from the official electrum website

Almost all of the cryptowallets are detected as virus depending on what antivirus u used. I simply consider it a false positive especially if it comes from their websites. You have no choice than to exclude that particular wallet in your AV

Have you downloaded it from their official website? Because then it will be fine. And your antivirus is just doing it because it is not recognizing it or don't have its certificate in its database, there is nothing to worry about, you can just disable your antivirus for a few minutes, download and install and then reactivate your antivirus again.
Electrum is one of the most used desktop wallets, I am also using it and its one of the top trusted ones too.
But make sure you are downloading it from their official website.

If you downloaded Electrum from "official website" there is nothing to worry about. Sometimes any antivirus picks false positive files and automatically quarantine them. You have two choices, look for another wallet but I am using Electrum and is trustworthy and of best desktop wallets out there, the second option is disable antivirus, download wallet and install. Then go location where wallet is installed and scan files from right context menu. Sometimes antivirus software will delete zip/far filed automatically so this may be the case too. If you install from the official website there is nothing to worry about.

Hello everybody! I was just getting ready to start my experience with bitcoin and as many recommended, I downloaded Electrum for windows 10 from the official site but as the download finished, windows defender has found a virus, a trojan and deleted it automatically. This seems a bit strange because I've seen many people talking about this wallet positively, could you tell me if you get the same result? I plan to buy soon from Coinbase, what wallet for desktop should I get instead of Electrum? Please let me know, thank you very much!