Quote from: Hippie Tech on April 02, 2015, 03:48:32 PM

Quote from: user8x8 on April 02, 2015, 01:24:41 AM

Quote from: Hippie Tech on April 01, 2015, 11:19:57 PM

Quote from: bathrobehero on April 01, 2015, 08:26:08 PM

Quote from: Hippie Tech on April 01, 2015, 01:09:37 PM

In short. Its finally happened peoples. lol I HAVE BEEN HACKED ! Shocked

I first became suspicious 2-4 days ago, then decided to test it out with some CANNdy flavoured bait. Wink

200 CANN wasn't enough but 3200 WAS ! lol
TXid : cd276e4d9619e5e201e60ded1c438bf3d2a5c52f6c4a7bea595d3c213327eb41
EDIT : https://chainz.cryptoid.info/cann/address.dws?CTSFTDzKSonarDJgpuRxukPrECXrby1eSe.htm

I woke up and noticed that my email account was up and the new/temp password from Polo or Ccex was selected and thought "WTF !!".

I did not request the password resets.

Check the processes with taskmanager and you will see the client is running as service.exe*32 and/or crcss.exe*32 and/or some other name. Right click the process and choose "open file location" when you are ready to delete it.

If deleted, it will rewrite itself to the program files(x86) folder after the system is rebooted.

The file responsible for this was found in one of the user's temp/Windows Live/ ID folders. EDIT This stopped after I disabled then deleted service.exe (and everything else) from the temp folder.

Terminating one of those .exe*32 processes caused my right to automatically reboot.

Congrats asshole(s) !

Please step forward so that the world may know your inbred shitcoin stained face !

How did you managed NOT to get hacked before if you haven't use 2FA, Sandboxie or VM? Anyone who don't launch random wallets in a controlled Sandboxie, VM or on a remote machine with a throwaway OS is pretty much asking for getting hacked.

Who knows. I've often wondered that myself. Tongue

Just to be clear, the coins were taken from my freshly baited wallet and not from Polo, Ccex or Bter.

@all

While we're waiting for an explanation, please check your "program files(x86) and the youruser/appdata/local/TEMP folders.

Perhaps these files were injected with a virus on your own computer which has been infected for awhile now?

Can you zip your versions of .exe and .dll and upload for investigation or perhaps try virustotal both your files?
Because obviously the official wallet distribution is clean.

I do not believe that the pc was infected previous to this because the hacker went for my most recently used /traded coins.

https://bitcointalk.org/index.php?topic=984878.msg10926344#msg10926344

Here is the download link I used and if there was anything left over, it was erased when the drive was cleaned and formatted.

Some XAI and 350k DGB was also taken.

In first post looks like you want ASN cheap rebuy.