Bitcoin Forum

Hello,

I was wondering if anyone else had this issue with bitcoin. I'm really thinking I picked up something nasty somewhere that my anti-virus (Comodo and Malware-Bytes) isn't picking up.

When ever I copy a bitcoin address and I paste it into a document, including the webpages, the address changes to another address not associated with what I'm trying. I can copy and paste multiple times until it pastes the correct address, but this is rather annoying. Has anyone else had this issue, and if so does anyone know a fix without having to wipe everything from my machine?

Thanks,
Anthony
A.K.A. Valandor

It's definitly a virus that you have there , it basically works like this : you copy adress to send to your friend for example , it changes it to the adress of the virus owner so you send it to him instead of your friend or whoever you was going to send it to .
I'd recommend you to wipe your PC right now and check this out my topic here : https://bitcointalk.org/index.php?topic=1152619.0

That indeed sounds like a virus and if your virus scanners aren't picking it up I think it's best if you wipe the OS clean and install a new one and this time add antiviruses with boot time scan, so they can pick something up which gets through the real time scan. There are a few things you can try but why take risk of losing any bitcoins, if I had seen anything happening like that in my PC, I would have wiped it off clean by now.

OP - that sounds bad, very bad. Seriously I wouldn't attempt to do any more bitcoin transactions until you resolve this. To be honest I'd be tempted to never use that computer again for bitcoin related activity.

On top it would be best to not even enter passwords or access anything security related. If you have this virus already then the virus creator can very easily upload other modules, for example a keylogger. He then could observe you typing passwords and voila... accessing your wallet or so.

usually a virus steal your wallet directly, this sound somethign messed up with your os or drivers or something else, it could still be a virus but i don't know, try to scan with other antivirus
and btw what address is displayed after the change? it's a fresh new address without bitcoin or it's already used? also from where you are copy pasting address? from core?

such virus would unlikely be caught by antivirus because it is not a keylogger and does not do the things that virus usually does, so I won't be surprised if it it is indeed a virus


but be sure that you are copying the correct address, just in case

Personally I'd just trash the computer. The potential harm here isn't limited to bitcoin theft. He could have his debit card, credit card details stolen & end up being a victim of fraud.

If you have bitcoins on that computer send them to a paper wallet created offline & throw that computer in the trash.
You're playing a dangerous game by keeping that computer.

Yes it is malware. You probably entered some crypto related apps recently. The most popular version is  called "COIN RPG MALWARE". You get this from CoinRpg.exe
Detailed raport:  https://malwr.com/analysis/MjdlNmEwZjcwZmM1NGYwYjlmZTYwZjc3OWFiZGQ1YzU/ (https://malwr.com/analysis/MjdlNmEwZjcwZmM1NGYwYjlmZTYwZjc3OWFiZGQ1YzU/)

Obviously this is virus/malware, you need to more carefully if you find some site or file which come from bitcoin related or anything something fishy things.
This is for reference for you to avoid this things happens again: https://bitcointalk.org/index.php?topic=203876.0

I would agree with this.  I would unplug from internet right now, and that hopefully prevents it from sending some of the information.  Although it's most likely to late.

Make sure to backup bitcoin wallet if you have not already. Blow away that computer and reinstall OS.  Now look into cold storage and put the coins in a safe cold storage.

After avoid what ever sites you were going to or downloads you were doing that might have caused it. 

Well he doesn't need to throw a computer in the trash for God's sake. Reformat everything and install a fresh version of the operating system will just do the job.

OP, I hope you haven't lost any valuable info or even some bitcoins to this malware. Clean everything, double check everything, and change all the passwords, and of course, depending on the wallet you use, make a new wallet on a secure machine and send your coins to this address.

Good luck!

Hello all,

Thank you for all the responses. I will be wiping this machine and reinstalling the os after a little bit of backing up is done. Before that I will be creating a program to watch my clipboard and log any programs that modify it and the location of those files so I know were I got this nasty little thing from. I think it's just changing my clipboard information as I don't have anything weird trying to connect to the net. Thank you all again.

I would do another simple thing (if I had the possibility). I will download another wallet in another computer (a laptop for example if you have one), will copy paste the dat file of my old bitcoin wallet from the old computer there. So all my bitcoins will be transferred. then in this clean computer will do all my transactions I want. If you have a web wallet the thing is more simple. Because it was enough to open your wallet from a clean computer and sent from there your bitcoins where do you want.

Well a quick update on this. I found the culprit, something called recoveryBTC. From my logs it seems that my nephew decided to try and install it. Thankfully it was sand-boxed and wasn't allowed network access, and most of the files were quarantined long ago. I use a web-based wallet with double verification when I login, just seems safer than keeping it on my computer. I sent the file which was causing the issues with a description of what it was doing to Comodo and Malware-Bytes.

Thankfully my machine is locked down pretty tight from anything I don't want accessing the net and I keep logs of everything people do on it.... It's how I make a living.

What was the address it was changed to? Maybe someone can track the hacker down.


Well using something like blockchain.info can be safer than storing them on your computer and may have saved you here but you're relying on a third party to keep your coins safe. Something could always go wrong on their side so keep that in mind.

No there was a virus that actually did this same thing. It observed the clipboard for bitcoin addresses and changed the addresses to ones that belonged to the hacker. It's a pretty old virus design actually i believe.

It's a classic virus. What is a virus if not something that sneaks into a computer to do malicious things? Viruses aren't only keyloggers.

Exactly. It's hard to know if all traces are killed. I once had a virus that reappeared on both OS i had on that computer at that time. I deleted it and it came back and showed even up on the other OS. Until i noticed that the bootloading screen had some strange signs showing. So i thought maybe the bootloader was infected, i overwrote it and killed all virus files on the OS and it was gone.

No Virusscanner had detected that... or maybe they had but couldn't do anything against. I wasn't informed about the bootloader virus though.

*lol* Your nephew... i think with nephews like that you need no enemies. Make sure to keep him away always a arm length wide. He is dangerous and would take away much more from you if you give him the chance.

So what do you mean with sandboxed? Would the software have stolen your coins otherwise?

Reading that... i wonder how many "hacks" actually were people that had access to that computer.

I would not let my computer open to others. It's fully encrypted with truecrypt.

well i dont know but something is wrong with your pc...

Thats sounds like a virus or remoting your pc.If your PC is infected the best way to clean your PC is format. If You dont want to  format your pc you may try this http://www.instructables.com/id/Removing-virus-without-using-anti-virus/?ALLSTEPS

Format is surely the safest way to kill everything on the harddisc but you can be unlucky, format and install everything new and still... the virus is back. If that happens then you might have a bootsectorvirus. He will start on startup and download the real virus again. The only way to kill it would be to overwrite the bootsektor and delete all viruses then.

So format is no always the full solution.

can you please explain the situation more clearly..like what browser you are using or what bitcoin wallet you are using so it will help us to find the solution faster

I would like to remind there is a huge chance that your AV software will not be able to detect most recent viruses and malware. It is always a good idea to try with different AVs.

i think you need upgrade and update your antivirus
or u can back up your wallet and try Re-instal your windows

I have the same problem. Whenever i copy and paste my bitcoin address, it changes to another. But i noticed it only changes the bitcoin address, not any other address. so i was telling is there any way to fix this problem without removing/wiping my whole pc or os. i mean its too much work. Please help.

We can't do much to directly help you but I try to tell you what can you do.

At this point it is certain, your machine is infected with virus/malware. They only way is to find what that virus is and remove it. If you fail to do that you need to purge your system.
To remove malware I suggest you can use Malwarebytes Anti-Malware or Kaspersky Anivirus - these two helped me before with extremely pesky trojans which other antiviruses refused to clean or even find.

Are you a Hearthstone player? Because I heard about this type of malware hidden in third-party tool for Hearthstone.

And be aware that browser extensions (plugins) can also do malicious things and aren't detected by antivirus scanners AFAIK.

You are right I was one of the victim of such malicious script injected through firefox add-on. When ever I tried to paste a bitcoin address, got pasted different bitcoin address in blockchain wallet's sent field and lost around 0.005 bitcoins in 2 to 4 transactions before I noticed the problem.

I checked another member also had shared similar problem here in this forum at that time but with no concrete solutions, but I just resolved this by uninstalling my browsers.

it sounds dangerious since i can be easily fall for this type of viruses but never did. thank you for notifying this i will be alert

That's not virus it's a code that in your console browser i think you just goo in youtube channel and looking for some tricky things on how to get bitcoin fast? Lot's of videos there are definitely FAKE if you download a file or what so ever and added on your browser clear your cache and your browing history and everything will be fine :)

Years ago, I have encountered a virus such as this one. To remove that virus, the only solution is via formatting your pc and erase every partition of your hard drive then create a new one. That way should have removed that virus. If it is still there after doing what I said, it's a different virus from the one I have experienced. The easiest way out of this though if formatting don't work is buying a new pc but that will be to expensive.

i know this is an old post but i just recently opened a file that was supposed to be a faucet auto bot and it installed this file umzs.exe and opened it which was hijacking my clipboard only if a bitcoin address was entered.. i opened task manager and killed it went to startup and opened file location and removed it. this should resolve the issue if anyone else has the same one

This is silly, simply have best antivirus to your PC for swipe away from the malicious attacks.  Trojan attacks do critical to take from the computers best thing just format your disk and install a any antivirus on it.

HINT : Always double check the prefix and suffix of the address before you hit send !!!

Dude. Smack your nephew very hard over the head for being such a simpleton.
People make these kind of programs so gullible or mostly plain stupid people think k ot actually works. It is like clicking opening up and installing a file names "free btc.exe"

Anyway what this program you have does is it changes your copy paste to am address they own in the hopes you dont check because you just copy pasted right ?it should be identical so you hit send and there you go bitcoin given to the guy who made the program.your nephew could have cost you so many bitcoins.

The best thing you can do is to save the SEED if you haven't already done so from your wallet. If you use online web wallet , well time to change to a desktop one like Electrum which is the best we have so far for free. I advise you to format your PC (of course after you have backed up all important data that you keep in your PC) and after a clean install, install first a good Antivirus. Only after install electrum and restore from SEED , I have taken Electrum as an example here.

If you use another wallet, in that case just copy the wallet.dat and save it in a USB. Better to spend some time rather than relying on some AV to remove such keylogger malware. In most of the cases once your PC is infected AV or Spyware remover cannot do that much.

i cant remember if i replied to this or not but it was as 1J or IJ wallet it was easy to pick out that it wasn't mine.. open task manager there is a program running that shouldn't be, you can find it easy because it will be in your startup files as well.. remove it, you'll be fine.. you have to kill it to cause it is running and stop the startup process, then the 2 dlls that were in the zip file. search for them and take ownership then delete them as well

edit: i did reply but not thoroughly as i did in the other post, its a 4 letter exe file i forget the name, i had to stupidly ignore a trojan warning on my virus scanner. i somewhat know how to remove viruses myself but you should never open iffy programs. i was stupid to ignore my own advice i give everyone but people who know how to remove viruses sometimes feel they are immune. i am lucky that i noticed the address change as i could have ended up sending him money or working towards his bitcoins for ads and stuff online.... be carefull everyone. do not click everything u see in the forum they do not delete scams. its up to you to spot them out. be smarter than i was

it's called "clipboard hijacking".  there's a lot of these circulating actually around.

you are definitively infected.  this has happened to a lot of users recently, as this malware got now several new versions.

I have recently watched at one of them source code, and it's evil of simplicity  lol 8)   

to resume: clean your computer ASAP .  and next time don't click on any .exe or jar file you don't know, or don't need.

the file
called
appconfig.exe
u will see it in task manager
there no antivirus block it
prolly changes names