Bitcoin Forum

he asked me to test this file on skype - http://www.filedropper.com/danza

now when i scam i found that its virus

pls check this file , is this a virus ??

if yes then i will show skype of him sending me this file

please give him red trust - https://bitcointalk.org/index.php?action=profile;u=345487

Hacked my pc and the application doesnt close until u shut down system @@

Virus results shows its a virus !!

https://www.virustotal.com/en/file/d4adedd1cccca5037ea43aa1363f81381319fb34d887e1d7f1886a7c39b09243/analysis/1444298177/

He is quite trusted here in the forum, also could give proofs where he has asked you to download the file.
Secondly, even if he has scammed you, he will not get banned as scams are not moderated here.
Thirdly, he does seem to be doing some unethical things but I wouldn't accept without proof that he tried hacking someone's computer or something, even though he does admit that he has a lot of botnets.
Edit: Aren't you the same guy who claimed heutanomous was hacked and that it was your account, and it was proved later that it was not, I'm going to take your word with a grain of salt

Few things you should know / do before we will give him negative trust :

• It could be your program and you are asking us to download it to inject us with a trojan or virus .
• You can scan this program by your self and post the results here using this : https://www.virustotal.com/
• Vortex is trusted so unless you are a millionaire I don't see why he would inject you .
• Unless you post proof that he gave you his skype and you show us a screenshot with his Skype name + him sending the file , he aint getting any negative trust .

guys just i am asking check this file, is it virus or not ?

i am happy to give my skype to anyone trusted like vod or someone and they can open my skype and check the chat ....

please trust me guys and before all that just not sure if its a virus , anyone trusted can msg me to check the history

Good try
At any rate, you have posted false accusations before without any proof, which turned out to be false(see above post), which makes you the one who is untrustworthy.

i am ready to show this to anyone trusted guys, just not sure is that a virus , please anyone try to undrstand hat I am saying

Why don't you go check the file on virustotal.com as suggested by OmegaStarScream? That won't take a lot of time.

added in main post

16 / 56 results , that can't be false positive as far as I know . Now post proof that Vortex really gave you this file and he really gave you his Skype . (when you show that he sent the file you should show his Skype username aswell) .

Not sure about you but I have talked to him several times and he seem quite alright and friendly. I have bought a PD bot from him and he has been helpful all along. I don't have much knowledge to dig deeper into the script though. But this is only my opinion. The truth may differ.

here is the proof of him giving me the bot , even ready for any trusted guy to check my skype !

http://prntscr.com/8p1fq2

Out atm, can confirm I think I have this user on my Skype, however I have no recent logs of conversation with him and he's blocked for me.

I am brokenvessel_ on Skype.

First things first, I haven't talked to this user on in at least a month, I think. Bit hard to use my phone on Skype. We far as I can tell, the screenshot is legitimate. I've been accused by a few people clever enough to fake screenshots before, I've made quite a few enemies in the deeper web.

My Skype, as far as I can tell, is secure. I deal with malware a lot, and I'm quite sure I haven't been infected to date.

Let me investigate and get back to you.

For now, kindly determine what the file does. 16 detection is NOT a false positive, it's like someone sent you an uncrypted file.

Are you a large holder of Bitcoins or do you possess something valuable? All my accounts use the same decently uncrackable password and none of my other accounts are compromised, as far as I can tell. My server also shows a most recent login from the correct IP.

Are YOU infected? I know for a fact it's possible to modify Skype's local files and change messages undetectably, as well as edit other's messages (but the changes are reflected and this is obvious).

You've caught me at a bad time, it's 6:18 over here and I'm on the way to a friend's potluck dinner. This is all the information I can provide.

Currently possible situations:

1) User is a) a giant troll or b) one of my competitors trying to deface my BitcoinTalk account
2) I've been hacked, and a) it's by one of my competitors looking to deface this account, b) once again, by a troll, or c) by a seller of a private CS:GO cheat - it's the only non-mainstream exe I've run in a while.
3) ???

awesome so you mean u have not sent me any file via skype right, please anyone trusted msg me and take my skype username and password and check whether i am right or he is

dont u remember u offered me 0.005 btc to test a file and it was named danza.exe ???

http://www.net-security.org/malware_news.php?id=2132

Shows on my phone, for some reason.


My Primedice bot is in jar form, this should have told you something already.


User is now trying to blackmail me....? ::)

What's this? The size of the file that this guy got is more than 20kb.

Gotta go, feel free to leave me a temporary negative, but note that I can't defend myself while I'm eating. ;) peace out for now

i would vouch for the bot's safety, but vortex hasnt pmed me back with the source for me to review yet. hope you get around to replying soon :)

anyone trusted who can confirm that I am not lier and this is true, anyone trusted online, anyone on default trust or such willbe great ! VOD ?

pretty sure someone will be on soon to verify your skype. Vortex is busy to at the moment as he said so lets not all jump into conclusions yet..

At my destination now.

I can answer questions on Skype: brokenvessel_

ok fine, i messaged many people but none relied, so i will start a meeting with join.me and show to everyone ! get ready, will edit this post and post link in 2 mins, and ys vortex u also come

hey everyone ready ??

come here : https://join.me/889-158-230

everyone is ready come and i will share !!

showed to all, anyone  pls comment !

well can confirm that the file sent was an .exe and not a .jar file...

There isn't much to say , personally you closed the JoinMe in my face without saying much :o anyway I was able to see that he really sent you the Danza.exe file , other then that ... idk


Vortex said .jar (Java) for what comes to the PrimeDice BOT , and when we asked in chat (I guess you was there) OP he said he never wanted to buy his PrimeDice BOT and when I asked him to scroll-up conversation on Skype , I saw something about AddmeFast .

Yes the convo showed that Vortex wanted a beta tester for the bot and he also requested 0.005BTC

so anyone on default trust again ask me and i will again show on join.me , please guys give him negative trust !

Convo history didn't show until I restarted Skype on my computer. Shows on my phone. I would offer to give access to a trusted member more than I, but it's got private information on it which would compromise secrecy between me and a lot of clients off BTalk.

I'll put it very clearly: I did not send any messages to this user about "testing" my Primedice bot. However, as it was sent from my Skype, I accept full responsibility. I found a RAT hidden with a Ring3 rootkit on my computer, unfortunately this means everything was compromised or can be treated as such. I have no idea how I got it, but that's a separate issue. It's been since removed, and I'll be changing the password for all my accounts shortly. Till then, the only uncompromised method of communication with me is XMPP at Vortex20000@exploit.im.

I apologise for thinking you were a troll at first, OP. Here's my proposed solution:

- I'll help you remove whatever you got, though from the screenshot in the chat log it looks like it's very poorly coded. Even in hacking, it's not common for coders to add obvious fail messages like that

- I see you were promised 0.005 for testing the "bot", I'm more than happy to give you 10x that, or 0.05BTC

Anyone else have any other solutions? I suspect who had me RAT'd, I will conduct my own personal investigation into this.

Tl;dr it happened, it wasn't me, I'll fix it

lol dude, for someone who specialize in RATs, nets, and exploits. , im sure no one's gonna buy that excuse... left a feedback, will remove once this issue is settled.

Fair enough. OP, waiting for your response on how you want to settle this.

IMO you should also lock your hacking lessons thread. Only shows to prove that you're indeed capable of doing such things i.e sending malwares to unsuspected victims.

OP, kindly share your login details (you can change the password) with someone like Tomatocage to confirm you are this random guy who got messages. I've tried messaging you on Skype to no extent.

IMO my hacking is still up to speed. Like I said, I'm not sure, but I have a pretty good idea of who's behind this.

I had a friend who does more whitehat stuff take a look at my computer in general. It was an instance of LuminosityLink connecting to a Taiwanese IP address, but if I had to guess I'd say it's a VPN.

On the problem of proving it wasn't me, there's just one very simple question... Looking at the chat logs, this is what I would ask:

Why would I target a user who is needing a job due to being broke with malware, using an account easily linked to me? I'm sorry but it falls outside my range of stupidity to do that, the stupidest thing I've done was give my botnet access details to a friend who accidentally killed all my bots off, but that's a different story.

Do people actually buy and download stuff from someone who "specializes in RATs" and not only that but he is infected with RATs as well?

lol

I would say that it would probably not be a good idea to download anything from anyone who makes that kind of advertisement. I would also say it is possible that the delay in admitting that it was vortex's skype that sent the malware was vortex making additional attempts to take over the OP's computer/account, although this would be speculation.

Personal guess is the OP has nothing to take over. Newbie account.

probably thought he was a newbie and perhaps you wanted to test your exploit on him ? just my 2.5cents.

If I wanted to do that, I'd do it either on myself with a VPS or just in a virtual machine. SimplexHosting sells Windows VPSes for $4/mo or something, and I have plenty of associates on Skype who would happily help me test malware.

Furthermore, I didn't even know someone was using my Skype till I got notifications and PMs someone had opened a scam report against me. I didn't know this user was a Bitcointalk user (rather, I'd forgotten).

I already asked you in skype to do that but then you made fun of me here, so I had to show everyone, anyways please come online at skype asap and lets finish this issue there ;)

I always like to forgive people and take reward :) , plus still i am clueless what i got hacked ( as had not much important files, but yet much to be hacked )

please come to skype asap

Lit'l update on me:

The IP the RAT was connecting to (assumed RAT, connects on port 20000 and not HTTP bot nor IRC): 217.42.14.74

I'll be doing some more digging up with this information shortly.

OP, I'm always on Skype. Even when I'm sleeping, my Skype's open ::)

I am sorting this with vortex2000 , will update it here soon. Stay tuned and no comments or feedbacks until then :)

Reason : vortex doesnt have access to COMPUTER until monday, so until then things cant be sorted out, on monday i will update.

These two statements seem to be contradictory to each-other.

thats what he told me, he dont have access to computer for today and tomorrow.

I think he meant personal computer, not any computer. One can always use public or other people's computers

And never execute files send by unknown people in the same OS that you store your BTC and login into your accounts, specially if you use windows or if the unknown comes from BTC world.

I was on it Saturday morning, then I left to go out late morning. I have church today and activities afterward, so Monday tomorrow is the earliest I can be on.

I'm in GMT +8 BTW.

I don't know him and I'am not supporting him or anything but maybe he is actually saying the truth , I mean why would he give you 0.05BTC offer while he can simply pay you 0.005BTC on the first place ? It wouldn't make a lot of sense if you ask me (Ask him to give you the adresses the funds was taken from + a signed message from it ) .
Still users like him (who have knowledge on the hacking field etc ) shouldn't get hacked easily due to their knowledge of the security measures that should be taken so...

Ouch I have multiple brain cancers from cases of ad hominem in our Skype chat. Anyway:

The funds were taken from my 1KQ address in my profile. Over .1 was stolen (the first .1 transaction made recently was legitimate, for something I won't mention here).

was this before or after bipolarbob granted you the loan?

OP, I'll post this in public. I'm more than happy to agree to pay you 0.05BTC as soon as I get the funds.


I don't remember taking any loans from any BitcoinTalk user...? How'd you come across this?

https://bitcointalk.org/index.php?topic=1205158.0

Guess you forgot but you were using this username during the join.me session we had on regards this issue with hmos.

I'm not ranochigo.

I have told you several/many many times that I am ranochigo on Bitcointalk and asked you to verify my identity. I was trying to prove my point but was repeatedly accused as being vortex. However, since the facts were proven true, I would apologise for saying that. I couldn't rule out possibility that it was a fake at that time.

Kindly enlighten me on where did you mention this to me several times

Perhaps you did not see this as you joined slightly later. I remember clearly that hmos was claiming that I'm vortex and I told everyone to verify that I am in fact ranochigo on bitcointalk (several times) those in the chat could hopefully verify this.

And kindly base on your accusations of me being an alt of vortex20000 on concrete evidence.

Ah, wrongly quote. Thought you were referring this to me. Im not accusing anything, vortex used the same name on the join.me session the other day. Must be a coincidence then  :)

I have a question for vortex, dude how is it possible that you didnt checked your wallet when you came to know you were hacked ? Really lame attempt of scamming a newbie. Happy to see scammer get caught, and better tell him what virus you send him ?

I will not defend any party, but to my knowledge, @hmos  already second time with blackmail trying to invent money. >:(

Lol yup, he wanted me to take a loan of 0.05 to pay him or he would "go on the forum and get people on DT to neg rep you!!!"


Well I'm sorry, it happened over a very exciting and fun weekend... Where I wasn't on my computer...

P.S. That's really jumping the gun, m8.
P.P.S. OP refuses to start his computer OFFLINE because of the virus he got sent. IMO this is fking stupid and it doesn't allow me to continue my investigation because I have no idea what the file does. So far it's basically given an error all the time and done nothing wrong and OP still insists it's harmful.

OP - start your computer OFFLINE and monitor traffic (or failed traffic).

Caught OP in a possible lie:

https://i.imgur.com/hZReXk5.jpg

claims to have downloaded the file on my trust, but...

https://i.imgur.com/E0dP9GN.jpg

look at his conversation with the hacker - he only asks for the profile after getting infected

---

On a side note, he's been bugging me to find ways to pay him, even to the extent of taking out a loan:

https://i.imgur.com/G32zZqX.jpg

Furthermore, OP got suddenly really defensive when I pointed it out:

https://i.imgur.com/qJHpZjl.jpg

I'm not pointing fingers here, but it's possible that either the OP solehandedly is responsible for my situation or he's (she's?) working with someone else / a group.

OP, is this you? https://bitcointalk.org/index.php?action=profile;u=119230

This may not be my place to say but it seems to me that your trying to pull the "I was hacked" excuse since you were caught,but then again you might have actually been ratted.

Highly unlikely as OP has stated him self he

Hm still sounds suspicious from me but its probably since I just spent the last couple months on HF,lol.

That's like saying every single government hack so far is a lie because the governments have hundreds of people working security.

Well maybe he got the ratted from a RAT that he probably bought from someone online. It may be possible that a supplier gave him a backdoored RAT.

So north korea decided to hack you too ?  ::)

https://bitcointalk.org/index.php?topic=1207050.0

Wow, been a long time.

Full story: thought OP was a LeakForums skid, tried to infect unsuccessfully (screw my crypter) and was too careless. RIP this account may it rest in peace from now on.

Edit:

nothing to do with this but I saw one of the comments put forth I may have been RATed... guess what? Few weeks ago I actually DID get a RAT on my computer, had to wipe it... not that anyone cares.  ::)

Prove this