Bitcoin Forum

Why every bitcoin address I post in this forum will be change to 152oBitoBwHwxR5UpUQnsvWSFjYHkheDJk automatically?

Because you are infected.

The virus detect that you copy a Bitcoin address and change it when you paste.

It is the most common Bitcoin virus.

What weird website have you seen ? What have you downloaded ?

EDIT: 14P13dhUCiVgrdEn1tw is not a Bitcoin address BTW

EDIT : Oh it was https://blockchain.info/address/14P13dbPC8wktib8NBD3zhUCiVgrdEn1tw
Nice, the hacker got 2 victims or maybe it is you lol ?

I never downloaded any thing so far.

I found this just because I happened to see my bitcointalk user profile signature bitcoin address was changed, and I can't change back forever. Every time I change back, it will show 152oBitoBwHwxR5UpUQnsvWSFjYHkheDJk automatically.

you've never downloaded... anything you say ?

Impossible.


yeah lol  ::)

Are you using Java,adobe,ms office or old browser etc? Probably you got infected by java drive by or by some exploit pack.

Maybe I was infected, right now I am using another computer to reply this post, everything looks fine so far. I think I have to check my computer now!!!

So many fraud in bitcoin industry nowadays..Even don't know how to secure my digital currency..About 1 bitcoin was stolen from my home computer, even now i don't know what was that..Very smart viruses today, i have checked my system many time but it was stolen and stolen again..

https://www.malwarebytes.org/getmbam (Scan your pc for viruses,trojans etc )
http://downloads.malwarebytes.org/file/mbae_beta (Scan your pc for exploits )
http://downloads.malwarebytes.org/file/mbar (Scan your pc for rootkit )

Yes you have.

Test - I'm now posting an address starting with "1Nz28..." whose hash (http://anyhash.com/sha256?1Nz28E4nvXAFPjJjx841sx4Qbz9HnWSKna) is b94a2b59189d5c9d5997085a54e7a497752dc4138ffacb5ec03f04b287e4710a :

1Nz28E4nvXAFPjJjx841sx4Qbz9HnWSKna

Yes, it works! :)

Conclusion: it's YOU who got hacked, not bitcointalk.org :) (Using Windows, by any chance?)

Thank you very useful tools!

It could be either the copy/paste virus that change the address or a hacked software like bitcoinQt or an attack in the browser with a malicious plugin.

Always check the address you copy/paste.
Only download application with a signed key to verify.
Always use Firefox with NoScript.

And you'll be fine.

I've read about a google chrome extension, some kind of a coin live ticker, which does such things!

 >:( >:( >:(

I am scanning my computer right now. But no virus found, everything looks fine right now? Why?

Test - I am going to post BTC address start with '152o':

14P13dbPC8wktib8NBD3zhUCiVgrdEn1tw

No gosh, change again!!!!!!!!!!!!!!!

Sometimes, Antiviruses are unable to detect malware as hackers use crypters to make their trojans,viruses fully undetectable from av's. So if you are unable to find any infection, best method is to take help from experianced users or in worst case, backup your data and reinstall windows or Ubuntu etc.

Remove live ticker if you are using it in chrome/ff

You can see this address (14P13dbPC8wktib8NBD3zhUCiVgrdEn1tw)  here.
http://pastebin.com/UuvLSeft 

You need to do a "clean boot" to detect any viruses with stealth mechanism.

Download a linux boot cd iso file, burn, boot and scan!

Avira rescue system: http://www.avira.com/en/download/product/avira-rescue-system (http://www.avira.com/en/download/product/avira-rescue-system)

You are right those are very smart viruses!Thank you for advices!

backup wallet, ensure you can get it up and going in another client on a laptop or another system you own.

reinstall OS.

• Open notepad and copy&paste an address there.
  
  • Still same problem? Not the problem of bitcointalk, virus on your computer.
    
  • Problem gone? Try same on another site in same browser.
    
    • Still same problem? Not the problem of bitcointalk, probably some browser extension.
    • Problem gone? wtf.

Basically I am trying to say, isolate the problem and find the cause that way.


That browser extension sounds most likely atm.

I have had the same problem for 3 month ago and had not solve it still..In my case,as i think, viruses are in some wallets of forks which i have installed at my home computer..

May be it is a chrome ticker. When I paste the bitcoin address in the text file and save it, evetything is fine. But when I post in this forum via chrome browser, it will change.

Test again, I want to post the address start with '152o' - 152oBitoBwHwxR5UpUQnsvWSFjYHkheDJk

Right now, I removed all chrome extensions, it seems everything works good.

Test the third time, I want to paste the bitcoin address here start with '152o' - 152oBitoBwHwxR5UpUQnsvWSFjYHkheDJk

yes


http://www.reddit.com/r/Bitcoin/comments/1qdgag/a_horrible_thought_i_just_had/

Don't forget to post link of that ticker addon here, so we can report it to chrome market and warn other users.

I want to test the forth times here to make sure I really resolve my problem.

I want to post the bitcoin address starting with '152o' here: 152oBitoBwHwxR5UpUQnsvWSFjYHkheDJk

Thank you all guys, I am fine now. Everything works well now. I removed all chrome extensions, and I promise that I will never add any extensions in the future. BTW, the extensions were added just a few months ago, after that I never add any other extensions.

I think it would be the peercoin ticker in my chrome browser.

Everyone, again here is my really bitcoin address starting with '152o': 152oBitoBwHwxR5UpUQnsvWSFjYHkheDJk

 ;)

Please don't forget to add "[RESOLVED]" to your post title!  ;)

That's just undoable, imho. Pretty most every modern website out there needs JavaScript to function normally.

Especially for novice users, who don't have a clue what JavaScript is or when they would (not) need it, NoScript is just not an option.

Yes, thanks for your reminding. I added the RESOLVED in the title.

Wow. I did not realize that this kinds of viruses are able to infect your system. Thanks for the warning. Gotta be careful now with that.