I am well known among the people who know me for being a poor communicator. Do I give a fuck? No.

What do you mean source? My computer was hacked. There were strange things on my computer in the time of the hack that I ignored. I'm telling anyone who has a Windows computer and is interested that if they do the above test they will know whether they have whatever hit my computer.

There were other oddities that were not predictable and easily tested. On Firefox sometimes in the last week a black bar would cover the lower left where an address should be. I also sometimes use other browsers and don't remember anything on them. Sometimes when I would press a letter or number on the keyboard nothing would happen until I pressed a second time. All this is only in the time of the hack, not ever in the last many many years except in the last 2 weeks plus.

What source do you want?

and others


I've been an IT zero years.

I've  been hacked once.

There were a few oddities in my computer that I noticed and could not explain but I ignored them. One of them, the easiest to notice, is that if you follow the steps above and your computer has this problem then when you log back into the admin account the start button will be black until you move the mouse over it.

There were several other things but thisc struck me as the most obvious and the one easiest to replicate.

Again, anyone and everyone is free to ignore my posts. If I had read this warning a week ago and spent a few minutes testing it then some coins would not be lost.

As far as anyone saying it sounds like this it sounds like that, all I can say is move on to the next post.

This is what happened on my computer. I thought it was very strange. I have been using Windows computers for years and never saw it. It coincides exactly with the hack. In other words exactly when the hack occurred this and a few other oddities occurred in Windows and on my browser. So I can saqy near 100% they are related.

I'm not trying to tell anyone to do anything nor am I pretending to know the least bit about security.

My advice though would be if someone has a Windows computer they follow steps above, create a non admin user, log in and out etc and look for the obvious change in the start button. Someone can do it, not do it, I don't care. When I see something like that I try to give a warning, that's all.

As I said earlier I will reconstruct the pcap files of the hack, put them on a storage drive and scan them regularly until one of the free major antivirus programs detects it. Then I will tell you its name.

I've never picked up a single virus in 15+ years until last week. I did what I did and learned my lesson. If you want to pay for a t shirt that says stupid I'll wear it.

If you don't want to read it don't read it.

This post is to point out that if a person notices that change on their computer they have been hacked. So far this is not detected by any antivirus programs so maybe someone else will find it useful. I have pcap files of the traffic and will run them through several antivirus programs once a week or so until it shows up. Til then this is one way to test for it.

You can download backups of your blockchain account.

I thought first he had hacked my blockchain but apparently he just took the backup off my computer along with the rest.

This is a quick tip for anyone using a Windows pc. My computer got hacked last week and if I had known it then I'd be richer.

I know this is probably common knowledge among tech types but I did not know it until too late.

1) Log into your Windows pc.

2) Create a second user without admin privileges.

3) restart.

4) Log into your regular account.

5) Look at the start button in the lower left.

6) Go to Switch User and go to your non admin account.

7) Log out of the non admin account.

Log back into the main account.

9) Without moving the mouse or anything else, if you notice something different in the start button you should be worried.

I'm sure this belongs in a different section, so move it. Also sure it is well known, but as I said before I did not know it.

Briefly the hack.

1) Someone emptied the 3 bitcoin I had at Blockchain into the wallet 1GFXKAYNo1Urm3HeaxgoWBPSG9MFUkWFDX

2) Then they emptied a litecoin wallet that I had lost the password for and had stored on my computer.

3) etc etc

In my initial paranoia I though adobe flash was used. Apparently it was not.

My suspicion also focused on Fireball who I have criticized a lot. But although he runs a crooked exchange he honestly does not seem to be the type to steal in this way.

It does seem likely the hacking is related to other altcoins. I've been on the internet since the 90s and was never hacked. Then I downloaded a bunch of weird coin wallets and within weeks got hit.

The hacker used ip address 109.120.153.223

I am officially retarded.

\Still though, the picture is like when you take a tiny picture and blow it up to 20 times the size. A monkey could make better graphics with gimp. And it doesn't seem like a native English speaker would write  "please download latest version". I don't know anything about emachines except that they had a computer on sale somewhere at some time in the past.

1) First sign of the hack was a bitcoin wallet taken.

2) Second sign right after was a litecoin wallet.

3) It seems likely that the hacker, at 109.120.153.223 used a coinwallet download to get on my computer.

I've been on the internet since the 90s and have never been hacked before. I don't know a lot about computers but I do think there is a problem that might concern other coin users.

I am looking now at the computer next to me. Restored to factory condition then all extra programs removed and several wallets installed. It has not touched the internet. It now has a popup telling me to "Please Download Latest Version of Flash".
On the task manager
Image name eMachines.scr *32
User Me
CPU 00
Memory 1,668k
Description Screen Saver

Unless Emachines has factory installed semi literate pop ups that probably came from one of the wallets.

Thyere are other oddities too, such as the wallet asking me to make sure my system clock was correct. Maybe meaningful maybe not.

**Edit. It looks like I'm probably wrong about the pop up since it is in 2 Windows systems folders and not in any wallets. The only facts at this point are that someone at 109.120.153.223 took a lot of litecoin and bitcoin from my computer and logged into numerous of my online financial accounts.**

My computer was thoroughly taken over recently and coin wallets hacked. In recent days I have been trying to reduce the damage done, etc.
One concern I mentioned earlier in another thread involves flash from adobe. There is a simple experiment that might prove or disprove my concern but I am not able to do it at the moment, if someone else is able it might save a lot of people some problems.

Briefly.
1) Computer hacked utterly, keyboard, screen, etc completely manipulated.
2) Numerous coins stolen.
3) Purchased additional computers and set about protecting what was left.
4) Completely restored to factory condition the affected computer.
5) Downloaded various wallets on another computer and transferred them to the factory restored operating system computer.
6) Removed all unnecessary programs from the computer that was restored. It was not connected to the internet at any point after being restored.
7) Installed wallets
anoncoin  0.7.5.0
armory
bitcoin 086 win32
craftcoin 1.1.4
feathercoin
multibit 0.5.15
phoenix 0.6.50
ppcoin 0.3.0 win32
primecoin 0.1.2
quarkcoin 083r6win
terracoin0.8.0.2

After a few hours idle the computer began prompting me to download flash. The prompt appears  to be a bogus pop up. Apparently it is prompted by something within one or more of the above wallets. There are at least two slightly different versions of the pop up so apparently at least two wallets have this.

Here is the experiment I hope someone will carry out.

1) Download the zipped file www.bitcoinistan.com/test/New%20folder%20%283%29.7z
The zipped folder contains the wallets downloaded from the respective sites. A person might try downloading the wallets from the sites as well.

2) It is 7zipped with the password 1 It is about 173 mb. Obviously don't open the file except in a sandbox or test environment etc.

3) Put the zipped folder on an offline computer.

4) Strip all adobe products from the computer, as well as any other unnecessary programs.

5) Ideally the computer should be just restored to original os.

6) Install the wallets.

7) Wait several hours to see if popups start.

If no one else does this experiment I will do it eventually again.  There is more I will probably add to this in a few days.

First computer as it got hacked had Comodo, spybot and malwarebytes. Comodo was the main security program, the others don't conflict.

Norton is on this computer, the same one but with a restored os.

I also have two other computers next to me now as I am trying to recover coins.

So far none of the programs have detected anything.

The hack did innvolve monkeying with core parts of windows so that processes were not displayed accurately in the task manager.

At one point my computer was running nothing actively but seemed sluggish. I opened the task manager and saw two netminers I had open were both above 45% of cpu which I have never seen before. Obviously something was uploading files from my computer but there was no evidence to be found. Read that twice.

edit
I won't post anymore on this until my computers are a little more straightened out, but my  personal advice to anyone at this point would be to take adobe products off of computers that have alt coin wallets with blockchains. Connecting to begin downloading the blockchain of some coins + certain adobe product(s) seems to compromise your computer.

End of topic.

Right.

My point though is that a hacker apparently used the real version of the latest flash to take over my computer and nothing was detected by Comodo full version, malwarebytes, spybot, Norton, etc. The pop up is not the problem. Flash is the problem.

As of about 2 minutes ago the pop up has improved a bit more and now doesn't show the promo link but simply directs you to flash.

I have no adobe products whatsoever on this computer right now.

If I had been on the internet on a page with flash and got a pop up to update the flash, and was then directed to the real adobe site, I would get bitten.

**Edit. It looks like I'm probably wrong about the pop up since it is in 2 Windows systems folders and not in any wallets. The only facts at this point are that someone at 109.120.153.223 took a lot of litecoin and bitcoin from my computer and logged into numerous of my online financial accounts.**

Feathercoin chart really does not look that great for the long term even if it has some occasional jumps.

Reliable coins with good technicals are primecoin, peercoin, anoncoin, devcoin.

Could you comment on this.
https://i.imgur.com/9xfpgBp.jpg

Bitcoin searches are at their all time high in many 3rd world countries with large economies. If it continues this will have a negative effect on the economies of countries with restrictive internets, like Saudi Arabia. The dictators get Darwined out one way or another.
Compare Indonesia, India, Brazil etc to Iran, Saudi Arabia etc.

*bang*

I got scammed by icbit. I've made a bunch of posts about it but most people without some knowledge of derivatives will not understand the scam. I imagine most people think they just lost money on the site, without ever knowing they had been scammed. https://bitcointalk.org/index.php?topic=246845

Eventually someone more gifted at explaining scams will point out what is going on and icbit will shut down.

A few posts have been made already trying to warn people about icbit, see https://bitcointalk.org/index.php?topic=246845

If the votes on this poll indicate that most people trust icbit then I will stop putting up the warning at https://en.bitcoin.it/wiki/ICBIT.