[XPM] 7800 STOLEN - Please read / help

[amosmc]

just my 2 cents but most vps will keep a log of ip addresses for incomeing connections if you could get this list it would help narrow it down you could then do a trace route/whois and backtrace to general area and isp from there you could contact the isp with the info and go from there i have to do this form time to time on ppl who jump bail when i can make contact with them online it might be a longshot but worth a try im recently new to mining so im afrain i cant donate coins but i have years of experience in tracking people and things down so will donate my time ive never tracked down a wallet addy before but theres a first time for everything

[amosmc]

for someone who knows more about it than me heeres the transaction details

Array
(
    [hex] => 0100000001bf21d2bf33ad48cb59ef160ae204dda5d7bbf5e6be9d8f75d5fb95d620098edd00000 0004a4930460221008e1c6aa6c28c10456a608fbc1c77e6fd8816a3499a942cb71135669fdd9a5c 7d022100fc7ef05f56270f91a59da7ec421c28eb1966bb050daf275491ffc235bc4d569f01fffff fff0240aeeb02000000001976a914c9bd871c1b681e43aec2bba71ec46ac9dc82713788ac00ca9a 3b000000001976a914e41c51584730272c896b6ddd15af7f6a14dcea2c88ac00000000
    [txid] => c0bcfde4fa1ac44d96edeb448bd5d7fa3ecf73f525e69058d69a01cf695c0400
    [version] => 1
    [locktime] => 0
    [vin] => Array
        (
           

• => Array

                (
                    [txid] => dd8e0920d695fbd5758f9dbee6f5bbd7a5dd04e20a16ef59cb48ad33bfd221bf
                    [vout] => 0
                    [scriptSig] => Array
                        (
                            [asm] => 30460221008e1c6aa6c28c10456a608fbc1c77e6fd8816a3499a942cb71135669fdd9a5c7d02210 0fc7ef05f56270f91a59da7ec421c28eb1966bb050daf275491ffc235bc4d569f01
                            [hex] => 4930460221008e1c6aa6c28c10456a608fbc1c77e6fd8816a3499a942cb71135669fdd9a5c7d022 100fc7ef05f56270f91a59da7ec421c28eb1966bb050daf275491ffc235bc4d569f01
                        )

                    [sequence] => 4294967295
                )

        )

    [vout] => Array
        (
           

• => Array

                (
                    [value] => 0.49
                    [n] => 0
                    [scriptPubKey] => Array
                        (
                            [asm] => OP_DUP OP_HASH160 c9bd871c1b681e43aec2bba71ec46ac9dc827137 OP_EQUALVERIFY OP_CHECKSIG
                            [hex] => 76a914c9bd871c1b681e43aec2bba71ec46ac9dc82713788ac
                            [reqSigs] => 1
                            [type] => pubkeyhash
                            [addresses] => Array
                                (
                                   

• => AaAaWgCpqebejux1wyw1H8yQvuPCizy6yy

                                )

                        )

                )

            [1] => Array
                (
                    [value] => 10
                    [n] => 1
                    [scriptPubKey] => Array
                        (
                            [asm] => OP_DUP OP_HASH160 e41c51584730272c896b6ddd15af7f6a14dcea2c OP_EQUALVERIFY OP_CHECKSIG
                            [hex] => 76a914e41c51584730272c896b6ddd15af7f6a14dcea2c88ac
                            [reqSigs] => 1
                            [type] => pubkeyhash
                            [addresses] => Array
                                (
                                   

• => Aca1dndvLHK1BLWEGsJE2Ci35Wg4azZy2F

                                )

                        )

                )

        )

    [blockhash] => 7db340b42e39e14554b4ac7ee831a646df1dbbcb547cd4ebba2aa413a0de3858
    [confirmations] => 1830
    [time] => 1376860711
    [blocktime] => 1376860711
)
   

[paulthetafy]

Thanks everyone for all your help and suggestions.  I still haven't gotten to the bottom of this but, thanks to the posts here, I do realise how easily I could have been compromised.  All of the VPS images I had used have been deleted already so I'm not able to check those for signs of malicious access.  But my best guess is that one of the early ones I used was compromised, before I started using an encrypted version of the wallet. 

Once I find some time I will try to collate all of the security-improving suggestions and post them into a new thread for everyone to benefit from.

Thanks
Paul