Can't Paste Bitcoin Addresses

[valandor062]

Hello,

I was wondering if anyone else had this issue with bitcoin. I'm really thinking I picked up something nasty somewhere that my anti-virus (Comodo and Malware-Bytes) isn't picking up.

When ever I copy a bitcoin address and I paste it into a document, including the webpages, the address changes to another address not associated with what I'm trying. I can copy and paste multiple times until it pastes the correct address, but this is rather annoying. Has anyone else had this issue, and if so does anyone know a fix without having to wipe everything from my machine?

Thanks,
Anthony
A.K.A. Valandor

[OmegaStarScream]

It's definitly a virus that you have there , it basically works like this : you copy adress to send to your friend for example , it changes it to the adress of the virus owner so you send it to him instead of your friend or whoever you was going to send it to .
I'd recommend you to wipe your PC right now and check this out my topic here : https://bitcointalk.org/index.php?topic=1152619.0

[bitbaby]

That indeed sounds like a virus and if your virus scanners aren't picking it up I think it's best if you wipe the OS clean and install a new one and this time add antiviruses with boot time scan, so they can pick something up which gets through the real time scan. There are a few things you can try but why take risk of losing any bitcoins, if I had seen anything happening like that in my PC, I would have wiped it off clean by now.

[LFC_Bitcoin]

OP - that sounds bad, very bad. Seriously I wouldn't attempt to do any more bitcoin transactions until you resolve this. To be honest I'd be tempted to never use that computer again for bitcoin related activity.

[omahapoker]

OP - that sounds bad, very bad. Seriously I wouldn't attempt to do any more bitcoin transactions until you resolve this. To be honest I'd be tempted to never use that computer again for bitcoin related activity.

On top it would be best to not even enter passwords or access anything security related. If you have this virus already then the virus creator can very easily upload other modules, for example a keylogger. He then could observe you typing passwords and voila... accessing your wallet or so.

[TinEye]

usually a virus steal your wallet directly, this sound somethign messed up with your os or drivers or something else, it could still be a virus but i don't know, try to scan with other antivirus
and btw what address is displayed after the change? it's a fresh new address without bitcoin or it's already used? also from where you are copy pasting address? from core?

[Brewins]

usually a virus steal your wallet directly, this sound somethign messed up with your os or drivers or something else, it could still be a virus but i don't know, try to scan with other antivirus
and btw what address is displayed after the change? it's a fresh new address without bitcoin or it's already used? also from where you are copy pasting address? from core?

such virus would unlikely be caught by antivirus because it is not a keylogger and does not do the things that virus usually does, so I won't be surprised if it it is indeed a virus


but be sure that you are copying the correct address, just in case

[LFC_Bitcoin]

Personally I'd just trash the computer. The potential harm here isn't limited to bitcoin theft. He could have his debit card, credit card details stolen & end up being a victim of fraud.

If you have bitcoins on that computer send them to a paper wallet created offline & throw that computer in the trash.
You're playing a dangerous game by keeping that computer.

[Snorek]

Yes it is malware. You probably entered some crypto related apps recently. The most popular version is  called "COIN RPG MALWARE". You get this from CoinRpg.exe
Detailed raport: https://malwr.com/analysis/MjdlNmEwZjcwZmM1NGYwYjlmZTYwZjc3OWFiZGQ1YzU/

[ikydesu]

Obviously this is virus/malware, you need to more carefully if you find some site or file which come from bitcoin related or anything something fishy things.
This is for reference for you to avoid this things happens again: https://bitcointalk.org/index.php?topic=203876.0

[notlist3d]

Personally I'd just trash the computer. The potential harm here isn't limited to bitcoin theft. He could have his debit card, credit card details stolen & end up being a victim of fraud.

If you have bitcoins on that computer send them to a paper wallet created offline & throw that computer in the trash.
You're playing a dangerous game by keeping that computer.

I would agree with this.  I would unplug from internet right now, and that hopefully prevents it from sending some of the information.  Although it's most likely to late.

Make sure to backup bitcoin wallet if you have not already. Blow away that computer and reinstall OS.  Now look into cold storage and put the coins in a safe cold storage.

After avoid what ever sites you were going to or downloads you were doing that might have caused it. 

[Mickeyb]

Personally I'd just trash the computer. The potential harm here isn't limited to bitcoin theft. He could have his debit card, credit card details stolen & end up being a victim of fraud.

If you have bitcoins on that computer send them to a paper wallet created offline & throw that computer in the trash.
You're playing a dangerous game by keeping that computer.

Well he doesn't need to throw a computer in the trash for God's sake. Reformat everything and install a fresh version of the operating system will just do the job.

OP, I hope you haven't lost any valuable info or even some bitcoins to this malware. Clean everything, double check everything, and change all the passwords, and of course, depending on the wallet you use, make a new wallet on a secure machine and send your coins to this address.

Good luck!

[valandor062]

Hello all,

Thank you for all the responses. I will be wiping this machine and reinstalling the os after a little bit of backing up is done. Before that I will be creating a program to watch my clipboard and log any programs that modify it and the location of those files so I know were I got this nasty little thing from. I think it's just changing my clipboard information as I don't have anything weird trying to connect to the net. Thank you all again.

[n2004al]

Hello,

I was wondering if anyone else had this issue with bitcoin. I'm really thinking I picked up something nasty somewhere that my anti-virus (Comodo and Malware-Bytes) isn't picking up.

When ever I copy a bitcoin address and I paste it into a document, including the webpages, the address changes to another address not associated with what I'm trying. I can copy and paste multiple times until it pastes the correct address, but this is rather annoying. Has anyone else had this issue, and if so does anyone know a fix without having to wipe everything from my machine?

Thanks,
Anthony
A.K.A. Valandor

I would do another simple thing (if I had the possibility). I will download another wallet in another computer (a laptop for example if you have one), will copy paste the dat file of my old bitcoin wallet from the old computer there. So all my bitcoins will be transferred. then in this clean computer will do all my transactions I want. If you have a web wallet the thing is more simple. Because it was enough to open your wallet from a clean computer and sent from there your bitcoins where do you want.

[valandor062]

Well a quick update on this. I found the culprit, something called recoveryBTC. From my logs it seems that my nephew decided to try and install it. Thankfully it was sand-boxed and wasn't allowed network access, and most of the files were quarantined long ago. I use a web-based wallet with double verification when I login, just seems safer than keeping it on my computer. I sent the file which was causing the issues with a description of what it was doing to Comodo and Malware-Bytes.

Thankfully my machine is locked down pretty tight from anything I don't want accessing the net and I keep logs of everything people do on it.... It's how I make a living.

[Sugarape]

What was the address it was changed to? Maybe someone can track the hacker down.

I use a web-based wallet with double verification when I login, just seems safer than keeping it on my computer.

Well using something like blockchain.info can be safer than storing them on your computer and may have saved you here but you're relying on a third party to keep your coins safe. Something could always go wrong on their side so keep that in mind.

[Linuld]

usually a virus steal your wallet directly, this sound somethign messed up with your os or drivers or something else, it could still be a virus but i don't know, try to scan with other antivirus
and btw what address is displayed after the change? it's a fresh new address without bitcoin or it's already used? also from where you are copy pasting address? from core?

No there was a virus that actually did this same thing. It observed the clipboard for bitcoin addresses and changed the addresses to ones that belonged to the hacker. It's a pretty old virus design actually i believe.

[Linuld]

usually a virus steal your wallet directly, this sound somethign messed up with your os or drivers or something else, it could still be a virus but i don't know, try to scan with other antivirus
and btw what address is displayed after the change? it's a fresh new address without bitcoin or it's already used? also from where you are copy pasting address? from core?

such virus would unlikely be caught by antivirus because it is not a keylogger and does not do the things that virus usually does, so I won't be surprised if it it is indeed a virus


but be sure that you are copying the correct address, just in case

It's a classic virus. What is a virus if not something that sneaks into a computer to do malicious things? Viruses aren't only keyloggers.

[Linuld]

Personally I'd just trash the computer. The potential harm here isn't limited to bitcoin theft. He could have his debit card, credit card details stolen & end up being a victim of fraud.

If you have bitcoins on that computer send them to a paper wallet created offline & throw that computer in the trash.
You're playing a dangerous game by keeping that computer.

Exactly. It's hard to know if all traces are killed. I once had a virus that reappeared on both OS i had on that computer at that time. I deleted it and it came back and showed even up on the other OS. Until i noticed that the bootloading screen had some strange signs showing. So i thought maybe the bootloader was infected, i overwrote it and killed all virus files on the OS and it was gone.

No Virusscanner had detected that... or maybe they had but couldn't do anything against. I wasn't informed about the bootloader virus though.

[bitcoinmasterlord]

Well a quick update on this. I found the culprit, something called recoveryBTC. From my logs it seems that my nephew decided to try and install it. Thankfully it was sand-boxed and wasn't allowed network access, and most of the files were quarantined long ago. I use a web-based wallet with double verification when I login, just seems safer than keeping it on my computer. I sent the file which was causing the issues with a description of what it was doing to Comodo and Malware-Bytes.

Thankfully my machine is locked down pretty tight from anything I don't want accessing the net and I keep logs of everything people do on it.... It's how I make a living.

*lol* Your nephew... i think with nephews like that you need no enemies. Make sure to keep him away always a arm length wide. He is dangerous and would take away much more from you if you give him the chance.

So what do you mean with sandboxed? Would the software have stolen your coins otherwise?

Reading that... i wonder how many "hacks" actually were people that had access to that computer.

I would not let my computer open to others. It's fully encrypted with truecrypt.