raumi29
Newbie
 Offline
Activity: 15
Merit: 0
|
 |
July 10, 2017, 02:30:43 PM |
|
@Earl_Vadim: I do not know what you're doing. -> Make your own batch with the start command and move it into the autostart. I did it that way and it works. If he is a scammer, he certainly does not make it so easy  @pr0ximus I am not a specialist, but my theory is: Your miner has to register at the pool. This happens via a static TCP sequence you can see via Wireshark. This includes the WalletID and the method "eth_submitLogin". Starts Claymore DevFee, he signs off. Starts the sequence again but with another WalletID (Claymores - WalletID) and the miner runs for Claymore. In this sequence, NoDevFee intervenes intercepts the packets and changes the WalletID to yours. I think stealing shares is just possible at this time. When NoDevFee inserts its own WalletID he gets the DevFee. So without new login on the pool he can not steal any shares. Anyone can check with Wireshark where the DevFee goes. But we will see more in a few hours  |
|
|
|
|
|
|
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
|
|
|
|
|
Ludwish
Newbie
Offline
Activity: 70
Merit: 0
|
|
July 10, 2017, 02:38:42 PM |
|
What version of Claymore can detect the Nofee? |
|
|
|
|
raumi29
Newbie
Offline
Activity: 15
Merit: 0
|
|
July 10, 2017, 03:17:40 PM |
|
The first two DevFee´s are going to my wallet how it should be and NoDevFee it shows in the CMD.
But on the third DevFee it shows: "DevFee Mining Detected: Real DevFee Mining. Wait. Next time it will mine to your wallet!"
And the DevFee goes to: "0x783231dEBa1FaFd90b4F146fDB21a374C29737fF" it is not my Wallet and i think it is not Claymores Wallet.. But i´m not sure which Wallet it is.
Unfortunately, I have to restart my rig now -.- But I will go on afterwards.
-EDIT-
The fourth DevFee went to my wallet again.
|
|
|
|
|
|
pr0ximus
|
|
July 10, 2017, 05:07:31 PM |
|
The first two DevFee´s are going to my wallet how it should be and NoDevFee it shows in the CMD.
But on the third DevFee it shows: "DevFee Mining Detected: Real DevFee Mining. Wait. Next time it will mine to your wallet!"
And the DevFee goes to: "0x783231dEBa1FaFd90b4F146fDB21a374C29737fF" it is not my Wallet and i think it is not Claymores Wallet.. But i´m not sure which Wallet it is.
Unfortunately, I have to restart my rig now -.- But I will go on afterwards.
-EDIT-
The fourth DevFee went to my wallet again.
Exactly. That definitely is not claymore's Wallet. It should be Falcon's. There is something fishy here. This wallet address doesn't seem to be as much mining. Like someone has mentioned before, Falcon's has another wallet address which mines at a huge rate. So, is he double stealing it (from dev fee and from our regular hash)?  Could you check that too? |
|
|
|
|
raumi29
Newbie
Offline
Activity: 15
Merit: 0
|
|
July 10, 2017, 05:21:28 PM |
|
Hm, I think it's too early to call him a scammer!
Okay, one devfee is go to his wallet.. But that could also be unwanted.. I will explain later why I believe that
|
|
|
|
|
Earl_Vadim
Jr. Member
Offline
Activity: 125
Merit: 2
|
|
July 10, 2017, 05:22:30 PM |
|
I'm sure that this is not a scam, but a common error in the code.
Otherwise the program would report that it mine into my wallet, and mine would be on Falcon wallet.
It's very bad that the program automatically adds the wrong BAT to startup
|
|
|
|
|
|
pr0ximus
|
|
July 10, 2017, 05:45:27 PM |
|
I'm sure that this is not a scam, but a common error in the code.
Otherwise the program would report that it mine into my wallet, and mine would be on Falcon wallet.
It's very bad that the program automatically adds the wrong BAT to startup
Program error even after repeated updates? wake up bro  |
|
|
|
|
Verminsp
Newbie
Offline
Activity: 1
Merit: 0
|
|
July 10, 2017, 08:58:16 PM |
|
The first two DevFee´s are going to my wallet how it should be and NoDevFee it shows in the CMD.
But on the third DevFee it shows: "DevFee Mining Detected: Real DevFee Mining. Wait. Next time it will mine to your wallet!"
And the DevFee goes to: "0x783231dEBa1FaFd90b4F146fDB21a374C29737fF" it is not my Wallet and i think it is not Claymores Wallet.. But i´m not sure which Wallet it is.
Unfortunately, I have to restart my rig now -.- But I will go on afterwards.
-EDIT-
The fourth DevFee went to my wallet again.
I confirm. For 13 hours, twice the work went to this address 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF. At this time in the window Nodevfee was specified my wallet. We are deceived! P.S Sorry for my English, I use Google translator. |
|
|
|
|
|
doktor83
|
|
July 10, 2017, 09:18:39 PM |
|
If it's only 2 shares in 13 hours then its nothing.. Looks like a looooot of people using this software if it can build up a constant hashrate - even 20mhs |
|
|
|
borox
Newbie
Offline
Activity: 44
Merit: 0
|
|
July 11, 2017, 09:17:46 AM |
|
If it's only 2 shares in 13 hours then its nothing.. Looks like a looooot of people using this software if it can build up a constant hashrate - even 20mhs Well, it is not 2 shares but 2 works in 13 hours. For a 100MHs mining rig that would be aprox. 30 shares. That is quiet a number. I can confirm the share-theft: it happened twice this night, that NoDevFee mined to the 0x78.. address. PLUS I caught a mining attempt to a private stratum-server with IP 147.135.221.69 and worker-names terraman.3 and terraman.4 Actually, it would have been no problem, if the extra-mining would have been communicated. But this way, it leaves a stale taste.. I will disassemble this code now to see, what is going on. |
|
|
|
|
|
doktor83
|
|
July 11, 2017, 09:43:33 AM |
|
Probably every n-th devfee mining goes to his wallet.
And i would say it still would be OK, if he told that. People would still get part of the devfee, so still would get more shares than without using this software.
|
|
|
|
adaseb
Legendary
 Online
Activity: 3738
Merit: 1708
|
|
July 11, 2017, 09:50:28 AM |
|
Pretty smart scam he pulled.
Basically since mining speed is never exact its almost impossible to tell he was stealing since he stole in small amounts.
|
|
|
|
|
pr0ximus
|
|
July 11, 2017, 09:54:40 AM |
|
Probably every n-th devfee mining goes to his wallet.
And i would say it still would be OK, if he told that. People would still get part of the devfee, so still would get more shares than without using this software.
Only if it works that way. It looks like he is taking more than just a part of dev fee. |
|
|
|
|
raumi29
Newbie
Offline
Activity: 15
Merit: 0
|
|
July 11, 2017, 10:56:20 AM
Last edit: July 11, 2017, 11:13:55 AM by raumi29 |
|
The last 12h i can not finde attempts to IP 147.135.221.69 or other IP´s.
After which time you get this packets?
|
|
|
|
|
|
|
|
|
|
|
Jackblow33
Newbie
Offline
Activity: 48
Merit: 0
|
|
July 11, 2017, 09:21:02 PM |
|
Because with the current situation: 2% of 5.50pe$ = not worth the effort......................................
|
|
|
|
|
borox
Newbie
Offline
Activity: 44
Merit: 0
|
|
July 12, 2017, 10:02:04 AM |
|
Hi,
I have found no evidence of virus activity in the code and no evidence for the strange redirection to the private stratum-server IP I reported. It could be a result of using the nicehash-software for some time, in between (I use it as auto-fallback, if the main poolmining has a problem).
BUT it has a random redirection to the authors mining-address 0x78.. build in. After I patched the software, all DevFee arrives at my own account, without exception.
The following submitted-shares numbers are broken down for a 100MHs mining rig for easy comparision.
Unpatched NoDevFee (24h run): mean value 176 shares per hour
Patched NoDevFee (24h run): mean value 182 shares per hour
That makes an average of 6 shares per hour mined to the authors purse.
So, dear @Millenium Falcon, thank your for programming this software, but could you please remove the undocumented mining-redirection to your purse? Or, at least, add a note to your posting regarding this topic?
|
|
|
|
|
dhaern
Newbie
Offline
Activity: 8
Merit: 0
|
|
July 12, 2017, 10:33:46 AM |
|
Hi,
I have found no evidence of virus activity in the code and no evidence for the strange redirection to the private stratum-server IP I reported. It could be a result of using the nicehash-software for some time, in between (I use it as auto-fallback, if the main poolmining has a problem).
BUT it has a random redirection to the authors mining-address 0x78.. build in. After I patched the software, all DevFee arrives at my own account, without exception.
The following submitted-shares numbers are broken down for a 100MHs mining rig for easy comparision.
Unpatched NoDevFee (24h run): mean value 176 shares per hour
Patched NoDevFee (24h run): mean value 182 shares per hour
That makes an average of 6 shares per hour mined to the authors purse.
So, dear @Millenium Falcon, thank your for programming this software, but could you please remove the undocumented mining-redirection to your purse? Or, at least, add a note to your posting regarding this topic?
How do you patching the .exe? with x64dbg? Could you add a little guide for do it please? |
|
|
|
|
|
