mkjohnson (OP)
Newbie
 Offline
Activity: 54
Merit: 0
|
 |
January 06, 2014, 11:34:36 PM |
|
WARNING!!! I just received this. The "backup.zip" file contains a "password.txt" file of 423.4kB and it is NOT a text file. I'm glad I opened this on my Ubuntu box with an empty wallet. Erwann Genson noreply@thehelixchallenge.com.hk via amazonses.com 5:10 PM (18 minutes ago) to me Hello David… I just did what you advised me to do but the problem remains the same : importing the private key is not working…. drives me nuts! Last time I checked blockchain.info ( https://blockchain.info/address/17yFutSCSuUkAWeqMCKRRcr8Go6t98YcoX ) there was still 30.28020001 BTC ! But no way my bitcoinqt client loads the key so I am stuck with those BTCs. Thanks for offering your help with this. Here is my wallet.dat with the password http://goo.gl/sFgbEJ. If you need anything else let me know. If you can load the key please send the BTCs to 1DxFvJ6up9jXAZ9pkUmWVdiMTWvsjgB5Ea This would help me so much. Thanks David! Erwann |
|
|
|
|
jchysk
Newbie
Offline
Activity: 17
Merit: 0
|
|
January 07, 2014, 12:08:30 AM |
|
Yeah, I got the same email. It looked interesting so I opened the password.txt which is just the string "n0^jO2eG,73gN48" without quotes which is of course not the password.
The password.txt is a UPX compressed .exe and decompressed it's a PE.
|
|
|
|
|
|
jondecker76
|
|
January 07, 2014, 12:09:36 AM |
|
I just got the same email
|
|
|
|
NES
Newbie
Offline
Activity: 1
Merit: 0
|
|
January 07, 2014, 12:11:00 AM |
|
Hello, I got the same email at 5:11 PM. I then noticed the " noreply@thehelixchallenge.com.hk via amazonses.com" part. "amazonses.com" is for mass mailing and marketing. |
|
|
|
|
DavidT
Newbie
Offline
Activity: 30
Merit: 0
|
|
January 07, 2014, 12:11:19 AM |
|
It's a SCAM!! The zip file contains spyware and you can lose all your BTCs, potentially. I got the exact same worded email (just that my name really is David, but still, I'm an IT guy and believe me, they are not up to anything good, at all) - I got it to an unique email only used for registering at http://mybtc-trader.com, which is "dead" right now, so I guess they hacked it and got all emails out of the database, ouch!! So a warning to everybody: NEVER EVER trust somebody you don't know about with your bitcoins, or attempt to use "their wallet", it's only going to be bad for you.. |
|
|
|
|
|
Jacce
|
|
January 07, 2014, 12:13:16 AM |
|
I also got it. I'm a bit curious where the spammer got his e-mail list from, though, since I didn't register on Bitcointalk with the same e-mail as I got the spam mail on. EDIT: Some more details about the mail: From: Erwann Genson ( noreply@thehelixchallenge.com.hk) Sent: 7 january 2014 00:09:10 I'm registered on Bitcointalk with a Gmail, and I got this mail in my Outlook (spam folder). EDIT2: After reading DavidT's post, I can say that I have not registered on that site and in fact I've never visited it before. EDIT3: I've used this mail as a public mail account and I've listed it on some sites, but I've never listed it on a Bitcoin related site without using Mailhide. |
|
|
|
|
jchysk
Newbie
Offline
Activity: 17
Merit: 0
|
|
January 07, 2014, 12:20:49 AM |
|
Little bit more information. There's a TSQL connection upon opening the executable (password.txt). It goes to 93.174.90.67 on port 7657 which a quick lookup shows the Location: The Hague, Netherlands
|
|
|
|
|
devthedev
Legendary
Offline
Activity: 1050
Merit: 1004
|
|
January 07, 2014, 12:29:56 AM |
|
Yep, I got the exact same thing. What site do we all have in common?
|
|
|
|
devthedev
Legendary
Offline
Activity: 1050
Merit: 1004
|
|
January 07, 2014, 12:32:52 AM |
|
It's a SCAM!! The zip file contains spyware and you can lose all your BTCs, potentially. I got the exact same worded email (just that my name really is David)
I thought it was funny your name is actually David  |
|
|
|
|
nobbynobbynoob
|
|
January 07, 2014, 12:40:32 AM |
|
Yep, I got the exact same thing. What site do we all have in common?
This one?  |
|
|
|
|
Jacce
|
|
January 07, 2014, 12:42:24 AM |
|
Yep, I got the exact same thing. What site do we all have in common?
This one? Not really, read my message. However, I guess it was done by a google search. Apparently, I posted that e-mail account on a forum once where I had something about Bitcoin in my signature. |
|
|
|
|
Kluge
Donator
Legendary
Offline
Activity: 1218
Merit: 1015
|
|
January 07, 2014, 12:51:26 AM |
|
Yep, I got the exact same thing. What site do we all have in common?
This one? Aside this, we can look at other potentials. Strike through those you're not registered on and we may find one in common. bc-casino.com bitcoinica.com bitfinex.com bitfunder.com bitmit.net bitratings.microhosting.com blockchain.info btc-play.com btcguild.com btclot.com btcmine.com bitvps.com coinworker.com dollar-trader.com eclipsemc.com give-me-coins.com glbse.com inputs.io minethings.com mtgox.com ozco.in pool-x.eu satoshisquared.com (I'm pretty sure I received a very similar email a good while ago, too. My memory's crap, though. No longer in email account. Probably deleted or marked as spam and it was automatically pruned.) |
|
|
|
|
|
Jacce
|
|
January 07, 2014, 12:54:07 AM |
|
Yep, I got the exact same thing. What site do we all have in common?
This one? Aside this, we can look at other potentials. Strike through those you're not registered on and we may find one in common. bc-casino.com bitcoinica.com bitfinex.com bitfunder.com bitmit.net bitratings.microhosting.com blockchain.info btc-play.com btcguild.com btclot.com btcmine.com bitvps.com coinworker.com dollar-trader.com eclipsemc.com give-me-coins.com glbse.com inputs.io minethings.com mtgox.com ozco.in pool-x.eu satoshisquared.com (I'm pretty sure I received a very similar email a good while ago, too. My memory's crap, though. No longer in email account. Probably deleted or marked as spam and it was automatically pruned.) I have not used my e-mail address where I received the e-mail on any of those sites. Probably mine was found with a google search. Can yours also be found by google searches? |
|
|
|
|
Kluge
Donator
Legendary
Offline
Activity: 1218
Merit: 1015
|
|
January 07, 2014, 12:58:31 AM |
|
Yep, I got the exact same thing. What site do we all have in common?
This one? Aside this, we can look at other potentials. Strike through those you're not registered on and we may find one in common. bc-casino.com bitcoinica.com bitfinex.com bitfunder.com bitmit.net bitratings.microhosting.com blockchain.info btc-play.com btcguild.com btclot.com btcmine.com bitvps.com coinworker.com dollar-trader.com eclipsemc.com give-me-coins.com glbse.com inputs.io minethings.com mtgox.com ozco.in pool-x.eu satoshisquared.com (I'm pretty sure I received a very similar email a good while ago, too. My memory's crap, though. No longer in email account. Probably deleted or marked as spam and it was automatically pruned.) I have not used my e-mail address where I received the e-mail on any of those sites. Probably mine was found with a google search. Can yours also be found by google searches? Yup. It's public right on this site. |
|
|
|
|
BTC-TK
Member
Offline
Activity: 154
Merit: 14
|
|
January 07, 2014, 12:58:45 AM |
|
Old news, use the search.
|
|
|
|
devthedev
Legendary
Offline
Activity: 1050
Merit: 1004
|
|
January 07, 2014, 01:35:21 AM |
|
bc-casino.com
bitcoinica.com
bitfinex.com
bitfunder.com
bitmit.net
bitratings.microhosting.com
blockchain.info
btc-play.com
btcguild.com
btclot.com
btcmine.com
bitvps.com
coinworker.com
dollar-trader.com
eclipsemc.com
give-me-coins.com
glbse.com
inputs.io
minethings.com
mtgox.com
ozco.in
pool-x.eu
satoshisquared.com
|
|
|
|
|
forbun
|
|
January 07, 2014, 01:54:35 AM |
|
I got the same email. Email list is probably from the mtgox hack awhile back.
|
What name would you give to the smallest unit of bitcoin (0.00000001)? sat. What name would you give to 100 sats? bit. 1 bit = 1 uBTC. 1,000,000 bits = 1 BTC. It's bits |
|
|
robbuodie79
Newbie
Offline
Activity: 1
Merit: 0
|
|
January 07, 2014, 01:58:34 AM |
|
Scary. Disguised txt.
|
|
|
|
|
|
g0re79
|
|
January 07, 2014, 01:59:26 AM |
|
I got the same email. Email list is probably from the mtgox hack awhile back.
Yap, got another one right now. |
|
|
|
stacey2911
Member
Offline
Activity: 105
Merit: 10
|
|
January 07, 2014, 02:05:40 AM |
|
inputs.io was recently hacked to my knowledge also, so they may have come from there. I am only signed up onCoinedUp and here, and I haven't received anything.
|
|
|
|
|
|
