ALERT! sgminerwindows.com Stealing Bitcoins!

[sammir]

The scammer here has other versions of SGminer that contain the hidden script, I can point the code out there as well.
He is also the creator of Shire Coin, which is a scam because it uses the same code to steal coins if you
download the wallet.

good to know that. im scared since last incident that why i dont mine in your pool, well i will try to get some blackcoin for hoarding.

[flound1129]

Multipool has removed the link to this site as well.  Pretty sad that something that was originally legit is now being used to scam people.

[flound1129]

I've filed a report on Google's safe browsing site and I suggest more people do the same.

https://www.google.com/safebrowsing/report_badware/

The site is still the #1 hit on google for "sgminer windows".

[flound1129]

The guy who built these binaries is: http://www.reddit.com/user/LiteSaber

According to his post history he also runs VertSquad.com and CoinHuntr.com.

It's also possible the site could have been compromised by someone else who uploaded the trojaned binaries.

[omgbossis21]

Nice, Im in the chatroom posting this asking how come both vertsquads guide and coinhuntr's guide link directly to it but the chat rooms are dead
Hes in both chatrooms, feel free to send him messages,  I am

[omgbossis21]

Hes a member on here :
https://bitcointalk.org/index.php?topic=719526.new#new

[sncs]

It sucks for anyone who got scammed with this. I will be uploading lots of dummy 100mb files to that server just for lolz.

[LiteSaber]

Sorry guys, just saw messages someone sent me on IRC.

I've gone ahead and removed the download links from sgminerwindows right away.

Previously I compiled all versions myself and these were 100% clean i guarantee. But the last update was done away from my computer (on a family vacation) using pre-compiled binaries from minersforwindows.com because I was getting heaps of messages from people to update with the latest beta version.

Stupid move on my part it seems. That'll teach me for being lazy and not just installing what i needed to compile onto my laptop.

In the spirit of keeping the site going (in the right hands) If there is a known trustworthy person here that would like to take over the website from this point on, I will happily give you the website's files and push the domain to you free of charge (you will need a namesilo.com account).

It's already ranking #1 in google for many sgminer terms so I would rather not see the site go to waste. But I just do not have the time to keep it updated.

Also, if you don't believe me. Go and check out minersforwindows.com and scan their versions. They do many more versions that i never added to my site thankfully. They also do other mining software.

[BrianM]

Damn scammers, they are everywhere I go 

[oreoeater]

Hey guys! sorry to hear what happened! this is ridiculous! It happened to me with another file I tried to download. The file file was the zipcoin-qt and it was designed to steal wallet.dat the exact way that this is...
Check out the thread https://bitcointalk.org/index.php?topic=721306.260 it took a few of us who were scammed a while to convince everyone but I think they believe it now

[sncs]

Damn scammers, they are everywhere I go 

Yeah i fucked him up a little. Must have uploaded at least 10GB of binary 0's and 1's.

He got smart:

Disconnected from server
Connection failed.
No connections allowed from your IP

Hahahaha.

[flound1129]

Sorry guys, just saw messages someone sent me on IRC.

I've gone ahead and removed the download links from sgminerwindows right away.

Previously I compiled all versions myself and these were 100% clean i guarantee. But the last update was done away from my computer (on a family vacation) using pre-compiled binaries from minersforwindows.com because I was getting heaps of messages from people to update with the latest beta version.

Stupid move on my part it seems. That'll teach me for being lazy and not just installing what i needed to compile onto my laptop.

In the spirit of keeping the site going (in the right hands) If there is a known trustworthy person here that would like to take over the website from this point on, I will happily give you the website's files and push the domain to you free of charge (you will need a namesilo.com account).

It's already ranking #1 in google for many sgminer terms so I would rather not see the site go to waste. But I just do not have the time to keep it updated.

Also, if you don't believe me. Go and check out minersforwindows.com and scan their versions. They do many more versions that i never added to my site thankfully. They also do other mining software.

Sent you a PM, I'm willing to take this over.

[Blisk]

Does anybody know if that sgminer install some malware on computer and will still steall money from wallets after you remove it from computer or that does just sgminer itself so I don't need to reinstall windows but only remove sgminer?

[fire000]

Does anybody know if that sgminer install some malware on computer and will still steall money from wallets after you remove it from computer or that does just sgminer itself so I don't need to reinstall windows but only remove sgminer?

if it was me I would do a clean install of windows as these things trend to write to other directorys besides the sgminer or wallet one etc.    think of it as normal malware it can write it file in a number of different directory's   and it a pain in the ass to fully get rid of etc

[Blisk]

If you read on site he is not compilled latest version of sgminer but he downloaded it from here
http://minersforwindows.com/

Actually this site is with malware sgminer

[Bitcoin Warrior]

their all set manicious malyware update virus.
you should check your device.

[dekodoge]

From my simple investigation if would seem its a non persistent threat, as seen in the code back in the thread.

It basically looks for common wallet files and uploads them to a FTP server each time its run.

So encrypt your bloody wallets always.

[LiteSaber]

Just for future reference.

I've handed over control of the sgminerwindows.com domain / website to flound1129

Hopefully he has more time to keep it all up to date than I did.

[flound1129]

I have the domain now.  I will be downing the site until the new binaries are available with an explanation of what happened.

[ingrown]

So is it confirmed that the tainted code was only in recent builds?  If so, how long ago did it happen?