[ANN] Zipcoin [ZIPC]- X13 PoW/PoS - NO Premine - 7 days PoW - Ninja

[oreoeater]

Well its obvious its all been said pretty much. There was a virus in a link in the OP which the dev had up for a few hours. The people who downloaded this link had the trojan and lost coins. Then the dev changed link to a clean wallet so if you downloaded after this your clean. your looking into it too much if you think this is FUD go through all past accounts read my post I posted on Vertcoin the day it happened. This is no FUD. The coin might be fine NOW and the wallet might be fine now BUT there was a virus and has BEEN SHOWN HERE!

SO you can think it is FUD or believe what people have said here its upto you as investors

[digiguy]

OK so i closed my wallet and i opened it again and guess what my coins are still there wow how lucky am I like said i can find no virus so stop the FUD for cheap coins

[Xircom]

I have no problem as well and I got 1795 Zipcoin`s in intrest today in my wallet...
It looks like some believe this coin is going to be good and want others to dump them to buy in cheap...

[oreoeater]

OK so i closed my wallet and i opened it again and guess what my coins are still there wow how lucky am I like said i can find no virus so stop the FUD for cheap coins

LOL you OBVIOUSLY haven't read a thing so either you are indeed the DEV trying to buy time or your just ABSOLUTELY STUPID.

If you are safe you should be happy and carry as you are doing...we are not spreading fud we are just letting potential victims know!

AGAIN : if you downloaded the wallet as soon as it was released then your fucked like us that have posted. If you downloaded after the change you are fine.
Collectively we have posted enough proof to let people know so make your own mind up trade as you will.

[madbit1000]

If you like i can send you the file i downloaded from the main source and then let you see for yourself how the virus works.

[digiguy]

If you like i can send you the file i downloaded from the main source and then let you see for yourself how the virus works.

sure PM me

[matrix961]

It's important for people to know. The original file exists and can be inspected. This may turn out to unfortunately be a new tactic.

- Release new coin with "special" wallet
- After 30 minutes change it to the clean wallet
- Wait a few days and watch a small group claim they had coins stolen
- The larger group will have the clean file and it will look like the small group of victims are just fudders
- Someone makes off with the stolen wallets of the victims

[btchris]

sorry took a while...here is what i believe to be the virus QT...

https://mega.co.nz/#!L1IBwTzB!sHUsuf3fLQ-PJrtScL7IZaT99DPNesSSrUfJ_ehFjkg

Thanks, I just tested this and it is the same thing that happened on my compromised PC. This was the original windows wallet that was posted. It starts with the ztor.exe process, and creates the C:/user/Appdata/local/spoon backdoor program.

Anyone in doubt should test this themselves on a vm or sandbox, DO NOT RUN THAT EXE ON YOUR NORMAL SYSTEM.

NP thanks for verify. Could some more people do this for credibility please?

I can't verify that URL referenced above was in the original post, but I can definitely verify that it drops malware:

[digiguy]

It's important for people to know. The original file exists and can be inspected. This may turn out to unfortunately be a new tactic.

- Release new coin with "special" wallet
- After 30 minutes change it to the clean wallet
- Wait a few days and watch a small group claim they had coins stolen
- The larger group will have the clean file and it will look like the small group of victims are just fudders
- Someone makes off with the stolen wallets of the victims

this is why u always have to check what u put on your PC

[btchris]

Has any asked a mod to see if the original post had the malicious link (not that I really doubt it)?

[Jookly]

got a chance to check the computer my wallet was installed on.

I also had the Spoon folder with all the bad stuff in it.

I didn't seem to have the malicious process running though and none of my wallet names were changed.

Im on Win8

[digiguy]

got a chance to check the computer my wallet was installed on.

I also had the Spoon folder with all the bad stuff in it.

I didn't seem to have the malicious process running though and none of my wallet names were changed.

Im on Win8

where did u download your file from?

[matrix961]

It's important for people to know. The original file exists and can be inspected. This may turn out to unfortunately be a new tactic.

- Release new coin with "special" wallet
- After 30 minutes change it to the clean wallet
- Wait a few days and watch a small group claim they had coins stolen
- The larger group will have the clean file and it will look like the small group of victims are just fudders
- Someone makes off with the stolen wallets of the victims

this is why u always have to check what u put on your PC

Or do like me and have a dedicated PC for mining, transferring coins to a cold wallet PC as you mine, then finally usually a few days later to a hot wallet PC etc. It's because of this all they got from me was empty wallets.

What's scary is that virustotal doesn't flag the file. It has to be run and then the extracted files are then seen as malware but quite a few scanners seemed to miss it judging by other posts. What I do above is really the best way but I understand not everyone can have a pc for each stage. People just need to be aware that it can happen.

[Jookly]

got a chance to check the computer my wallet was installed on.

I also had the Spoon folder with all the bad stuff in it.

I didn't seem to have the malicious process running though and none of my wallet names were changed.

Im on Win8

where did u download your file from?

I downloaded it from the ANN post here.

edit: not sure of time.  It wasn't immediately though. Several hours at least after the mining had began

[Nxtblg]

I just checked the archived original post at Bitcointa.lk:

https://bitcointa.lk/threads/ann-zipcoin-x13-pow-pos-no-premine-7-days-pow-ninja.350313/

The link under the "Wallet" category that the Windows .png is the anchor for, happens to be:

https://mega.co.nz/#!6cAxzBjT!KVntyW_y8j4QVwobEHROrRhpuKnX_2uxd-KML_S4ips

You can check it yourself by going to the Bitcointa.lk thread and using "Copy Shortcut" yourself. Bitcointa.lk automatically archives Bitcointalk threads, but does not change them to reflect after-the-fact edits. It also archives posts from self-modded threads that are later deleted, which does make it useful in certain cases.  


I hope this clears things up.

[sdelgit]

In the wallet Trojan steals coins - ztor.exe !!!

[teamlottowin]

can we decide for good now, please --

Virus or no Virus

[btchris]

can we decide for good now, please --

Virus or no Virus

There definitely is a version which contains a virus. What hasn't been decided is where that version came from, and if it was created by the author of the official Zipcoin wallet. So far, the currently posted version has not been found to contain any malware, but since any semblance of Gitian has been ripped out of it, it's very difficult to know for sure. (Gitian is what allows people to compile the software from source and see if the .exe is exactly the same as what's posted.)

As of right now, I honestly don't know, but I'd err on the safe side if I were you.

[btchris]

I just checked the archived original post at Bitcointa.lk:

https://bitcointa.lk/threads/ann-zipcoin-x13-pow-pos-no-premine-7-days-pow-ninja.350313/

The link under the "Wallet" category that the Windows .png is the anchor for, happens to be:

https://mega.co.nz/#!6cAxzBjT!KVntyW_y8j4QVwobEHROrRhpuKnX_2uxd-KML_S4ips

You can check it yourself by going to the Bitcointa.lk thread and using "Copy Shortcut" yourself. Bitcointa.lk automatically archives Bitcointalk threads, but does not change them to reflect after-the-fact edits. It also archives posts from self-modded threads that are later deleted, which does make it useful in certain cases.  


I hope this clears things up.

Not entirely... where did the virus-version come from, and was it created by the same author of Zipcoin?

As far as I can tell, this link has been claimed to be the link where the virus version originally came from (although its content has since been removed): https://mega.co.nz/#!JAoyiajC!0ND16g-6qVDRGVuxnNBZmd-NInXzpbdaW9Pe9dDlDUo

The first reference I can find of that link is over in this forum by an admin, so I doubt it was created by them: https://cryptocointalk.com/topic/13908-zipcoin-zip-information/?p=116755

I posted a question asking where the link came from, we'll see if there's any reply.

[mikelitoris]

I can't believe how dumb some of you are, several people come forward with stolen coins and you IDIOTS brush it off as fud, I will sit back with my popcorn now and watch you all cry scam in a day or two and blame bittrex for this.