My account was hacked. Please help me. PROOFS inside.

[atleticofa_hacked]

Hello,

My account atleticofa was hacked 5 days ago. The password was stolen and the email was changed.

https://bitcointalk.org/index.php?action=profile;u=161675

Code:

November 23, 2014, 06:54:41 PM - atleticofa - password changed

https://bitcointalk.org/seclog.php

I'm monitoring it and there are no new messages since then for now. The account was stolen as a result of an infected wallet in a false ninja launch. Be careful since now.

Only McAfee was able to detect the trojan in virustotal.com  And only Malwarebytes anti rootkit was able to delete it. The trojan created recurrent .exe files in all the system, and some logs in dclogs folder in roaming.

I contacted theymos following this guide: https://bitcointalk.org/index.php?topic=497545.0
But there is no answer yet. How much should I wait? I hope to recover my account.  

___________________________________

EDIT:


 I sent to theymos a PM just with the proof #1 because I didn't realize of the others. Should I send another with the rest of the proofs? Can some administrator help me? Thank you.

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
Hello, today is 7 December of 2014 and I'm the owner of atleticofa hacked account and 18mKzcMUUHHG79R7NL53fBV3c95ajvS7bk BTC address
-----BEGIN SIGNATURE-----
18mKzcMUUHHG79R7NL53fBV3c95ajvS7bk
HwhrgVQEcz1gYhWLu79yAgyZIw21od+Wk/98oZSicr7MNm59xLYzD8bgKeMB1V9UQHAz6ilAGb0pv+1ZNt4qb2k=
-----END BITCOIN SIGNED MESSAGE-----

Proof #1: I published my address on the forum in January 12, I edited after the message. But is yet recorded in bitcointa.kl database here: https://bitcointa.lk/threads/ann-usde-unitary-status-dollar-ecoin-mandatory-update-before-block-91-000.234337/page-27#post-4239977

Proof #2: If you go to my trust summary. I left a comment for thekekk in January 22 with are reference. The reference point to the BTC transaction https://blockchain.info/es/tx/86dff12a2088f3cd8a69c2939bf88ba9c6541f2dd733c3a16e414eb552baf7d4 showing that my account 18mKzcMUUHHG79R7NL53fBV3c95ajvS7bk got 0.1BTC

Proof #3: The same happen with the comment I leave for bitcoinguyman, in February 16. The reference point to the transaction: https://blockchain.info/es/tx/562c25ea39d44a05b6b58beeeafd3e8c2acb979e91a6eed1337d7232fc3545ce in which the address 18mKzcMUUHHG79R7NL53fBV3c95ajvS7bk received 0.09BTC as the comment in the trust summary says.



I'm trying to collect more proofs contacting people which I made some trades in the forum before. But I think with that three is enought to proof I'm the owner :/

[Quickseller]

Looking at your last 40 posts, I see that a lot of them are shit posts. Also the "hacker" appears to have not logged in nor posted from your account.

Did your account happened to get banned?

[atleticofa_hacked]

Looking at your last 40 posts, I see that a lot of them are shit posts. Also the "hacker" appears to have not logged in nor posted from your account.

Did your account happened to get banned?

My account wasn't banned. My account was stolen.

I downloaded a wallet with a trojan in the ANN section. It was a cloned thread of Odccoin, here is the wallet with the trojan that I downloaded: https://www.dropbox.com/s/kv3rjsgj090ir5g/ODCcoin-wallet-qt.rar?dl=0

Don't open the .exe except you are using a virtual machine.

In the next morning I couldn't access to my account, also I didn't receive new emails from the watched subforums... And then I checked the trust summary of my account and it was a message that says:

Code:

This user changed his/her password recently.

So it was stolen for sure. I have proofs that I'm the owner, I own an address that a published on the forum with atleticofa account.

[Quickseller]

Looking at your last 40 posts, I see that a lot of them are shit posts. Also the "hacker" appears to have not logged in nor posted from your account.

Did your account happened to get banned?

My account wasn't banned. My account was stolen.

I downloaded a wallet with a trojan in the ANN section. It was a cloned thread of Odccoin, here is the wallet with the trojan that I downloaded: [I am not quoting a malware link]

Don't open the .exe except you are using a virtual machine.

In the next morning I couldn't access to my account, also I didn't receive new emails from the watched subforums... And then I checked the trust summary of my account and it was a message that says:

Code:

This user changed his/her password recently.

So it was stolen for sure. I have proofs that I'm the owner, I own an address that a published on the forum with atleticofa account.

What thread did you find the trojan wallet in? Did you report the post for having a link to malware so others do not have the same fate?

The reason for my skepticism is because someone recently made a very similar claim in this thread and it turns out that his account was banned.

[atleticofa_hacked]

Looking at your last 40 posts, I see that a lot of them are shit posts. Also the "hacker" appears to have not logged in nor posted from your account.

Did your account happened to get banned?

My account wasn't banned. My account was stolen.

I downloaded a wallet with a trojan in the ANN section. It was a cloned thread of Odccoin, here is the wallet with the trojan that I downloaded: [I am not quoting a malware link]

Don't open the .exe except you are using a virtual machine.

In the next morning I couldn't access to my account, also I didn't receive new emails from the watched subforums... And then I checked the trust summary of my account and it was a message that says:

Code:

This user changed his/her password recently.

So it was stolen for sure. I have proofs that I'm the owner, I own an address that a published on the forum with atleticofa account.

What thread did you find the trojan wallet in? Did you report the post for having a link to malware so others do not have the same fate?

The reason for my skepticism is because someone recently made a very similar claim in this thread and it turns out that his account was banned.

This was the thread: https://bitcointalk.org/index.php?topic=869842

A new topic, ' [ANN] [ODC] OddCoin | Start nov/23/2014 - 14EST - 20CET - 19UTC', has been made on a board you are watching.

You can see it at
https://bitcointalk.org/index.php?topic=869842.new#new

Unsubscribe to new topics from this board by clicking here: https://bitcointalk.org/index.php?action=notifyboard;board=159.0

Regards,
The Bitcoin Forum Team.

It was deleted in less than 5 minutes by a mod, it was only one message when I opened. I don't know if there were more people affected, probably no.

[Quickseller]

Looking at your last 40 posts, I see that a lot of them are shit posts. Also the "hacker" appears to have not logged in nor posted from your account.

Did your account happened to get banned?

My account wasn't banned. My account was stolen.

I downloaded a wallet with a trojan in the ANN section. It was a cloned thread of Odccoin, here is the wallet with the trojan that I downloaded: [I am not quoting a malware link]

Don't open the .exe except you are using a virtual machine.

In the next morning I couldn't access to my account, also I didn't receive new emails from the watched subforums... And then I checked the trust summary of my account and it was a message that says:

Code:

This user changed his/her password recently.

So it was stolen for sure. I have proofs that I'm the owner, I own an address that a published on the forum with atleticofa account.

What thread did you find the trojan wallet in? Did you report the post for having a link to malware so others do not have the same fate?

The reason for my skepticism is because someone recently made a very similar claim in this thread and it turns out that his account was banned.

This was the thread: https://bitcointalk.org/index.php?topic=869842

A new topic, ' [ANN] [ODC] OddCoin | Start nov/23/2014 - 14EST - 20CET - 19UTC', has been made on a board you are watching.

You can see it at
https://bitcointalk.org/index.php?topic=869842.new#new

Unsubscribe to new topics from this board by clicking here: https://bitcointalk.org/index.php?action=notifyboard;board=159.0

Regards,
The Bitcoin Forum Team.

It was deleted in less than 5 minutes by a mod, it was only one message when I opened. I don't know if there were more people affected, probably no.

Well the topic is deleted now so that is good, however 5 minutes is very quick for a mod to respond to a report, in my experience it usually takes much longer for action to be taken on my reports in general, and in my experience malware reports take the longest for action to be taken (I assume that fewer moderators are able to handle these kinds of reports).

Also you should make the fact that the above dropbox link contains malware more prominent.

[atleticofa_hacked]

Looking at your last 40 posts, I see that a lot of them are shit posts. Also the "hacker" appears to have not logged in nor posted from your account.

Did your account happened to get banned?

My account wasn't banned. My account was stolen.

I downloaded a wallet with a trojan in the ANN section. It was a cloned thread of Odccoin, here is the wallet with the trojan that I downloaded: [I am not quoting a malware link]

Don't open the .exe except you are using a virtual machine.

In the next morning I couldn't access to my account, also I didn't receive new emails from the watched subforums... And then I checked the trust summary of my account and it was a message that says:

Code:

This user changed his/her password recently.

So it was stolen for sure. I have proofs that I'm the owner, I own an address that a published on the forum with atleticofa account.

What thread did you find the trojan wallet in? Did you report the post for having a link to malware so others do not have the same fate?

The reason for my skepticism is because someone recently made a very similar claim in this thread and it turns out that his account was banned.

This was the thread: https://bitcointalk.org/index.php?topic=869842

A new topic, ' [ANN] [ODC] OddCoin | Start nov/23/2014 - 14EST - 20CET - 19UTC', has been made on a board you are watching.

You can see it at
https://bitcointalk.org/index.php?topic=869842.new#new

Unsubscribe to new topics from this board by clicking here: https://bitcointalk.org/index.php?action=notifyboard;board=159.0

Regards,
The Bitcoin Forum Team.

It was deleted in less than 5 minutes by a mod, it was only one message when I opened. I don't know if there were more people affected, probably no.

Well the topic is deleted now so that is good, however 5 minutes is very quick for a mod to respond to a report, in my experience it usually takes much longer for action to be taken on my reports in general, and in my experience malware reports take the longest for action to be taken (I assume that fewer moderators are able to handle these kinds of reports).

Also you should make the fact that the above dropbox link contains malware more prominent.

In the announcements subforum threads with malware get banned in less than 10 minutes always. At least that's my experience, it's not the first wallet with malware that I downloaded.

[Quickseller]

Looking at your last 40 posts, I see that a lot of them are shit posts. Also the "hacker" appears to have not logged in nor posted from your account.

Did your account happened to get banned?

My account wasn't banned. My account was stolen.

I downloaded a wallet with a trojan in the ANN section. It was a cloned thread of Odccoin, here is the wallet with the trojan that I downloaded: [I am not quoting a malware link]

Don't open the .exe except you are using a virtual machine.

In the next morning I couldn't access to my account, also I didn't receive new emails from the watched subforums... And then I checked the trust summary of my account and it was a message that says:

Code:

This user changed his/her password recently.

So it was stolen for sure. I have proofs that I'm the owner, I own an address that a published on the forum with atleticofa account.

What thread did you find the trojan wallet in? Did you report the post for having a link to malware so others do not have the same fate?

The reason for my skepticism is because someone recently made a very similar claim in this thread and it turns out that his account was banned.

This was the thread: https://bitcointalk.org/index.php?topic=869842

A new topic, ' [ANN] [ODC] OddCoin | Start nov/23/2014 - 14EST - 20CET - 19UTC', has been made on a board you are watching.

You can see it at
https://bitcointalk.org/index.php?topic=869842.new#new

Unsubscribe to new topics from this board by clicking here: https://bitcointalk.org/index.php?action=notifyboard;board=159.0

Regards,
The Bitcoin Forum Team.

It was deleted in less than 5 minutes by a mod, it was only one message when I opened. I don't know if there were more people affected, probably no.

Well the topic is deleted now so that is good, however 5 minutes is very quick for a mod to respond to a report, in my experience it usually takes much longer for action to be taken on my reports in general, and in my experience malware reports take the longest for action to be taken (I assume that fewer moderators are able to handle these kinds of reports).

Also you should make the fact that the above dropbox link contains malware more prominent.

In the announcements subforum threads with malware get banned in less than 10 minutes always. At least that's my experience, it's not the first wallet with malware that I downloaded.

I don't visit the altcoin section very often so I really cannot speak to how quickly mprep is able to take action on the reports there, although he is the only moderator of the altcoin section and it tends to be very busy (and have a lot of drama).

If this is not your first malware wallet you have downloaded then I might suggest that you be more careful about what you download. Sending out malware can be a very effective way to cheat people out of a lot of money as it can usually easily steal any bitcoin (or any other alt coins) you have stored on your computer, hackers/attackers will often use malware as a result of this.

IDK how much bitcoin you have stored on your computer, but I am sure that you worked hard for however much you have there, and I don't think you would want it to be unfairly stolen from you

[atleticofa_hacked]

Looking at your last 40 posts, I see that a lot of them are shit posts. Also the "hacker" appears to have not logged in nor posted from your account.

Did your account happened to get banned?

My account wasn't banned. My account was stolen.

I downloaded a wallet with a trojan in the ANN section. It was a cloned thread of Odccoin, here is the wallet with the trojan that I downloaded: [I am not quoting a malware link]

Don't open the .exe except you are using a virtual machine.

In the next morning I couldn't access to my account, also I didn't receive new emails from the watched subforums... And then I checked the trust summary of my account and it was a message that says:

Code:

This user changed his/her password recently.

So it was stolen for sure. I have proofs that I'm the owner, I own an address that a published on the forum with atleticofa account.

What thread did you find the trojan wallet in? Did you report the post for having a link to malware so others do not have the same fate?

The reason for my skepticism is because someone recently made a very similar claim in this thread and it turns out that his account was banned.

This was the thread: https://bitcointalk.org/index.php?topic=869842

A new topic, ' [ANN] [ODC] OddCoin | Start nov/23/2014 - 14EST - 20CET - 19UTC', has been made on a board you are watching.

You can see it at
https://bitcointalk.org/index.php?topic=869842.new#new

Unsubscribe to new topics from this board by clicking here: https://bitcointalk.org/index.php?action=notifyboard;board=159.0

Regards,
The Bitcoin Forum Team.

It was deleted in less than 5 minutes by a mod, it was only one message when I opened. I don't know if there were more people affected, probably no.

Well the topic is deleted now so that is good, however 5 minutes is very quick for a mod to respond to a report, in my experience it usually takes much longer for action to be taken on my reports in general, and in my experience malware reports take the longest for action to be taken (I assume that fewer moderators are able to handle these kinds of reports).

Also you should make the fact that the above dropbox link contains malware more prominent.

In the announcements subforum threads with malware get banned in less than 10 minutes always. At least that's my experience, it's not the first wallet with malware that I downloaded.

I don't visit the altcoin section very often so I really cannot speak to how quickly mprep is able to take action on the reports there, although he is the only moderator of the altcoin section and it tends to be very busy (and have a lot of drama).

If this is not your first malware wallet you have downloaded then I might suggest that you be more careful about what you download. Sending out malware can be a very effective way to cheat people out of a lot of money as it can usually easily steal any bitcoin (or any other alt coins) you have stored on your computer, hackers/attackers will often use malware as a result of this.

IDK how much bitcoin you have stored on your computer, but I am sure that you worked hard for however much you have there, and I don't think you would want it to be unfairly stolen from you

I have 0 bitcoins on my computer so I'm not worried for that, my bitcoins are safe in my Trezor device.

Probably mprep has email notifications for new threads, because he is really fast sometimes.

[atleticofa_hacked]

Still no answer form theymos.  

I talked with mprep, he told that he will say to administrators. But I suppose only theymos can really do something.


Since 2 days ago someone is posting with my account. Maybe the hacker sell to someone because the messages look normal.  
But in the security log appears that nobody changed the pass again, so probably is the hacker.


https://bitcointalk.org/index.php?action=profile;u=161675;sa=showPosts



And by the way, the same hacker published again the same trojan on this thread some minutes ago:

https://bitcointalk.org/index.php?topic=885719.msg9769347

[redsn0w]

Still no answer form theymos.  

I talked with mprep, he told that he will say to administrators. But I suppose only theymos can really do something.


Since 2 days ago someone is posting with my account. Maybe the hacker sell to someone because the messages look normal.  

https://bitcointalk.org/index.php?action=profile;u=161675;sa=showPosts



And by the way, the same hacker published again the same trojan on this thread some minutes ago:

https://bitcointalk.org/index.php?topic=885719.msg9769347

If your account was hacked , I think some member in the defaultTrust list should left  a negative feedback (for security) :

https://bitcointalk.org/index.php?action=trust;u=161675

[atleticofa_hacked]

Still no answer form theymos.  

I talked with mprep, he told that he will say to administrators. But I suppose only theymos can really do something.


Since 2 days ago someone is posting with my account. Maybe the hacker sell to someone because the messages look normal.  

https://bitcointalk.org/index.php?action=profile;u=161675;sa=showPosts



And by the way, the same hacker published again the same trojan on this thread some minutes ago:

https://bitcointalk.org/index.php?topic=885719.msg9769347

If your account was hacked , I think some member in the defaultTrust list should left  a negative feedback (for security) :

https://bitcointalk.org/index.php?action=trust;u=161675

I know.

I didn't do yet because I can prove I'm the original owner of that account in some many ways and I still have hopes to recover it. But if finally I don't recover I wil tell everyone I know to leave negative feedback.

[redsn0w]

....
If your account was hacked , I think some member in the defaultTrust list should left  a negative feedback (for security) :

https://bitcointalk.org/index.php?action=trust;u=161675

I know.

I didn't do yet because I can prove I'm the original owner of that account in some many ways and I still have hopes to recover it. But if finally I don't recover I wil tell everyone I know to leave negative feedback.

This is the unique way for recover your account : https://bitcointalk.org/index.php?topic=497545.0     Good luck .

[atleticofa_hacked]

I know. I'm trying to collect all possible proofs. I sent to theymos a PM just with the proof #1 because I didn't realize of the others. Should I send another with the rest of the proofs? Can some administrator help me? Thank you.

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
Hello, today is 7 December of 2014 and I'm the owner of atleticofa hacked account and 18mKzcMUUHHG79R7NL53fBV3c95ajvS7bk BTC address
-----BEGIN SIGNATURE-----
18mKzcMUUHHG79R7NL53fBV3c95ajvS7bk
HwhrgVQEcz1gYhWLu79yAgyZIw21od+Wk/98oZSicr7MNm59xLYzD8bgKeMB1V9UQHAz6ilAGb0pv+1ZNt4qb2k=
-----END BITCOIN SIGNED MESSAGE-----

Proof #1: I published my address on the forum in January 12, I edited after the message. But is yet recorded in bitcointa.kl database here: https://bitcointa.lk/threads/ann-usde-unitary-status-dollar-ecoin-mandatory-update-before-block-91-000.234337/page-27#post-4239977

Proof #2: If you go to my trust summary. I left a comment for thekekk in January 22 with are reference. The reference point to the BTC transaction https://blockchain.info/es/tx/86dff12a2088f3cd8a69c2939bf88ba9c6541f2dd733c3a16e414eb552baf7d4 showing that my account 18mKzcMUUHHG79R7NL53fBV3c95ajvS7bk got 0.1BTC

Proof #3: The same happen with the comment I leave for bitcoinguyman, in February 16. The reference point to the transaction: https://blockchain.info/es/tx/562c25ea39d44a05b6b58beeeafd3e8c2acb979e91a6eed1337d7232fc3545ce in which the address 18mKzcMUUHHG79R7NL53fBV3c95ajvS7bk received 0.09BTC as the comment in the trust summary says.

[exoton]

Although it appears that you were previously the owner of atleticofa, I am going to say there is a very good chance that it is now banned as per your above post it was posting malware which is a very good/quick way to get your account banned.

While I certainly agree that it is not fair that someone else can get your account banned when they hack your account, it is also virtually impossible to prove that it was not you spreading such malware.

[atleticofa_hacked]

Although it appears that you were previously the owner of atleticofa, I am going to say there is a very good chance that it is now banned as per your above post it was posting malware which is a very good/quick way to get your account banned.

While I certainly agree that it is not fair that someone else can get your account banned when they hack your account, it is also virtually impossible to prove that it was not you spreading such malware.

Luckily nobody published malware yet with atleticofa account

https://bitcointalk.org/index.php?action=profile;u=161675;sa=showPosts

[exoton]

Although it appears that you were previously the owner of atleticofa, I am going to say there is a very good chance that it is now banned as per your above post it was posting malware which is a very good/quick way to get your account banned.

While I certainly agree that it is not fair that someone else can get your account banned when they hack your account, it is also virtually impossible to prove that it was not you spreading such malware.

Luckily nobody published malware yet with atleticofa account

https://bitcointalk.org/index.php?action=profile;u=161675;sa=showPosts

According to the below quote, the hacker published a "Trojan", which would be consider malware. It appears the post has been deleted.

And by the way, the same hacker published again the same trojan on this thread some minutes ago:

https://bitcointalk.org/index.php?topic=885719.msg9769347

The decision to ban your account is not mine, nor is the decision to unban the account (if applicable) however my experience in this forum would say that it is probably banned and probably not be unbanned (at least from information that is publicly available - I have never seen an account publicly get unbanned)

[atleticofa_hacked]

Although it appears that you were previously the owner of atleticofa, I am going to say there is a very good chance that it is now banned as per your above post it was posting malware which is a very good/quick way to get your account banned.

While I certainly agree that it is not fair that someone else can get your account banned when they hack your account, it is also virtually impossible to prove that it was not you spreading such malware.

Luckily nobody published malware yet with atleticofa account

https://bitcointalk.org/index.php?action=profile;u=161675;sa=showPosts

According to the below quote, the hacker published a "Trojan", which would be consider malware. It appears the post has been deleted.

And by the way, the same hacker published again the same trojan on this thread some minutes ago:

https://bitcointalk.org/index.php?topic=885719.msg9769347

The decision to ban your account is not mine, nor is the decision to unban the account (if applicable) however my experience in this forum would say that it is probably banned and probably not be unbanned (at least from information that is publicly available - I have never seen an account publicly get unbanned)

But these messages were not published from my hacked account. I know is the same hacker because I donwloaded the wallet and it's exactly the same that I downloaded when he hacked me, different icon but same size: 606kb for the wallet qt

He always follow the same pattern: He clone a thread from a coin that is going to launch in some minutes and change the wallet to his trojan. First time was ODCCOIN, today was Darkgold, tomorrow who knows

My account (atleticofa) is not banned.

[escalicha]

Up!

good look man! I hope theymos will recovery the best ninja account in whole bitcointalk!

[redsn0w]

I've left a negative feedback for security . Is it a problem for you ?