Copy/Paste BTC Address changer virus

[CRIZZI]

Every time I copy a btc address it changes. It seems like a Clipboard Hjacked Virus or sth. What can I do in order to remove it?

Luckily I saw it, so I sent no money to this scammer.

 

Thanks for your help!

[CRIZZI]

Here are all required files

scan-log.txt FRST.txt Addition.txt

[Maurice Naggar]

Hi,  Crizzi    

My name is Maurice. I will be helping and guiding you, going forward on this case.

Later on, please provide some detail on what you copy "From" &

what you "Paste" to.

and if any of that involves a web browser & if so, which web browser.

.

Thanks for the reports.  I spotted one questionable program on the reports that is named E.exe

This next action is a first step.

Please Close and save any open work files before you start this next step.  It may involve a Windows Restart at the end of it.

I am sending a   custom Fix script which is going to be used by the FRST64 tool. They will both work together as a pair.

Please RIGHT-click the (attached file named) FIXLIST and select SAVE AS and save it directly ( as is) in the Downloads folder 

The tool named FRST64.exe  is already on the Downloads folder.

Start the Windows Explorer and then, open the Downloads folder.


Double click FRST64

  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
Click the Fix button just once, and wait.

 

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. Some machines take longer than others.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Kindly attach the Fixlog.txt with your next reply   ( later after you have finished all the steps below ). 

[ 2 ]

Let me suggest you do a CUSTOM scan on the whole C drive !

Open Malwarebytes

Click the Settings menu followed by the Protection tab.

Scroll down to Scan Options and turn the Scan for rootkits setting on.

 

Next, click the icon button at left marked SCAN

 

Then, from the 3 panel choices, click on the middle one marked CUSTOM

( IF you see a summary white screen with a green check, click on the Close X spot on the right side so you get to that out of the way & then click Scan button on the left & then Custom scan on the middle selected .)

 

 

Then click on Configure Scan button

 

be sure the Scan for rootkit on left is ticked

 

Be sure to click on the box marked C on the right.

You want to scan the whole C drive.

 

Then click Scan Now button.

 

Then see what the result is.

.

Fixlist.txt

Edited July 5, 2019 by Maurice Naggar

[CRIZZI]

Big thanks! I think it got fixed.

I can copy BTC addresses without problems again.

 

Fixlog.txt

[Maurice Naggar]

You are very welcome.   😊

I am glad to read this news.  I would still encourage you to make some time, and then do the Custom scan.  That way all of the system is checked.

Let me know if you need anything else.

Sincerely,

Maurice

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks