0

I'm on Windows 10 last build and for a few days it looks like I have a malware that modifies ethereum addresses in my clipboard.

I sadly tried a lot of antivirus, antispyware and nothing is found. I think I have a FUD malware.

Is there a tool to catch a process that modifies my clipboard? Maybe any sysinternal tools?

Improve this question
1
  • Also make sure that it's not a web page running a script that's modifying your clipboard.
    – user
    Oct 12, 2020 at 18:04

1 Answer 1

Reset to default
1

You can reboot, close every single auto-start program you have, close anything not crucial, copy one Ethereum address to clipboard, paste it somewhere and see if it changed.

Then you could use Process Explorer to list every single running process, and run strings (form SysInternals too) on each one searching for the changed address. Unless the address is obfuscated in some way, it can reveal the culprit.

If you cannot find it using strings, use Volatility to take a memory dump, and check the dump later to pinpoint which process have the changed address in memory.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .