0

I'm on Windows 10 last build and for a few days it looks like I have a malware that modifies ethereum addresses in my clipboard.

I sadly tried a lot of antivirus, antispyware and nothing is found. I think I have a FUD malware.

Is there a tool to catch a process that modifies my clipboard? Maybe any sysinternal tools?

1
  • Also make sure that it's not a web page running a script that's modifying your clipboard.
    – user
    Oct 12 '20 at 18:04
1

You can reboot, close every single auto-start program you have, close anything not crucial, copy one Ethereum address to clipboard, paste it somewhere and see if it changed.

Then you could use Process Explorer to list every single running process, and run strings (form SysInternals too) on each one searching for the changed address. Unless the address is obfuscated in some way, it can reveal the culprit.

If you cannot find it using strings, use Volatility to take a memory dump, and check the dump later to pinpoint which process have the changed address in memory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.