Im freaking out here!

[Den]

Ok so I get done with my homework and think to myself, "Hey, il use my 10 mins to go play some Runescape.

 

 

 

I click on my runescape bookmark... and i get redirected to a Runescape cheat and Gold buying site. :shock:

 

 

 

I then think, "Wow, im going nuts." So I close the browser, open a new one and click the bookmark again.

 

I get redirected to the same site.

 

 

 

Now im starting to freak out.

 

I go to my desctop and open the Jagex Runescape client, certain that this might just be some mistake.

 

The runescape client opens the gold buying site.

 

 

 

Is there something on my pc that redirects the runescape site to a gold buying site? :ohnoes:

 

Im kinda shaky at the moment, does anyone know what the problem is? :?

[Master_Smither]

Run a virus scan is the only thing I'd say maybe your computer is infected.

[JustAGamer]

yeah...that's not good. :?

 

 

 

Offhand, Best advice I've got is the stuff you've heard a hundred times before, clear cookies, run scans etc.

 

 

 

Let us know if you fix it. :)

[Den]

Run a virus scan is the only thing I'd say maybe your computer is infected.

 

 

 

Ok, I started avg but iI dont think its my computer.

 

 

 

I just tried entering runescape from my laptop and it goes to the same site as on my main pc. :shock: :ohnoes:

[compfreak847]

Your hosts file (C:\windows\system32\drivers\etc\hosts) has been hijacked, most likely. Open it up and look for an entry labeled 'runescape.com'. It's redirecting traffic from runescape to whatever the IP of the scam site is. You probably have all sorts of viruses, DON'T LOG ON UNTIL YOUR CLEAN. Use tools like AVG Antispyware, Spybot S&D, and Lavasoft Ad-Aware to clean it out.

[compfreak847]

Run a virus scan is the only thing I'd say maybe your computer is infected.

 

 

 

Ok, I started avg but iI dont think its my computer.

 

 

 

I just tried entering runescape from my laptop and it goes to the same site as on my main pc. :shock: :ohnoes:

 

That's a problem... Same virus, or router redirection?

[obfuscator]

Try searching "runescape.com" on google, and clicking the link there.

[x1992x]

Try searching "runescape.com" on google, and clicking the link there.

 

 

 

dont do that for god sake!

[Den]

Try searching "runescape.com" on google, and clicking the link there.

 

 

 

Same scam site. :-#

 

 

 

Tried to enter other places on runescape.com but i always get redirected to the site.

[pulli23]

uhm that seems like a browser hack, what happens is that basically your browser is set up so that it "bookmarks" a certain word (in this case "runescape.com") to another site.

 

 

 

This shouldn't be done automatically (or at least, without user confirmation), so something must be wrong (but you figured THAT out already didn't you :lol: ).

 

 

 

Is that 'bookmark' you use, coming from IE or from firefox - what version?

 

If it's IE, do you have activeX enabled? (wow disabling it doesn't even work)

 

 

 

Most generic (and only) advice I can give you atm is to use firefox, and to update to the latest version.

 

 

 

Other than that: well if something like this happens to firefox the easiest thing to do is to reinstal it completely: and/or reset everything in the about:config to it's default option....

 

But with IE I have no clue how to actually reinstal it without storing the settings.

 

 

 

 

 

Well if it's on your laptop happening too: seems to me that there's a DNS problem.. Try going to:

 

http://168.75.183.51/

 

If this works it's definatelly a DNS problem, you could set up your PC to use 1.1.1.2 as dns server...

[x1992x]

Try searching "runescape.com" on google, and clicking the link there.

 

 

 

Same scam site. :-#

 

 

 

Tried to enter other places on runescape.com but i always get redirected to the site.

 

 

FOR GOD SAKE DONT LOG ON ANY PLACE UNTIL ITS CLEANED!!!!

[JustAGamer]

There's a difference between reaching the site and logging in. Relax. :lol:

 

 

 

In any case, either A: Something's wrong with your router, or B: You picked up something that's smart enough to spread between multiple places attached to the same router, or C: You went to the same thing with both computers. (though the latter doesn't seem all that likely to me to happen suddenly)

[x1992x]

There's a difference between reaching the site and logging in. Relax. :lol:

 

 

 

In any case, either A: Something's wrong with your router, or B: You picked up something that's smart enough to spread between multiple places attached to the same router, or C: You went to the same thing with both computers. (though the latter doesn't seem all that likely to me to happen suddenly)

 

 

 

YOU can never be to secure when i comes to keyloggers or something like that ;)

[ghoulmeister]

Count your blessings, this could have been a lot worse. My friend was once directed to a fake rs site, when you logged on, it put you on a private server. He lost a d chain, 20 mil at the time.

[Den]

uhm that seems like a browser hack, what happens is that basically your browser is set up so that it "bookmarks" a certain word (in this case "runescape.com") to another site.

 

 

 

This shouldn't be done automatically (or at least, without user confirmation), so something must be wrong (but you figured THAT out already didn't you :lol: ).

 

 

 

Is that 'bookmark' you use, coming from IE or from firefox - what version?

 

If it's IE, do you have activeX enabled? (wow disabling it doesn't even work)

 

 

 

Most generic (and only) advice I can give you atm is to use firefox, and to update to the latest version.

 

 

 

Other than that: well if something like this happens to firefox the easiest thing to do is to reinstal it completely: and/or reset everything in the about:config to it's default option....

 

But with IE I have no clue how to actually reinstal it without storing the settings.

 

 

 

 

 

Well if it's on your laptop happening too: seems to me that there's a DNS problem.. Try going to:

 

http://168.75.183.51/

 

If this works it's definatelly a DNS problem, you could set up your PC to use 1.1.1.2 as dns server...

 

 

 

 

 

Both my home pc and laptop use firefox.

 

I just searched for runescape in total commander and found temporary internet files containing runescape and money as the file names.

 

The ip you linked sent me to the runescape page, but the scam site logo was still on the page. :lol:

 

 

 

Il try deleting the temporary internet files and cookies then if it doesnt work, reinstall firefox.

[compfreak847]

There's a difference between reaching the site and logging in. Relax. :lol:

 

 

 

In any case, either A: Something's wrong with your router, or B: You picked up something that's smart enough to spread between multiple places attached to the same router, or C: You went to the same thing with both computers. (though the latter doesn't seem all that likely to me to happen suddenly)

 

 

 

YOU can never be to secure when i comes to keyloggers or something like that ;)

 

Not going to a site because your paranoid isn't going to do anything though. Just don't enter your password. And yes, this is some sort of redirection thing - either your router table has been compromised, or the same thing infected both of your computers. check the hosts file. I could almost guarantee you'll see a runescape.com entry - delete it and your fine. Of course, there's probably more underlying products - so use the tools I mentioned earlier. No need to panic.

[PlatinumPixey]

Ok so I get done with my homework and think to myself, "Hey, il use my 10 mins to go play some Runescape.

 

 

 

I click on my runescape bookmark... and i get redirected to a Runescape cheat and Gold buying site. :shock:

 

 

 

I then think, "Wow, im going nuts." So I close the browser, open a new one and click the bookmark again.

 

I get redirected to the same site.

 

 

 

Now im starting to freak out.

 

I go to my desctop and open the Jagex Runescape client, certain that this might just be some mistake.

 

The runescape client opens the gold buying site.

 

 

 

Is there something on my pc that redirects the runescape site to a gold buying site? :ohnoes:

 

Im kinda shaky at the moment, does anyone know what the problem is? :?

 

 

 

I didn't have this particularly happen to me but the one time I went to click on my RS client icon to open it and it said it couldn't find the file so I re-downloaded it and then it eventually happened again and I didn't know why. Well the one time I was going through the virus vault on my computer and saw that it found a virus in my rs client, twice. I have no idea how it happened because I hadn't played rs in awhile and I hadn't gone to any sites that might have caused it. It was so weird till this day still don't know why it could have happened.

[The Observer]

Try running HiJackThis and post a log file.

 

 

 

EDIT: Look for it here: http://www.download.com/Trend-Micro-Hij ... 27353.html

[@Dan3HitU]

Malware mate.

[pulli23]

Well if the same thing happens with both firefox and IE (the runescape client), it's probably not a browser related problem..

 

 

 

Though there are a few shared spaces (like bookmarks, and other user settings).

 

Noscript will probably safe the day here: but it won't FIX the problem, will probably just hide it.

 

 

 

What I wonder what exactly happens:

 

The ip you linked sent me to the runescape page, but the scam site logo was still on the page.

 

 

 

You mean that there's some "parts" that display the wrong site? - Could you post a picture/explain what parts? If it's the "advertisement bar, the bar just above the

home - play now - acoutn - ect

bar, than it really means there's a dns/routing problem. That part of the website is an Iframe (back to "advert.runescape.com") and so this part gets routed to the scam site...

[Den]

:|

 

 

 

In the middle of scanning with spybot, i decide to try getting in via the item database.

 

Now I go to the real main page on both my pc's... :|

[The Observer]

:|

 

 

 

In the middle of scanning with spybot, i decide to try getting in via the item database.

 

Now I go to the real main page on both my pc's... :|

 

 

 

I wouldn't log-in. You should end all the programs you are running (after you have scanned with Spybot) and then run HiJackThis and post a log file. That can catch browser hijacks which what appears to be the problem.

[Den]

What I wonder what exactly happens:

 

The ip you linked sent me to the runescape page, but the scam site logo was still on the page.

 

 

 

You mean that there's some "parts" that display the wrong site? - Could you post a picture/explain what parts? If it's the "advertisement bar, the bar just above the

home - play now - acoutn - ect

bar, than it really means there's a dns/routing problem. That part of the website is an Iframe (back to "advert.runescape.com") and so this part gets routed to the scam site...

 

 

 

Basically, i was sent to the runescape page with a white background and blue links lined up on the left side of the screen.

 

The only picture was the same banner as on the scam site and was located in the area where the ads usualy are on runescape.com

 

 

 

Looks like its fixed but im still paranoid about logging in.

 

 

 

Could it have been that google added a rs gold site and the rs gold ad had a javascript message that sends anyone who enters the site the ad is on, to the site the ad wants them to be sent to?

 

 

 

(Last sentance might be a little confusing)

 

 

 

P.S. Spybot just said my computer is 100% clean.

[Den]

I have no idea what any of this means but killer seems to have it.

 

 

 

Running processes:

 

C:\Windows\system32\taskeng[Caution: Executable File]

 

C:\Windows\system32\Dwm[Caution: Executable File]

 

C:\Windows\Explorer[Caution: Executable File]

 

C:\Program Files\Windows Defender\MSASCui[Caution: Executable File]

 

C:\Windows\RtHDVCpl[Caution: Executable File]

 

C:\Program Files\AVG\AVG8\avgtray[Caution: Executable File]

 

C:\Program Files\Java\jre1.6.0_07\bin\jusched[Caution: Executable File]

 

C:\Windows\System32\rundll32[Caution: Executable File]

 

C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy[Caution: Executable File]

 

C:\Program Files\Windows Sidebar\sidebar[Caution: Executable File]

 

C:\Windows\ehome\ehtray[Caution: Executable File]

 

C:\Windows\ehome\ehmsas[Caution: Executable File]

 

C:\Program Files\Windows Live\Messenger\msnmsgr[Caution: Executable File]

 

C:\Program Files\Windows Media Player\wmpnscfg[Caution: Executable File]

 

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor[Caution: Executable File]

 

C:\Program Files\Common Files\LightScribe\LightScribeControlPanel[Caution: Executable File]

 

C:\Program Files\WinTV\Ir[Caution: Executable File]

 

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr[Caution: Executable File]

 

C:\Windows\system32\wbem\unsecapp[Caution: Executable File]

 

C:\Windows\system32\wuauclt[Caution: Executable File]

 

C:\Windows\system32\taskeng[Caution: Executable File]

 

C:\Program Files\Mozilla Firefox\firefox[Caution: Executable File]

 

C:\Windows\system32\conime[Caution: Executable File]

 

C:\Program Files\Trend Micro\HijackThis\HijackThis[Caution: Executable File]

 

C:\Windows\system32\SearchFilterHost[Caution: Executable File]

 

 

 

I noted the last one as suspisious.

[compfreak847]

Quite a few suspicious looking ones in there. Try http://housecall.trendmicro.com/.