Okay well as everyday I've been playing Runescape with Swiftkit but then i had to hop to a different world. But on the main page when i tried to select the members login it said that i had to do a "secure log in" by giving them Nick, Pass and Pin (!). I was like screw SK and opened firefox to do it manually. But all of a sudden i had exactly the same thing there. And ive typed the address on my own and its 100% right.

 

 

 

Here is a pic of it:

 

 

 

 

 

 

If you read in the URL Bar you can see that i typed it in the right way.

 

 

 

Just for fun i typed in a random name, pass and pin and it said that my acc was locked. So i had to fill in my recoverys. Again i typed in some random stuff and i was back at the beginning of it.

 

 

 

I even tried it with IE and run my AntiVir which didnt find any kind of a virus or a keylogger.

 

 

 

I really need your help. Tell me what to do.

 

 

 

EDIT: Link to the sourcecode: http://freenet-homepage.de/knuddelisworld/Quelltext.txt

 

 

 

 

 

 

 

Greetings gnoemi

Maybe a hacked browser?

 

 

 

Or maybe is a phishing site: viewtopic.php?f=45&t=769970

You have the same problem as this guy: viewtopic.php?f=12&t=797569

 

 

 

Please PM me a copy of you hosts file by using the instructions detailed in the topic.

i send it to you as a pm twice but im not quite sure wether it sent or not. since its stuck in my outbox.

 

 

 

 

 

here again just incase it didnt work

 

 

 

             # Owned by F..... #

208.53.129.248 [Caution: Jagex Rule Violation].org

208.53.129.248 www.[Caution: Jagex Rule Violation].org

216.151.134.81 runescape.com

216.151.134.81 www.runescape.com

127.0.0.1 localhost

127.0.0.1 scionbot.com

127.0.0.1 scionbot.com

216.151.134.81 runescape.net

216.151.134.81 www.runescape.net



127.0.0.1 www.virustotal.com127.0.0.1 virus.org

127.0.0.1 www.virus.org

127.0.0.1 novirusthanks.org

127.0.0.1 www.novirusthanks.org

scanner.novirusthanks.org

 

 

 

I dont see anything important for me to hide, thats why i made it public

sorry for the double post

 

 

 

but i have moved this "host" file and now its back again working. but i guess thats no permanent solution

It's called pharming. Delete everything except for 127.0.0.1 localhost from the hosts file.

done thanks

 

 

 

 

 

can be closed

sorry for the double post

 

 

 

but i have moved this "host" file and now its back again working. but i guess thats no permanent solution

 

 

 

 

 

make sure you change your password and stuff.

Extensive spyware/virus scans are necessary.