Keylogger

[Pullade Nyss]

Yo so basically i got keylogged for 80m+ There was a guy on irc named [Foe]`Bren He Pmed me a site  called W.foe-rs(DOT)tk he was like Lmao look what MM did funny shit..I clicked it and theres a  white screen and a java thing comes up so i tought this was normal so i just pushed Run then nothing happend i was thinking to myself this is odd so i started malwarebyte but it found nothing so after waiting 5hours to check if i got 100zeals so i could get 99str i got it so i went to the warriors guild to buy capes i went with 26m cash ags berserk ring because i was also going to bot banshees overnight so i get back to edge the Bren dude reboots my comp i turn it on i run malwarebytes and i see i got Trojans and keyloggers Sadface.... i just want to warn you guys but for me lesson learned im never going to click a (DOT)tk website again...Oh and i have a bank pin and i dont care about grammar atm:p

[Smush]

Idiot.

Lol what's the use of a bank pin if you carry around most of your wealth?

Lucky he didn't use the zeals on defense or something lol.

[Spittles (Old School)]

Sucks bro, you gotta be more aware with stuff like that.

[Pullade Nyss]

Idiot.

Lol what's the use of a bank pin if you carry around most of your wealth?

Lucky he didn't use the zeals on defense or something lol.

Did you miss the gigantic picture ? and i was going to bank it but he rebooted my computer.

Sucks bro, you gotta be more aware with stuff like that.

Yeah i will from now on=)

[Emily]

Press Ctrl, alt, delete. Select processes. Look for any oddly named or not normally their processes. All key loggers show up in your processes.

This type of keylogging (through a java applet) is called a java drive by.

Edit:

Grats on 99 strength by the way, you can see my rsn in your image. Its a fence.

[Blitz]

Press Ctrl, alt, delete. Select processes. Look for any oddly named or not normally their processes. All key loggers show up in your processes.

This type of keylogging (through a java applet) is called a java drive by.

Edit:

Grats on 99 strength by the way, you can see my rsn in your image. Its a fence.

^ This bird knows wot shes on about

[6 9i]

might be off subject but isn't botting against the rules in foe...just sayin

[Pullade Nyss]

Press Ctrl, alt, delete. Select processes. Look for any oddly named or not normally their processes. All key loggers show up in your processes.

This type of keylogging (through a java applet) is called a java drive by.

Edit:

Grats on 99 strength by the way, you can see my rsn in your image. Its a fence.

Thanks =] school is good after all:p. And i did what you said there was something called jusched Its description was Java

[Emily]

Press Ctrl, alt, delete. Select processes. Look for any oddly named or not normally their processes. All key loggers show up in your processes.

This type of keylogging (through a java applet) is called a java drive by.

Edit:

Grats on 99 strength by the way, you can see my rsn in your image. Its a fence.

^ This bird knows wot shes on about

hehe thanks, I'll explain it using my friends pictures that way others don't fall for this.

Here is the image of a fake java applet site.

Always look at the "From:" Website url, that is where the data is going to be downloaded or ran from. If this is not the site you are currently on then obviously this is a keylogger. If the site does not look safe then obviously don't click Run. It will always say if its a fake phisher site by telling from the "From:" website.

Here is an example of a safe java applet(runescape):

First note that it is validated this is a sure and promising site that this is not a phisher/keylogger. Second look at the from, its coming from runescape so there for it is safe to run.

Press Ctrl, alt, delete. Select processes. Look for any oddly named or not normally their processes. All key loggers show up in your processes.

This type of keylogging (through a java applet) is called a java drive by.

Edit:

Grats on 99 strength by the way, you can see my rsn in your image. Its a fence.

Thanks =] school is good after all:p. And i did what you said there was something called jusched Its description was Java

No, that is a Java update scheduler application don't worry about that. If you want post a picture of your processes and I can tell you if its still running. (chances are its not).

[Ethan|Unicornz]

1. If you don't know them don't click the link

2. It's kind of obvious that it wasn't the official site if it was Invalid format, why did you open it anyway?

3. Don't accept java signatures you don't know - doesn't it say that on the accept popup?

4. Java on website + run and it's just white screen = OBVIOUS JAVA DRIVEBY. If something odd like that happened, the LAST thing you should do is log back onto your account. Virus scan after anything suspicious.

If I was the hacker, I would have gotten your MM xp then spent your 100 zeals on def. An obvious hack couldn't be more obvious. May as well be website NotActuallyFoe.HackerHosts.hack

EDIT: removed system32 comment because I thought you might actually do it

[Pullade Nyss]

might be off subject but isn't botting against the rules in foe...just sayin

90% of Foe bots and it doesnt state that botting is not allowed

[Pullade Nyss]

1. If you don't know them don't click the link

2. It's kind of obvious that it wasn't the official site if it was Invalid format, why did you open it anyway?

3. Don't accept java signatures you don't know - doesn't it say that on the accept popup?

4. Java on website + run and it's just white screen = OBVIOUS JAVA DRIVEBY. If something odd like that happened, the LAST thing you should do is log back onto your account. Virus scan after anything suspicious.

If I was the hacker, I would have gotten your MM xp then spent your 100 zeals on def. An obvious hack couldn't be more obvious. May as well be website NotActuallyFoe.HackerHosts.hack

EDIT: removed system32 comment because I thought you might actually do it

Lol:p no he said something look what mm made on this site like they actually made the site and there was something in it and i know (dot)tk is phishing material and stuff +I dont know anything about computers

[Pullade Nyss]

Here emily

[Ethan|Unicornz]

Here emily

Look at the top right hand corner of your latest post, you will see the button you have been using to quote. To the left of this, you should see another button. This button says "edit". It allows you to add to your post without making a new one. It is a convention of forum-ing that, when your post is already the latest one on the page, you refrain from making another post, and rather edit your old one. Welcome.

Oh and Emily, you really know your shit lol. We should chat some time, Omg Unicornz on RS or Ethan|Unicornz on IRC

[Emily]

Here emily

Jezz you have alot of excess processes.

Well to start. You should really only be having one of the process rundll32.exe, I want you to right click, and open file location. The real file should be located in system32. If the file you open does not take you to system32, but to your recent downloads file, then delete it. Or simply end the process for now.

I'm assuming you are playing runescape at the current time due to the javaw.exe, if you aren't (and you aren't on any site that uses java applications), then also end this process. (if you are playing runescape don't, it'll close your client)

Everything else looks mildly clean, so chances are if its nothing that I stated above, that the keylogger is already stopped running.

[Pullade Nyss]

Yeh im doing something illegal on runescape right now and Both of them took me to something with windows

[Emily]

Yeh im doing something illegal on runescape right now and Both of them took me to something with windows

There was 3 processes of it running the picture that you showed me. None the less if they don't seem potentially dangerous then chances are you are safe again. Always a good idea to occasionally check your processes =P

[Pullade Nyss]

Oh yeh and the third one didnt let me check its file but yeh i guess im safe again Thx btw.

[Piggylisk]

the irc ones that ask for permission are ok right? just making sure..

[Jessica]

Don't click on links that people send to you in pm, simple as that. Now with free trade being out, people will go to extreme lengths to get ahold of your account and your wealth. Be more careful in the future.

[Env]

Never run unknown Java applications. Simple.

[Hitto]

sucks man

[Logan|Ravaged]

Press Ctrl, alt, delete. Select processes. Look for any oddly named or not normally their processes. All key loggers show up in your processes.

This type of keylogging (through a java applet) is called a java drive by.

Edit:

Grats on 99 strength by the way, you can see my rsn in your image. Its a fence.

we have a smart 1 between all the idiots 

[FOE Sandwich]

It was pretty obvious, why would you do that. Use your common sense

Also, nice stats

[Beastdefire]

Search your system32 folder for lol.exe. It's a trojan.