RS Wikia Now With Malware and Keyloggers

[kire667]

Jagex claims RS Wikia is a safe website. http://services.runescape.com/m=forum/forums.ws?254,255,8,61790038

If you think you can trust RS Wikia think again.

http://runescape.wikia.com/wiki/RuneScape_Wiki

This is now the 2nd day in a row I've visited a guide on that website. And both times I've finally tracked it down to the source. Last time on the "Zamorak Arrow" page. This time was while viewing the "Urns" guide.

I'll be viewing the internet as usual, then a pop up asks me if I wish to allow Java (same one you get when running RuneScape) so I denied it. I wasn't loading a damn thing I needed Java for other than RuneScape which was already loaded.

Somehow it opened a 2nd Java client on its own and not even 5 minutes later I get this pop up at the lower right on my desktop claiming a virus was found in "Win/system32". I'm no moron and I know I don't use a virus scanner so any pop ups are bs plus System32 is the operating system itself so why the **** would I block that?

I try closing this and another window appears overlaying my FireFox RuneScape tab showing "scanning for viruses..." and a button for click to stop scan. I know how the scam works.. you click stop and it in fact accepts to install a ton of viruses that completely **** your PC up. So I did my usual Alt+Ctrl+Del to open File Manager and manually closed down BOTH the 2nd Java client AND the random named program "jvwvwvjgm".

Word of advice. Avoid RS Wikia unless you've added their main URL to your blocked sites list under Start > Control Panel > Internet Options > Security > Restricted Sites. And set their security block to "High" to ensure nothing gets through to your PC beyond the guides and that's all!

Figured I'd send this out to everyone in case your internet stops working because of an RS Wikia malware. This "virus scanner" also disabled your internet somehow to make you think something is actually messed up. To get your internet working again follow these easy steps.

Start > Control Panel > Internet Options > Connections > LAN Settings

Uncheck BOTH boxes here. One for "Use a proxy server for your LAN (these settings will not apply to dial-up or VPN connections)." The other box for "Bypass proxy server for local addresses".

Thanks to owning 2 PCs I had the ability to Google a solution to this last night.It sent me to Yahoo Answers where another person had their internet randomly stop working on a laptop. Theirs too claimed "Unable to connect to proxy servers".

I was luckier than others. I spoke to members of Amber Meow's cc and a few actually have been keylogged by going there. (Then again we can also suspect if they use bots they might have been keylogged when that was going around PowerBot's site.)

 

[K_F_C]

Most of the time it's actually the advertisements running malicious code. I find it hard to believe such a huge site would be adding java drive-bys unless it's been compromised.

Not saying your lying or anything but it just seems a dumb move by the owners.

 

[ll0ll0l0ll0ll0l]

it is a wiki, anyone can add/remove stuff in it

its just a matter of finding a way to inject code without it being filtered.

 

[dsj]

For some reason I kinda doubt RS wiki is trying to give you a virus/keylogger. Been going there for years and never had any of the issues you talked about. You may have just gotten a virus from a different site.

 

[sarahxxxx]

damn..
After FT. alot of things are becoming dangerous

 

[malakadang]

Never had a problem with that website, strange.

 

[ultima14d]

Well, believe it or not, that isn't anything really harmful. Just an annoying add trying to get you to buy their product. It doesn't do anything to your computer, except if you actually install it where it will constantly ask you to buy the product and that your system is infected. It happens on random websites to me.

 

[kire667]

I can't run programs on my laptop anymore.

Soon as I start it up it has that annoying thing pop up ask if I wish to run virus scan. I don't own a virus scanner and never will.

I went to Task Manager to shut it down, and the damn thing closed off my Task Manager. I went to System restore and it closed that down too. It closed down Screen Recorder Studio when I attempted to make video proof that RS Wikia installs a virus/malware/keylogger on my laptop.

I'm now trying to figure out how to run safe mode so nothing can shut down my programs and I can run a System Restore to before the virus installed itself on my laptop.

If ANY of my accounts log in I was keylogged. I'll hop on from my safe PC to check my items are still there and to issue a bank pin to ALL of my accounts.

 

[Gurtaton]

You're being paranoid. I've been using that site for as long as I can remember, and I assure you, I've suffered zero hacks from the first time I first started using computers.

 

[Flight]

Unless you clicked on a link, the site it self can't give you malware or anything like it.

 

[JRSmithfan1]

You're being paranoid. I've been using that site for as long as I can remember, and I assure you, I've suffered zero hacks from the first time I first started using computers.

It was only recently.
I think SMR told me this in IRC.

I almost click on them when I go on google to find RS shit. -.-;

 

[Jimmy]

I'm fairly certain that this is indeed a legitimate problem with all wikia sites atm (I had to spend several hours yesterday cleaning off my families computer from a rogue antivirus infection, and the last site that was visited prior to the infection was Harry Potter wiki). To everybody infected, you should download malwarebytes to a portable device (AKA flash drive) and install it on your computer to remove the infection (also, renaming any file to "iexplore.exe" will allow you to open it).

 

[ShockWaveee]

It doesn't sound like it's someone targeting your RS accounts. It's probably just some adware. Do as Jimmy said and put malwarebytes on a flash drive, boot into safe mode, load up malwarebytes and it should take care of the rest.

 

[Crewther]

bring runehq back to life xD

 

[WeRnIE]

I can't run programs on my laptop anymore.

Soon as I start it up it has that annoying thing pop up ask if I wish to run virus scan. I don't own a virus scanner and never will.

I went to Task Manager to shut it down, and the damn thing closed off my Task Manager. I went to System restore and it closed that down too. It closed down Screen Recorder Studio when I attempted to make video proof that RS Wikia installs a virus/malware/keylogger on my laptop.

I'm now trying to figure out how to run safe mode so nothing can shut down my programs and I can run a System Restore to before the virus installed itself on my laptop.

If ANY of my accounts log in I was keylogged. I'll hop on from my safe PC to check my items are still there and to issue a bank pin to ALL of my accounts.

It is probably an advertisement, go through Safe Mode and do System Restore.

 

[Lured Yah]

damn that would suck :O

 

[florol]

I went to rs wikia and typed in "Zamorak Arrow" and I looked at the bottom of the page and it said "transferring data from t.pointtroll.com" Could that be the problem?

 

[ILikeSkills]

It is sad to see so much crap going on after FT.

 

[dark spaj]

If it's advertisements, would that only affect some countries/people?
My computer recently stopped working, maybe this is why.
The other computer I'm using seems fine (at the moment).

Let's just hope it's not a serious problem. :S

 

[2percent]

I used the wiki yesterday and didn't have a problem. Thanks for the heads up though. Also, I wonder why Zybez is not on that list of recognized fansites? They have been around for a while and do a good job.