Hacked? Phishing Site?

Hello, I was recently hacked and was wondering if its because I visited this site. This probably looks like I'm trying to lure people or whatever but I'm asking because I did a virus scan and nothing can be found.

PLEASE DO NOT CLICK ON THE LINK BELOW.
Unless you are comfortable dealing with things like this, again please don't click on the link. I'm only looking for help to determine if I was keylogged or whatever.

The website is called
xxx

Any help would be greatly appreciated. Thanks!

 

I am going to guess it is a java drive by. You got onto it by some kind of YouTube video right?

 

Well yes, I heard it was a great site for runescape videos, and from multiple people so I assumed it was safe. My mistake. But I asked because I have ran multiple anti viruses and none of them have brought anything up. I also asked because I frequently buy gold and I'm not sure if it was from a JagRoll or a hacker. Preferably it was from Jagex instead of an undetectable keylogger.

 

What was on the site when you visited it? If it looked like a legitimate site, maybe you accidently clicked a phishing email and thought that the site was the cause?

 

Well like I said it was supposed to be for like runescape videos, and it opened a legitimate looking video player which displayed a loading sign, although the loading sign just spun around without actually going anywhere.

I did actually click an "allow button" before the video began to load or whatever similiar to originally clicking the allow button when loading runescape.

 

Sounds exactly like you got phished then. If phishing sites can copy Runescape's homepage, I'm sure they could make a nice looking video site.

Sorry you got hacked, I really hate phishers

 

Not a problem, thanks for replying to everything though.

It is so weird, the same thing that popped up from the website keeps popping up while I type this and everytime I deny it and start typing again it pops up.

But anyways am I supposed to remove the phisher somehow or was it a one time thing??

 

Fuck as I said the thing was popping again and I located the file location of where the thing was trying to gain acres and I found an application called enr. I tried deleting it and now this shit is popping up about some fake anti virus and won't let me access the Internet.

EDIT: I couldn't delete the application because it said it was running. So I pressed CTR ALT DLT and quickly found the running process, forced stopped the application, then quickly deleted it from the location I originally found it in, I then emptied my recyling bin. I can once again access the internet without being redirected, and now I just want to know, is this the end of it?

 

It most likely copied it self to some location and is pointing to it in the registry, so next time you boot up it will start again.. I suggest you have a quick looking in the HKCU->run in the registry for something there that seems out of place. Thats not a phisher, it is most likely a JDB

 

It happens

 

Thanks for your reply, you sound like you know what you're talking about. But honestly I have no idea what you just said. If you can please explain to me what you meant or how to do whatever you said.

Thanks for your ridiculously useless post. Love your 50+ vouch signature when you have 41 posts. GTFO ban evader. Reported BTW

 

Start up regedit.

expand: HKEY_CURRENT_USER->Software->Microsoft->Windows->CurrentVersion then click on run.

You will see a list of name and data, look for one of those that open up/have the location of the file you were describing and delete it, that will stop it from opening again next time you reboot your computer. Ofcourse there may be other place to hide it but thats the most common

 

You have helped out a ton. I really couldn't have asked for more. It was there just like you described and the steps were perfect. If I wasn't hacked I would definitetly tip. :/ I will definitely make sure to make a mental note in the future.

 

np, luckily that was one of the easier ones to remove. Next time be more careful on what sites you visit and sory bout your loss

 

No? It was a Java driveby lol... :laugh:

 

Resolved.