Sounds like ur PC is infected.
I saw nothing what u described on the site.
Totally possible. Hopefully not the case. I'd be way relieved if it was just me.
A few more posts like yours, and I'll kill the topic, just want to be sure.
Quote:
Do they have rotating ads on the site? If so, it could be one ad in the rotation, which you were lucky enough not to get.
|
Originally Posted by Master0fCeremony
Sounds like ur PC is infected.
I saw nothing what u described on the site. |
Goodbye may seem forever
Farewell is like the end
But in my heart's the memory
And there you'll always be
-- The Fox and the Hound
When I visit http://www.paragonwiki.com or http://wiki.cohtitan.com I don't see any ads at all. I do see this statement:
Quote:
Note that there is another wiki you might find on the web, recognizable by the word "wikia" present in its server address, which does include rotating ad banners in its pages. That wiki has no connection to the Titan Network. I prefer not to link to it since any link helps it build Google score and it often ends up higher than the good paragonwiki.com site in searches.
|
Ad-Free Fan-Site Paragon Wiki has been ad-free since 2005. |
Quote:
Is this the site you went to? |
Originally Posted by Rakeeb
Hey -
CoHTitan (and their Wiki) appear to be compromised with a fake antivirus ad. It's pretty clearly malignant. Can we get a mass community warning to stay away, do NOT obey the instructions on the screen, and the site shut down until the system is purged and verified to be bug-free? Thanks. |
http://paragonwiki.com/wiki/Main_Page
I just came from there and (1) I saw no ads at all and (2) my virus checker was as quiet as a sleeping kitten
Lisa.
So don't wait for heroes, do it yourself
You've got the power
winners are losers
who got up and gave it just one more try
***Dennis DeYoung
i have never seen ads on the site before and still didn't two minutes ago.
Dr. Todt's theme.
i make stuff...
Quote:
There are NO ads on the Paragon Wiki and never have been, TonyV made a point to keep it ad-free when he moved it OUT of the Wikia...|
Originally Posted by Rakeeb
CoHTitan (and their Wiki) appear to be compromised with a fake antivirus ad.
|
Are you sure you don't mean the Wikia site?
*points down to sig*
Wikia's horrible for just that sort of thing. Which is one of the reasons Paragonwiki's not there. Unfortunately, it (Wikia) is still at the top of Google searches for PW.
Make 100% sure you're not going to wikia.
Unfortunately, I think more people go to Wikia not only because it's easy to confuse with ParagonWiki, but because ParagonWiki is exclusively about CoX and Wikia seems to be about many games.
to 
TO THE END!Villains are those who dedicate their lives to causing mayhem. Villians are people from the planet Villia!
Quote:
Not getting any problems or notices here from my A/V or spyware detectors.|
Originally Posted by Rakeeb
Hey -
CoHTitan (and their Wiki) appear to be compromised with a fake antivirus ad. It's pretty clearly malignant. Can we get a mass community warning to stay away, do NOT obey the instructions on the screen, and the site shut down until the system is purged and verified to be bug-free? Thanks. |
Looks like the problem is on your computer.
Also, the Titan Network doesn't use ads at all.
Yes, I know others have posted the same thing above.
But I also know that some people only read the last post or two in a thread before commenting on it.
I put this here for them.
If the game spit out 20 dollar bills people would complain that they weren't sequentially numbered. If they were sequentially numbered people would complain that they weren't random enough.
Black Pebble is my new hero.
They had been infected with a nasty virus before. Some of those areas are still down since they're not restored from the clean-up effort yet.
Hopefully they haven't gotten infected again. But I don't see anything getting blocked from popping up by NoScript or Adblock on the paragonwiki site though. Might've just typed out the wikia and gotten led to a sleazy site designed to look like the titan network or something.
Quote:
The last thing I saw was that they'd gotten all of the sections cleaned up and operational.|
Originally Posted by Iannis
They had been infected with a nasty virus before. Some of those areas are still down since they're not restored from the clean-up effort yet.
Hopefully they haven't gotten infected again. But I don't see anything getting blocked from popping up by NoScript or Adblock on the paragonwiki site though. |
CoH Faces was the last area to come up as far as I know.
It seems some of the pages (Ouroboros Portal) may still be using invalid links to the various sites of the Titan Network (they still point to the old address for CoH Faces for example).
If the game spit out 20 dollar bills people would complain that they weren't sequentially numbered. If they were sequentially numbered people would complain that they weren't random enough.
Black Pebble is my new hero.
We didn't have a "virus" before, technically. Some poophead injected crap into a loophole in the Faces site. That loophole has been closed (Faces got a bottom-up rewrite), and all sites have been restored that will be restored. Anything you don't see back up likely will never come back.
OP: ParagonWiki does not have ads. Aside from approximately a year when hosted by Wikia, ParagonWiki has never had ads. And the ads served by Wikia were not by our choice, but forced on us by the folks at Wikia.
(We don't own cohfaces.com anymore so that isn't us doing weird things.)
Paragon Wiki: http://www.paragonwiki.com
City Info Terminal: http://cit.cohtitan.com
Mids Hero Designer: http://www.cohplanner.com
Quote:
|
Originally Posted by Dispari
I don't know why Dink thinks she's not as sexy as Jay was. In 5 posts she's already upstaged his entire career.
|
Quote:
I was on Paragonwiki a few times earlier today and I'm not seeing this. It sounds like something at your end. There's malware out there that specifically targets Wikipedia, i.e. when you visit the site, it 'seems' to be displaying ads, but they are actually being generated by malware on your system. I imagine there is malware out there trying to pull the same nonsense with any widely used wiki/forum/etc software.
|
Originally Posted by Rakeeb
Hey -
CoHTitan (and their Wiki) appear to be compromised with a fake antivirus ad. It's pretty clearly malignant. |
Paragon City Search And Rescue
The Mentor Project
Quote:
are you using chrome?
|
Originally Posted by Rakeeb
Hey -
CoHTitan (and their Wiki) appear to be compromised with a fake antivirus ad. It's pretty clearly malignant. Can we get a mass community warning to stay away, do NOT obey the instructions on the screen, and the site shut down until the system is purged and verified to be bug-free? Thanks. |
Quote:
Interesting. Yeah, I do use Chrome, prefer it for how light it is compared to other browsers.|
Originally Posted by ryu_planeswalker
are you using chrome?
|
Thinking that's the problem?
Quote:
I use Chrome. I just went to http://paragonwiki.com/wiki/Main_Page and didn't see anything.|
Originally Posted by Rakeeb
Interesting. Yeah, I do use Chrome, prefer it for how light it is compared to other browsers.
Thinking that's the problem? |
Edit: Just went to http://www.cohtitan.com/ and also didn't see anything.
Weight training: Because you'll never hear someone lament "If only I were weaker, I could have saved them."
Quote:
Sometimes chrome will flag pages as having viruses that do not. It is not usually a problem as you can skip the warning but caution on them is always wise.
|
Originally Posted by Rakeeb
Interesting. Yeah, I do use Chrome, prefer it for how light it is compared to other browsers.
Thinking that's the problem? |
Quote:
I got hit with this going to a CoHTitan page I had used hundreds of times before. The Faces opening apparently allowed a number of other pages to send the toxic payload to those going to the page and it ripped through every layer of anti-malware protection that I had. Tony V was very upfront and timely with updates about the efforts to fix things.|
Originally Posted by Aggelakis
We didn't have a "virus" before, technically. Some poophead injected crap into a loophole in the Faces site.
|
The irritating part of such odious behavior is that it used to be that you had to go to a "suspect" site or click on a link for these things to happen, but apparently there are bots in China and elsewhere that continually search for internet sites with vulnerabilities and attach their evil payloads to them.
It took a fairly potent cocktail of additional anti-malware to rub the infection out, but I have been all-clear since. CoHTitan is typically very careful; stuff happens. I do not blame them and Tony's efforts and communication were well-received on my part.
What I do not understand, though, is why these particular malware infections take the form of an "ad" for anti-malware scans, etc., that encourage you to click on a link for various services. At that point, your computer is thoroughly infected and slammed... why do they need you to further click on a link? It is as though they have zapped you with a lethal dose of radiation then encourage you to drink this "medicine" which is actually poison. I freely admit I do not understand the mental pathologies of those creating the malware, but this certainly seems like overkill.
"How do you know you are on the side of good?" a Paragon citizen asked him. "How can we even know what is 'good'?"
"The Most High has spoken, even with His own blood," Melancton replied. "Surely we know."
Quote:
When you click on the link, it gets you to download the trial version of the only software that can save your computer from impending DOOOOM! Once you've downloaded the software, it tells you that you are indeed infected, and the horrible nasty virus will delete your hard drive, forward itself to all your friends, relatives, and enemies, delete THEIR hard drives, and then kick a puppy. And it will all be YOUR fault. BUT if you buy the full version of the software, they can eliminate the evil virus of DOOOOOM! Please enter your credit card number here.|
Originally Posted by Melancton
What I do not understand, though, is why these particular malware infections take the form of an "ad" for anti-malware scans, etc., that encourage you to click on a link for various services. At that point, your computer is thoroughly infected and slammed... why do they need you to further click on a link? It is as though they have zapped you with a lethal dose of radiation then encourage you to drink this "medicine" which is actually poison. I freely admit I do not understand the mental pathologies of those creating the malware, but this certainly seems like overkill.
|
And that last bit is what they were after.
@Roderick
Quote:
And that last bit is what some people, even some quite educated and/or computer literate people, have done.|
Originally Posted by Roderick
When you click on the link, it gets you to download the trial version of the only software that can save your computer from impending DOOOOM! Once you've downloaded the software, it tells you that you are indeed infected, and the horrible nasty virus will delete your hard drive, forward itself to all your friends, relatives, and enemies, delete THEIR hard drives, and then kick a puppy. And it will all be YOUR fault. BUT if you buy the full version of the software, they can eliminate the evil virus of DOOOOOM! Please enter your credit card number here.
And that last bit is what they were after. |
That's okay though. It keeps me employed as well as having plenty of side jobs outside of my full-time job.
If the game spit out 20 dollar bills people would complain that they weren't sequentially numbered. If they were sequentially numbered people would complain that they weren't random enough.
Black Pebble is my new hero.
Quote:
/stevemartin|
Originally Posted by Roderick
Please enter your credit card number here.
And that last bit is what they were after. |
So it's a profit deal!!
/stevemartin
Now it all makes sense. I keep thinking of malware as just being a form of griefing... causing misery just to cause it. These folks are certainly upping the ante.
The guy behind it is probably that Nigerian official who now needs my help smuggling all of his loot out of his country.
"How do you know you are on the side of good?" a Paragon citizen asked him. "How can we even know what is 'good'?"
"The Most High has spoken, even with His own blood," Melancton replied. "Surely we know."
Quote:
I like the phone calls presumably from some guy in India who claims to be a Microsoft Certified tech who's tired of looking at reports about how many errors your computer has. He wants you to run Event Viewer and be scared by any events logged therein and go to some website that will probably either give him access to your computer or else prompt you to download and run a program that'll do something malicious.
|
Originally Posted by Melancton
/stevemartin
So it's a profit deal!! /stevemartin Now it all makes sense. I keep thinking of malware as just being a form of griefing... causing misery just to cause it. These folks are certainly upping the ante. The guy behind it is probably that Nigerian official who now needs my help smuggling all of his loot out of his country. |
Goodbye may seem forever
Farewell is like the end
But in my heart's the memory
And there you'll always be
-- The Fox and the Hound
Hey all, sorry I just now saw this thread.
I did a quick once-over of our sites and I don't see anything obvious wrong. I'll keep digging to see if I missed anything.
Something mentioned above is a good question. Rakeeb, are you absolutely certain that you were on the Titan Network's sites? The Titan Network is completely ad-free, including the Paragon Wiki. The closest thing we have to ads are a couple of links on the main home page, one to HeroStats (which we host) and one to Imaginator Central (Liz "Syrusb", our graphics guru, who hosts her own site), and during the holiday season we put a link to the Real World Hero charity drive on the wiki sidebar. None of those are dynamic or third-party ads, though; they're static links with the images and code behind them hosted locally on our own server.
The Wikia theory actually sounds plausible to me. They do run third-party ads, and I have gotten nailed with malware served by those third parties before. That's why I hate running third-party ads on sites, because you're not in full control of the content you're serving, and it opens up another vector (the third-party ad provider) by which your sites can become infected.
The following is a full list of Titan Network sites. If you're visiting a URL other than these, you're almost certainly not on our site. Note that after the domain name, there should either be nothing (e.g. http://cohtitan.com) or a slash (e.g. http://www.cohtitan.com/forum). If there is anything else, you're not on our site (e.g. http://cohtitan.com.other.stuff/mydata)!
http://[www.]cohtitan.com
http://[www.]cohplanner.com
http://[www.]paragonwiki.com
http://[www.]ouroportal.com
http://wiki.cohtitan.com
http://cit.cohtitan.com
http://faces.cohtitan.com
http://tomax.cohtitan.com
http://avatars.cohtitan.com
There is also a "hidden" domain, webservice.cohtitan.com, that Sentinel talks to, and though we don't directly maintain it, we also host herostats.org.
Anyway, my immediate thought is that we are not infected. If we are, then obviously, I want to know as soon as possible. It might be helpful if you can send me screenshots of exactly what you're seeing. You can reach me by e-mail (tonyv@cohtitan.com) or hit me up on Skype (tonyv.paragonwiki). I am at work today, so I might not be able to respond immediately, but I'll try to respond as soon as I can.
In the meantime, I highly encourage everyone to make sure your computer is protected against malware. This isn't an alarmist "we might be infected!" suggestion, this is just a good idea in general, even if you don't ever visit the Titan Network sites. You need two main things: antivirus and anti-spyware. Make sure they're up-to-date and that you run them periodically. I actually suggest against the 800 pound gorilla in the market, Norton/Symantec anti-virus, because it puts lots of tentacles into your system that make it almost as bad as a virus itself. Besides, there are some decent free solutions, such as AVG Free and Avast!. For anti-spyware, try Ad-Aware or Spybot Search & Destroy.
Also, if you're using Chrome, I would suggest turning off cookies and whitelisting only the ones you need. If you're running Firefox, Adblock Pus is a godsend.
Oh, and as for our site compromise from before, the nutshell version of what happened was that someone used an exploit in an old version of CodeIgniter (the framework that underlies a bunch of our sites) to upload a php file that injected malware links in all of our index.php sites. It affected most of our sites, and we've since taken some pretty good measures to avoid such a thing happening again. The best thing I think we did (other than upgrade all of our software to patch security holes) was we took write permissions away from the web service account to all content directories except ones that it specifically requires for uploaded files. I'd never be so arrogant to say that our server isn't compromisable (which is the sure fire way to see that it does get compromised), but hopefully it minimizes the risk of being hit with these drive-by mass attacks that every server undergoes.
We take security very seriously, and if I find out that it's been compromised, I will shut down the sites if I have to (which I did last time) until I'm confident that we're not posing a security risk to people--even if it means we're offline for days (which we were) or longer (*ahem...* Faces...).
Edit: Oh, there's one more thing folks might want to know. We do use a Content Distribution Network named CloudFlare that is a front-end to several of our sites. For most people, it's completely transparent. However, one of the things that CloudFlare does is set up so-called "honeypots" to detect machines that are infected or that otherwise try to spread malware. Because addresses on the Internet are dynamic, now and then you might get some kind of page asking you to validate you're a person via a captcha. This is another security measure on our part to try to prevent known malware bots from accessing our server by filtering out malware traffic. So if you try to access one of our sites and you get something from CloudFlare, don't panic.
You can read more about CloudFlare's security at their site if you're interested.
We've been saving Paragon City for eight and a half years. It's time to do it one more time.
(If you love this game as much as I do, please read that post.)
Hey -
CoHTitan (and their Wiki) appear to be compromised with a fake antivirus ad. It's pretty clearly malignant.
Can we get a mass community warning to stay away, do NOT obey the instructions on the screen, and the site shut down until the system is purged and verified to be bug-free?
Thanks.