Invasive banner ad on KoLwiki redirects and fakes error message

Frugal · November 8th, 2007, 08:32 AM

While browsing the KoL wiki, some banner ad (I assume) for performanceoptimizer.com minimized my browser when I clicked on some text in the middle of an article, gave me a fake error message, then redirected me to their website. When I closed that tab, it gave me like 3 popup dialogue windows in a row trying to get me to use their "service".

A different site (the "DVD Talk Forum") has had this problem. You may want to try asking them how they fixed it.

Clackling · November 8th, 2007, 08:35 AM

Wow, I've never seen that before, and I apologize for what you had to put up with. Typically, we try and capture a screenshot of the ad, as well as the URL it links to, because we can then send it back to the ad company to block that ad from coming through. However, this could also be adware, could it not? Are you sure your computer is clean?

Holy · November 10th, 2007, 11:06 PM

I got the same thing from browsing the wiki.

Not sure which one gave it to me but i got it when i clicked random page (probably dosen't help much)

Mag · November 11th, 2007, 02:17 PM

We're trying to track down which advertiser is popping this banner up, but that's easier said then done..

So we're still hunting it

maiaflute · November 14th, 2007, 11:06 PM

I know you guys are working on it, so no pressure or anything.

But I've had fun with it several times already. I looked around on the internet and ran across some information on the fixthemnow drive-by download, which is what this seemed to be to me.

Clackling · November 15th, 2007, 08:43 AM

Again, if you're seeing it, send me a screenshot and, if possible, the URL that the link takes you to (before redirection....right-click to find the URL). It's much easier if we have data about it.

FrostByghte · November 15th, 2007, 02:25 PM

I could use the JS source of the ad, then I can find it. I need to be able to trace it back to the advertiser.

Mag · November 19th, 2007, 05:55 PM

More info on slashdot:
Slashdot | Hackers Use Banner Ads on Major Sites to Hijack Your PC

And a video on explaining the thing and why it's such a bitch to track:
YouTube - Major League Baseball Strikes out

I've been seeing this ad for quite a while now (months), very rarely though, only once a month maybe, but due to the redirecting nature it's really difficult to see where it comes from

discosis · November 27th, 2007, 02:44 AM

Various intrusive ads have actually been popping up on the wiki for months, but this last one finally prompted me to look here. No clue about the javascript, but this is a screenshot of what happens:

http://www.vanderwaa.com/zut/kol_col...i_popup_ad.gif

And the URL it points to is:
WARNING: You must protect your system from threats!

is that enough info?

discosis · November 27th, 2007, 02:49 AM

No idea about the js, but this is a screendump of what happens:
http://www.vanderwaa.com/zut/kol_col...i_popup_ad.gif

and the evil URL is:

hxxp://avsystemcare.com/data/?gai=tr9vel0n&gli=intl&3&tmn=av1&mt_info=4094_1538 _197&tmn=null&45080108

does that help?

Mind you: the first time I posted this avsystemcare thingy, ten minutes ago, it renamed itself once posted, and then my entire message disappeared. Moderated?

November 8th, 2007, 08:32 AM	#1 (permalink)
Frugal Luke warm Join Date: Nov 2007 Posts: 1	Invasive banner ad on KoLwiki redirects and fakes error message While browsing the KoL wiki, some banner ad (I assume) for performanceoptimizer.com minimized my browser when I clicked on some text in the middle of an article, gave me a fake error message, then redirected me to their website. When I closed that tab, it gave me like 3 popup dialogue windows in a row trying to get me to use their "service". A different site (the "DVD Talk Forum") has had this problem. You may want to try asking them how they fixed it. Last edited by Frugal : November 8th, 2007 at 08:33 AM. Reason: clarification

November 8th, 2007, 08:35 AM	#2 (permalink)
Clackling KoL Site Manager Join Date: Mar 2006 Location: Philadelphia, PA Posts: 316	Wow, I've never seen that before, and I apologize for what you had to put up with. Typically, we try and capture a screenshot of the ad, as well as the URL it links to, because we can then send it back to the ad company to block that ad from coming through. However, this could also be adware, could it not? Are you sure your computer is clean? __________________

November 10th, 2007, 11:06 PM	#3 (permalink)
Holy Luke warm Join Date: Nov 2007 Location: NH Posts: 8	I got the same thing from browsing the wiki. Not sure which one gave it to me but i got it when i clicked random page (probably dosen't help much) __________________ We dont sell shakes...We sell FROSTIES.... well exCUSE ME.

November 11th, 2007, 02:17 PM	#4 (permalink)
Mag Drunk admin.., no really.. Join Date: May 2004 Location: Netherlands Posts: 360	We're trying to track down which advertiser is popping this banner up, but that's easier said then done.. So we're still hunting it __________________

November 14th, 2007, 11:06 PM	#5 (permalink)
maiaflute Luke warm Join Date: Nov 2007 Posts: 1	I've seen it too. I know you guys are working on it, so no pressure or anything. But I've had fun with it several times already. I looked around on the internet and ran across some information on the fixthemnow drive-by download, which is what this seemed to be to me. Last edited by maiaflute : November 14th, 2007 at 11:32 PM.

November 15th, 2007, 08:43 AM	#6 (permalink)
Clackling KoL Site Manager Join Date: Mar 2006 Location: Philadelphia, PA Posts: 316	Again, if you're seeing it, send me a screenshot and, if possible, the URL that the link takes you to (before redirection....right-click to find the URL). It's much easier if we have data about it. __________________

November 15th, 2007, 02:25 PM	#7 (permalink)
FrostByghte Coolest admin on the net Join Date: May 2004 Posts: 341	I could use the JS source of the ad, then I can find it. I need to be able to trace it back to the advertiser. __________________ FrostByghte - frostbyghte@coldfront.net The all unknowning and never powerful FrostByghte!!!

November 19th, 2007, 05:55 PM	#8 (permalink)
Mag Drunk admin.., no really.. Join Date: May 2004 Location: Netherlands Posts: 360	More info on slashdot: Slashdot \| Hackers Use Banner Ads on Major Sites to Hijack Your PC And a video on explaining the thing and why it's such a bitch to track: YouTube - Major League Baseball Strikes out I've been seeing this ad for quite a while now (months), very rarely though, only once a month maybe, but due to the redirecting nature it's really difficult to see where it comes from __________________

November 27th, 2007, 02:44 AM	#9 (permalink)
discosis Luke warm Join Date: Nov 2007 Posts: 3	Various intrusive ads have actually been popping up on the wiki for months, but this last one finally prompted me to look here. No clue about the javascript, but this is a screenshot of what happens: http://www.vanderwaa.com/zut/kol_col...i_popup_ad.gif And the URL it points to is: WARNING: You must protect your system from threats! is that enough info?

November 27th, 2007, 02:49 AM	#10 (permalink)
discosis Luke warm Join Date: Nov 2007 Posts: 3	No idea about the js, but this is a screendump of what happens: http://www.vanderwaa.com/zut/kol_col...i_popup_ad.gif and the evil URL is: hxxp://avsystemcare.com/data/?gai=tr9vel0n&gli=intl&3&tmn=av1&mt_info=4094_1538 _197&tmn=null&45080108 does that help? Mind you: the first time I posted this avsystemcare thingy, ten minutes ago, it renamed itself once posted, and then my entire message disappeared. Moderated?

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode