PHP Developers Network

A community of PHP developers offering assistance, advice, discussion, and friendship.
 
Loading
It is currently Mon Jun 24, 2019 5:31 pm

All times are UTC - 5 hours




Post new topic Reply to topic  [ 8 posts ] 
Author Message
PostPosted: Sun Dec 15, 2013 12:44 am 
Offline
Jack of Zircons
User avatar

Joined: Thu Nov 09, 2006 9:30 pm
Posts: 4484
Location: California, USA
I'm still running IE 8 (I know, I know!) because I'm still running XP on my main computer (gotta do something about that SOON!), but this has me worried:

Sporadically, I find that there are individual words in the body of a web page that are double-underlined and in red, and they turn out to be hyperlinks, sometimes to another URL, sometimes to the current page URL--but when I look at the source code, THERE ARE NO LINKS! So I figure it has to be a virus, so I scan iexplore.exe and I scan my whole damn computer, and nothing! I thought that I saw the same thing once in FF, but I may have been mistaken, because when I try to look for it now, I don't see any such pages.

Does this sound familiar to anybody? Any idea what's going on?


Top
 Profile  
 
PostPosted: Sun Dec 15, 2013 12:59 am 
Offline
Spammer :|
User avatar

Joined: Wed Oct 15, 2008 2:35 am
Posts: 6617
Location: WA, USA
Any particular sites it happens on, or do you see them everywhere?


Top
 Profile  
 
PostPosted: Sun Dec 15, 2013 1:05 am 
Offline
Moderator
User avatar

Joined: Mon Nov 03, 2003 7:13 pm
Posts: 5978
Location: Odessa, Ukraine
My bet the sites run an ad script to do this. Or you may have an unwanted extension/ActiveX installed.


Top
 Profile  
 
PostPosted: Sun Dec 15, 2013 1:36 am 
Offline
Jack of Zircons
User avatar

Joined: Thu Nov 09, 2006 9:30 pm
Posts: 4484
Location: California, USA
I'm still trying to establish the boundaries. I have only observed them on my own sites, so far (which answers Weirdan's question--my scripts definitely don't have anything like that in them), and looking at the source in the browser shows nothing but plain text! Whatever it is, it is being introduced after it arrives at the browser. And I don't see it in other browsers (Chrome, Opera, Safari).

OK, here are a couple of screen captures of one of my own pages, the first one shows 3 spam links, one at the top supplies its own text, the other 2 surround a word of my text as a link. Only visible in IE 8, not other browsers (I haven't tried a later version of IE on my laptop, but I could). Definitely not present in my script on the server, and not in the source code, as viewed with the browser.

Puzzling (to me, at least!).


Attachments:
File comment: pop-up when I hover over the links
Image11.gif
Image11.gif [ 33.76 KiB | Viewed 7327 times ]
File comment: 3 spam links, some on existing text, some not
Image10.gif
Image10.gif [ 54.4 KiB | Viewed 7327 times ]
Top
 Profile  
 
PostPosted: Sun Dec 15, 2013 2:51 am 
Offline
Jack of Zircons
User avatar

Joined: Thu Nov 09, 2006 9:30 pm
Posts: 4484
Location: California, USA
Update: getting back to requinix's question, I've now established that it's happening on many, but not all websites I visit! It usually creates just 3 links on a page, and they pop up a small window when I hover over them. A page loads, then there's a couple of seconds pause before it shows "Done" on the status bar and if I'm looking at the right part of the page, that's when these spurious links show up! When it initially loads, they aren't there. And on subsequent visits, it's not always the same words that get turned into links. It's definitely something in IE 8, perhaps because it's so down-level that MS isn't supporting it anymore, but it's the highest version that will run under XP. Yeah, another good reason to get rid of XP. But it really bugs me how this is done. And I wonder why it's just now being exploited (again, maybe it's because MS has abandoned XP and older IE versions). Hey, maybe I need to install Vista!!


Top
 Profile  
 
PostPosted: Sun Dec 15, 2013 4:17 pm 
Offline
Spammer :|
User avatar

Joined: Wed Oct 15, 2008 2:35 am
Posts: 6617
Location: WA, USA
It does sound like malware after all. A few sites here and there might use those stupid ad scripts that put links in text, and I adblock them every time I see them, but certainly not as many as you're seeing.

IE is horrible with extensions. Try something like HijackThis which will show you a variety of things running or installed - I'd bet a little bit of money that your culprit is in there.


Top
 Profile  
 
PostPosted: Wed Jan 08, 2014 7:47 am 
Offline
Forum Commoner

Joined: Thu Oct 10, 2013 8:40 am
Posts: 26
Location: Manchester
it seem to be the problem with the website. The website owner seems to want to make extra money by posting some affiliate links on his website in order to take his website's visitors of the affiliated survey or website that will earn him some dollars. I guess this is not the problem with your browser and you cannot do anything regarding this problem as it is not in your hands to not see these links.

_________________
Tayla the great


Top
 Profile  
 
PostPosted: Wed Jan 08, 2014 12:49 pm 
Offline
Jack of Zircons
User avatar

Joined: Thu Nov 09, 2006 9:30 pm
Posts: 4484
Location: California, USA
Tayla6 wrote:
it seem to be the problem with the website. The website owner seems to want to make extra money by posting some affiliate links on his website in order to take his website's visitors of the affiliated survey or website that will earn him some dollars. I guess this is not the problem with your browser and you cannot do anything regarding this problem as it is not in your hands to not see these links.

Hardly. One of them is MY website and I have checked that the source has not been changed. And, looking at the source as received by the browser, there is nothing in them to cause this behavior. Logically, it must be something inserted into the rendering of the page AFTER it has been received by my browser. Back to malware, I'm afraid! If it were consistent, I'd have a chance to diagnose the cause, but, sporadic as it is, it's driving me nuts (as if that were very far to drive...).


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 

All times are UTC - 5 hours


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB® Forum Software © phpBB Group