Ick... virus?

Post by **spiderfrommars** » Mon Sep 26, 2011 9:15 pm

I dunno if I've downloaded something really manky on my computer.

Webpages now have random words turned into weblinks. They are green and double underlined. Hover over them or click on them and I get an advert.

On Transfans it's blue, not green, and a single underline. Places like Facebook and Twitter aren't affected. I use Internet Explorer but Google Chrome doesn't appear affected.

Any ideas? It's creeping me out now.

Hot Shot · Post by **Hot Shot** » Mon Sep 26, 2011 9:41 pm

I've seen some sites do the same thing, but I assume those were programmed like that for ad revenue. Something's definitely wrong if Transfans is doing it.

Probably a dumb question, but have you tried a virus scanner yet? If you boot up in safe mode and run one it'll probably catch it.

Post by **Kaylee** » Tue Sep 27, 2011 2:28 am

Which version of IE and which Windows and which antivirus?

Brendocon · Post by **Brendocon** » Tue Sep 27, 2011 8:16 am

You been looking at HotBustyDecepticons again Spidey?

Post by **Kaylee** » Tue Sep 27, 2011 10:32 am

For the sake of expediency I'll assume a Windows higher than XP (Vista or 7), a half-decent antivirus and Internet Explorer 8+:

1. My first guess would be an add-on for IE that's causing the issue by giving 'helpful' ad links
* Go to IE > Tools > Manage Add Ons and have a look
* Delete/disable anything that you don't explicitly want/need
* See if that fixed it.

If that doesn't help, then this generic checklist usually cures most ills on a modern Windows system:

2. Then go to your computer's 'Add Remove' programs dialog and clear out anything in there that you don't need/use. If you don't use it, don't know what it is and it doesn't sound like something to do with the actual running of your PC then delete it. Let your computer reboot as necessary.

3. Run Windows Update and make sure your PC is up to date (including installing IE 9 if you don't have it and don't have a major reason for not upgrading). Typing 'windows update' into the Windows 7/Vista start menu will bring up the program. Let your computer reboot as necessary.

4. Turn on UAC if it's not already on (by default on in Windows 7). Typing 'turn on uac' into the Windows 7/Vista start menu will bring up the relevant option.

5. Make sure your antivirus is up to date and let it do a run through, exaclty as HS suggested.

If at the end of all that you still have the problem then we'll kick it up a notch and give it a bam from the ol' spice weasel. By which I mean I'll pitch less generic advice

Post by **spiderfrommars** » Tue Sep 27, 2011 10:03 pm

Cheers Karl! I've followed your steps, and I'll see how it goes. In answer to your questions it is Windows 7 and it was IE 8 (now 9). I use a free version of AVG.

Post by **spiderfrommars** » Wed Sep 28, 2011 12:43 am

Brendocon wrote:You been looking at HotBustyDecepticons again Spidey?

How can something so wrong feel so right?

Post by **Kaylee** » Wed Sep 28, 2011 4:13 am

spiderfrommars wrote:Cheers Karl! I've followed your steps, and I'll see how it goes. In answer to your questions it is Windows 7 and it was IE 8 (now 9). I use a free version of AVG.

Sweet. If you're on Windows 7 then it's probably not a virus and more likely some add-on that's come down quietly for IE (one of those 'Ah want to install this piece of software, do you? Well I'm going to just tick this box for you to bring down the Ask PointlessPlugin, Google Steal My Life and Apple's 'We Couldn't be Bothered to Recode it for a PC' Mac Application).

Man IT has made me bitter

Hope that has solved it but if not we'll kick it's ass anyway!

Post by **spiderfrommars** » Fri Sep 30, 2011 3:26 pm

Yep, it's still there.

Can we do some ass kicking?

Post by **Kaylee** » Sat Oct 01, 2011 1:21 am

*Cracks knuckles*

Before we begin please turn on 'Protected Mode' in IE9, it's under the little cog icon in the top right > Internet Options > Security and then there's a tick box to enable it.

1. First let's try removing the IE cache, to make sure there's nothing funky in there. Go to the little cog icon in the top right > Internet Options > Delete then nuke everything.

For a more comprehensive clean then you can give Piriform's CCleaner a go: http://www.piriform.com/

It's a freebie and is useful for situations where you want your PC to have a thorough dusting.

2. If that fails and the underline links are still there for TransFans then we'll turn to a spyware/adware scanning tool:

http://download.cnet.com/Spybot-Search- ... 22137.html

It's an outdated POS but it might help here. Certainly did on the family PC a few months back, snaffling a couple of nasties that didn't quite qualify as 'viruses' but were causing mischief.

Let it do a full scan (ignore it's crap about Tea-Time Protection or whatever nonsense it talks about) and nuke anything it finds.

If that solves it, remove it afterwards.

If not, lemme know and we'll take it forward from there,

Post by **spiderfrommars** » Sat Oct 01, 2011 7:34 pm

Cheers Karl, will let you know how it goes. It's doesn't do it all the time, so won't know if this works straight away.
I'll get started...

Post by **Kaylee** » Sun Oct 02, 2011 2:43 am

spiderfrommars wrote:Cheers Karl, will let you know how it goes. It's doesn't do it all the time, so won't know if this works straight away.
I'll get started...

Doesn't do it all the time? That's very interesting...

Yar, lemme know how it goes

Post by **spiderfrommars** » Sun Oct 02, 2011 7:09 pm

Wow, I've carried out the latest steps and it's still doing it! Guess this is bad?

Post by **Kaylee** » Mon Oct 03, 2011 1:00 am

spiderfrommars wrote:Wow, I've carried out the latest steps and it's still doing it! Guess this is bad?

Not necessarily

I'll do a little research then get back to you in a few mins.

EDIT:

I'd like to gather a little more information, since the usual stuff didn't get us anywhere. Could you go to http://chrome.google.com and download Chrome, periodically give TransFans a go in it and see if you get the same problem?

I'd like to narrow down whether the issue is from the wire to the application or within the application.

Once you're relatively happy with the answer by all means remove Chrome.

Our other alternative at this point, as I appreciate this is sucking time out of your life, is to go far more heavy duty and use System Restore to try and get rid of whatever change caused these ads to appear. Your files and documents won't be affected but the things installed on your system will revert back to how they were some weeks/months ago.

Would you like to go for the more heuristic or the more nuclear option?

Post by **spiderfrommars** » Mon Oct 03, 2011 6:03 pm

Yep, I already have Chrome and it's unaffected.
Also, earlier I said it didn't affect Twitter but turns out it does.

System Restore - what kind of stuff will I lose?

Post by **Kaylee** » Mon Oct 03, 2011 11:04 pm

You're right, my apologies, first post you said Chrome was fine.

System restore will keep the contents of your documents folder, so things like music, photos and office documents stay the same. Anything in the programs folder and Windows folders are fair game and will be reverted back to how they were however long ago we choose to restore to.

It's worth doing a quick backup just in case though, something like Dropbox maybe just for essentials that can't be replaced.

Do you want to head down that route? It's heavy handed but is probably the best option.