Weired Computer Thing

[HFishbine]

This is really weired. I just made a post in LBN discussing mortgage rates. When my comments were posted, all the words "mortgage" on the the page (not just in my post) were hyperlinks. I clicked on one at it brought me to a page listing mortgage brokers. I went back to the DU page, and the links were gone.

Is this a DU thing or has some shit been loaded into my web browser that makes links out of certain words? Anybody seen anything like this before? Any help?

[everythingsxen]

1. Thats a new one on me...

Haxxor attaxxor?

[EarlG]

2. It's not coming from us

Sounds like spyware, in a new and particularly unpleasant form. Get a copy of Ad-Aware (it's free, just google it) and check your system.

EG

[Gato Moteado]

4. adaware is good....

....also try "spybot search and destroy".

[Melsky]

3. It is spyware

did you download a program lately? This is something hidden in many downloaded programs that does this. The links are to paid advertisers.

You can get a program for free to get rid of this crap here:

http://www.lavasoft.de/support/download/

This is Ad-Aware.

It happened to us after my hubby downloaded some kind of music sharing program.

[nn2004]

5. Go to a command prompt and type netstat -a

If you see anything other than DU and your provider (assuming you have no other wanted connections live) then contact the domain and their upstream and make their life miserable for stealing your bandwidth and intruding on your privacy.

[HFishbine]

9. nn2004

I followed your instructions after removing the spyware and I see a lot of things that seem to be beyond what you suggested I should see:

(CAIN is my computer name)

Active TCP Connections

CAIN:epmap
CAIN: microsoft-ds
CAIN: 1026
CAIN: 1028
CAIN: 1029
CAIN: 44334
CAIN: netbios-ssn
CAIN: pop3

All of the above show a Foreign Address of CAIN:0

All are "listening"

ACTIVE UDP Connections

CAIN: epmap
CAIN: microsoft-ds
CAIN: 1030
CAIN: 44334
CAIN: netbios-ns
CAIN: netbios-dgm
CAIN: isakmp
CAIN: 1031

All of the above show a Foreign Address of *:*

Nothing specifically identified as DU (although I'm on the post page right now, of course). Does any of that look suspicious to you?

[ima_sinnic]

6. some kind of program was stealth-installed on your computer

Back when I knew a less than I do now I stupidly downloaded WeatherBug (which is a spyware and stealthware kind of program) and ended up with the same kind of crap you're talking about.

do you have adaware?
It's a free download that scans for spyware and the kind of thing you're talking about. can't recommend it highly enough. get it for free at http://www.lavasoftusa.com/software/adaware/

I run adaware about every 2 weeks and love it. have stayed completely free of adware, spyware, and also most popups (esp. in conjunction with the popup blocker included in the google toolbar).

[HFishbine]

7. Figured it out -- and Ad-Aware Didn't Find It

Thanks all for your great suggestions. I have Ad-Aware and it didn't find anything. But I think I found the problem.

It appears to be a piece of adware called Winshow. I found removal instructions here:

http://www.kephyr.com/spywarescanner/library/winshow/index.phtml

I'm not sure how I got this. I use IE but with a pop-up stopper and alerts for Active X controls turned on -- which I usually deny.

The removal instrutions recommend Bazooka Adware and Spyware Scanner for detecting this and other nasty things (http://www.kephyr.com/spywarescanner/index.html).

Thanks again for the help.

[ET Awful]

8. Sounds like one of the older spyware programs to me

Like toptext or such.

Go to www.scumware.com for good information and links to programs to clean this crap off.