strange occurrances on site this morning

[wvwoman]

for about the past hour, when solving puzzles, the system won't let me change letters by just clicking on the box (space) and entering the new letter over the existing one---i now have to double-click to highlight the letter in the box, delete to clear the box, then enter the new letter. i have to go through the same process of highlighting in order to clear a box, too.

then, on my most recent puzzle solution page, in the space where the completed quote is shown under the stats, a couple of the words in the quote were in in blue with double underlines. hover your cursor over the blue, underlined words, and an ad pops up. now that's weird!

[admin2]

It sounds like your browser has had some sort of adware/malware installed on top of it which is surreptitiously inserting links in any content you view. I'd highly recommend you run some sort of antivirus program as soon as possible to get it removed.

I usually recommend http://www.malwarebytes.org/ - it's free and it's cleaned up my system on several occasions where Norton and others have failed.

Good luck!

[montyb]

I think I agree with Admin, wvwoman. I do not seem to be having any trouble with the site today.

[wvwoman]

argh!

i am still trying to rid my computer of whatever malware is plaguing it/me---i have run two long, slow scans by my antivirus program to start, and have run malwarebytes, spybot and another whose name i can't recall at this moment, all to no avail.

i'm now advised to run a rootkit program---but that i have to be careful when removing things that are found, as they are not all bad things. well, how the he** am i supposed to know?!! i'm not a computer expert.

strangely, after each try at getting rid of it, everything seems good...i see no evidence of it anywhere (the words in blue with double underlines that show ads when cursor hovers over them) until i come back to this sight and solve one puzzle---then there they are!

before i start a "how did this happen--i'm so cautious" rant, if you have any advice, sock it to me. i'm mightily frustrated, and wonder what this malware is doing to my 'baby' (computer, lifeline, etc.).

thank you!

[admin2]

Sorry to hear you're still having trouble!

What browser are you using? What I would do at this point would be to go into my browser settings and disable all plugins/add-ons (even the ones you think you can trust) to see if that has any effect. If it does, then re-enable all plugins/add-ons and disable them again one-by-one until you can pinpoint which one is causing the links to appear. That will be your culprit, and hopefully you can then remove/uninstall it manually.

Sometimes a "legitimate" add-on or plugin for your browser will sneakily start adding these links under the radar so that they don't trigger anti-virus programs right away.

Good luck!

[wvwoman]

i use firefox.
does it mean anything that all the ads say "tuvaro" at the top?
oh, now there are some that aren't tuvaro ads--they just say "post 5574."
this is so weird.
what kind of damage can this sucker do?
ok, i'm off to try what you have suggested.

[admin2]

It's never good to have unrecognized software on your computer, but with that caveat, most of these things just serve ads that they hope you click on so that they'll make some money. A small percentage of them are more damaging - but the really dangerous ones generally won't bother showing you ads. They'd rather be left undetected so they can gather your personal data without you realizing anything is wrong.

Good luck!

[wvwoman]

shhhhh...trying to contain my excitement!

i don't want to say it very loudly, but it appears i have success, thanks to you, stephen! (yes, i'm thinking that speaking too loudly might wake up the beast that might still be hiding somewhere--it's just the way things often go--so one hates to get overly excited prematurely!)

i've solved several puzzles, and see no signs of the dreaded blue-colored, double-underlined words.

i disabled all plug-ins/add-ons, as you suggested, so it seems you were correct--one of them is the culprit. no one else thought to suggest that--i'm highly appreciative.

a few more questions:
1. as i add them back, one at a time, do i need to restart my computer each time?
2. how does malware get attached to an add-on? is it there when i add it, or does it 'magically' attach itself to an existing add-on? is it attached to that add-on forever?
3. why were the links so prevalent on this particular site?

[admin2]

Glad to hear it!

You don't need to restart your computer as you add them back, just your browser. As for how it gets attached, I'm not well-versed in the specifics, but generally any plugin/add-on you install runs this risk, so always make sure you can trust the source. Some software also has "sleeper" periods, where you'll install it, it works fine for a month or two, and then it triggers the adware to start popping up all of a sudden - the idea being that you wouldn't suspect the plugin of being the culprit since it was installed so long ago and never caused problems before.

As for why it seems to trigger more on this site than others, I really don't know - I guess we're lucky. :-)

Also - if you have the list of disabled plugins, try googling each one by title and see if anything pops up about others having similar problems with it. That might help you narrow it down.

[wvwoman]

when i went back to my 'add-on' page, i expected to see the list of all the 'disabled' add-ons---but many of them were 'enabled' again without my having done anything. obviously this is happening automatically to over half of them. so far, no adware is showing up again. how would i go about turning off that auto feature if the need arises?

[Lily H]

Hi Wvwoman,

Like Stephen, I too use Malwarebytes as my anti-virus program to get rid of viruses and trojans, but sometimes even it fails to locate the problem. I don't know a lot about computers, but I have learned a lot over time through trial and error and from internet forum chats. I had one particularly difficult to remove trojan that only Spybot Search and Destroy was able to remove. You can go to the CNet site to download it for free. Be sure to run the scan as an administrator. I hope that helps solve your problem for good. I don't do a lot of surfing on the internet, but I still do daily scans rather than wait for problems to arise. By the way, if you use multiple anti-malware programs like I do, you should only have one running in real time for virus detection.

Lily

[damsel22]

Strange occurrences on site this morning

This may be helpful-I also use Firefox, and while I didn't notice anything strange today, I become plagued with a slow browser from time to time. I have learned that it's best to just keep all of Firefox's default settings and not try to change anything, even though I may want to. Firefox just seems to run best that way.

[wvwoman]

hmm...

i don't even know if i still have the default settings...or even what that means, exactly!

[damsel22]

Strange occurrences on site this morning

Wvwoman, I stumbled upon this one day when I just went to open my browser. Instead of my home page opening, the Firefox home page popped up and told me my browser seemed to be opening slowly. It then prompted me to find out more, so I clicked a link that said restore Firefox defaults. I had never seen this before! Must be some built in optimization Firefox offers its users. As an alternative, you can try going to Tools on your menu, click options, then in the startup section at the top of the dialog box, click restore defaults. I assume this feature is the same, but honestly I'm not completely sure. As with the Windows environment, there are always multiple ways of accomplishing the same objective. Good luck!