Links in copy of website with popups - Issue

[lance71]

Would anyone know the cause of the following issue:

We have a website which is developed in php - www.paraffin.co.za/sawc

Throughout the copy of the website some of the words are highlighted in blue and if you rollover it then a popup appears with an image and some sort of special. There are loads and all different things appearing.

I have seen this issue on the clients machine, my machine now and another machine too.

I will appreciate any help here.

Thanks,
Lance

[lance71]

Seems the home page is fine, but if you go through the pages to this one for example you should see what I mean:

http://www.paraffin.co.za/sawc/index.php?id=247

[AndyD]

It will be a feature in the settings somewhere. I know forum boards come with something similar and it's called 'skimlinks', you've just got to find it and check the box to turn it off.

[lance71]

Thanks, where would these settings be? In the browser? I don't find them on other websites so I am thinking it must be a security thing on the server or something like that.

Never saw them until yesterday and the client was complaining about them for 2 weeks already.

[lance71]

It also happens in both IE and Firefox...

[AndyD]

It will be in the settings of the website itself, not the browser although maybe an adblocker can stop them, not sure to be honest.

[lance71]

Thanks looking in to see if I can find a solution with this.

[lance71]

The problem is our site is a custom built PHP site so we dont have settings like you get on wordpress etc. so we are still stumped by this. Any other helpful advice?

[Dave A]

The cause of your pain is CouponDropDown Adware. From what I've read so far, apparently it does act as malware - and it's obviously crept into the site's code base somehow.

Here's a page on how to remove CouponDropDown Adware, although that seems to relate more to browser infections. Getting it out off your web pages might be a bit trickier...

EDIT: Another listing from McAffee on this - but again, looking at this more as a browser extension

[lance71]

Thanks, looking into this now, will let you know if it solves things.

[Dave A]

Scratching deeper - the question is how did this get imbedded into your website pages. It's behaving like Skimlinks or Vigilinks, but it's clearly accessing the DropDownCoupons resources.

I'm seeing the In-Text Ads and I don't have the plug-in in my browser.
Hence it's in the site somewhere.
It's not in the page source text that I can see.
It's got to be buried in the javascript calls, or libraries or perhaps a class definition.

Actually, it could be anywhere!

For that page you link to in post 2 above, lines 501 & 503 are external script calls.
Or it might be bundled into the boxslider script (where'd you get the module?)
Or..

Good luck!

[lance71]

Ok I have tried going through all the options said above and installed a Microsoft cleaner. Found nothing as well as in Firefox I have no extension as listed in the article.

The reason I think it is on the actual website is that I don't get the problem on any other website and surely I would if it were malware or something like that?

[lance71]

Thanks that's sounding about right now, I think we are on the right track. Although the developer doesn't see them so makes it a bit tricky from his side as i try to explain the issue

Thanks for the help and will post the result once we (hopefully) find the problem.

[SilverNodashi]

I don't see anything in the HTML output of the website that could cause what you're explaining, so it might be malware on the server, which is probably setup in such a way that it only target's you under certain conditions. But I seriously doubt it. Do you have access to the .htaccess file on the server? Please post the content of that file here. Website malware is generally very targeted and setup in such a way that the owner of said website won't detect it under normal conditions. But it's hard to tell without seeing the actual PHP or other code on the server

Do a google search for "website walware check" and run some of the free online tools to check your website for malware. Google webmaster tools is a good option to go with if you don't already use it.


Alternatively, something on your PC is causing this. Go through the list of installed application (Start > Control Panel > Add / Remove Programs) and see if there's anything that you don't recognize. Look for "bing bar", and any other bars with buttons on your web browser. As a test, you could install another web browser which you don't already have, like Safari / Opera / Google Chrome (if you don't use it already) and see if the symptoms are still the same.

What Internet Security suite are you using? Free Antrivirus applications generally won't pickup stuff like this, and it's recommended to use a full internet security suite, like Kaspersky Internet Security, or pick your favourite vendor.

[lance71]

Thanks for your input, we are busy looking into all options at the moment, however we have realized that this is not a problem on our machines as it only happens on this particular site on the 3 different machines we have tested it on. I have also checked for any add ons that should not be there and i have nothing, also downloaded a Microsoft security checker and sowed all is clean.

I will get the .htaccess file and post it trough the course of the day. Thanks for the help.