Links in copy of website with popups - Issue

[lance71]

Would anyone know the cause of the following issue:

We have a website which is developed in php - www.paraffin.co.za/sawc

Throughout the copy of the website some of the words are highlighted in blue and if you rollover it then a popup appears with an image and some sort of special. There are loads and all different things appearing.

I have seen this issue on the clients machine, my machine now and another machine too.

I will appreciate any help here.

Thanks,
Lance

[lance71]

Seems the home page is fine, but if you go through the pages to this one for example you should see what I mean:

http://www.paraffin.co.za/sawc/index.php?id=247

[AndyD]

It will be a feature in the settings somewhere. I know forum boards come with something similar and it's called 'skimlinks', you've just got to find it and check the box to turn it off.

[lance71]

Thanks, where would these settings be? In the browser? I don't find them on other websites so I am thinking it must be a security thing on the server or something like that.

Never saw them until yesterday and the client was complaining about them for 2 weeks already.

[lance71]

It also happens in both IE and Firefox...

[AndyD]

It will be in the settings of the website itself, not the browser although maybe an adblocker can stop them, not sure to be honest.

[lance71]

Thanks looking in to see if I can find a solution with this.

[lance71]

The problem is our site is a custom built PHP site so we dont have settings like you get on wordpress etc. so we are still stumped by this. Any other helpful advice?

[Dave A]

The cause of your pain is CouponDropDown Adware. From what I've read so far, apparently it does act as malware - and it's obviously crept into the site's code base somehow.

Here's a page on how to remove CouponDropDown Adware, although that seems to relate more to browser infections. Getting it out off your web pages might be a bit trickier...

EDIT: Another listing from McAffee on this - but again, looking at this more as a browser extension

[lance71]

Thanks, looking into this now, will let you know if it solves things.