1
   

Highlighted Text / Popup menus in Internet Explorer / XP

 
 
muntz
 
Reply Sun 16 May, 2004 11:40 pm
My browser has some new behaviour that is very nasty.

Special keywords are being highlighted in yellow, and when you mouseover them it brings up a popup menu. For example, when the word "business" is found in the page, it makes it bold and gives it a yellow background. This occurs across all sites, with a range of keywords including "computer", "credit" and even drug names. The menu redirects to links like this:

http://yafoo.biz/search.cgi?acc=1326&q=Home Insurance

Ad-Aware and Spybot can't seem to find anything wrong, even with updates and running in Safe Mode (the problem occurs in Safe Mode - even with no internet connection enabled.)

When I view source, I find a bunch of style entries and javascript functions to create the floating menu.

<style>
.xxxxmenu
{visibility:hidden;background-color:#ECF8FF; etc etc

.xxxxkeyword
{background-color:#FFFF00;color:#000000;

function onmo(obj)
{
var objname = obj.getAttribute('id')+'_menu';
inMenu = true;
var spn = document.getElementById(objname);

The keyword is surrounded by a span:
<span id="BUSINESS_menu" class=xxxxmenu onmouseout="menuonmo(this);" onmouseover="menuonmover(this);">
<b>Category:</b><a href='http://yafoo.biz/search.cgi?acc=1326&q=Business' target='_blank'>Business</a>

How does this stuff get inserted into the page? How do I get rid of it???
  • Topic Stats
  • Top Replies
  • Link to this Topic
Type: Discussion • Score: 1 • Views: 1,209 • Replies: 9
No top replies

 
fishin
 
  1  
Reply Mon 17 May, 2004 06:58 am
Read the following announcement:

http://www.able2know.com/forums/viewtopic.php?t=23352

There is nothing on your computer or any "problem" per se hence, nothing for Spybot or Ad-Aware, etc to find.
0 Replies
 
Craven de Kere
 
  1  
Reply Mon 17 May, 2004 10:21 am
fishin'

Actually, that is some kind of spyware and isn't related to our text ads.

muntz,

Please post a hijackthis log.
0 Replies
 
muntz
 
  1  
Reply Mon 17 May, 2004 05:15 pm
Yep - it's definitely spyware.

The underlined text / popup menus occur on ANY web-page, even when I just open up a html document off-line.

I actually tracked it down myself - SpyBot and Ad-Aware gave my PC the all clear. I did a dump of the DLLs loaded by IE (iexplore.exe) using ListDlls, and also did it on my uninfected work PC.

This gave me a short-list of 5 DLLs and I then inspected each in turn.

The one that proved to be the culprit was:
0x01500000 0x27000 1.00.0000.0001 D:\WINDOWS\System32\msvsres.dll

which looks innocuous enough. The description had something to do with XML and Mime - so maybe it is something that IE is expecting to be there to do some sort of transformation. The DLL wasn't signed by Microsoft of course.

Once I shut down IE I was able to delete the sucker easily enough. All clear now.... Very Happy

Do a Google search on msvsres.dll and you'll find some other people with problems, perhaps caused by a different version.
0 Replies
 
Craven de Kere
 
  1  
Reply Mon 17 May, 2004 08:10 pm
muntz,

Thanks for returning to post your finds, it'll help those who are here combatting spyware.
0 Replies
 
Noddy24
 
  1  
Reply Tue 18 May, 2004 05:56 am
Would it be possible down the road to use the text ads (and the revenue from the text ads) to eliminate the financial necessity of the detour before posting a reply and seeing the post?

Carrots and sticks, carrots and sticks.
0 Replies
 
Craven de Kere
 
  1  
Reply Tue 18 May, 2004 09:23 am
Noddy, this thread isn't about A2K's ads.
0 Replies
 
Noddy24
 
  1  
Reply Tue 18 May, 2004 12:52 pm
Craven--

Final proof that this is Not My Best Day. Time for a nap. Sorry for the moment of muddle.
0 Replies
 
Craven de Kere
 
  1  
Reply Tue 18 May, 2004 12:58 pm
No worries, I just wanted to make it clear because nobody wants to be associated with the scummy stuff muntz is talkin' about. Here we put a lot of effort into helping people fight spyware and in this thread we were being equated with the spyware (which, of course, is way uncool ;-) ).
0 Replies
 
Noddy24
 
  1  
Reply Tue 18 May, 2004 02:50 pm
Craven--

Rather than wash my mouth out with soap for having smirched the name of A2K, I bleached my fingertips and scoured them with steel wool.

If you call in the G-men they won't be able to run my prints for days and days, but I am contrite and you do not need the G-men.

Besides you have more sense than certain members of the party currently in power--at least when you're not under the influence of moonlight.

Hold your dominion.
0 Replies
 
 

Related Topics

YouTube Is Doomed - Discussion by Shapeless
So I just joined Facebook.... - Discussion by DrewDad
Internet disinformation overload - Discussion by rosborne979
Participatory Democracy Online - Discussion by wandeljw
OpenDNS and net neutrality - Question by Butrflynet
Internet Explorer 8? - Question by Pitter
 
  1. Forums
  2. » Highlighted Text / Popup menus in Internet Explorer / XP
Copyright © 2024 MadLab, LLC :: Terms of Service :: Privacy Policy :: Page generated in 0.03 seconds on 11/05/2024 at 07:36:38