January 27, 2004

9:20 AM

I've got some kind of adware on IE 6.0 that is putting hot links on MetaFilter and other pages for certain keywords, like "Photoshop" or "diamonds". The links lead to search engine websites. It is really gumming up the works. I've tried Spybot but that didn't remove it. Anyone have any ideas? Thanks.
posted by trigfunctions to (7 comments total)

try adaware as well, and remember to update the definitions. Most anti-virus programs include some sort of adware detection, too, so update them too and run a full system scan.
posted by Hackworth at 9:57 AM on January 27, 2004

Isolating it manually is only a little tougher-- ALT-CTRL-DEL and then write down any running processes that you don't recognize. Google them. There are lot of sites with removal how-tos.

It sounds like ezula, which is updated very frequently to stay ahead of the spybot/adaware folks. Removal details are in the link provided.
posted by Mayor Curley at 10:50 AM on January 27, 2004

Is it really happening on MetaFilter? Because I've seen a similar phenomenon at other websites. I finally followed up on it and I found the problem in the source of the page:

< !-- start vibrant media intellitxt script section -->
< script language="javascript" src="http://itxt.vibrantmedia.com/intellitxt/front.asp?IPID=7">< /script>
< !-- end vibrant media intellitxt script section -->

The links go to vibrantmedia.com, then are redirected to search engines.

If it happens on MeFi, it's obviously something else.
posted by ajpresto at 10:53 AM on January 27, 2004

The problems may be appearing appearing in the source because some spyware actually hijacks your winsock.dll file, replacing certain words with the ads before the page even gets to the browser.
posted by zsazsa at 10:57 AM on January 27, 2004

Yep - it's happening on Metafilter, Fark, and other websites. THANKS to Mayor Curley! I checked out the eZula link and it detected that I have eZula on my machine. I have no idea how it got there. I'll have to wait and take it off later. I'll come back and let you know how it went. Again, thank you very much!
posted by trigfunctions at 11:14 AM on January 27, 2004

This sounds almost like the ill-fated MS Smart Tags, but you would have had to go to some trouble to enable them, so probably not.
posted by dg at 6:22 PM on January 27, 2004

The online script at Doxdesk is finds parasites installed on your machine, and gives very good advice on how to remove them.
posted by arha at 2:23 AM on January 28, 2004