Comments on: How do I rid myself of this adware on IE 6 that adds hotlinks to search engines on certain keywords?

Question: How do I rid myself of this adware on IE 6 that adds hotlinks to search engines on certain keywords?

trigfunctions — Tue, 27 Jan 2004 09:20:56 -0800

I've got some kind of adware on IE 6.0 that is putting hot links on MetaFilter and other pages for certain keywords, like "Photoshop" or "diamonds". The links lead to search engine websites. It is really gumming up the works. I've tried Spybot but that didn't remove it. Anyone have any ideas? Thanks.

By: Hackworth

Hackworth — Tue, 27 Jan 2004 09:57:25 -0800

try adaware as well, and remember to update the definitions. Most anti-virus programs include some sort of adware detection, too, so update them too and run a full system scan.

By: Mayor Curley

Mayor Curley — Tue, 27 Jan 2004 10:50:36 -0800

Isolating it manually is only a little tougher-- ALT-CTRL-DEL and then write down any running processes that you don't recognize. Google them. There are lot of sites with removal how-tos.

It sounds like ezula, which is updated very frequently to stay ahead of the spybot/adaware folks. Removal details are in the link provided.

By: ajpresto

ajpresto — Tue, 27 Jan 2004 10:53:27 -0800

Is it really happening on MetaFilter? Because I've seen a similar phenomenon at other websites. I finally followed up on it and I found the problem in the source of the page:

< !-- start vibrant media intellitxt script section -->
< script language="javascript" src="http://itxt.vibrantmedia.com/intellitxt/front.asp?IPID=7">< /script>
< !-- end vibrant media intellitxt script section -->

The links go to vibrantmedia.com, then are redirected to search engines.

If it happens on MeFi, it's obviously something else.

By: zsazsa

zsazsa — Tue, 27 Jan 2004 10:57:45 -0800

The problems may be appearing appearing in the source because some spyware actually hijacks your winsock.dll file, replacing certain words with the ads before the page even gets to the browser.

By: trigfunctions

trigfunctions — Tue, 27 Jan 2004 11:14:21 -0800

Yep - it's happening on Metafilter, Fark, and other websites. THANKS to Mayor Curley! I checked out the eZula link and it detected that I have eZula on my machine. I have no idea how it got there. I'll have to wait and take it off later. I'll come back and let you know how it went. Again, thank you very much!

By: dg

dg — Tue, 27 Jan 2004 18:22:02 -0800

This sounds almost like the ill-fated MS Smart Tags, but you would have had to go to some trouble to enable them, so probably not.

By: arha

arha — Wed, 28 Jan 2004 02:23:30 -0800

The online script at Doxdesk is finds parasites installed on your machine, and gives very good advice on how to remove them.