Has anyone else here been 'zapped' by "text-enhance"

[DB83]

For the last week or so, my web-browsing experience has been plagued by random links appearing on web pages, including these forums.

They take the appearance of green underlined text replacing the actual text of the web page and if you mouse-over on this you invariably get a pop-up that you may have won something or could win something.

Now, you will tell me that my system has some malware but I have scanned it with several utilities and they all draw a blank. There is no add-on in IE or Firefox that appears to be unusual and I can not see any new item that is being loaded when Windows starts.

In all, this is very annoying.

Anyone else been plagued and if so, what was your cause of it and how, did you remove it ?

PS the text-encance site opt-out does NOT work. Well it does not fo rme.

[hech54]

http://wafflesatnoon.com/2011/10/05/seeing-unwanted-text-enhance-ads/

[DB83]

http://wafflesatnoon.com/2011/10/05/seeing-unwanted-text-enhance-ads/

Thanks for that.

I was at that page yesterday and noted the add-ins quoted which I do not have. Have now installed their suggested software and done a scan. Only tracking cookies were detected(Norton normally finds the bad guys amongst those) but have quarantined these just to see if this makes a difference.

Watch this space.

[dragonkeeper]

Yah happen to me a while back has to be one of the most annoying things ever. Thanks for the link hech54

[DB83]

Quick update.

Not fixed. Links/pop-ups are still on the webpage.

[Bjs]

Most likely you need to add a filter to the firewall to block intellitxt.com, text-enhance.com and vibrantmedia.com.

[davexnet]

Perhaps try a scan with malwarebytes or something similar.
http://www.malwarebytes.org/

Could be worth checking the HOSTS fine for any bogus entries..

Also, from a command prompt, enter ipconfig /all
and check to see the DNS servers are valid.

[aedipuss]

or put them in your hosts file.

[zoobie]

It was recommended to scan with the big 3:
Malwarebytes, Superantispyware, and Adaware
If it's still in there after using these 3 programs, the Adaware team will want to take a look at it

[DB83]

It was recommended to scan with the big 3:
Malwarebytes, Superantispyware, and Adaware
If it's still in there after using these 3 programs, the Adaware team will want to take a look at it

Already tried Malwarebytes and Superantispyware - before I turned off last night, I did a full scan with the latter and it just found another 64 tracking cookies which I deleted (the quick scan had earlier found 190 on the first scan and just 2 the second time). This morning, I have only visited 2 sites - this one to check the replies and one other to refresh my knowledge about HOSTS config. The first time I came to this site it was 'clean' but when I cam back to post this reply the little green men were back again.

Will look at Adaware later and also the suggested HOSTS and/or firewall configurations.

Many thanks for your continued input. Together we can beat this.

[aedipuss]

there has to be a browser add-in or process running for the pop-up to occur. have you look in the task manager to see if you can find the bugger running the little green men? or in your browsers add-in section?

[DB83]

I spent 2 hrs+ running a full scan with ad-aware. Again, it found some cookies which it said were suspect and these are now gone.

Wish I could say the same for the 'martians' who still pop up from time to time.

Believe me, I have done all the obvious things. As far as I can tell, the services running are clean (and not one of the 'big three' picked up anything here). Also, as previously stated, I have checked the add-ins and there is nothing that is running that I do not recognise.

There are a couple of sites that I frequent quite often. One is Abebooks and while they do not this text there is another mouse-over there which lists 'coupons'. So I do wonder if, having cleaned up my system by visiting this site after I am getting infected via this feature which I do not see on other sites.

On another site, which is a rockband forum, I do not see green underlined text but links are still there - text is shown in a ligher colour. No pop-ups but when you mouse-over you can see an address http://nameofsite/pageref#. of course that target does not exist and if you click the link you go to one of the advertised sites even tho this site/forum runs no such advertising.

Well, my next line of inquiry will be the HOSTS method.

Keep reading.

[davexnet]

Have you tried starting IE with add-ons disabled. Does the problem still occur?

Use the command iexplore.exe -extoff

For FF, to start with add-ons disabled, there is a link in the Help dropdown.

[jagabo]

Text Enhance can also be activated by Java Script on a web site. Use the NoScript addon for Firefox. Set the default to Disable Java Script. Enable it only for sites you trust.

[davexnet]

I have noscript installed, and skimresources.com is allowed. I've never seen anything odd @ videohelp.com -
perhaps Adblock Plus is stopping the weirdness ?

[jagabo]

Adblock Plus will let you see a list of items being blocked. I see it's blocking some js at s.skimresources.com while here.

[davexnet]

On this forum page? I temporarily disabled Adblock (middle click the icon) and refreshed this page.
I still did not see anything suspicious.

EDIT perhaps because Baldrick has disabled it!

[dragonkeeper]

It seems that skimlinks that I use has gone mad. It should only add a referer id to software links and not random words. I'm disabling it now.

Yah that's been going on for some time now, leave it to the spammers to misuse a good idea. Originally it was very useful to me then it turned into a spammers paradise.

[DB83]

It seems that skimlinks that I use has gone mad. It should only add a referer id to software links and not random words. I'm disabling it now.

It's probably same for other sites too.

I do not wish to suggest that this site is the source of the misery. If it was then a whole lot more people would be screaming.

Following my last post here, I have not as yet invoked the HOSTS suggestion. I have visited both sites that I previously mentioned and the little green men, or rather their incarnation there, have not materialised.

I was having some issues here - the word 'day' on the "Today's Posts" page was affected - but not at present.
Hopefully, I have seen the last of these but knowing sod's law as soon as I publish this post............

[DB83]

Well, after a week of no issues - usual internet activities - the martians have returned.

Scanned with superantispyware and ad-aware and only tracking cookies (deleted) have been found. I also run admuncher.

I noticed them almost immediately after Norton had done a full(weekly) system scan but that can hardly be the culprit ?

But I am now seeing them on other sites such as BBC/news so rather than an improvement, the issue is somewhat worse

[davexnet]

Have you tried Internet Explorer and Firefox? Does it occur on both ?

[TreeTops]

If you google 'green text enhance' you will get millions of hits on this one. Seems like lots of people are having that problem.

[TextEnhance]

Hello, we apologize that you are having trouble with the TextEnhance product. If you are seeing these links, then a web publisher has decided to offer them to you. If you would like to opt-out of seeing these links, visit: http://optout.textsrv.com/optout.php

For FAQs and additional help on removing Text Enhance, please visit http://support.text-enhance.com

[aedipuss]

easier to put -

# text enhance ads
127.0.0.1 intellitxt.com
127.0.0.1 text-enhance.com
127.0.0.1 vibrantmedia.com

in your hosts file - windows/system32/divers/etc/hosts

and yes even if you are running 64bit windows it goes there.

[jagabo]

easier to put -

# text enhance ads
127.0.0.1 intellitxt.com
127.0.0.1 text-enhance.com
127.0.0.1 vibrantmedia.com

in your hosts file - windows/system32/divers/etc/hosts

Agreed. You can edit the file with NotePad or any plain text editor.

[DB83]

Hello, we apologize that you are having trouble with the TextEnhance product. If you are seeing these links, then a web publisher has decided to offer them to you. If you would like to opt-out of seeing these links, visit: http://optout.textsrv.com/optout.php

For FAQs and additional help on removing Text Enhance, please visit http://support.text-enhance.com

Go forth and multiply.

I can even see them on a local version of MY OWN WEB SITE and that is totally ad-free.

Explain that one.

And your opt-out does not work.

[DB83]

easier to put -

# text enhance ads
127.0.0.1 intellitxt.com
127.0.0.1 text-enhance.com
127.0.0.1 vibrantmedia.com

in your hosts file - windows/system32/divers/etc/hosts

and yes even if you are running 64bit windows it goes there.

Thanks !

That will be my next approach. Did not do it earlier as I thought it the issue was fixed.

[DB83]

Have you tried Internet Explorer and Firefox? Does it occur on both ?

Only IE (as I write this).

Let me see if the HOSTS suggestion really fixes this.

[aedipuss]

don't forget to reboot after changing the hosts file.

[DB83]

don't forget to reboot after changing the hosts file.

Well I added the lines, as directed, to the HOSTS file.

Just rebooted and logged back on here.

No difference. GRRRRRRRRRRR

A thought. Should that be a cold reboot ?. I just did a restart.