Has anyone else here been 'zapped' by "text-enhance"

[DB83]

Only wish I could win one of these feckers.

[aedipuss]

looks like they have other urls sending the crap out now. we need to find them to add them also. have you check again for the program/process/service or browser add-on that's doing the pop-up load? it is there or they wouldn't work.

[DB83]

looks like they have other urls sending the crap out now. we need to find them to add them also. have you check again for the program/process/service or browser add-on that's doing the pop-up load? it is there or they wouldn't work.

How do I find that ?. If I right-click on the 'link' the properties just say "#"

If I right click on the text-enhance text the properies just say http://text-enhance.com/ which is the addr that was placed in the HOSTS file subst a local addr (127......) for the http.

I am only thinking outloud now so will try this tomorrow (been a long day) but as I run a localhost server on this PC (to test my website) could that defeat the HOSTS file ?

[davexnet]

I've read all these post, but I still don't understand how it works.

Is it Java script on the webpage causing these green links,
or is it due to a toolbar/plug-in/BHO installed into the browser?

If it's java script, why not run no-script?
If it's a plug-in or extension, uninstall it.

What am I missing ?

[aedipuss]

it's most likely an include.js. try deleting everything in all your temp and download folders. windows/temp, users/user/appdata/local, etc. do a computer search for anything with a link to "text-enhance"

from their tos.
In addition, the Plugin may be bundled with, or require the installation of, third-party software, such as but not limited search engine toolbars.
THE PLUGIN MAY COLLECT OR STORE INFORMATION FOR INTERNATIONAL WEB SERVICES, LLC ("LICENSOR", "WE" OR "US") ABOUT THE WEB PAGES YOU VISIT AND YOUR ACTIVITY ON THOSE PAGES, SUCH AS IMPRESSIONS AND CLICKS. IN SOME CASES, INFORMATION COLLECTED BY THE PLUGIN MAY BE PERSONALLY IDENTIFIABLE, AND INFORMATION (INCLUDING INFORMATION FROM OR ABOUT PAGES OF SOCIAL MEDIA WEBSITES YOU VISIT) MAY BE USED OR SHARED WITH THIRD PARTIES

it could have been installed by just about anything you allowed.

[aedipuss]

it may even be part of that veoh toolbar in your browser.

[davexnet]

I've never experienced the problem myself. Is it malware? The above TOS implies it's a plugin

If you want it to disappear, why not just uninstall the plugin?

[jagabo]

I've never experienced the problem myself. Is it malware? The above TOS implies it's a plugin

It can be installed locally or it can be invoked via js on a web page.

[aedipuss]

here are a couple more possibilities for the hosts file.

127.0.0.1 kontera.com
127.0.0.1 jxliu.com

here's a copy of my hosts file if you want it.

[DB83]

it may even be part of that veoh toolbar in your browser.

I have a veoh toolbar which seems to have a mind of its own - I unclick it and it goes only to reappear without my express permission.

This toolbar has been installed for approx 9 months so I hardly see it being the cause unless it has a security flaw which is being exploited. So I would rather remove that permanently if issues return that will be one of my first options.

However........

On first impressions today this site no longer has the visitation - just as it was a week ago after a full scan (which I did do last night). I also altered the HOSTS file and, ofcourse, it is now a cold reboot rather than a restart.

I will keep your HOSTS file in mind should I need it. Thanks for that.

Hopefully, this is the end of it for me. I do not wish to keep coming back on here for this reason. I do believe in self-help and read all I could find on this before starting this topic. Its purpose was a shared experience and I do find the guys on here more than knowledgeable - in the other places 'fixes' were restricted to specific add-ons which I do not have.

Whether it is Js-based or not I do see why I should turn that off, which would severely restrict my web-browsing experience (having to turn it back on on a site-by-site basis). Same goes for add-ons. It was suggested that I turn them all off. But why? Some will inevitably be needed and, again, I can not see any rogue one there - certainly nothing installed in the time frame that I have had these issues - the only ones with newish dates appear respectable ie Sun Microsystems.

One which is not dated and run without permission is "Google Update". I did read that if this is not located on my HDD at a specific place then it could be a problem. I did find a suspicious instance on my HDD which I removed but I do wonder how this came about.

The mad proffessor in me likes to look beyond any 'fix' and discover the root cause. Only then can the issue really be put to bed.

Thanks to all for your continued input.

[Poppa_Meth]

Has anyone tried running Combofix? It seems to have to right tools to get rid of these painful infections. It'll zap the google redirect virus when MBAM and SAS don't get it.

[Baldrick]

I have at least disabled all skimwords, text-enhance crap on my site. I hope google adsense doesn't add any such.

[intracube]

I have at least disabled all skimwords, text-enhance crap on my site.

I'm still seeing skimlinks javascript at the bottom of each page, which is being blocked by NoScript.

[Baldrick]

I have at least disabled all skimwords, text-enhance crap on my site.

I'm still seeing skimlinks javascript at the bottom of each page, which is being blocked by NoScript.

It's just for links like www.amazon.com/djkhsf?ref=VIDEOHELP and not any words.

[davexnet]

Why not just use noscript in Firefox. Doesn't take long to train it.
You either temporarily allow a script from a particular domain or you white-list it (allow permanent usage).

[DB83]

A quick update from me.

After I posted my last message to this thread #41 - no martians visible - I had to go out so I powered down. On my return an hour or so later, with no odd browsing, they had also returned. With the comments of aedipuss still in my head, I now disabled the Veoh toolbar AND the conduit engine which was reported to me to be part of this install. In fact there were two instances of the conduit engine so I killed both of them - if these are used by anything else then I have not noticed it in the last week.

The minute the toolbar and the conduit engine(s) were disabled, the martians vanished as quickly as they had appeared and up until 10 minutes ago they were not to be seen. Equally, the Veoh toolbar had also not appeared in my browser.

Then I browsed over to a site and FFS the little green men were there and equally, and without invitation, the toolbar had come back. So I disabled it again and the two reported instances of the conduit engine and, once again, the browser is sans-martian. So, for me, there really does appear to be a definite link between this toolbar which like I said seems to have a mind of its own and the appearance of this 'feature'.

Now when I checked the add-ins for the browser I now see two instances of the toolbar, both disabled, and two instances of the conduit engine also both disabled. But if memory serves me right last week there was only one add-in of that toolbar. So that does seem to replicate itself. All very strange.

Now I do not need that toolbar - I simply do not go to Veoh now and only installed it to download one video which is not available elsewhere and, on reflection, could probably have d/led that by other means. So this is far from essential. And since it now really does appear that atleast for me this is the root cause I would rather uninstall it completely. Well, I have now done that and the Veoh Web Player. The add-ins are no longer shown so there should be no way this toolbar can return and, hopefully, I have also seen the last of the martians.