Random ad links again

The machines we love to hate

Moderator: Wiz Feinberg

User avatar
Richard Sinkler
Posts: 17809
Joined: 15 Aug 1998 12:01 am
Location: aka: Rusty Strings -- Missoula, Montana

Random ad links again

Post by Richard Sinkler »

This has happened to me before and I forgot what to do. I am getting random links in posts on the forum that when you hover over them or click on them, you get ads. I know they are not put in by the poster because I posted a topic and a word got underlined and the color of font change, just like a normal hyperlink. How do I get rid of them.

In fact, the words "ad links" in my title, "meet online" in the forum logo at the top of the page, "want" in the sentence asking if you want to add a poll are all showing this behavior. The words turn orange and have a double underline.

Only things I have done in the past day was to run cCleaner last evening and Malwarebytes over night, neither of which I think would cause this.
Carter D10 8p/7k, Dekley S10 3p/4k C6 setup, Regal RD40 Dobro, Recording King Professional Dobro, NV400, NV112, Ibanez Gio guitar, Epiphone SG Special (open G slide and regular G tuning guitar) .

Playing for 55 years and still counting.
User avatar
Richard Sinkler
Posts: 17809
Joined: 15 Aug 1998 12:01 am
Location: aka: Rusty Strings -- Missoula, Montana

Post by Richard Sinkler »

OK, figured it out. It's an actual program called TidyNetwork and you uninstall it through control panel / add - remove programs. I would like to know how it gets installed without my knowledge and permission. I am assuming it is some sort of malware. What's puzzling is, the only things I have recently downloaded or updated were MalwareBytes and cCleaner. I would assume both of those to be safe from this crap.
Carter D10 8p/7k, Dekley S10 3p/4k C6 setup, Regal RD40 Dobro, Recording King Professional Dobro, NV400, NV112, Ibanez Gio guitar, Epiphone SG Special (open G slide and regular G tuning guitar) .

Playing for 55 years and still counting.
User avatar
Wiz Feinberg
Posts: 6113
Joined: 8 Jan 1999 1:01 am
Location: Mid-Michigan, USA

Post by Wiz Feinberg »

Without seeing your browser's history, I can only guess that this snuck in via a stealthy downloader on a compromised web page you visited.

The website may be legitimate, but because they are running some insecure web software, or an out-dated blog, criminals installed a redirection script and your browser followed it.
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog