Spam Link being Embedded on Message Board

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by AggieFrank, Jul 2, 2005.

  1. AggieFrank

    AggieFrank Private E-2

    Whenever I post on a certain message board, a link appears that I didn't submit with the message. The link originally was for freeloadmp3.com but has now morphed to 1know.com. Any ideas how this is happening and how I can stop the link?
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It could be part of the message board. Some may do this. Even using free email programs (even Microsoft's Hotmail) will add stuff to the end of your messages which you do not see in your original mail.

    It does not happen here as you can see.
     
    Last edited: Jul 2, 2005
  3. AggieFrank

    AggieFrank Private E-2

    You're correct it isn't happening on all message boards, just on one board I post on. The board has a built in "link adder" (for lack of a better term) so users can paste a web address that will automatically be converted into an HTML hot link. If I leave the "link adder" blank, something embeds a link to 1know.com each time I post a message.


    I'm sure some code is writing the link from my pc since there are many users but only my posts have the embedded link. Somehow, I've picked up a virus (worm...something) that is adding the link and I'd like to find the source on my pc and remove it. Anybody have an idea how to do that?
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    But why would it only occur on that website! I would question the websites behavior. But if you think the problem is related to a malware issue on your PC, follow our standard cleaning procedures given below.


    - Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    Make sure you check version numbers and get all updates.

    - Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


    After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
     
  5. AggieFrank

    AggieFrank Private E-2

    Ok - I've run all the steps and added the hijackthis log. Note - I ran the virus scans in normal boot.

    The link is still being imbedded.

    Thanks for any help!
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You are way out of date with your updates. This represents a major security risk. You must get updated after we finish fixing any remaining problems you have. We will discuss that later.

    This C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE is not where I requested that you install HJT. It is exactly where I requested that you not put it. Please fix this.

    If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
    For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O4 - HKLM\..\RunServices: [Srv32 spool service] C:\WINDOWS\System\spoolsrv32.exe

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    C:\WINDOWS\System\spoolsrv32.exe

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

    Now run Ccleaner (installed while running the READ ME FIRST).
    Now reboot in normal mode and post a new HJT log. And tell us how things are working.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds