Unwanted ads in postings - a smf issue or not?

Started by K-Forum, November 28, 2013, 01:34:48 PM

Previous topic - Next topic

K-Forum

Hello,

in our forum (Version 2.0.6) two members just had a weird experience. They see words linked to some kind of contextual advertizing-thing and - understandably - have complained about that.

Strange thing is: I never voluntarily implemented any ad-tool or mod. And I would not want anything like that on my forum.
So when the first member complained I had a look at the posting - I saw nothing. I checked the source code - again nothing. I checked the posting in IE 8 and Firefox 25.0.1 and saw nothing.
So I suggested that she should scan her computer for ad-/malware, because I "knew" that our forum doesn't have ads.

But now a second member came up with the same posting and even the same word linking to an advertisement. Well, that would be a coincidence, wouldn't it?

I do believe in coincidence :) but this kind of makes me think twice. I just don't feel comfortable with pointing at users, saying: "The problem is on your side." I gotta do something.
So, in order to pinpoint the problem, my question would be: Is any of these installed and active mods known to cause ad-issues?

Optimus Brave 1.8.5
Pretty URLs    1.0    
SimplePortal    2.3.5
Ohara YouTube Embed    1.0
Bad Behavior mod    1.5.13
Similar Topics    0.3
SMF4iPhone-Mod    1.1
Mobile Device Detect    0.2.2
SimplePortal - German    2.3.5
SimplePortal - German Informal    2.3.5
dQuoteSelection    2.5 b2

Just asking for a quick look (maybe somebody says: "Yeah, that's the one!") and I certainly will keep on searching myself.

Anyone an idea?

Thanks!

Arantor

None of those should be causing ads.

I would wonder if your host is adding the ads in - this is not unheard of, especially if it's a free host.

K-Forum

Thank you Arantor,
wouldn't I see these ads as well? I don't see anything even with adblock and ghostery turned off...
Would firebug show these kind of ads?
[Edit: and my host is much too expensive]

Chalky

It's also possible that it could be malware on their local machines, especially if it's only affecting two of your users.

Arantor

It's difficult to say. I'm just trying to eliminate possible options.

There are four ways this sort of thing can happen - mods (which we seem to have eliminated), the host splicing ads in, or your files have been compromised and some nastiness is adding them in, or lastly your users have malware.

margarett

Or a browser add-on that specifically adds that.
Can they print screen the issue? If that is one if those word-link popup with contextual links, there isn't such thing for SMF but a browser add-on can maybe provide it..
Se forem conduzir, não bebam. Se forem beber... CHAMEM-ME!!!! :D

QuoteOver 90% of all computer problems can be traced back to the interface between the keyboard and the chair

K-Forum

Thanks!
Well, maybe you want to have a look? I just can't reproduce it myself...

This is the posting. And it should be the word "Plattenspieler" (which, to you, means "record player" :) )
http://www.georgkreisler.net/allgemeines/witz-des-tages/msg21061/#msg21061

Is the Plattenspieler linking to anything?

margarett

No, no link at all.

As I've told you, there is no way (that I know of) to do that intentionally in SMF. I recall some MOD requests for something like that. The browser recognizes the word and link it to something.

It's clearly something on their side. Ask them a printscreen. And ask them to try in a different computer/browser.
Se forem conduzir, não bebam. Se forem beber... CHAMEM-ME!!!! :D

QuoteOver 90% of all computer problems can be traced back to the interface between the keyboard and the chair

K-Forum

#8
Thank you for having a look, margarett! And I did.
So I think we have eliminated the provider-option. I wasn't 100% sure about that one.

[edit: Still curious how this can happen. So I will try to find a way to help my users. Can maybe one or two others have a look and post their result for confirmation?]
Thanks for your support!

kat

Are these members using ads everywhere Google Chrome?

If so, do they have an extension called "Auto Refresh Plus"?

If they do, my betting is that it's that.

It's adware, as are a number of Chrome's extensions...

a10

Had a look from here (Norway), no strange ads\links, FF & IE.
2.0.19, php 8.0.23, MariaDB 10.5.15. Mods: Contact Page, Like Posts, Responsive Curve, Search Focus Dropdown, Add Join Date to Post.

K-Forum

Thanks for your replies, K@ and a10gf

@K@: Afaik it was not chrome but firefox.

kat

Ah. Well, it was worth considering.

I wonder, though. Do any Firefox addons do the same thing?

After all, Mozilla's main source of funding comes from Google...

K-Forum

#13
Yes and "hmm", it's still puzzling me.

I just quoted a quotation in my forum, switched the wysiwyg-editor to kindasource-code and detected an image-tag that doesn't look familiar to me.
And it's right after the "Plattenspieler":

It looks like this:
Aber schön zu hören, daß es noch Leute mit Plattenspieler[img height=10 width=10]http://www.georgkreisler.net/file:///C:\Users\xxx\AppData\Local\Temp\msohtml1\01\clip_image002.gif[/img] gibt.

As far as I can see it appears here for the first time, in a quote (this member complained first), but it cannot be found in the original posting, where she saw an ad.

Member two sees an ad in a quotation of member one.
[quote author=Burkhard link=topic=865.msg21061#msg21061 date=1203377324]Aber schön zu hören, daß es noch Leute mit Plattenspieler gibt.[/quote]
This code is clean again. But he sees an ad there.


It's no path on my local machine. So what could that mean?

[Edit: Eradicated Name in Path. Privacy, and it's not necessary.]

kat

As you allow guests to post, I quoted Burkhard's post, too. I'm not getting anything weird, at all.

So, I have to suspect that the person who's quoting has something nasty on his computer.

Maybe he ought to visit this place:

http://www.trendmicro.co.uk/campaigns/housecall/index_a.html

K-Forum

#15
Thank you, Cat!
And feel free to post something, if you want. I don't mind getting test-postings if it serves a purpose. It's an open forum.

And as the story continues to continue, I have to say, I really appreciate the support I get from here. I always did and I do now. Thanks a bunch for the hard work and the service that all of you provide here. And - let it be an issue that my users have - I feel even more grateful for you helping me to help them. I do not take that for granted.

So in short terms it's "thanks" I guess.

kat

Glad to be of service, my old china! :)

Let us know how it goes, woncha?



K-Forum

'kay, here we go:

Remember the strange local path above? (Of course you do.) It is not strange at all!

Later in the evening (me nuts as nuts can be) it became clear to me, that she hadn't quoted like good quoters quote. She had, of course, copied the sentence from her browser and pasted it. And with it she copied and pasted the local path of an image that the malware on her machine wants to show with its link.

Now we've got a path and an image. That should help us to get rid of her malware. And this local path made sure, that it can not be a smf-issue.

Interesting though, that a Firefox-User and a Mac-Safari-User come up with ads in the same Word ("Plattenspieler") at the same time...

Advertisement: