Featured Content Slider v2.5 and Adverting Links

[Trishah]

FYI: In the search results for "content slider" this script is mislabeled as Featured Content Slider v2.4 not v2.5.
________________

The following is a description of very odd behavior and I haven't been able to fully explain the behavior as I can not currently reproduce it myself.

What happens: On my client's website (PrincetonComputerTutor.com), when the Featured Content Slider v2.5 script is functioning, on his Win7 computer using FireFox browser, some words are made into advertising links (e.g., tutoring, phone, computer, etc.). The words becoming links change over time. This does not happen on Mac or in any other browsers on Win7 and in no browser on XP.

Okay, so now you are going to say he has malware on his computer... That was my first thought too, but here is why I'm not sure that is the case...

#1 His website also has these links when viewed from one of his client's computers but only on her Win7 with IE.

#2 When I was first developing his page, in WeBuilder Editor preview, I was also getting these links. But I changed one of the scripts I was using and I never saw them again. I've never seen them on his actual site even though I am using Win7 with FireFox.

#3 When I comment-out the Featured Content Slider v2.5 script, he does not see the links any more. When I let Featured Content Slider v2.5 function again, the links come back.

#4 We systematically removed all javascript from the page, the only thing that makes the links disappear is removing the Content Slider script.

#5 I've checked his site/server for malware - there is none.

#6 I even changed the ShareThis bar for an AddThis bar but that did nothing. Removing both of these scripts does not change the links.

My client is going to do some additional virus scans to see if he can find anything on his computer. But, I find it odd that removing this content slider would effect the links he sees on the website... If you have ANY thoughts on what could be going on, I'd greatly appreciate it!!

Trishah

[ajfmrf]

I use firefox 22.0 and have win7 too

could you post the url and I will see if I have any odd results

[Beverleyh]

My friend's mum had something similar - turned out to be a bit of adware/malware: http://botcrawl.com/how-to-remove-text-enhance/ which was fixed by running this malware tool: http://www.malwarebytes.org/lp/malwa...FSXItAodcWIAwg

I'm not saying that that's what it is for certain, but it's worth a shot. I don't know why it only seems to be affected by that one script though. I've used the Featured Content Glider a few times and have never seen it cause anything untoward. I would say that its most likely down to the computer rather than the website/script.

[Trishah]

could you post the url and I will see if I have any odd results

Thank you for taking the time to help...

princetoncomputertutor dot com

[Trishah]

My friend's mum had something similar - turned out to be a bit of adware/malware: http://botcrawl.com/how-to-remove-text-enhance/ which was fixed by running this malware tool: http://www.malwarebytes.org/lp/malwa...FSXItAodcWIAwg

Thank you for this. One of the first things he did was run malwarebytes. He's actually done it several times and it has no effect on the behavior.

I'm not saying that that's what it is for certain, but it's worth a shot. I don't know why it only seems to be affected by that one script though. I've used the Featured Content Glider a few times and have never seen it cause anything untoward. I would say that its most likely down to the computer rather than the website/script.

I also have used this slider several times and never experienced any problems. I have been using DynamicDrive scripts since the first website I charged for in 2003 so I really don't believe it's the script. I've also checked the script and can not see anything that would cause this problem. But the fact that #1 I saw these links during my early development of the site in my code editor preview and #2 the problem stops when I remove the script from the site, well, it just has me baffled!

The website in question is: princetoncomputertutor dot com There is a checkmark section in the black upper part of the page were the links usually show up. You can find screenshots in this folder

princetoncomputertutor dot com/graphics/ss/