Hacked, or what? [Solved]

Hi there
Perhaps you can redirect me to wherever this might be addressed.
I run a site for a dulcimer club. The club president reports as follows—-

When I clicked on the Big Green Button for the E-mail List, I found 2011 and 2012 to be in blue and underlined so I clicked on them to find out what's what. Up popped ads for Awesome Penny Stocks!

I went back to the web page and found that if I hovered my mouse over 2011 I get the pop-up that says Powered by Text Enhance. Join the web's #1 free stock newsletter today. When I hovered it over the 2012 got a different one saying something about answering 1 question and claiming an iPad2. Hit refresh and the same pop-ups came up, but in different places.



Page in question is http://www.cranberrygathering.com/emaillist.html


I don't see any such shenanigans when I look at it from my computer, and, of course, I did not put them there.

Wot's this, then?

Denno

Hmm. More i think about this, seems logical it is one the one person's computer. If it were on the server version, I'd see it. So either she got hacked personally, or there is a malware that inserts ad links when you view a website. Problems with the latter argument, why only in the one place? Anyhow, y'all know of such a malware? She's going to run a Malwarebytes scan and see if anything shows up.

Hi and Welcome!! My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  
• Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Watch Topic button to the right of your topic title and then choosing the notification method ( Recommended: Inmediate Notification)
  
• The fixes are specific to your problem and should only be used for the issues on this machine.
  
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  
• It's often worth reading through these instructions and printing them for ease of reference.
  
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  
• Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———-

Please download DDS from one of the following links and save it to your desktop.

• • DDS.scr
  • DDS.pif
• Disable any script blocking protection (How to Disable your Security Programs)
• Double click DDS icon to run the tool (may take up to 3 minutes to run)
• When done, DDS.txt will open.
• After a few moments, attach.txt will open in a second window.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

———-

Please download aswMBR to your desktop.

• Double click the aswMBR icon to run it.
  Vista and Windows 7 users right click the icon and choose "Run as administrator".
• Click the Scan button to start scan.
• When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

In your next reply please post both of the logs created by DDS and the log created by aswMBR.exe.

Hi Jeff The problem is not on my computer, as specified in my first post. I have forwarded the link to this thread to the person who's seeing the anomaly. Perhaps she will ring in and you can help her. As a general question, is there such an invasive program as would make one see links in a viewed site? Thanks, Denno

As a general question, is there such an invasive program as would make one see links in a viewed site?

The types of malware that is our there varies greatly and unfortunately is really only limited to the creativity of the one writing the malware.

If your friend finds that there is help needed they are more than welcome to start their own topic and they can receive help here.

Thanks

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.