is this a virus? unwanted ad program?

olias

My comp has recently started showing certain random words on all sorts of websites highlighted and underlined like links - when I hover my mouse over them a pop up appears for iphones. I have ran all my antivirus programs - avira, miscrosoft security essentials and malwarebites and its still happening - is this a virus, or some sort of adware I have inadvertently switched on? Anyone any ideas as to how I get rid of it? Thanks

Olias

waddler_8

What browser?

tonyh66

they are called skimlinks, websites and forums think they are a viable means of income (perhaps they are) I find them a right pain in the ar*e.

closed

the machine wont run very well with 2 resident antivirus programs (avira and mse)

waddler_8

Most likely text-enhance. As well as being used by websites, It can also install a browser extension when you install certain freeware.

olias

Hi, and thanks - it is mainly on forums (including this one!), so it may well be something they have. I use Firefox as a browser.
waddler 8 - is this something I can remove manually?
closed - I've never had any problem running both anti virus programs

Olias

waddler_8

Yes, it's something you could remove manually.

Download OTL by Old Timer from the link below and save it to your Desktop.

LINK

• Double click on OTL.exe to run it.
• Click the Quick Scan button.
• When it's finished , two Notepad files will open.
  • OTL.txt <-- Will be opened
  • Extras.txt <-- Will be minimized
• Please post the contents of OTL.txt in your next reply.

You may have to split the contents of the notepad file over multiple posts.

waddler_8

Oh, and closed is correct. At the very least you'll see a performance hit, as both scan files on-access - at worst the system will crash; BSoD. It may be at the time you need it most when that happens.

olias

Here you go - hope this helps.

FYI, I have also disabled and removed an add-on called Yontoo which related to text-enhancers, and I have also disallowed cookies from text-enhance and skimlinks, but the problem is still there...


Olias

olias

2nd half...


< End of report >

waddler_8

This is as likely a candidate as any:

[2012/07/22 20:32:23 | 000,216,359 | ---- | M] () (No name found) -- C:\Users\jason\AppData\Roaming\Mozilla\Firefox\Pro files\ss6orgtz.default\extensions\OneClickDownloader@OneClickDownloader.com.xpi