Links in browser underlined in green; re-directed to 'Sponsored Link'

This may help you http://www.woodworkersworkshop.com/idc/en-us/dept_52.html

It seems to occur on any website, as I stated above, including this one. There are usually 1-3 underlined links per page. In fact, in my first post above, the word 'website' is underlined. When I mouse-over it, I get the following:

'Sponsored Link
Quickly Earn a Web Developer Certificate

Aspen University's 8-week, 18-credit Web Developer Certificate program offers hands-on classroom training and flexability to study from home or while you travel: $5,900. Financing available.

www.traininghott.com'

The text is always different, along with a different link.

My HijackThis log file follows:

Logfile of HijackThis v1.97.7
Scan saved at 7:51:09 PM, on 5/15/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\ati2plab.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\tp4mon.exe
C:\WINNT\system32\Atiptaxx.exe
C:\WINNT\system32\ltcm000c.exe
C:\WINNT\system32\Promon.exe
C:\DOCUME~1\nick\MYDOCU~1\PROGRAMS\ZONEAL~1\zlclient.exe
C:\Program Files\Enigma Software Group\SpyHunter\PopupBlocker\EnigmaPopupStop.exe
C:\Documents and Settings\nick\Programs\Pulse\Pulse.exe
C:\WINNT\wt\updater\wcmdmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Documents and Settings\nick\My Documents\Programs\Post-It\PsnLite.exe
C:\DOCUME~1\nick\MYDOCU~1\Programs\Post-It\PSNGive.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Netscape\Communicator\Program\netscape.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\unzipped\hijackthis1977\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.runescape.com/aff/runescape/serverlist.cgi?plugin=0&lores.x=50&lores.y=42
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.yahoo.com/"); (C:\Program Files\Netscape\Users\maverick22489\prefs.js)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [XircWinModem4] ltcm000c.exe 9
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [tourpath] regedit /s c:\winnt\tour.reg
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [EnigmaPopupStop] C:\Program Files\Enigma Software Group\SpyHunter\PopupBlocker\EnigmaPopupStop.exe
O4 - HKLM\..\Run: [wcmdmgr] C:\WINNT\wt\updater\wcmdmgrl.exe -launch
O4 - HKCU\..\Run: [Pulse] C:\Documents and Settings\nick\Programs\Pulse\Pulse.exe -splash
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Global Startup: officejet 6100.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Documents and Settings\nick\My Documents\Programs\Post-It\PsnLite.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O16 - DPF: {65E7DB1D-0101-4100-BD66-C5C78C917F93} (WTDMMPVersion Class) - http://install.wildtangent.com/bgn/partners/aolim/install.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37979.496400463
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/bgn/partners/shockwave/orbital/install.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Cleaning your computer  - and protecting it in the future -  can't be answered with one issue.

As you can see in my url below there are at least 7 different issues, where you should decide 1 of each, or else you does'nt protect your computer at all.

The reason is, that the many different programs not always protects against each other, and each of them does'nt protect equally.

It's very important, that you study all of these issues in my knowledgebase (some of them are freeware):
http://www.tryware.dk/English/Knowledgebase/HowToProtectYourComputer.html

BTW: I'm using the Trend Micro virus-suite, and SoftScan , and haven't got any of my servers or computers infected since 1999.

Many Regards
Jorgen Malmgren
IT-Supervisor
Denmark

:o) Your brain is like a parachute. It works best when it's open

How to remove spyware wildtangent
http://www.pestpatrol.com/PestInfo/w/wildtangent.asp#Detection%20and%20Removal

Hi!

As well as "Wildtangent", you have a few more things that need to be dealt with.
You should probably start by removing wildtangent first - as much as you can without rebooting.
After you've taken the steps to remove wildtangent -
Using Taskmanager, stop this process - pulse.exe (pulse is part of Flooder.MSN.VB.w)
Delete this folder: C:\Documents and Settings\nick\Programs\Pulse
And do a search for any instances of the following:
pulse.exe
pulse.swf
If you find any, delete them as well.

This next entry is a candidate for removal:
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
Have HijackThis fix it.
And this one as well:
O4 - HKCU\..\Run: [Pulse] C:\Documents and Settings\nick\Programs\Pulse\Pulse.exe -splash
Have HJT fix the next two:
O16 - DPF: {65E7DB1D-0101-4100-BD66-C5C78C917F93} (WTDMMPVersion Class) - http://install.wildtangent.com/bgn/partners/aolim/install.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

Also, delete the folder: C:\Program Files\Viewpoint

The next 2 entries, while they are not really considered "bad" - are known resource hogs, having HijackThis
fix them will not affect the functionality of the programs - user's choice:
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

When you have fixed everything that you want -
Clean out ALL of your "temp" files, including those located in all Profiles within "Documents and Settings", delete
your "Temporary Internet Files" and cookies, empty your recycle bin, and reboot your computer into "Safe Mode".
While in safe mode make sure, "Show all files", including "Hidden" and "System" is turned on.
Search your computer for any left-over instances of wildtangent, pulse.exe, ViewMgr.exe, etc.,
and delete them.
It's probably a good idea to search the registry for any instances of the progams you have fixed -
paying particular attention to the various, "Run" keys (Run ,RunOnce, RunServices, etc.).
Clean out your "temp" files, empty your recycle bin, and reboot the computer into "Normal" mode.
With all browser windows closed, run HijackThis and post a new log-file here - we'll take a look at it.
Any questions - let us know.
Good luck!

I didn't uninstall Pulse; I think you must be mistaken about its origin and/or intent. It's a simple keystroke-counter (not logger) program that I use. You can find more information at http://www.project-dolphin.nl. And besides, I installed Pulse long before any of these problems cropped up.

I was also reluctant to delete WildTangent, due to the fact that I use it to play games online. I suppose I can always re-install it if need be, though, so I went ahead and got rid of it.

I did everything else you suggested, and it only seems to have aggravated the problem ;-)

Now, along with 'website', the word 'Web' in my first post is underlined and linked.

Here is my latest HijackThis logfile:

Logfile of HijackThis v1.97.7
Scan saved at 5:11:09 PM, on 5/16/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\ati2plab.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\tp4mon.exe
C:\WINNT\system32\Atiptaxx.exe
C:\WINNT\system32\ltcm000c.exe
C:\WINNT\system32\Promon.exe
C:\DOCUME~1\nick\MYDOCU~1\PROGRAMS\ZONEAL~1\zlclient.exe
C:\Program Files\Enigma Software Group\SpyHunter\PopupBlocker\EnigmaPopupStop.exe
C:\Documents and Settings\nick\Programs\Pulse\Pulse.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Documents and Settings\nick\My Documents\Programs\Post-It\PsnLite.exe
C:\DOCUME~1\nick\MYDOCU~1\Programs\Post-It\PSNGive.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINNT\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\unzipped\hijackthis1977\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.runescape.com/aff/runescape/serverlist.cgi?plugin=0&lores.x=50&lores.y=42
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.yahoo.com/"); (C:\Program Files\Netscape\Users\maverick22489\prefs.js)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [XircWinModem4] ltcm000c.exe 9
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [tourpath] regedit /s c:\winnt\tour.reg
O4 - HKLM\..\Run: [EnigmaPopupStop] C:\Program Files\Enigma Software Group\SpyHunter\PopupBlocker\EnigmaPopupStop.exe
O4 - HKCU\..\Run: [Pulse] C:\Documents and Settings\nick\Programs\Pulse\Pulse.exe -splash
O4 - HKCU\..\Run: [DealHelperDown] "C:\Documents and Settings\nick\Local Settings\Temp\ms5.tmp"
O4 - Global Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Global Startup: officejet 6100.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Documents and Settings\nick\My Documents\Programs\Post-It\PsnLite.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37979.496400463
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Please reconsider:

Wildtangent  collects your first and last name, address, email address, phone number, and other information. Collects system configuration information such as your computer's CPU speed, video card configuration, and DirectX version. Collects product usage information such as the number of product launches and time spent using a product

Advertising: Yes. 'New product availability information or messages are transparently and unobtrusively transferred to your computer in the background, allowing you to review them later when you're off-line. You can access these product updates in the Game Channel folder of your start menu. When you install a product through a Message, your Start Menu shortcuts will be automatically updated. We collect the following information: Receipt of a message, Number of times a particular message is viewed and clicked on'

http://www.pestpatrol.com/PestInfo/w/wildtangent.asp#Risks

Alright, so you've convinced me about WildTangent. As I said, I've already deleted it. Can you help any further with the problem at hand?

Alright, now I'm fairly tech-competent, but I don't want to screw anything up, so can someone walk me through this in more detail?

I've got my hosts file open, but I'm not sure just [i]where[/i] to add the line.

There are a couple servers already listed, followed by

127.0.0.1       localhost

which is [i]not[/i] denoted with '#'.

Hi!
This is what Pest Patrol says about "pulse":
http://www.pestpatrol.com/PestInfo/f/flooder_msn_vb_w.asp
Just trying to help - what do you think?
Cheers and good luck!

Just add it below the localhost entry so the file looks like:
127.0.0.1  localhost
127.0.0.1  itxt.vibrantmedia.com

The # at the beginning of a line just means it's a comment.

Well, I still maintain that I am running a different 'Pulse'... Many of my friends, including IT pros, run it, and I've never heard of any flooding problems being experienced... I'll be sure and keep an eye on it, though.

I added the line, and the infuriating double-underlined green links are gone! Thanks once again for all your help!

Points to smallpygmy (=

Agh, I've got to reopen this problem... It's back!

My hosts file still contains the itxt line, but the underlined ads have returned...

Just on this page, for example, 'Spybot', 'Windows 2000', 'server', and 'video card' have all been turned into advertisements.

Is it as simple as adding another line to hosts? Or something more complicated?