In which a group of graying eternal amateurs discuss their passions, interests and obsessions, among them: movies, art, politics, evolutionary biology, taxes, writing, computers, these kids these days, and lousy educations.

E-Mail Donald
Demographer, recovering sociologist, and arts buff

E-Mail Fenster
College administrator and arts buff

E-Mail Francis
Architectural historian and arts buff

E-Mail Friedrich
Entrepreneur and arts buff
E-Mail Michael
Media flunky and arts buff


We assume it's OK to quote emailers by name.







Try Advanced Search



  1. Another Technical Note
  2. La Ligne Maginot
  3. Actress Notes
  4. Technical Day
  5. Peripheral Explanation
  6. More Immigration Links
  7. Another Graphic Detournement
  8. Peripheral Artists (5): Mikhail Vrubel
  9. Illegal Update


CultureBlogs
Sasha Castel
AC Douglas
Out of Lascaux
The Ambler
PhilosoBlog
Modern Art Notes
Cranky Professor
Mike Snider on Poetry
Silliman on Poetry
Felix Salmon
Gregdotorg
BookSlut
Polly Frost
Polly and Ray's Forum
Cronaca
Plep
Stumbling Tongue
Brian's Culture Blog
Banana Oil
Scourge of Modernism
Visible Darkness
Seablogger
Thomas Hobbs
Blog Lodge
Leibman Theory
Goliard Dream
Third Level Digression
Here Inside
My Stupid Dog
W.J. Duquette


Politics, Education, and Economics Blogs
Andrew Sullivan
The Corner at National Review
Steve Sailer
Samizdata
Junius
Joanne Jacobs
CalPundit
Natalie Solent
A Libertarian Parent in the Countryside
Rational Parenting
Public Interest.co.uk
Colby Cosh
View from the Right
Pejman Pundit
Spleenville
God of the Machine
One Good Turn
CinderellaBloggerfella
Liberty Log
Daily Pundit
InstaPundit
MindFloss
Catallaxy Files
Greatest Jeneration
Glenn Frazier
Jane Galt
Jim Miller
Limbic Nutrition
Innocents Abroad
Chicago Boyz
James Lileks
Cybrarian at Large
Hello Bloggy!
Setting the World to Rights
Travelling Shoes


Miscellaneous
Redwood Dragon
IMAO
The Invisible Hand
ScrappleFace
Daze Reader
Lynn Sislo
The Fat Guy
Jon Walz

Links


Our Last 50 Referrers







« Great Titles | Main | "Point Blank" »

July 13, 2005

Computer Help Wanted

Can someone with some geek competence help me out? A few minutes ago, something strange started happening with the blog. Every new occurrence of the word "book" started being captured by some gremlin or other, which turned the word into a link. (Oddly, it doesn't seem to happen when the word is encased in quote marks.)

Watch this: book, book, book.

I didn't make any of those "book"s into a link. Some bit of evil software did.

I don't think the gremlin inhabits my own computer. The out-of-nowhere links first appeared on a comment that MissGrundy left on my posting about Westerns -- how can that have happened via my computer? So: Is the infected party perhaps my webhost?

Any hunches and/or tips would be much appreciated.

posted by Michael at July 13, 2005




Comments

I don't know, but I'm not hanging around long enough to catch whatever you have!

Just typing book to see if it still does it for you.

Posted by: susan on July 13, 2005 04:45 PM



There it is!

Come to think of it, are the evil links appearing on anyone else's screen? Or am I the only person seeing them?

A thought that hadn't occurred to me before ....

Posted by: Michael Blowhard on July 13, 2005 04:48 PM



The book links are indeed appearing on my screen, and they link to this page:

http://67.15.154.58/cmapp/zx-hclick.php?hid=1

My firewall's down, so I'm not going there.

Posted by: Brian on July 13, 2005 05:41 PM



I see them in your post, but not in susan's comment.

Who's your host? Don't they have a help department?

book

Posted by: john massengale on July 13, 2005 05:42 PM



no link for me in my comment either

perhaps relevant: I have Mac OS 10.4.1

Posted by: john massengale on July 13, 2005 05:44 PM



Yes, I suppose it would have immediately helped if I told you that I didn't see a link from the b-word on my computer either. In the comment anyway; but I do see it in your post. I have Win XP, IE.

Posted by: susan on July 13, 2005 06:18 PM



I've never seen anything like that. But, here's my guess:

There was some sort of security hole in your blog software or elsewhere on your system.

Someone has an automated program that looks for such holes. When it finds them, it modifies your MovableType to point certain keywords at their site. Much more GoogleJuice than they'd get from just linkspamming. In essence, they're getting you to spam Google for them. I bet there are other words than book that will become links...

What should you do?

1) Contact your webhost immediately
2) Find what files have been modified and fix them
3) Upgrade to the latest versions of everything you run on your site.

In the longer term, you should upgrade your blog hosting software to WordPress...

Posted by: Dan G on July 13, 2005 06:43 PM



My favorite chicken joke:

A chicken walks into the library. It goes up to the circulation desk and says, “Book, book, book, boook.”

The librarian hands the chicken a book. It tucks it under his wing and runs out. A while later, the chicken runs back in, throws the first book into the return bin and goes back to the librarian saying, “Book, book, book, book, boook.” Again the librarian gives the chicken a book, and the chicken runs out. The librarian shakes her head in dismay.

Within a few minutes, the chicken is back, returns the book and starts all over again: “Book, book, book, book, boook.” The librarian gives him yet a third book, but this time, as the chicken is running out the door, she follows it.

The chicken runs down the street, through the park and down to the riverbank. There, sitting on a lily pad is a big green frog. The chicken holds up the book and shows it to the frog, saying, “Book, book, book, boook.” The frog blinks and croaks, saying, “Read-it, read-it, read-it.”

Ba-da-bum

Posted by: Seachie on July 13, 2005 10:58 PM



It's clearly a virus of some kind, probably infecting your MT software. The easiest solution is to search for any plugins you didn't install yourself. If there aren't any, immediately replace the core MT files (not the template, obviously) with a fresh download from SixApart.

The other option is that you have some kind of a virus on your own computer that's inserting the link, but that would be hard to believe if you enter your posts into MT directly as pure text.

As for how the thing got there, hoo boy...

Posted by: Kyle on July 14, 2005 10:12 AM



67.15.154.58 resolves to:

07/14/05 12:52:55 IP block 67.15.154.58
Trying 67.15.154.58 at ARIN
Trying 67.15.154 at ARIN

OrgName: Everyones Internet, Inc.
OrgID: EVRY
Address: 390 Benmar
Address: Suite 200
City: Houston
StateProv: TX
PostalCode: 77060
Country: US

NetRange: 67.15.0.0 - 67.15.239.255
CIDR: 67.15.0.0/17, 67.15.128.0/18, 67.15.192.0/19, 67.15.224.0/20
NetName: EVRY-BLK-15
NetHandle: NET-67-15-0-0-1
Parent: NET-67-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.EV1.NET
NameServer: NS2.EV1.NET
Comment:
RegDate: 2004-02-06
Updated: 2005-07-01

TechHandle: RW172-ARIN
TechName: Williams, Randy
TechPhone: +1-713-579-2850
TechEmail: admin@ev1.net

OrgAbuseHandle: ABUSE477-ARIN
OrgAbuseName: ABUSE
OrgAbusePhone: +1-713-579-2850
OrgAbuseEmail: abuse@ev1.net

OrgNOCHandle: NOC1445-ARIN
OrgNOCName: NOC
OrgNOCPhone: +1-713-579-2850
OrgNOCEmail: noc@ev1.net

OrgTechHandle: RW172-ARIN
OrgTechName: Williams, Randy
OrgTechPhone: +1-713-579-2850
OrgTechEmail: admin@ev1.net

OrgTechHandle: VST3-ARIN
OrgTechName: Stinson, Valarie
OrgTechPhone: +1-713-579-2850
OrgTechEmail: admin2@ev1.net

# ARIN WHOIS database, last updated 2005-07-13 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

Posted by: Bill on July 14, 2005 01:01 PM



Thanks to all for tips. Action is being taken!

Posted by: Michael Blowhard on July 14, 2005 09:44 PM



I think we should all just start referring to "b**ks" as "codex/codices" just for the hell of it. Fat chance of any spammers ever figuring that out either.

Posted by: . on July 16, 2005 04:24 AM



I've have that trouble too. I found a CMAPP folder in my Program Files directory. In this folder is a Client subdirectory with an uninstall program in it. That seems to sort out the problem.

Posted by: sparks on July 22, 2005 11:36 PM



Same thing is happening here, but it's not with the word "the"...

FOund the CMAPP file, I'm going to uninstall now, thanks for the tip

Posted by: Molitor on August 1, 2005 05:10 PM



Looks like your server is running php that hasn't been patched yet. I run a hosting service that offers absolutely everyting. If you need to change webhosts, get ahold of me. We have excellent service and support and a great selection of one-click installable programs. Pretty awesome stuff.

Cordially,
FullServiceHosts.com

Posted by: Full Service Hosts on August 2, 2005 03:48 PM



Hi,

I've seen the same problem with the word 'the'. This does not have it, but on the machine that did have, it would place links on all occurrences of 'the'. Same IP address in the link.
Came to this site when trying to find a fix for it. I'll keep looking...
If someone finds a fix email me will ya'

Posted by: SameProblem on August 3, 2005 09:30 AM



Same thing happened to me, so I found and deleted CMAPPS directory. This is the result of a trojan I downloaded embedded in a Windows Keygen. Delete the keygen if you have it before deleting the CMAPPs directory.

Posted by: Robert on August 6, 2005 12:35 PM



how do I know which keygen it is...I have several.

Posted by: Jennifer on August 10, 2005 09:26 AM






Post a comment
Name:


Email Address:


URL:


Comments:



Remember your info?