In which a group of graying eternal amateurs discuss their passions, interests and obsessions, among them: movies, art, politics, evolutionary biology, taxes, writing, computers, these kids these days, and lousy educations.

E-Mail Donald
Demographer, recovering sociologist, and arts buff

E-Mail Fenster
College administrator and arts buff

E-Mail Francis
Architectural historian and arts buff

E-Mail Friedrich
Entrepreneur and arts buff
E-Mail Michael
Media flunky and arts buff

We assume it's OK to quote emailers by name.

Try Advanced Search

  1. Seattle Squeeze: New Urban Living
  2. Checking In
  3. Ben Aronson's Representational Abstractions
  4. Rock is ... Forever?
  5. We Need the Arts: A Sob Story
  6. Form Following (Commercial) Function
  7. Two Humorous Items from the Financial Crisis
  8. Ken Auster of the Kute Kaptions
  9. What Might Representational Painters Paint?
  10. In The Times ...

Sasha Castel
AC Douglas
Out of Lascaux
The Ambler
Modern Art Notes
Cranky Professor
Mike Snider on Poetry
Silliman on Poetry
Felix Salmon
Polly Frost
Polly and Ray's Forum
Stumbling Tongue
Brian's Culture Blog
Banana Oil
Scourge of Modernism
Visible Darkness
Thomas Hobbs
Blog Lodge
Leibman Theory
Goliard Dream
Third Level Digression
Here Inside
My Stupid Dog
W.J. Duquette

Politics, Education, and Economics Blogs
Andrew Sullivan
The Corner at National Review
Steve Sailer
Joanne Jacobs
Natalie Solent
A Libertarian Parent in the Countryside
Rational Parenting
Colby Cosh
View from the Right
Pejman Pundit
God of the Machine
One Good Turn
Liberty Log
Daily Pundit
Catallaxy Files
Greatest Jeneration
Glenn Frazier
Jane Galt
Jim Miller
Limbic Nutrition
Innocents Abroad
Chicago Boyz
James Lileks
Cybrarian at Large
Hello Bloggy!
Setting the World to Rights
Travelling Shoes

Redwood Dragon
The Invisible Hand
Daze Reader
Lynn Sislo
The Fat Guy
Jon Walz


Our Last 50 Referrers

« Great Titles | Main | "Point Blank" »

July 13, 2005

Computer Help Wanted

Can someone with some geek competence help me out? A few minutes ago, something strange started happening with the blog. Every new occurrence of the word "book" started being captured by some gremlin or other, which turned the word into a link. (Oddly, it doesn't seem to happen when the word is encased in quote marks.)

Watch this: book, book, book.

I didn't make any of those "book"s into a link. Some bit of evil software did.

I don't think the gremlin inhabits my own computer. The out-of-nowhere links first appeared on a comment that MissGrundy left on my posting about Westerns -- how can that have happened via my computer? So: Is the infected party perhaps my webhost?

Any hunches and/or tips would be much appreciated.

posted by Michael at July 13, 2005


I don't know, but I'm not hanging around long enough to catch whatever you have!

Just typing book to see if it still does it for you.

Posted by: susan on July 13, 2005 4:45 PM

There it is!

Come to think of it, are the evil links appearing on anyone else's screen? Or am I the only person seeing them?

A thought that hadn't occurred to me before ....

Posted by: Michael Blowhard on July 13, 2005 4:48 PM

The book links are indeed appearing on my screen, and they link to this page:

My firewall's down, so I'm not going there.

Posted by: Brian on July 13, 2005 5:41 PM

I see them in your post, but not in susan's comment.

Who's your host? Don't they have a help department?


Posted by: john massengale on July 13, 2005 5:42 PM

no link for me in my comment either

perhaps relevant: I have Mac OS 10.4.1

Posted by: john massengale on July 13, 2005 5:44 PM

Yes, I suppose it would have immediately helped if I told you that I didn't see a link from the b-word on my computer either. In the comment anyway; but I do see it in your post. I have Win XP, IE.

Posted by: susan on July 13, 2005 6:18 PM

I've never seen anything like that. But, here's my guess:

There was some sort of security hole in your blog software or elsewhere on your system.

Someone has an automated program that looks for such holes. When it finds them, it modifies your MovableType to point certain keywords at their site. Much more GoogleJuice than they'd get from just linkspamming. In essence, they're getting you to spam Google for them. I bet there are other words than book that will become links...

What should you do?

1) Contact your webhost immediately
2) Find what files have been modified and fix them
3) Upgrade to the latest versions of everything you run on your site.

In the longer term, you should upgrade your blog hosting software to WordPress...

Posted by: Dan G on July 13, 2005 6:43 PM

My favorite chicken joke:

A chicken walks into the library. It goes up to the circulation desk and says, “Book, book, book, boook.”

The librarian hands the chicken a book. It tucks it under his wing and runs out. A while later, the chicken runs back in, throws the first book into the return bin and goes back to the librarian saying, “Book, book, book, book, boook.” Again the librarian gives the chicken a book, and the chicken runs out. The librarian shakes her head in dismay.

Within a few minutes, the chicken is back, returns the book and starts all over again: “Book, book, book, book, boook.” The librarian gives him yet a third book, but this time, as the chicken is running out the door, she follows it.

The chicken runs down the street, through the park and down to the riverbank. There, sitting on a lily pad is a big green frog. The chicken holds up the book and shows it to the frog, saying, “Book, book, book, boook.” The frog blinks and croaks, saying, “Read-it, read-it, read-it.”


Posted by: Seachie on July 13, 2005 10:58 PM

It's clearly a virus of some kind, probably infecting your MT software. The easiest solution is to search for any plugins you didn't install yourself. If there aren't any, immediately replace the core MT files (not the template, obviously) with a fresh download from SixApart.

The other option is that you have some kind of a virus on your own computer that's inserting the link, but that would be hard to believe if you enter your posts into MT directly as pure text.

As for how the thing got there, hoo boy...

Posted by: Kyle on July 14, 2005 10:12 AM resolves to:

07/14/05 12:52:55 IP block
Trying at ARIN
Trying 67.15.154 at ARIN

OrgName: Everyones Internet, Inc.
Address: 390 Benmar
Address: Suite 200
City: Houston
StateProv: TX
PostalCode: 77060
Country: US

NetRange: -
NetName: EVRY-BLK-15
NetHandle: NET-67-15-0-0-1
Parent: NET-67-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.EV1.NET
NameServer: NS2.EV1.NET
RegDate: 2004-02-06
Updated: 2005-07-01

TechHandle: RW172-ARIN
TechName: Williams, Randy
TechPhone: +1-713-579-2850

OrgAbuseHandle: ABUSE477-ARIN
OrgAbuseName: ABUSE
OrgAbusePhone: +1-713-579-2850

OrgNOCHandle: NOC1445-ARIN
OrgNOCPhone: +1-713-579-2850

OrgTechHandle: RW172-ARIN
OrgTechName: Williams, Randy
OrgTechPhone: +1-713-579-2850

OrgTechHandle: VST3-ARIN
OrgTechName: Stinson, Valarie
OrgTechPhone: +1-713-579-2850

# ARIN WHOIS database, last updated 2005-07-13 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

Posted by: Bill on July 14, 2005 1:01 PM

Thanks to all for tips. Action is being taken!

Posted by: Michael Blowhard on July 14, 2005 9:44 PM

I think we should all just start referring to "b**ks" as "codex/codices" just for the hell of it. Fat chance of any spammers ever figuring that out either.

Posted by: . on July 16, 2005 4:24 AM

I've have that trouble too. I found a CMAPP folder in my Program Files directory. In this folder is a Client subdirectory with an uninstall program in it. That seems to sort out the problem.

Posted by: sparks on July 22, 2005 11:36 PM

Same thing is happening here, but it's not with the word "the"...

FOund the CMAPP file, I'm going to uninstall now, thanks for the tip

Posted by: Molitor on August 1, 2005 5:10 PM

Looks like your server is running php that hasn't been patched yet. I run a hosting service that offers absolutely everyting. If you need to change webhosts, get ahold of me. We have excellent service and support and a great selection of one-click installable programs. Pretty awesome stuff.


Posted by: Full Service Hosts on August 2, 2005 3:48 PM


I've seen the same problem with the word 'the'. This does not have it, but on the machine that did have, it would place links on all occurrences of 'the'. Same IP address in the link.
Came to this site when trying to find a fix for it. I'll keep looking...
If someone finds a fix email me will ya'

Posted by: SameProblem on August 3, 2005 9:30 AM

Same thing happened to me, so I found and deleted CMAPPS directory. This is the result of a trojan I downloaded embedded in a Windows Keygen. Delete the keygen if you have it before deleting the CMAPPs directory.

Posted by: Robert on August 6, 2005 12:35 PM

how do I know which keygen it is...I have several.

Posted by: Jennifer on August 10, 2005 9:26 AM

Post a comment

Email Address:



Remember your info?