[Dynamoo]

This is a strange sort of site to use as an example - but look at http://www.transplantfortammie.com/ - almost at the bottom.

There's a TopText link actually in the page itself. It's there no matter how I look at it, in IE, NS4 and even the DOS-based Lynx browser.

Is this a case of a parasite somehow infected a web editor? Or is there a simpler explanation?

________
Please leave my port 137 alone.

[Haiko de Poel, Jr.]

Moo,

I'd assume so since it is hard coded into the html http://abw.infopop.cc/infopop/emoticons/icon_confused.gif

<font size="2" face="Verdana">Haiko


The secret of success is constancy of purpose. ~ Disraeli</font></p>

[pricezilla]

If someone was infected with Ezula/Toptext and viewed a page, then saved that page, or a selection from that page, could that cause this?

Very strange.

[Haiko de Poel, Jr.]

Good hypothesis Pricezilla! That could be it!

<font size="2" face="Verdana">Haiko


The secret of success is constancy of purpose. ~ Disraeli</font></p>

[cumbrowski]

It looks like a copy and paste from the yahoo directory from somebody who has eZula installed.

The Page source looks like a MS Frontpage or MS Word generated Page, no wonder...

Carsten

Shop-Links.net Partner
http://www.shop-links.net
Sign-up for our Affiliate Program
http://www.shareasale.com/shareasale.cfm?merchantID=2123

If you can't move things, try harder!

[parentsworld]

<BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR>Originally posted by PriceZilla.com:
If someone was infected with Ezula/Toptext and viewed a page, then saved that page, or a selection from that page, could that cause this?

Very strange.<HR></BLOCKQUOTE>

That'd be my guess too. Looking at the code the top lines are:

< !DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" >
< !-- saved from url=[0031)http://transplantfortammie.com/ -- >
< HTML >< HEAD >< TITLE >Kidney Transplant For Tammie< /TITLE >

A wishbone has never taken place of a backbone.

[Dynamoo]

I think I see it.. those Yahoo! links in the bottom are copied straight from the web page and pasted into that one.. they still have the Yahoo tracking code in. It must have copied-and-pasted the TopText code in too.

________
Please leave my port 137 alone.