VGLNK advertising

[Richard Wallace]

I am seeing them also, and on multiple computers. Can this be malware? Or is it advertising, as the OP says?

The symptom is one or more instances of a hyperlink that the poster apparently did not create, and that are not pertinent to the content of the post except in a trivial sense; i.e., the linked string also appears in the post title.

[Mark McLeod]

I've never seen those.
Would you take a screen shot the next time it happens, so we can see what you're describing?

[kjohnson]

Originally Posted by Mark McLeod

I've never seen those.
Would you take a screen shot the next time it happens, so we can see what you're describing?

I see the links in this thread: http://www.chiefdelphi.com/forums/sh...d.php?t=115358

The word "flashlight" links back to eBay and Amazon from multiple browsers on multiple PCs.

[Kusha]

Originally Posted by nukemknight

I see the links in this thread: http://www.chiefdelphi.com/forums/sh...d.php?t=115358

The word "flashlight" links back to eBay and Amazon from multiple browsers on multiple PCs.

Disabled adblock and I see it too.

[synth3tk]

Originally Posted by Kusha

Disabled adblock and I see it too.

Yup, same. Either we all have the same malware, or there is actually a forum plugin installed that's doing this.

Can we get an official word from a mod or admin?

[Racer26]

Using Chrome 26.0, I don't see them. No adblock installed (however, I AM behind my corporate firewall).

[Teamcodeorange]

After disabling AdBlock I don't see anything abnormal.

[engunneer]

Originally Posted by nukemknight

I see the links in this thread: http://www.chiefdelphi.com/forums/sh...d.php?t=115358

The word "flashlight" links back to eBay and Amazon from multiple browsers on multiple PCs.

the word flashlight in your post is even being turned into a link (ebay and amazon too, if you didn't link them, the forum did). Incidentally, I am not making them a link here either.

It must be a forum plugin. The source contains:

<script type="text/javascript" async="" src="//cdn.viglink.com/api/vglnk.js"></script>

So far I have not seen them in threads where you are linking into a post, but only in threads arrived by the main topic link.

[Racer26]

Originally Posted by engunneer

It must be a forum plugin. The source contains:

<script type="text/javascript" async="" src="//cdn.viglink.com/api/vglnk.js"></script>

So far I have not seen them in threads where you are linking into a post, but only in threads arrived by the main topic link.

Can't be so quick to be sure of this. Malware on your machine could be injecting that code.

Interesting. I see the js call to viglink.com in my source provided by the server, but I don't see the phantom links.

[Joe Ross]

Ghostery also blocks the links from showing up, but the source still shows the vglnk code.

[Racer26]

My office machine (where I am right now), is behind a Watchguard Firebox X, and runs TRENDmicro's antivirus software. Does not have Adblock Plus, Ghostery, or any other similar adware blocking stuff.

Remote desktop'ing to my server at home, which runs no antivirus, and sits behind a NAT only, I see the viglinks, (its Windows Server 2003 R2, running Chrome 25.0/26.0).

I think I've revised my theory to being that it IS a forum addon, but that it is blocked by some blocking software/hardware.

[synth3tk]

I'm on Chrome 26.0 now and having no issues accessing CD. Just the same old JS issues that have been present for a while now.

I wonder when they added this VIGLNK plugin?

[Mark McLeod]

I'm apparently immune.

I see nothing in the page source.

[Whippet]

Just started getting this a few minutes ago. It annoys me, since normally people hyperlink single words to show examples of what they're saying, so I click them. I hope this is not a permanent feature.

[Racer26]

I noticed from my remote desktop session that unlike the other hotlinking adwords I've seen before (which appeared in green and double underlined, clearly different from an ordinary hyperlink), these viglinks appear to be ordinary links, indistinguishable from ones intentionally added by the post maker. This is a PROBLEM.