Links missing from web page & source code

[Guest]

This is a recurrence of a problem I had before. Within certain pages of a
specific website, links do not show up--they don't show up on the web page,
and they don't show up when I try to "view source" (one specific page is
www.fly.faa.gov/ois -- the links are missing from the left-hand frame). In
addition. on the page http://www.fly.faa.gov/Products/products.html, the 1st
link (for advisories access database) is missing--all the other links show up.

I had received several suggestions from this forum before, that did not fix
the problem: These steps included uninstalling & reinstalling Java, and
running various Spywayre/Malware removal tools. I also posted a log to
Hijack This forum, but no problems were found.

Finally, I ran Spybot S&D (for the 4th time)--and this time, it did find a
'problem" that I fixed with Spybot. That problem was under "FCI" and it was
called
"H_KEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\CONNECT\UninstallString\"

The webpages in question "worked" until I used the "disk cleanup" function
of Windows XP--and now the problem is back. (The first time the problem
occurred was when I ran an IE Cache cleaning tool from my ISP, this tool is
located at http://support.cox.com/sdcxuser/asp/cox_main.asp)

I tried running all the spyware/malware tools a couple of times (especially
Spybot)--but again no problems are found. It seems like a coincidence that
the problem surfaced twice after running 2 very similar procedures. Does
anyone have any thoughts? I am running Windows XP SP2, and IE 6.0 PS2.

Thank you!

 

[Guest]

More notes on the "problem": within this website (www.fly.faa.gov), only
certain links are missing from certain pages:
-From www.fly.faa.gov/ois, all the links on the left-hand frame are ALWAYS
missing;
-From http://www.fly.faa.gov/Products/products.html; only the first link
(for advisories access database) is missing--and it is only missign SOMETIMES
-From the main page (www.fly.faa.gov/ois), the menu items at the top (FAA
Home/Airport Status, etc) are supposed to have a drop-down menu taht appears
when I hover the cursor over the item--this does not appear
-Other java functions within this website do work (for example,
http://www.fly.faa.gov/Products/AADC/aadc.html)

 

[Robert Aldwinckle]

This is a recurrence of a problem I had before. Within certain pages of a
specific website, links do not show up--they don't show up on the web page,
and they don't show up when I try to "view source" (one specific page is
www.fly.faa.gov/ois -- the links are missing from the left-hand frame).

This is in a frame. Make sure that you know how to view its source.
(E.g. right-click, View Source or F6,Menu-V NOT Alt-V,c)

Post the source you see from doing that. Make sure it is titled menu_sys
and not something else.

BTW if you are still running NIS and its ads scraper please remove it
while you are trying to diagnose your problem symptoms. Please verify
that it has been _removed_ using the Manage Add-ons tool (Alt-T,A)
or by a new HijackThis!.log

http://www.microsoft.com/communitie...04720e-bd7f-49b2-a68b-c44d62ea40dc&sloc=en-us


HTH

Robert Aldwinckle
---

 

[Guest]

Hi Robert, thanks for the help! THe source code for the frames page is
displayed below, after a couple of questions.

When you say to remove NIS & the ad scraper, do you mean just disable it ,
or to completely uninstall the program? I disabled the ad blocker toolbar
from "manage add-ons"--I also completely disabled NIS, but the problem still
persists. In addition, I have always run NIS on this computer and didn't
have an issue until I was using the computer for about 2 weeks.

Do you think there is anything to the point that running 2 similar processes
might have something to do with it? The first time the problem appeared, I
ran an IE Cache Cleaning tool from Cox (my ISP). The problem was "fixed" by
using Spybot S&D (after using it about 4 times). Then, a couple days later,
I ran "disk cleanup" from Windows XP--and the probelm started again.

here's the source code for the frame
(http://www.fly.faa.gov/ois/menu_sys.html)--the only thing that displays on
my screen is the FAA logo at the top, folllowed by ATCSCC OIS System and the
current date. Within the main fram, everything appears as normal>
*******************************************************
<HTML>
<HEAD>
<LINK rel=stylesheet type="text/css" href="/styles/ois.css">

<script language="JavaScript">
<!--

function SymError()
{
return true;
}

window.onerror = SymError;

//-->
</script>

<SCRIPT LANGUAGE="JavaScript">
<!-- Begin hiding script from older browsers

// Two other places are changed: Menu array, and Input My Full screenbutton

function y2k(number) { return (number < 1000) ? number+1900 : number; }

function home_date() {
date = new Date();
var todays_date = date.getDate();
var month_number = date.getMonth();
var year = y2k(date.getYear()); // year is y2k compatible
var month_name = '';

if(month_number == 0){month_name = 'January';}
if(month_number == 1){month_name = 'February';}
if(month_number == 2){month_name = 'March';}
if(month_number == 3){month_name = 'April';}
if(month_number == 4){month_name = 'May';}
if(month_number == 5){month_name = 'June';}
if(month_number == 6){month_name = 'July';}
if(month_number == 7){month_name = 'August';}
if(month_number == 8){month_name = 'September';}
if(month_number == 9){month_name = 'October';}
if(month_number == 10){month_name = 'November';}
if(month_number == 11){month_name ='December';}

var dateline = (month_number + 1) + '/' + todays_date + '/' + year;
document.write('<b><font size="+1" face="arial">' + dateline +
'</font></b>');
}


// End hiding script from old browsers -->
</SCRIPT>
<!--
-------------------------------------------------------------------------
OUTLINE STYLE TABLE OF CONTENTS in JAVASCRIPT
Version 2.0
by Danny Goodman ([email protected])
Analyzed and described at length in
"JavaScript Bible"
by Danny Goodman
(IDG Books ISBN 0-7645-3022-4)

This program is Copyright 1996 by Danny Goodman. You may adapt
this outliner for your Web pages, provided these opening credit
lines (down to the lower dividing line) are in your outliner HTML
document.
You may not reprint or redistribute this code without permission from
the author.
-------------------------------------------------------------------------
21 February 1997 Added intelligence so that clicking on a fully nested
widget icon does not cause the outline to reload.

24 October 1997 Script speedup for Navigator 4, reduces access to
cookie

To find information specific to DevEdge, search for DevEdge.
-->



</HEAD>

<body>
<DIV align="center"><A HREF="/index.html" target=_top><IMG id="ATCSCC_Logo"
HEIGHT=148 WIDTH=148 SRC="/images/smallatcscclogo.gif" BORDER=0 ALT="Go to
the ATCSCC Home Page" ></A></DIV>
<H3><CENTER>

<FONT COLOR="BLACK">ATCSCC<BR>OIS<BR>SYSTEM</FONT>
</CENTER></H3>

<center>

<script language="javascript" align="center">
<!-- Begin hiding script from older browsers

home_date();
document.write ("<BR>");

// end hiding script from old browsers -->

</script>

</center>

<BR>
<SCRIPT LANGUAGE="JavaScript1.1">

<!-- start
// build new outline based on the values of the cookie
// and data points in the outline data array.
// This fires each time the user clicks on a control,
// because the HREF for each one reloads the current document.
var newOutline = ""
var prevIndentDisplayed = 0
var showMyDaughter = 0
// DOCUMENT NAME IS HERE (DEVEDGE INFO WAS PREVIOUSLY HERE ALSO BUT WAS
MOVED TO LATER IN FILE)
document.write("<NOBR><FONT SIZE=-1><B>" + documentName +
"</FONT></B></NOBR><BR>")
// DOCUMENT NAME ENDS HERE
// cycle through each entry in the outline array
for (var i = 1; i < db.length; i++) {
var theGIF = getGIF(i) // get the image
var theGIFStatus = getGIFStatus(i) // get the status message
var currIndent = db.indent // get the indent level
var expanded = getCurrState().charAt(i-1) // current state
// display entry only if it meets one of three criteria
if (currIndent == 0 || currIndent <= prevIndentDisplayed ||
(showMyDaughter == 1 && (currIndent - prevIndentDisplayed == 1))) {
newOutline += "<NOBR><IMG SRC=\"/images/filler.gif\" HEIGHT
= 1 WIDTH =" + (indentPixels * currIndent) + ">"
newOutline += "<A HREF=\"javascript:history.go(0)\"
onMouseOver=\"window.status=\'" + theGIFStatus + "\';return true;\"
onClick=\"toggle(" + i + ");return " + (theGIF != endpointWidget) + "\">"
newOutline += "<IMG SRC=\"" + theGIF + "\" HEIGHT=" +
widgetHeight + " WIDTH=" + widgetWidth + " BORDER=0></A>"
if (db.URL == "" || db.URL == null) {
newOutline += " " + db.display + "</NOBR><BR>"
// no link, just a listed item
} else {
newOutline += " <A HREF=\"" + db.URL + "\"
TARGET=\"" + db.tgt + "\" onMouseOver=\"window.status=\'" +
db.statusMsg + "\';return true;\">" + db.display + "</A></NOBR><BR>"
}
prevIndentDisplayed = currIndent
showMyDaughter = expanded
if (db.length > 25) {
document.write(newOutline)
newOutline = ""
}
}
}
document.write(newOutline)
document.write("<HR>")

// document.write("<NOBR><FONT SIZE=-1>If cookies are
disabled,</FONT></NOBR><BR>")
// document.write("<NOBR><FONT SIZE=-1>this outline cannot
expand.</FONT></NOBR><BR>")
// document.write("<NOBR><FONT SIZE=-1>This frame is
resizable.</FONT></NOBR><P>")

// end -->

</SCRIPT>
</body>
</html>
********************************************

 

[Robert Aldwinckle]

Hi Robert, thanks for the help! THe source code for the frames page is
displayed below, after a couple of questions.

When you say to remove NIS & the ad scraper, do you mean just disable it ,
or to completely uninstall the program? I disabled the ad blocker toolbar
from "manage add-ons"--I also completely disabled NIS, but the problem still
persists.

When you are having as much trouble as you have been it is safer
to assume the worst. There are precedents where disabling things
and even "uninstalling" them still leaves bits of them behind which
are sufficiently active that they cause a problem symptom. Hopefully
uninstalling it would at least remove the uncertainty that just disabling it
wouldn't work.

However, if you prefer, you could disable it and then monitor its
module with FileMon and RegMon (freeware from SysInternals).
If there was no apparent file or registry access involving it you would
then have more certainty that it was probably not causing the problem.
This test result would be even more convincing if you did a previous test
with the ads scraper active which showed you that normally it was changing
the file. Hmm... that just made me think that you could probably use
FileMon too to detect that the menu_sys file *is* being changed.
E.g. you would see it being written once, being read and being written
again, perhaps even in a different place. Unfortunately since the ads
scraper is a BHO you probably wouldn't be able to identify that it was
responsible for doing those extra steps (i.e., iexplore.exe would still
appear to be the active task doing that) but depending on the filter you
were using you might also be able to detect if the ads scraper module
being read from and loaded.

In addition, I have always run NIS on this computer and didn't
have an issue until I was using the computer for about 2 weeks.

That isn't necessarily a good argument that it isn't the cause
unless you know about the source of the menu page.
If the menu page had been redesigned recently in a way that
it caught the ad scraper's attention you would have an explanation
for your symptom. BTW the technique that they are using for
building the menu is a common technique for building a set of ads
which cycle through themselves, occupying one block on the page.

Aha! Look what I get when I check just the menu_sys page
(check with javascript:document.lastModified in the Address bar)

05/17/2005 16:41:23

Still want to think that NIS isn't the cause? <EG>

BTW we were lucky. Often these days pages are built dynamically
so this property is often useless for knowing when there has been
a source change. In that case you would have to depend on the
discipline of the coder and whether the shop had a policy to date
source changes, etc.

Do you think there is anything to the point that running 2 similar processes
might have something to do with it? The first time the problem appeared, I
ran an IE Cache Cleaning tool from Cox (my ISP). The problem was "fixed" by
using Spybot S&D (after using it about 4 times). Then, a couple days later,
I ran "disk cleanup" from Windows XP--and the probelm started again.

No I don't. The source code is being changed, exactly as if an ads scraper
was at work. A cache cleaner works only at the file level and does not
explain the change in source.

Oh, hang on. If the source is built from separate files it might explain that...
Nope. I have just confirmed by a packet trace that the array elements are
coded in the original .html document. So the fact that you aren't seeing
them means that something is deleting them after the file is cached.

here's the source code for the frame
(http://www.fly.faa.gov/ois/menu_sys.html

Seeing this URL by itself suggests another useful test which would
eliminate any uncertainty about what effect your cache cleaner might
be having here. Load that URL in its own window and press Ctrl-F5.
See if that has *any* change in your symptoms. This would also be
a simpler case to check with FileMon.

)--the only thing that displays on
my screen is the FAA logo at the top, folllowed by ATCSCC OIS System and the
current date.

That's because all references to inputArray have been deleted!
BTW Notepad shows menu_sys has 469 lines; so I think that
more than just those references have been deleted.

Within the main fram, everything appears as normal>

That's because there isn't as much script in it. <eg>


HTH

Robert
---