The Un-Official Proxomitron Forum

Full Version: Test Filter: Kill Possible Fake IE Alert Bar CSS
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
This filter kills the fake Alert bars now used by crapware spreaders.

Code:
[Patterns]
Name = "Kill Possible Fake IE Alert Bar CSS [Kye-U]"
Active = TRUE
URL = "$TYPE(css)"
Limit = 256
Match = "\w\s\{"
        "*top : 0 px&"
        "*left : 0 px&"
        "*z-index : \w&"
        "*background-color : #FFFFCC"
        "*\}"
Replace = "$ALERT(Possible Fake IE Alert Bar Removed on:\n\n\u)"

Screenshots:

[Image: before8ek.th.png]
Malicious page without filter activated (notice the bar)

[Image: alert0zv.th.png]
Filter activated - Alert message

[Image: after3ap.th.png]
Spoof foiled Smile!

For those who want to test it out for themselves, a LIVE example can be found here (be careful):

http://64.233.161.104/search?q=cache:GxG...ence&hl=en
I didn't get any bars with Firefox at all on that web page.
I have ysbweb.com in my connection-killer blocklist, however.
Near the bottom of the page, I did get this message:
"[an error occurred while processing this directive]".
Siamesecat Wrote:I have ysbweb.com in my connection-killer blocklist, however.

This is probably why.

duble.com loads a script from ysbweb.com which then loads the stylesheets and additional javascript codes.

If it's killing the connection to ysbweb.com, then you won't be able to get the stylesheets Smile!
Reference URL's