Jul. 30, 2005, 08:14 PM
This filter kills the fake Alert bars now used by crapware spreaders.
Screenshots:
Malicious page without filter activated (notice the bar)
Filter activated - Alert message
Spoof foiled
For those who want to test it out for themselves, a LIVE example can be found here (be careful):
http://64.233.161.104/search?q=cache:GxG...ence&hl=en
Code:
[Patterns]
Name = "Kill Possible Fake IE Alert Bar CSS [Kye-U]"
Active = TRUE
URL = "$TYPE(css)"
Limit = 256
Match = "\w\s\{"
"*top : 0 px&"
"*left : 0 px&"
"*z-index : \w&"
"*background-color : #FFFFCC"
"*\}"
Replace = "$ALERT(Possible Fake IE Alert Bar Removed on:\n\n\u)"
Screenshots:
Malicious page without filter activated (notice the bar)
Filter activated - Alert message
Spoof foiled
For those who want to test it out for themselves, a LIVE example can be found here (be careful):
http://64.233.161.104/search?q=cache:GxG...ence&hl=en