Test Filter: Kill Possible Fake IE Alert Bar CSS

Test Filter: Kill Possible Fake IE Alert Bar CSS - Printable Version

+- The Un-Official Proxomitron Forum (https://www.prxbx.com/forums)
+-- Forum: Proxomitron Filters (/forumdisplay.php?fid=38)
+--- Forum: Privacy/Security/Spam (/forumdisplay.php?fid=10)
+--- Thread: Test Filter: Kill Possible Fake IE Alert Bar CSS (/showthread.php?tid=564)

Test Filter: Kill Possible Fake IE Alert Bar CSS - Kye-U - Jul. 30, 2005 08:14 PM

This filter kills the fake Alert bars now used by crapware spreaders.

Code:

[Patterns]

Name = "Kill Possible Fake IE Alert Bar CSS [Kye-U]"

Active = TRUE

URL = "$TYPE(css)"

Limit = 256

Match = "\w\s\{"

        "*top : 0 px&"

        "*left : 0 px&"

        "*z-index : \w&"

        "*background-color : #FFFFCC"

        "*\}"

Replace = "$ALERT(Possible Fake IE Alert Bar Removed on:\n\n\u)"

Screenshots:

Malicious page without filter activated (notice the bar)

Filter activated - Alert message

Spoof foiled Smile!

For those who want to test it out for themselves, a LIVE example can be found here (be careful):

http://64.233.161.104/search?q=cache:GxGR_BaCHWYJ:lyrics.duble.com/lyrics/S/static-x-lyrics/static-x-permanence-lyrics.htm+static-x+permanence&hl=en

- Siamesecat - Jul. 31, 2005 06:28 AM

I didn't get any bars with Firefox at all on that web page.
I have ysbweb.com in my connection-killer blocklist, however.
Near the bottom of the page, I did get this message:
"[an error occurred while processing this directive]".

- Kye-U - Jul. 31, 2005 06:33 AM

Siamesecat Wrote:I have ysbweb.com in my connection-killer blocklist, however.

This is probably why.

duble.com loads a script from ysbweb.com which then loads the stylesheets and additional javascript codes.

If it's killing the connection to ysbweb.com, then you won't be able to get the stylesheets Smile!