Test Filter: Kill Possible Fake IE Alert Bar CSS

[Kye-U]

This filter kills the fake Alert bars now used by crapware spreaders.

Code:

[Patterns]
Name = "Kill Possible Fake IE Alert Bar CSS [Kye-U]"
Active = TRUE
URL = "$TYPE(css)"
Limit = 256
Match = "\w\s\{"
        "*top : 0 px&"
        "*left : 0 px&"
        "*z-index : \w&"
        "*background-color : #FFFFCC"
        "*\}"
Replace = "$ALERT(Possible Fake IE Alert Bar Removed on:\n\n\u)"

Screenshots:


Malicious page without filter activated (notice the bar)


Filter activated - Alert message


Spoof foiled

For those who want to test it out for themselves, a LIVE example can be found here (be careful):

http://64.233.161.104/search?q=cache:GxG...ence&hl=en