Post Reply 
Test Filter: Kill Possible Fake IE Alert Bar CSS
Jul. 30, 2005, 08:14 PM (This post was last modified: Jul. 31, 2005 06:32 AM by Kye-U.)
Post: #1
Test Filter: Kill Possible Fake IE Alert Bar CSS
This filter kills the fake Alert bars now used by crapware spreaders.

Code:
[Patterns]
Name = "Kill Possible Fake IE Alert Bar CSS [Kye-U]"
Active = TRUE
URL = "$TYPE(css)"
Limit = 256
Match = "\w\s\{"
        "*top : 0 px&"
        "*left : 0 px&"
        "*z-index : \w&"
        "*background-color : #FFFFCC"
        "*\}"
Replace = "$ALERT(Possible Fake IE Alert Bar Removed on:\n\n\u)"

Screenshots:

[Image: before8ek.th.png]
Malicious page without filter activated (notice the bar)

[Image: alert0zv.th.png]
Filter activated - Alert message

[Image: after3ap.th.png]
Spoof foiled Smile!

For those who want to test it out for themselves, a LIVE example can be found here (be careful):

http://64.233.161.104/search?q=cache:GxG...ence&hl=en
Visit this user's website
Add Thank You Quote this message in a reply
Jul. 31, 2005, 06:28 AM
Post: #2
 
I didn't get any bars with Firefox at all on that web page.
I have ysbweb.com in my connection-killer blocklist, however.
Near the bottom of the page, I did get this message:
"[an error occurred while processing this directive]".
Add Thank You Quote this message in a reply
Jul. 31, 2005, 06:33 AM
Post: #3
 
Siamesecat Wrote:I have ysbweb.com in my connection-killer blocklist, however.

This is probably why.

duble.com loads a script from ysbweb.com which then loads the stylesheets and additional javascript codes.

If it's killing the connection to ysbweb.com, then you won't be able to get the stylesheets Smile!
Visit this user's website
Add Thank You Quote this message in a reply
Post Reply 


Forum Jump: