SilentObserver
March 22nd, 2005, 05:31 PM
I have an addition for the SpywareBlaster database.
Here's all the info I have.
I visited a certain site. When the page started loading, I see an ActiveX dialog which asks if I want to install MWSearch Toolbar.
After I clicked No and reloaded the page, the dialog appeared again.
While the ActiveX dialog is still visible, I see in the statusbar (replace hxxp with http):
{QUOTE-> Loading page hxxp://morwillsearch.com/mwsbar.php?adv_id=partner... <-QUOTE}
I opened the source of the page in notepad and searched for "morwill".
This is the line where it matched (replace hxxp with http)
<iframe src="hxxp://morwillsearch.com/mwsbar.php?adv_id=partner" height="1" width="1" border="0"></iframe>
I pasted the url in the address bar and pressed enter.
The dialog showed as I expected.
This is the source of that page.
<body>
<object classid="clsid:D7BF3304-138B-4DD5-86EE-491BB6A2286C" codebase="mwsearch.cab">
<param name="adv_id" value="partner">
<param name="sub_id" value="">
<param name="surf_id" value="4319686">
</object>
</body>
Some details from the ActiveX dialog:
{QUOTE-> Name: MWSearch Toolbar
Company: ANGROD TRADING S.A. <-QUOTE}
Could you please add it to the SpywareBlaster database?
Thanks for everything.
Here's all the info I have.
I visited a certain site. When the page started loading, I see an ActiveX dialog which asks if I want to install MWSearch Toolbar.
After I clicked No and reloaded the page, the dialog appeared again.
While the ActiveX dialog is still visible, I see in the statusbar (replace hxxp with http):
{QUOTE-> Loading page hxxp://morwillsearch.com/mwsbar.php?adv_id=partner... <-QUOTE}
I opened the source of the page in notepad and searched for "morwill".
This is the line where it matched (replace hxxp with http)
<iframe src="hxxp://morwillsearch.com/mwsbar.php?adv_id=partner" height="1" width="1" border="0"></iframe>
I pasted the url in the address bar and pressed enter.
The dialog showed as I expected.
This is the source of that page.
<body>
<object classid="clsid:D7BF3304-138B-4DD5-86EE-491BB6A2286C" codebase="mwsearch.cab">
<param name="adv_id" value="partner">
<param name="sub_id" value="">
<param name="surf_id" value="4319686">
</object>
</body>
Some details from the ActiveX dialog:
{QUOTE-> Name: MWSearch Toolbar
Company: ANGROD TRADING S.A. <-QUOTE}
Could you please add it to the SpywareBlaster database?
Thanks for everything.