Block MWSearch Toolbar

Discussion in 'SpywareBlaster & Other Forum' started by SilentObserver, Mar 22, 2005.

Thread Status:
Not open for further replies.
  1. SilentObserver

    SilentObserver Registered Member

    Joined:
    Mar 22, 2005
    Posts:
    4
    I have an addition for the SpywareBlaster database.
    Here's all the info I have.

    I visited a certain site. When the page started loading, I see an ActiveX dialog which asks if I want to install MWSearch Toolbar.
    After I clicked No and reloaded the page, the dialog appeared again.
    While the ActiveX dialog is still visible, I see in the statusbar (replace hxxp with http):
    I opened the source of the page in notepad and searched for "morwill".
    This is the line where it matched (replace hxxp with http)
    Code:
    <iframe src="hxxp://morwillsearch.com/mwsbar.php?adv_id=partner" height="1" width="1" border="0"></iframe>
    I pasted the url in the address bar and pressed enter.
    The dialog showed as I expected.
    This is the source of that page.
    Code:
    <body>  
    <object classid="clsid:D7BF3304-138B-4DD5-86EE-491BB6A2286C" codebase="mwsearch.cab">
    <param name="adv_id" value="partner">
    <param name="sub_id" value="">
    <param name="surf_id" value="4319686">
    </object>
    </body>
    Some details from the ActiveX dialog:
    Could you please add it to the SpywareBlaster database?
    Thanks for everything.
     
  2. SilentObserver

    SilentObserver Registered Member

    Joined:
    Mar 22, 2005
    Posts:
    4
    *bump*

    In case you didn't see this post...
     
  3. morwill

    morwill Guest

    Have you seen this one

    morwillsearch.com | mwsearch.cab ( Trojan-Clicker.Win32.Morwill.a )

    in here customblocking.txt

    and Google
     
Thread Status:
Not open for further replies.