Block MWSearch Toolbar

Discussion in 'SpywareBlaster & Other Forum' started by SilentObserver, Mar 22, 2005.

Thread Status:
Not open for further replies.
  1. SilentObserver

    SilentObserver Registered Member

    Joined:
    Mar 22, 2005
    Posts:
    4
    I have an addition for the SpywareBlaster database.
    Here's all the info I have.

    I visited a certain site. When the page started loading, I see an ActiveX dialog which asks if I want to install MWSearch Toolbar.
    After I clicked No and reloaded the page, the dialog appeared again.
    While the ActiveX dialog is still visible, I see in the statusbar (replace hxxp with http):
    I opened the source of the page in notepad and searched for "morwill".
    This is the line where it matched (replace hxxp with http)
    Code:
    <iframe src="hxxp://morwillsearch.com/mwsbar.php?adv_id=partner" height="1" width="1" border="0"></iframe>
    I pasted the url in the address bar and pressed enter.
    The dialog showed as I expected.
    This is the source of that page.
    Code:
    <body>  
<object classid="clsid:D7BF3304-138B-4DD5-86EE-491BB6A2286C" codebase="mwsearch.cab">
<param name="adv_id" value="partner">
<param name="sub_id" value="">
<param name="surf_id" value="4319686">
</object>
</body>
    Some details from the ActiveX dialog:
    Could you please add it to the SpywareBlaster database?
    Thanks for everything.
     
    SilentObserver, Mar 22, 2005
    #1
  2. SilentObserver

    SilentObserver Registered Member

    Joined:
    Mar 22, 2005
    Posts:
    4
    *bump*

    In case you didn't see this post...
     
    SilentObserver, Mar 25, 2005
    #2
  3. morwill

    morwill Guest

    Have you seen this one

    morwillsearch.com | mwsearch.cab ( Trojan-Clicker.Win32.Morwill.a )

    in here customblocking.txt

    and Google
     
    morwill, Mar 26, 2005
    #3
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...