another pop-up

[geffers]

Since June 10, someone has been distributing a browser hijack that spawns an offscreen pop up window which opens a page at datanotary.com.

The hijack is accomplished by inserting _javascript into a Cascading Style Sheet (CSS) file, then hijacking Internet Explorer's accessibility options to force it to use that style sheet. When activated, the _javascript makes use of an obscure and proprietary Microsoft CSS extension to create the pop up window.

The pop up windows are hidden, since the _javascript opens them at a position 5,000 pixels from the top and 5,000 pixels from the right of the screen (most monitors display only 768 pixels from top to bottom). It is unclear whether the window was intentionally placed offscreen, or if the malware author simply made a typo.

The extension is called and the pop up windows created when the victim begins to type into a form on a web page. This causes the computer to slow down quite visibly as the window is being created offscreen. This is, in fact, how the hijack was discovered. Hundreds of people were posting questions on message boards around the world asking for help with a mysterious slow down while typing.

A user at the SWI support forums noticed that his browser was set to use a custom stylesheet. After resetting that option to not use the style sheet, his slow typing problem disappeared.

Examination of the file found a _javascript _expression where CSS should have been. Converting the _expression into Human-readable text revealed a script that opens a hidden pop up window to datanotary.com

Removal Instructions

Click Tools
Click Internet Options
Click Accessibility
Uncheck "Format documents using my style sheet"
See if this is checked, make sure before you uncheck to look at the path of the *.css file. It was my.css in one case, system.css in another.
Click Ok twice
Now go to the c:Windows directory where the file is located and delete that *.css.
Reboot
This information is located at http://www.spywareinfo.com/articles/datanotary/

[lyjg1201]

玻璃钢消防员装备箱有高质量的树脂和玻璃纤维毡符合而成，是消防器材（灭火器、水带）的专用存放箱。玻璃钢水带箱是消防水龙 带的专用存放箱，采用玻璃钢制作，耐腐蚀、耐候性好、不生锈、不霉烂, 分为有盘架水带箱和无盘架水带箱RHZK系列正压式空气呼吸器是一种自给开放式空气 呼吸器，广泛应用于消防、化工、船舶、石油、冶炼、仓库、试验室、矿山等部门供消防员或抢险救护人员在浓烟、毒气 、蒸汽或缺氧等各种环境下安全有效地进行灭火，抢险救灾和救护工作。 迎使用本站地图查看 呼吸器， 空气呼吸器 ，防化服，正壓式空氣呼吸器,消防产品，救生产品，劳保产品，消防器材，救生器材，救生设备，船用灭火器，海上救援 器材，船舶救生消防产品,消防员装备