Computer Cops ť Remove WebBugs

New User? Need help? Click here to register for free! Registering removes the advertisements.

	Donations

	If you found this site helpful, please donate to help keep it online Don't want to use PayPal? Try our physical address

	Prime Choice

	ˇ Head Lines ˇ Advisories (All) ˇ Dnld of the Week! ˇ CCSP News Ltrs ˇ Find a Cure! ˇ Ian T's (AR 24) ˇ Marcia's (CO8) ˇ Bill G's (CO12) ˇ Paul's (AR 5) ˇ Robin's (AR 2) ˇ Ian T's Archive ˇ Marcia's Archive ˇ Bill G's Archive ˇ Paul's Archive ˇ Robin's Archive

	Security Central

	· Home · Wireless · Bookmarks · CLSID · Columbia · Community · Downloads · Encyclopedia · Feedback (send) · Forums · Gallery · Giveaways · HijackThis · Journal · Members List · My Downloads · PremChat · Premium · Private Messages · Proxomitron · Quizz · RegChat · Reviews · Google Search · Sections · Software · Statistics · Stories Archive · Submit News · Surveys · Top · Topics · Web Links · Your Account

	CCSP Toolkit

	ˇ Email Virus Scan ˇ UDP Port Scanner ˇ TCP Port Scanner ˇ Trojan TCP Scan ˇ Reveal Your IP ˇ Algorithms ˇ Whois ˇ nmap port scanner ˇ IPs Banned [?]

Survey

How much can you give to keep Computer Cops online?

	$10 up to $25 per year?
	$25 up to $50 per year?
	$10 up to $25 per month?
	$25 up to $50 per month?
	More than $50 per year?
	More than $50 per month?
	One time only?
	Other (please comment)

Results
Polls

Votes: 1170
Comments: 21

Translate

Forum FAQ

Usergroups

Profile

FavForums

Remove WebBugs

Computer Cops Forum Index -> Proxo Filters

View previous topic :: View next topic

Author

Message

Dissident

Private
Private

Joined: Jun 20, 2003
Posts: 49
Location: Earth

Posted: Sat Dec 13, 2003 11:57 pm Post subject: Remove WebBugs

Only for Internet Explorer & the latest version of Proxomitron:

Code:

[Patterns]
Name = "/-------------------------------------------------------------------------\"
Active = FALSE
Bounds = "<Proxo>"
Limit = 1
Match = "<Proxo>Separator"

Code:

[Patterns]
Name = "Remove: WebBugs (part#1) r031216 ~Dissident~"
Active = TRUE
URL = "$TYPE(htm)(^$KEYCHK(^s))"
Bounds = "($NEST(<(^(^script(\s[^>]++|)>)),</script>) )+{1,*}$NEST(<noscript>,</noscript>)|<(iframe|object)\1\s[^>]+>(^<$TST(\1))++*<(\\|)/$TST(\1)>|(<a\s[^>]++> |)<img\s(^prx)([^>]++)\7src=$AV(*)(\8)>( </a>|)"
Limit = 4096
Match = "((($NEST(<(^(^script(\s[^>]++|)>)),</script>) )+{1,*}<noscript>(*<img(^\sprx))+{1,*}"
"(*(src=(\\"|"|)$AVQ((^*.(jpg|jpe(g|)|gif|png|bmp|psp|ico|xbm|emf|wmf))*)|"
"[ '](width$SET(w=1)|height)=(\\"|"|)$AVQ((([#0]|[#2:7])$SET(b=0)|[#1]$SET(b=1)|[#8:*]$SET(b=2))\0(\\"|"|))[^><]++"
"[ ']($TST(w=1)height|width)=(\\"|"|)$AVQ(($TST(b=0)[#0:7]|$TST(b=1)[#0:*]|$TST(b=2)[#1])\1(\\"|"|)))|"
"(^[^><]++[ ']width)[^><]++[ ']height=(\\"|"|)$AVQ([#1](\\"|"|))|"
"(^[^><]++[ ']height)[^><]++[ ']width=(\\"|"|)$AVQ([#1](\\"|"|))))"
"$SET(3=)|"
""
"(<(iframe|object)\s([^>]++>(*<img(^\sprx))+{1,*}$SET(v=1)|)"
"(*($TST(v=1)src=(\\"|"|)$AVQ((^*.(jpg|jpe(g|)|gif|png|bmp|psp|ico|xbm|emf|wmf))*)$SET(5=height=)$SET(4=width=)$SET(1=0)$SET(0=0)|"
"[ '](((width$SET(w=1)|height)=)\4(\\"|"|)$AVQ((([#0]|[#2:7])$SET(b=0)|[#1]$SET(b=1)|[#8:*]$SET(b=2))\0(\\"|"|))[^><]++"
"[ '](($TST(w=1)height|width)=)\5(\\"|"|)$AVQ(($TST(b=0)[#0:7]|$TST(b=1)[#0:*]|$TST(b=2)[#1])\1(\\"|"|))|"
"margin((width$SET(w=1)|height)=)\4(\\"|"|)$AVQ(([#0])\0(\\"|"|))[^><]++"
"margin(($TST(w=1)height|width)=)\5(\\"|"|)$AVQ(([#0])\1(\\"|"|))))|"
"(^[^><]++[ ']width)[^><]++[ '](height=)\4(\\"|"|)$AVQ([#1](\\"|"|))|"
"(^[^><]++[ ']height)[^><]++[ '](width=)\4(\\"|"|)$AVQ([#1](\\"|"|))))"
"$SET(3=<img prx \5\1 \4\0>)|"
""
"((<a\s[^>]++> |)<img(^\sprx)"
"((*[ '](width$SET(w=1)|height)=(\\"|"|)$AVQ((([#0]|[#2:7])$SET(b=0)|[#1]$SET(b=1)|[#8:*]$SET(b=2))\0(\\"|"|))*"
"[ ']($TST(w=1)height|width)=(\\"|"|)$AVQ(($TST(b=0)[#0:7]|$TST(b=1)[#0:*]|$TST(b=2)[#1])\1(\\"|"|))|"
"(^[^><]++[ ']width)[^><]++[ ']height=(\\"|"|)$AVQ([#1](\\"|"|))|"
"(^[^><]++[ ']height)[^><]++[ ']width=(\\"|"|)$AVQ([#1](\\"|"|)))$SET(3=<img prx \7\8>)|"
"*src=(\\"|"|)$AVQ(*.(gif|jpg|cgi)[?]*)$SET(3=<img prx title="" alt="prx" usemap="" src=http://local.ptron/clear.gif \7\8>))|"
""
"(<a\s[^>]++href=(\\"|"|)$AVQ((*[?])\1*)*> <img(^\sprx)[^>]++src=(\\"|"|)$AVQ($TST(\1)*)*>|"
"<a\s[^>?]++> <img(^\sprx)[^>]++src=(\\"|"|)$AVQ((^*.(jpg|jpe(g|)|gif|png|bmp|psp|ico|xbm|emf|wmf))&(^*[?])*)*>)"
"$SET(3=<img prx title="" alt="prx" usemap="" src=http://local.ptron/clear.gif \7\8>)))*"
Replace = "\3$SET(b=)$SET(h=)$SET(w=)$SET(v=)"

Code:

[Patterns]
Name = "Remove: WebBugs (part#2) r031216 ~Dissident~"
Active = TRUE
URL = "$TYPE(oth)(^$KEYCHK(^s))"
Bounds = "($NEST(<(^(^script(\s[^>]++|)>)),</script>) )+{1,*}$NEST(<noscript>,</noscript>)|<(iframe|object)\1\s[^>]+>(^<$TST(\1))++*<(\\|)/$TST(\1)>|(<a\s[^>]++> |)<img\s(^prx)([^>]++)\7src=$AV(*)(\8)>( </a>|)"
Limit = 4096
Match = "((($NEST(<(^(^script(\s[^>]++|)>)),</script>) )+{1,*}<noscript>(*<img(^\sprx))+{1,*}"
"(*(src=(\\"|"|)$AVQ((^*.(jpg|jpe(g|)|gif|png|bmp|psp|ico|xbm|emf|wmf))*)|"
"[ '](width$SET(w=1)|height)=(\\"|"|)$AVQ((([#0]|[#2:7])$SET(b=0)|[#1]$SET(b=1)|[#8:*]$SET(b=2))\0(\\"|"|))[^><]++"
"[ ']($TST(w=1)height|width)=(\\"|"|)$AVQ(($TST(b=0)[#0:7]|$TST(b=1)[#0:*]|$TST(b=2)[#1])\1(\\"|"|)))|"
"(^[^><]++[ ']width)[^><]++[ ']height=(\\"|"|)$AVQ([#1](\\"|"|))|"
"(^[^><]++[ ']height)[^><]++[ ']width=(\\"|"|)$AVQ([#1](\\"|"|))))"
"$SET(3=)|"
""
"(<(iframe|object)\s([^>]++>(*<img(^\sprx))+{1,*}$SET(v=1)|)"
"(*($TST(v=1)src=(\\"|"|)$AVQ((^*.(jpg|jpe(g|)|gif|png|bmp|psp|ico|xbm|emf|wmf))*)$SET(5=height=)$SET(4=width=)$SET(1=0)$SET(0=0)|"
"[ '](((width$SET(w=1)|height)=)\4(\\"|"|)$AVQ((([#0]|[#2:7])$SET(b=0)|[#1]$SET(b=1)|[#8:*]$SET(b=2))\0(\\"|"|))[^><]++"
"[ '](($TST(w=1)height|width)=)\5(\\"|"|)$AVQ(($TST(b=0)[#0:7]|$TST(b=1)[#0:*]|$TST(b=2)[#1])\1(\\"|"|))|"
"margin((width$SET(w=1)|height)=)\4(\\"|"|)$AVQ(([#0])\0(\\"|"|))[^><]++"
"margin(($TST(w=1)height|width)=)\5(\\"|"|)$AVQ(([#0])\1(\\"|"|))))|"
"(^[^><]++[ ']width)[^><]++[ '](height=)\4(\\"|"|)$AVQ([#1](\\"|"|))|"
"(^[^><]++[ ']height)[^><]++[ '](width=)\4(\\"|"|)$AVQ([#1](\\"|"|))))"
"$SET(3=<img prx \5\1 \4\0>)|"
""
"((<a\s[^>]++> |)<img(^\sprx)"
"((*[ '](width$SET(w=1)|height)=(\\"|"|)$AVQ((([#0]|[#2:7])$SET(b=0)|[#1]$SET(b=1)|[#8:*]$SET(b=2))\0(\\"|"|))*"
"[ ']($TST(w=1)height|width)=(\\"|"|)$AVQ(($TST(b=0)[#0:7]|$TST(b=1)[#0:*]|$TST(b=2)[#1])\1(\\"|"|))|"
"(^[^><]++[ ']width)[^><]++[ ']height=(\\"|"|)$AVQ([#1](\\"|"|))|"
"(^[^><]++[ ']height)[^><]++[ ']width=(\\"|"|)$AVQ([#1](\\"|"|)))$SET(3=<img prx \7\8>)|"
"*src=(\\"|"|)$AVQ(*.(gif|jpg|cgi)[?]*)$SET(3=<img prx title="" alt="prx" usemap="" src=http://local.ptron/clear.gif \7\8>))|"
""
"(<a\s[^>]++href=(\\"|"|)$AVQ((*[?])\1*)*> <img(^\sprx)[^>]++src=(\\"|"|)$AVQ($TST(\1)*)*>|"
"<a\s[^>?]++> <img(^\sprx)[^>]++src=(\\"|"|)$AVQ((^*.(jpg|jpe(g|)|gif|png|bmp|psp|ico|xbm|emf|wmf))&(^*[?])*)*>)"
"$SET(3=<img prx title="" alt="prx" usemap="" src=http://local.ptron/clear.gif \7\8>)))*"
Replace = "\3$SET(b=)$SET(h=)$SET(w=)$SET(v=)"

Code:

[Patterns]
Name = "Remove: WebBugs (part#3) r031216 ~Dissident~"
Active = TRUE
URL = "$TYPE(js)(^$KEYCHK(^s))"
Bounds = "($NEST(<(^(^script(\s[^>]++|)>)),</script>) )+{1,*}$NEST(<noscript>,</noscript>)|<(iframe|object)\1\s[^>]+>(^<$TST(\1))++*<(\\|)/$TST(\1)>|(<a\s[^>]++> |)<img\s(^prx)([^>]++)\7src=$AV(*)(\8)>( </a>|)"
Limit = 4096
Match = "((($NEST(<(^(^script(\s[^>]++|)>)),</script>) )+{1,*}<noscript>(*<img(^\sprx))+{1,*}"
"(*(src=(\\"|"|)$AVQ((^*.(jpg|jpe(g|)|gif|png|bmp|psp|ico|xbm|emf|wmf))*)|"
"[ '](width$SET(w=1)|height)=(\\"|"|)$AVQ((([#0]|[#2:7])$SET(b=0)|[#1]$SET(b=1)|[#8:*]$SET(b=2))\0(\\"|"|))[^><]++"
"[ ']($TST(w=1)height|width)=(\\"|"|)$AVQ(($TST(b=0)[#0:7]|$TST(b=1)[#0:*]|$TST(b=2)[#1])\1(\\"|"|)))|"
"(^[^><]++[ ']width)[^><]++[ ']height=(\\"|"|)$AVQ([#1](\\"|"|))|"
"(^[^><]++[ ']height)[^><]++[ ']width=(\\"|"|)$AVQ([#1](\\"|"|))))"
"$SET(3=)|"
""
"(<(iframe|object)\s([^>]++>(*<img(^\sprx))+{1,*}$SET(v=1)|)"
"(*($TST(v=1)src=(\\"|"|)$AVQ((^*.(jpg|jpe(g|)|gif|png|bmp|psp|ico|xbm|emf|wmf))*)$SET(5=height=)$SET(4=width=)$SET(1=0)$SET(0=0)|"
"[ '](((width$SET(w=1)|height)=)\4(\\"|"|)$AVQ((([#0]|[#2:7])$SET(b=0)|[#1]$SET(b=1)|[#8:*]$SET(b=2))\0(\\"|"|))[^><]++"
"[ '](($TST(w=1)height|width)=)\5(\\"|"|)$AVQ(($TST(b=0)[#0:7]|$TST(b=1)[#0:*]|$TST(b=2)[#1])\1(\\"|"|))|"
"margin((width$SET(w=1)|height)=)\4(\\"|"|)$AVQ(([#0])\0(\\"|"|))[^><]++"
"margin(($TST(w=1)height|width)=)\5(\\"|"|)$AVQ(([#0])\1(\\"|"|))))|"
"(^[^><]++[ ']width)[^><]++[ '](height=)\4(\\"|"|)$AVQ([#1](\\"|"|))|"
"(^[^><]++[ ']height)[^><]++[ '](width=)\4(\\"|"|)$AVQ([#1](\\"|"|))))"
"$SET(3=<img prx \5\1 \4\0>)|"
""
"((<a\s[^>]++> |)<img(^\sprx)"
"((*[ '](width$SET(w=1)|height)=(\\"|"|)$AVQ((([#0]|[#2:7])$SET(b=0)|[#1]$SET(b=1)|[#8:*]$SET(b=2))\0(\\"|"|))*"
"[ ']($TST(w=1)height|width)=(\\"|"|)$AVQ(($TST(b=0)[#0:7]|$TST(b=1)[#0:*]|$TST(b=2)[#1])\1(\\"|"|))|"
"(^[^><]++[ ']width)[^><]++[ ']height=(\\"|"|)$AVQ([#1](\\"|"|))|"
"(^[^><]++[ ']height)[^><]++[ ']width=(\\"|"|)$AVQ([#1](\\"|"|)))$SET(3=<img prx \7\8>)|"
"*src=(\\"|"|)$AVQ(*.(gif|jpg|cgi)[?]*)$SET(3=<img prx title="" alt="prx" usemap="" src=http://local.ptron/clear.gif \7\8>))|"
""
"(<a\s[^>]++href=(\\"|"|)$AVQ((*[?])\1*)*> <img(^\sprx)[^>]++src=(\\"|"|)$AVQ($TST(\1)*)*>|"
"<a\s[^>?]++> <img(^\sprx)[^>]++src=(\\"|"|)$AVQ((^*.(jpg|jpe(g|)|gif|png|bmp|psp|ico|xbm|emf|wmf))&(^*[?])*)*>)"
"$SET(3=<img prx title="" alt="prx" usemap="" src=http://local.ptron/clear.gif \7\8>)))*"
Replace = "\3$SET(b=)$SET(h=)$SET(w=)$SET(v=)"

Code:

[Patterns]
Name = "\-------------------------------------------------------------------------/"
Active = FALSE
Bounds = "<Proxo>"
Limit = 1
Match = "<Proxo>Separator"

Code:

[HTTP headers]
In = FALSE
Out = TRUE
Key = "URL: Filter .shtml (WebBugs filter r031216 Addon) ~Dissident~"
URL = "(^$KEYCHK(^s))"
Match = "(*.shtml*)\1"
Replace = "\1$FILTER(TRUE)"

Part 1,2 & related HTTP Header filter must be activated together (part #3 is optional).

You can bypass those filters by pressing SHIFT.

The "allow for multiple matches" option isn't activated so activate it if there's a need!

It actually removes a little more than webbugs.

Some tested sites:
www.warp2search.net
www.gamecopyworld.com
www.hardocp.com
www.cracks4u.us
www.pcworld.com
www.espn.com
www.runescape.com
www.meteomedia.com
www.rottentomatoes.com
www.mmm100.com
www.vcdquality.com
www.ign.com
www.tweakxp.com
...

~Dissident~

Last edited by Dissident on Tue Dec 16, 2003 8:02 pm, edited 1 time in total

ProxFox

Sergeant

Joined: Nov 11, 2003
Posts: 110
Location: USA

Posted: Sun Dec 14, 2003 9:52 am Post subject:

Awesome! I'm no longer getting those pesky little "red-x" placeholder images where images were supposed to be placed, yet blocked by the HOSTS file... I definitely prefer Proxo to be the first line of defense... The HOSTS file is merely a backup... ps - no e-Dexter comments from the peanut gallery, please...

Display posts from previous:

	Computer Cops Forum Index -> Proxo Filters	All times are GMT - 5 Hours
Page 1 of 1

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 1112 pages served in previous 5 minutes. Page Rendered: 0.538 seconds.