Active X

cd34 · 2010-12-10, 03:46 PM

The one possibility that comes to mind is a toolbar that is modifying the <body> tag to include some code for popups that is being blocked by the browser.

Recently I've seen some exploits that depend on jquery being present on a page that do similar modifications where view source doesn't show anything, but, the webmaster tools in firefox/chrome for view generated source reveal the bad code.

Might want to run a check to see if the page itself has some code embedded really far down or right and that you're not just assuming since everything you see in the viewport is all that is there, or, to see if you have a toolbar or malware running that might be modifying the page on the fly.

There are 'innocent' toolbars that do use activeX to do tracking and send back information to a central location for trending that might also do it. Or, perhaps spellcheck is now an activeX control and is triggered when the browser see a textarea.

Does it happen on any page with a textarea? or just that one?

2010-12-10, 03:46 PM	#4
cd34 a.k.a. Sparky Join Date: Sep 2004 Location: West Palm Beach, FL, USA Posts: 2,396	The one possibility that comes to mind is a toolbar that is modifying the <body> tag to include some code for popups that is being blocked by the browser. Recently I've seen some exploits that depend on jquery being present on a page that do similar modifications where view source doesn't show anything, but, the webmaster tools in firefox/chrome for view generated source reveal the bad code. Might want to run a check to see if the page itself has some code embedded really far down or right and that you're not just assuming since everything you see in the viewport is all that is there, or, to see if you have a toolbar or malware running that might be modifying the page on the fly. There are 'innocent' toolbars that do use activeX to do tracking and send back information to a central location for trending that might also do it. Or, perhaps spellcheck is now an activeX control and is triggered when the browser see a textarea. Does it happen on any page with a textarea? or just that one? __________________ SnapReplay.com a different way to share photos - iPhone & Android