Symantec are Stupid

I’ve just wasted half an hour of my life working out why IMG tags are missing and have been stripped out of the HTML source on my directors laptop.

The key to it was some Javascript that had been injected.

Function SymError()

So if you see this it’s Norton Internet Security and it’s advert blocker at work, seems there’s a list of banned words for images. One of which is “banner”.

So there I am using a perfectly self descriptive image name of main.banner.jpg, which just happens to be an innocent header image spanning the page, and it’s gets wiped out by some lazy cunt at Symantec.

Seems many strings are just wripped out. Here’s a full list. Images of certain sizes are also stripped out as well.

Blocked Strings

CLink
%23CLink
%2Fads%2E
%3Fad%2E
&ad_
&banner=
-ad.cgi
-ads/
.ad.
.ads.
.ads/
.bluestreak.com
.eshop.
.net-on.com
.webconnect.com
/199.78.52.
/?ad.
/ad-
/ad.
/ad/
/ad_control
/ad_image
/ad_track/
/adbot.
/adclient.
/adcontent.
/adcouncil/
/adgifs/
/adgraph/
/adimages/
/adinfo/
/adjuggler/
/adlog.
/adman.
/adnet.
/adnet/
/adpics/
/adpopup
/adproof/
/adredirect/
/adrevolver/
/ads-
/ads.
/ads/
/adsales
/adserv
/adspace
/adsrc
/adv/
/advert/
/advertentie
/advertise/
/advertiser/
/advertisers/
/advertising/
/adverts/
/adview.
/banner.
/banner/
/banner=
/banner_images/
/banners/
/by.banclk?
/clickover.
/cyberfirst
/follow_ad?
/generate_ad.
/graphics/advert
/htmlad/
/jbanner/
/liveads/
/nph-bounce?
/nph-load?
/nph-redir?
/promo_gif/
/promos/
/promote/
/promotions/
/rankem.cgi?action=
/sponsor.
/sponsor/
/sponsors/
/videobanners/
/viewad/
1-2-free.com
199.172.144.25/2
?acb=acb
?ad.cgi
?ad=
?Adcode=
?adlink
?adserv
?adv=
?advertID=
_ad.
_ads/
a32.g.a.yimg.com/7
ad.doubleclick.net/click
ad.infoseek.com
ad.linkexchange.com
ad.preferences.com
ad.tw.doubleclick.net/ad/
adbanner
adbot.com
adcenter.in2.com
AdClick
adcount.hollywood.com
adlink.htm
adlink.preferences.com
adman.medius.net
adoptimizer
adredir.asp
ads.adsmart.net
ads.clickagents.com
ads.imagine-inc.com
ads.imdb.com
ads.infospace.com
ads.lycosasia.com.sg/RealMedia/ads/
ads.narrowline.com
ads.realmedia.com
ads.softbank.net
ads.usatoday.com
ads.washingtonpost.com
ads.web.aol.com
ads.web21.com
adserver.adtech.de
advertisements
advertising.com
alladvantage.com/go.asp?refid=
allpolitics.com/ads/
ar.atwola.com
badservant.guj.de
banner_ad
bannerad
bannerexchange.com
bannerpower.com
bannerswap.com
BF_Home_AD
bfast.com/booklink
cc-dt.com
click1.wisewire.com
click100.genesis.com
click2.wisewire.com
click2net.com
clk_thru^
commonwealth.riddler.com
count4all.com
crosswalk.com/click.ng/transactionID=
dirtycash.com
ds.cybereps.com
exchange-it.com/click.go?
eyeblasterscript
fastclick.net/w/click.here
findcommerce.com/tracking
flycast.com
focalink.com
GeoAD?
globaltrack.com
globaltrak.net
hg1.hitbox.com
home.keycity.com/addd2000/ok.shtml

images/mainad
imgis.com
impartnet.de/cgi-bin/
infoback.net
infoseek.com/redirect
java.yahoo.com/a/1-/flash
java.yahoo.com/a/1-/java
java.yahoo.com/a/a-/flash
java.yahoo.com/a/a-/java
linkexchange.com
linksynergy.com
mantel/
maxcash.cgi?
mediahits.com/click.fcg
mediaserv.247media.com
mirror.qkimg.net
movielink.com/media/imagelinks/MF.ad
movielink.com/media/imagelinks/MF.sponsor
netads.hotwired.com
netbanner.com/cgi-bin/
nrsite.com
pagecount.com
pathfinder.com/r0/marketing
pathfinder.com/sponsors
pegasoweb.com
pennyweb.com
progcgi.ads/
qksrv.net
rd.yahoo.com/M=2
rd.yahoo.com/M=3
rd.yahoo.com/M=4
rd.yahoo.com/M=5
rd.yahoo.com/M=6
rd.yahoo.com/M=0
rd.yahoo.com/M=1
rd.yahoo.com/M=7
rd.yahoo.com/M=8
rd.yahoo.com/M=9
register-it.netscape.com/
mbclick.com/
rn11.com
safe-audit.com
service.bfast.com
showad.asp
smartclicks.com
spinbox.
stats.hitbox.com
submit-it.com/images
telecom-pros.com/images
test1234567890
textchange.com/cgi-bin/
tracker.clicktrade.com
tracker.tragedoubler.com
us.a1.yimg.com/us.yimg.com/a
valueclick.com
vk4Voam2y
vwWzJwWLv9m2Cr
websponsors.com/cgi-bin/
webunion.com/cgi-localbin/click.cgi?
weg352o643t322c463h321a
ww3.cybercity.com/tw/adexe/
www.247media.com.tw
www.admax.com.tw/
www.admax.com
www.ads.warnerbros.com
www.anonymozer.com/cm/door.cgi?
www.asiad.net/
www.banner.com.tw/
www.bannerwomen.com
www.clickadhere.com/
www.clickxchange.com/fr.phtml
www.cyberone.com.tw
www.epaper.com.tw/cgi-bin/adm/ad_red
www.halee.com/advert/
www.link4link.com/cgi-bin/
www.marketspace
www.modchip.com/clickcgi/click.cgi?
www.netvigator.com.tw/popad/
www.nj.com/adverts
www.nrsite.com
www.search.com/Banners
www.warehouse.com/netbuyer/ticker/
www.whispa.com/tracking/
www.wishing.com/webaudit/
yahoo.com/adv/
yahoo.com/CategoryId=0
yimg.com/images/compliance


Blocked image sizes

Images:
125x125
160x600
180x150
234x60
240x400
250x250
300x250
336x280
468x60
88x31
120x90
120x60
120x240