Re: [Full-Disclosure] Cool Web Search

From: Andrew Clover (and-bugtraq_at_doxdesk.com)
Date: 07/30/04

  • Next message: Todd Towles: "RE: [Full-Disclosure] Automated SSH login attempts?"
    To: full-disclosure@lists.netsys.com
    Date: Fri, 30 Jul 2004 20:44:11 +0900
    
    

    Gregh <chows@ozemail.com.au> wrote:

    > It was used by me to list various entries in registry which, when lumped
    > together like that, show off CWS quite easily. Once they are there, removing
    > them and the progs started by some of them is easy.

    This is not the case for all variants of CWS. The newer, sneakier
    variants can rebuild themselves if they detect a program like HijackThis
    removing their registry entries.

    This is part of a strong trend in unsolicited commercial software,
    copying survival techniques learned from virus authors. The use of
    constantly-loaded multiple DLLs and/or processes and/or services that
    all restart and repair each other if tampering is detected, is becoming
    widespread (see also CommonName, ClearSearch, TVMedia etc.).

    Where there are not short-cut workarounds this means removing the
    software manually is simply impossible. Currently a trip into Safe Mode
    can do the trick, by stopping any of the software running, but I'm sure
    that'll be worked around too eventually. (Rootkit-like spyware?)

    -- 
    Andrew Clover
    mailto:and@doxdesk.com
    http://www.doxdesk.com/
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html
    

  • Next message: Todd Towles: "RE: [Full-Disclosure] Automated SSH login attempts?"

    Relevant Pages

    • Re: Removing CoolWebSearch (spyware)
      ... presence of CoolWebSearch (hereafter referred to as CWS) spyware ... Some of these programs are teasers in that they search for spyware ... all of which translate into removing certain registry entries ... in temporary internet files -> content.IE5 manually. ...
      (alt.guitar)
    • Re: Removing CoolWebSearch (spyware)
      ... Previous problem with internet connectivity narrowed to presence ... of CoolWebSearch spyware on machine ... On the effort to remove CWS: ... of which translate into removing certain registry entries using ...
      (alt.guitar)