Full Disclosure mailing list archives
Re: Cool Web Search
From: Andrew Clover <and-bugtraq () doxdesk com>
Date: Fri, 30 Jul 2004 20:44:11 +0900
Gregh <chows () ozemail com au> wrote:
It was used by me to list various entries in registry which, when lumped together like that, show off CWS quite easily. Once they are there, removing them and the progs started by some of them is easy.
This is not the case for all variants of CWS. The newer, sneakier variants can rebuild themselves if they detect a program like HijackThis removing their registry entries.
This is part of a strong trend in unsolicited commercial software, copying survival techniques learned from virus authors. The use of constantly-loaded multiple DLLs and/or processes and/or services that all restart and repair each other if tampering is detected, is becoming widespread (see also CommonName, ClearSearch, TVMedia etc.).
Where there are not short-cut workarounds this means removing the software manually is simply impossible. Currently a trip into Safe Mode can do the trick, by stopping any of the software running, but I'm sure that'll be worked around too eventually. (Rootkit-like spyware?)
-- Andrew Clover mailto:and () doxdesk com http://www.doxdesk.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Cool Web Search Gregh (Jul 29)
- <Possible follow-ups>
- RE: Cool Web Search Richard Golodner (Jul 29)
- Re: Cool Web Search Gregh (Jul 29)
- RE: Cool Web Search Todd Towles (Jul 29)
- Re: Cool Web Search KF (lists) (Jul 29)
- Re: Cool Web Search JacK (Jul 29)
- Re: Cool Web Search Gregh (Jul 29)
- Re: Cool Web Search Andrew Clover (Jul 30)
- Re: Cool Web Search Dave Horsfall (Jul 30)
- Re: Cool Web Search Andrew Clover (Jul 30)
- Re: Cool Web Search Gregh (Jul 30)
- Re: Cool Web Search Valdis . Kletnieks (Jul 30)
- Re: Cool Web Search Andrew Clover (Jul 30)
- Re: Cool Web Search Gregh (Jul 30)
- RE: Cool Web Search Todd Towles (Jul 30)
- Re: Cool Web Search Gregh (Jul 29)
- Re: Cool Web Search Raj Varada (Jul 30)
- Re: Cool Web Search John Kinsella (Jul 30)
- Re: [OT] Hard drive recovery (WAS CoolWebSearch) Andrew Farmer (Jul 30)