mailing list archives
Re: Cool Web Search
From: Andrew Clover <and-bugtraq () doxdesk com>
Date: Fri, 30 Jul 2004 20:44:11 +0900
Gregh <chows () ozemail com au> wrote:
It was used by me to list various entries in registry which, when lumped
together like that, show off CWS quite easily. Once they are there, removing
them and the progs started by some of them is easy.
This is not the case for all variants of CWS. The newer, sneakier
variants can rebuild themselves if they detect a program like HijackThis
removing their registry entries.
This is part of a strong trend in unsolicited commercial software,
copying survival techniques learned from virus authors. The use of
constantly-loaded multiple DLLs and/or processes and/or services that
all restart and repair each other if tampering is detected, is becoming
widespread (see also CommonName, ClearSearch, TVMedia etc.).
Where there are not short-cut workarounds this means removing the
software manually is simply impossible. Currently a trip into Safe Mode
can do the trick, by stopping any of the software running, but I'm sure
that'll be worked around too eventually. (Rootkit-like spyware?)
mailto:and () doxdesk com
Full-Disclosure - We believe in it.