lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <410A348B.9010306@doxdesk.com>
From: and-bugtraq at doxdesk.com (Andrew Clover)
Subject: Cool Web Search

Gregh <chows@...mail.com.au> wrote:

> It was used by me to list various entries in registry which, when lumped
> together like that, show off CWS quite easily. Once they are there, removing
> them and the progs started by some of them is easy.

This is not the case for all variants of CWS. The newer, sneakier 
variants can rebuild themselves if they detect a program like HijackThis 
removing their registry entries.

This is part of a strong trend in unsolicited commercial software, 
copying survival techniques learned from virus authors. The use of 
constantly-loaded multiple DLLs and/or processes and/or services that 
all restart and repair each other if tampering is detected, is becoming 
widespread (see also CommonName, ClearSearch, TVMedia etc.).

Where there are not short-cut workarounds this means removing the 
software manually is simply impossible. Currently a trip into Safe Mode 
can do the trick, by stopping any of the software running, but I'm sure 
that'll be worked around too eventually. (Rootkit-like spyware?)

-- 
Andrew Clover
mailto:and@...desk.com
http://www.doxdesk.com/


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ