full-disclosure - FW: Cool Web Search

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: Thomas.Simmons at ncfcorp.com (Simmons, Thomas)
Subject: FW: Cool Web Search

I have found that if you do an "end process tree" on everything running
that you don't want. Then run through the "ADD & Remove" to remove
everything that you see is not wanted. Follow up with Spybot S&D and
then use HijackThis to remove unwanted Reg problems. Often during the
process of removing apps or even using Spybot you have to reboot and
that requires that you run through the "end process tree" function each
time. I follow up with one last sweep through "add & remove Programs".
This is usually a successful way to remove all Spyware Apps without much
complication.

Thomas Simmons 
Network/Server Support

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Andrew
Clover
Sent: Friday, July 30, 2004 6:44 AM
To: full-disclosure@...ts.netsys.com
Subject: Re: [Full-Disclosure] Cool Web Search

Gregh <chows@...mail.com.au> wrote:

> It was used by me to list various entries in registry which, when
lumped
> together like that, show off CWS quite easily. Once they are there,
removing
> them and the progs started by some of them is easy.

This is not the case for all variants of CWS. The newer, sneakier 
variants can rebuild themselves if they detect a program like HijackThis

removing their registry entries.

This is part of a strong trend in unsolicited commercial software, 
copying survival techniques learned from virus authors. The use of 
constantly-loaded multiple DLLs and/or processes and/or services that 
all restart and repair each other if tampering is detected, is becoming 
widespread (see also CommonName, ClearSearch, TVMedia etc.).

Where there are not short-cut workarounds this means removing the 
software manually is simply impossible. Currently a trip into Safe Mode 
can do the trick, by stopping any of the software running, but I'm sure 
that'll be worked around too eventually. (Rootkit-like spyware?)

-- 
Andrew Clover
mailto:and@...desk.com
http://www.doxdesk.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html