Full Disclosure mailing list archives
FW: Cool Web Search
From: "Simmons, Thomas" <Thomas.Simmons () ncfcorp com>
Date: Fri, 30 Jul 2004 15:58:28 -0500
I have found that if you do an "end process tree" on everything running that you don't want. Then run through the "ADD & Remove" to remove everything that you see is not wanted. Follow up with Spybot S&D and then use HijackThis to remove unwanted Reg problems. Often during the process of removing apps or even using Spybot you have to reboot and that requires that you run through the "end process tree" function each time. I follow up with one last sweep through "add & remove Programs". This is usually a successful way to remove all Spyware Apps without much complication. Thomas Simmons Network/Server Support -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Andrew Clover Sent: Friday, July 30, 2004 6:44 AM To: full-disclosure () lists netsys com Subject: Re: [Full-disclosure] Cool Web Search Gregh <chows () ozemail com au> wrote:
It was used by me to list various entries in registry which, when
lumped
together like that, show off CWS quite easily. Once they are there,
removing
them and the progs started by some of them is easy.
This is not the case for all variants of CWS. The newer, sneakier variants can rebuild themselves if they detect a program like HijackThis removing their registry entries. This is part of a strong trend in unsolicited commercial software, copying survival techniques learned from virus authors. The use of constantly-loaded multiple DLLs and/or processes and/or services that all restart and repair each other if tampering is detected, is becoming widespread (see also CommonName, ClearSearch, TVMedia etc.). Where there are not short-cut workarounds this means removing the software manually is simply impossible. Currently a trip into Safe Mode can do the trick, by stopping any of the software running, but I'm sure that'll be worked around too eventually. (Rootkit-like spyware?) -- Andrew Clover mailto:and () doxdesk com http://www.doxdesk.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Re: Cool Web Search, (continued)
- Re: Re: Cool Web Search Aaron Horst (Jul 30)
- RE: Re: Cool Web Search KUIJPERS Jimmy (Jul 30)
- RE: Re: Cool Web Search Dean Porter (Jul 30)
- RE: Re: Cool Web Search Goudie, Derek (Jul 30)
- RE: Re: Cool Web Search kquest (Jul 30)
- Re: Cool Web Search JacK (Jul 30)
- Re: Re: Cool Web Search JacK (Jul 30)
- RE: Re: Cool Web Search Todd Towles (Jul 30)
- RE: Re: Cool Web Search Ron DuFresne (Jul 30)
- RE: Re: Cool Web Search Todd Towles (Jul 30)
- RE: Cool Web Search Schmidt, Michael R. (Jul 30)
- FW: Cool Web Search Simmons, Thomas (Jul 30)
- RE: Cool Web Search Dean Porter (Jul 30)
- Re: Cool Web Search Denis McMahon (Jul 31)