Broadband Tech > Security > Security > CWS = The most dangerous program...

reply to Buddel

Re: CWS = The most dangerous program...

So before we break out the acetylene, may I ask... is IE under XP SP2 impervious to all CWS drive-by strains? If so, how many duh-clicks would Joe or Jane have to issue before it ran anyway?

-- B
--
In a realm outside causality and function

reply to BlitzenZeus

reply to B
I don't consider IE in XP SP2, it doesn't cover all users, therefore, all users would not be protected if it did prevent it, even in some way.

CWS has always been installed invisibly behind the users backs using exploits whenever possible to my knowledge, and users should never have to disable features to protect themselves, the software should be patched for everyone. If they were prompted with a legitimate prompt to install the software, and read a EULA that would be something very different.
--
My hourly rates:
$25 per hour.
$35 per hour if you want to watch.
$45 per hour if you want to help.
$75 per hour if you tried to fix it, and failed.
The biggest error is sitting in front of your keyboard.

reply to B

reply to antdude
In my view, the really insidious variants are those that install in system. Remove it and System Restore immediately puts the offending file back.

Or the ones that hide in ADS.
--
Better to remain silent and be thought a fool, than to speak and remove all doubt.

reply to B
> Has CoolWebSearch, or ANY other spyware, successfully exploited a browser other than Internet Explorer?

Yep. As mentioned on my info page (as quoted by Name Game), they have also used a Sun Java VM exploit. This would work on any browser that had an old Sun VM loaded, though in this case it was behind a browser sniffer: so IE users would be redirected to an IE-specific exploit, whilst other users would get the Java exploit.

> is IE under XP SP2 impervious to all CWS drive-by strains?

For all CWS exploits I have seen *so far*, yes. However, since there are execute-arbitrary-code holes in IE6SP2 we should expect future CWS exploits to use them. As alternative browsers become more popular, we can also expect CWS affiliates to target any hole found in them in the future.

CWS are not picky. Their MO is to stick multiple browser exploits of various types on an attacker page.

reply to antdude
I had one of these forever. Ran all the anti-spyware tools but it would only temporarily kill it. Finally got into the habit of just running BHODaemon all the time. Whenever it would alert me that my browser had just been hijacked, I would do the following:

Needs to be done immediately or you need to close IE.
1. Tools->Manage addons (Disable new random addon)
2. Double click on new BHO in BHODaemon.
3. Open the file location and delete file.
4. Browse to your Documents and settings file, and under temporary internet files/temp delete the sp.html file that will be created.
5. Reset your homepage
6. Run Regcleaner.

That's a huge pain in the ass when it goes off everyday, especially when it goes off when I'm just checking one quick thing before I run out.

When I did my annual reinstall of Windows XP (now with SP2) it removed it for good. I also upgraded to AVG 7.0 (because they are discontinuing support for 6.0) and that found an offending file and deleted it right off. So nice to be free of dreaded CWS. Some of these variants are just SUPER nasty.

reply to gwion
Because they are in other countries

reply to bobince

reply to antdude
heres the simple reason why ie is the most infected.

Dont have the exact number ut a friend of mines site browser useage stats had ie well over 98% opera moz and firebird/fox variants makeing up less than 2% total. His site gets over 2 mill hits a week.

So i ask you why would th writers of spyware even bother to target non ie browsers. As they would only target 2 maybe 3% of the market.
When it was a neck and neck race between netscape and ie netscape had just as many security flaws and holes as ie did. As netscape fell in useage numbers so did the number of security holes and this was pre windows 95 when ie started to be integraded in to windows. As for the whole ms intrgrating ie in to windows thats a diffrent matter and is no diffrent than linux installs includeing moz variants etc. I mean after all they dont include ie as well as moz based browser now do they?
--
new 3d chat comunity at »planetvirtuel.com my site »spellbound.valshea.com/news.php

reply to novaflare
Oh, please. Let's not do this old, old argument *again*.

Sure, IE's popularity makes it a target. And the alternative browsers are by no means 100% secure.

But Microsoft has made some extremely poor design decisions with IE, which make it very difficult for the software to be made secure.

It's very easy to paint every product as bad as the rest, but there *are* large-scale technical reasons why IE is more prone to security problems.

reply to paranoidxe

Interesting, mozilla launches fine when I remove explorer using task manager and then launch it manually via file - new task..

Maybe its just your build, try upgrading. Firefox has nothing to do with explorer and its dlls, the only browser that would need that is one that skins off of IE itself.

And this topic is getting off topic quick...
--
- paranoidxe (textsource.org)

reply to antdude
Why not patronize other web browsers which are much more safer and securer than IE ... like firefox, netcaptor or opera .... they have more feature in every way!
anyway, force-installs like CoolWebSearch or MyWebSearch suck and their creators must be fed to piranhas or something ....
--
The Blackest day, The Darkest Night ...

reply to novaflare