When a good idea goes very wrong.

[coyoteden.livejournal.com]

OK, so this evening I was helping out my former employer with a couple of tricky jobs. One of which was cleaning up his own computer. We're all careful about security, but it got hijacked by CoolWebSearch. Don't ask.

Now, this was one of the nastier variants that loads from HKLM/.../Run like most stuff, but then hides itself from the process list, spawns copies, hides the files on disk, puts all the copies in startup, and deletes the original file. If you remove any of the registry keys, it puts them right back. You can't kill it with the usual tools because you just can't see the fnords. The files change every time you reboot, and if you don't get EVERY file from safe mode, it will come right back.

Well, I thought I killed it. I KNOW I killed it. The files had been deleted and the system had been scanned from safe mode.... but the registry keys just kept coming back. Uh-oh. I loaded up Regmon and took a look at what was writing that key in the registry.

"Ad-watch.exe"

Fucking Ad-Aware. Goat-fucking Ad-Aware Pro to be precise. The real-time protection was restoring the damn CoolWebSearch keys (including the browser hijacks!) every time I removed them! And giving no warning. At all.

Comments

[klytus.livejournal.com]

Damn. My real-time protection vs spyware software *always* warns me when ANYTHING in the registry changes. I thought that was the default on all of them.

[jecook]

*face-palms*

[twitchfetish.livejournal.com]

i've been caught by that one...

i now use microsoft's A/S solution believe it or not, coz it's the only one i've found that actually catches most of them...

and it's free coz it's beta :P

IV

MSAS

[coyoteden.livejournal.com]

Yup, same here.

FYI, it will remain free when it's no longer beta, but expect it to suggest ignoring or just not detecting the adware from the compaines Microsoft buys up.

Re: MSAS

[twitchfetish.livejournal.com]

hence why i will still use Spybot...

:)

IV

[jcaswell.livejournal.com]

I've never had the MS one detect a single thing, on any computer. Weird.

[xdownfornowx.livejournal.com]

I've found that using multiple A/S apps works the best, and never keep the restore points from them. I will also concur with twitchfetish that the MS app is really good at actively preventing that bullshit in the first place.

[rrrebo.livejournal.com]

Yep, when I scan my system, I usually run Ad-Aware, Spybot, Spyware Doctor (caught over 2000 items missed by the previous 2), and HijackThis.