CoolWebSearch

» see coolwebsearch.com as it lived, on the wayback machine

~ the eulogy ~

CoolWebSearch was on the shared machines before I knew it had a name. Internet cafes in Turkey around 2003 ran Windows XP on hardware that fifty strangers a day sat down at, and a good share of those machines opened Internet Explorer onto a search page nobody had chosen. You learned to ignore it the way you ignored the sticky keyboard. It took me a while to work out that the page was a product with a business model behind it.

The first variants turned up in May 2003. The install was usually silent: browsing a prepared page was enough on an unpatched copy of Internet Explorer, and the rest of the time it came attached to something else you had agreed to download. Once it was on, the homepage and the default search both pointed at coolwebsearch.com, popups appeared where no popups had been, and typing an address that failed sent you to a pay-per-click page instead of an error.

The scale is the part that still reads oddly. On 30 March 2005, Richard Stiennon of Webroot told InformationWeek that nearly half of all the PCs the company had audited carried it, and estimated 127 million machines worldwide. He described its only purpose as getting onto a PC and staying there even at the cost of killing the machine, which is a fair summary of the code. Gator, the household name of that category, was second on the same list at about a quarter of the figure.

There was exactly one tool that reliably got it off, and it was written by a Dutch student. Merijn Bellekom built CWShredder alongside HijackThis, gave both away, and by 19 October 2004 had handed CWShredder to InterMute, which Trend Micro then bought the following year. For about two years, the answer to the most widespread piece of Windows malware in the world was a free download from one person's homepage.

~ the dossier ~

~ what it actually did ~

It was not one program. Removal forums named the variants after whatever they impersonated or hooked, so the family tree runs through msconfig, Msoffice, Mupdate, Msinfo and Svchost32, each with different code doing roughly the same job. Some editions rewrote the trusted-sites list and the browser security settings so that whatever came next would install without a prompt. Others turned ordinary words on ordinary pages into links, and dropped shortcuts onto the desktop and into the favorites folder.

The design decisions all point one direction. The ads carried no label saying who served them. There was no license agreement, no about page, no support address, and nothing anywhere that connected the software on your machine to the website it sent you to. Every part of it that a user could see had been built so that a user could not act on it.

~ the truth page ~

The strangest artifact this thing left behind is coolwebsearch.com/hijacking.html, and the archive still has it. Dated 19 May 2005, it opens with an update thanking readers for reporting bad affiliates, sixty new domains added to the list this time, and then addresses the reader directly: "Has your computer been hijacked or taken over by spyware? Are you confident that the person responsible for it is a Coolwebsearch affiliate?" Send screenshots and the source of the page, it says, and the offender's account will be closed without payment.

Then the defense. "You will be shocked to find out that 95% of all so called CWS hijacks have NOTHING WHATSOEVER to do with Coolwebsearch." The capitals are theirs. Unethical competitors were framing them, the argument went, in the same way somebody could forge your email address and get you sent to prison. The front page carried a companion note from August 2005 announcing that their lawyers were considering suing Yahoo for slander, and offering a test anyone could run: follow the redirects, and if they do not pass through 66.250.74.152 or the coolwebsearch.com domain, it is not us.

~ the blank page ~

That defense froze in place. The wording captured in April 2008 is identical to the wording captured in 2005, same news update, same date, same IP address offered as proof. Nobody had touched it in nearly three years. The rest of the site was still there underneath: a keyword bidding page, an affiliates section, a jobs link, and a wall of premium categories running from Phentermine to Home Insurance to i ching.

The archive caught the end within seventy-two hours. On 1 July 2008 the address served the full 4,753 byte page it had been serving all along. On 4 July it returned 243 bytes of nothing, and every capture after that is the same. By October 2012 the domain had been picked up as a Sedo parking page; it now sits with a domain broker, priced by the letter, and the tagline that ran across the top of the real thing is gone. It read: Cool Web Search, the Search you Trust.

~ who it belonged to ~

Nobody was ever charged for it, and the ownership trail was built to look like that on purpose. The terms of service on coolwebsearch.com ran under the law of Quebec, while the DNS registration gave an address in the British Virgin Islands. The web server appeared to be sitting with a hosting company in Massachusetts. Three jurisdictions, no company, no named officer.

Later work on the Koobface network connected Stanislav Avdeyko to CoolWebSearch, which is as close to attribution as this ever got, and it arrived years after the site had already gone quiet. The thing that infected an estimated nine figures worth of computers has no founder, no funding round and no shutdown notice. It has a parked domain and one indignant HTML page that nobody updated after 2005.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »