CWShredder

~ the last words ~

Your home page changed and it would not change back. That was the symptom, and in 2003 and 2004 it was everywhere. Internet Explorer 6 opened onto coolwebsearch.com instead of whatever you had set, and a toolbar you never installed sat above the page. A folder of bookmarks to pornography had appeared on the desktop. Deleting the entries did nothing, because something was putting them back.

CWShredder was written by Merijn Bellekom, a Dutch student who had already made himself useful by writing HijackThis. CoolWebSearch first showed up in May 2003 and went deeper than the adware people were used to. Rather than sit in the startup folder waiting to be found, it hid in DLLs registered as browser helper objects. Some builds arrived by drive-by download, from a page you had done nothing but visit.

I was at university when this was happening, still on dial-up at home for most of it, and the hijacked home page is the one piece of malware from that period I can still picture. Everything else announced itself as a slowdown you could argue about. This announced itself in the address bar every single time the browser opened. What I do not remember is anyone around me running a removal tool for it. The fix in practice was to reinstall Windows, which took an afternoon and was considered ordinary maintenance.

~ the record ~

~ the fall ~

The problem with CWShredder was never the code. It was the release schedule on the other side. New CoolWebSearch variants appeared every few weeks, and by mid-2004 Bellekom counted more than a thousand affiliates pushing the thing. Some builds were written specifically to disable removal tools, and the sites hosting CWShredder were knocked offline by denial-of-service attacks.

In June 2004 he stopped. The statement was not dramatic. He said he did not have the tools to remove the latest variants, and that they were too aggressive or too complicated to allow for automated removal. Version 1.59 was the last one he signed. He had earlier described CoolWebSearch as the most devious hijacker he had come across, which from the person who had taken apart every version of it was not marketing.

~ the postmortem ~

InterMute bought CWShredder on 19 October 2004 and folded it into SpySubtract, its paid anti-spyware product. Eight months later, in June 2005, Trend Micro bought InterMute. The tool kept being offered as a free standalone download and also went into what Trend Micro renamed Trend Micro Anti-Spyware, so on paper it had been rescued by a company with real resources behind it.

The last build was 2.19, in November 2005. There was no announcement and no final version notice. A tool whose entire value was keeping pace with a target that moved every three weeks simply stopped moving, and the download link stayed up for years afterward pointing at software that had quietly stopped being true.

~ the long tail ~

CoolWebSearch itself did not outlast the browser it was built for. Internet Explorer 6 was the whole attack surface, and once Firefox and then Chrome took real share and Microsoft shipped IE 7 with a tighter add-on model, the family stopped being worth maintaining. The people behind it went to work that scaled better.

What CWShredder proved was that one person could out-engineer a commercial malware operation for about twelve months, and then could not. Every model that came after assumes the opposite: signatures pushed daily by a company with staff, because no individual keeps up. Bellekom sold HijackThis to Trend Micro as well, and that one at least got open sourced years later. CWShredder never did. It is still on download mirrors, version 2.19 dated November 2005, offering to clean an infection that nothing has run in fifteen years.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »