Spyware is a type of malware that can be installed on
computers, and which collects small pieces of information about users without their knowledge. The presence of spyware is typically hidden from the user, and can be difficult to detect. Typically, spyware is secretly installed on the user's
personal computer. Sometimes, however, spywares such as
keyloggers are installed by the owner of a shared, corporate, or
public computer on purpose in order to secretly monitor other users.
While the term
spyware suggests software that secretly monitors the user's computing, the functions of spyware extend well beyond simple monitoring. Spyware programs can collect various types of
personal information, such as Internet surfing habits and sites that have been visited, but can also interfere with user control of the computer in other ways, such as installing additional software and redirecting
Web browser activity. Spyware is known to change computer settings, resulting in slow connection speeds, different home pages, and/or loss of
Internet connection or functionality of other programs. In an attempt to increase the understanding of spyware, a more formal classification of its included software types is provided by the term
privacy-invasive software.
In response to the emergence of spyware, a small industry has sprung up dealing in
anti-spyware software. Running anti-spyware software has become a widely recognized element of
computer security practices for computers, especially those running
Microsoft Windows. A number of jurisdictions have passed anti-spyware laws, which usually target any software that is surreptitiously installed to control a user's computer.
[edit] History and development
The first recorded use of the term
spyware occurred on 16 October 1995 in a
Usenet post that poked fun at
Microsoft's
business model.
[1] Spyware at first denoted
software meant for
espionage purposes. However, in early 2000 the founder of
Zone Labs, Gregor Freund, used the term in a
press release for the
ZoneAlarm Personal Firewall.
[2] Since then, "spyware" has taken on its present sense.
[2] According to a 2005 study by
AOL and the National Cyber-Security Alliance, 61 percent of surveyed users' computers were infected with form of spyware. 92 percent of surveyed users with spyware reported that they did not know of its presence, and 91 percent reported that they had not given permission for the installation of the spyware.
[3] As of 2006, spyware has become one of the preeminent security threats to computer systems running Microsoft Windows
operating systems. Computers on which
Internet Explorer (IE) is the primary
browser are particularly vulnerable to such attacks, not only because IE is the most widely-used,
[4] but because its tight integration with Windows allows spyware access to crucial parts of the operating system.
[4][5]
Before
Internet Explorer 6 SP2 was released as part of
Windows XP Service Pack 2, the browser would automatically display an installation window for any
ActiveX component that a website wanted to install. The combination of user naivety concerning
malware, and the assumption by
Internet Explorer that all ActiveX components are benign, led, in part, to the massive spread of spyware. Many spyware components would also make use of
exploits in
Javascript, Internet Explorer and Windows to install without user knowledge or permission.
The
Windows Registry contains multiple sections where modification of key values allows software to be executed automatically when the operating system boots. Spyware can exploit this design to circumvent attempts at removal. The spyware typically will link itself from each location in the
registry that allows execution. Once running, the spyware will periodically check if any of these links are removed. If so, they will be automatically restored. This ensures that the spyware will execute when the operating system is booted, even if some (or most) of the registry links are removed.
[edit] Comparison
[edit] Spyware, adware and tracking
The term
adware frequently refers to any software which displays advertisements, whether or not the user has consented. Programs such as the
Eudora mail client display advertisements as an alternative to
shareware registration fees. These may be classified as "adware", in the sense of advertising-supported software, but not as spyware. Adware in this form does not operate surreptitiously or mislead the user, and provides the user with a specific service.
Most adware is
spyware in a different sense than "advertising-supported software": it displays advertisements related to what it finds from spying on users. Gator Software from
Claria Corporation (formerly GATOR) and Exact Advertising's
BargainBuddy are examples. Visited Web sites frequently install Gator on client machines in a surreptitious manner, and it directs revenue to the installing site and to Claria by displaying advertisements to the user. The user is shown many
pop-up advertisements.
Other spyware behavior, such as reporting on websites the user visits, occurs in the background. The data is used for "targeted" advertisement impressions. The prevalence of spyware has cast suspicion on other programs that track Web browsing, even for statistical or research purposes. Some observers describe the
Alexa Toolbar, an Internet Explorer plug-in published by
Amazon.com, as spyware, and some anti-spyware programs such as
Ad-Aware report it as such. Many of these adware-distributing companies are backed by millions of dollars of adware-generating revenues. Adware and spyware are similar to viruses in that they can be considered malicious in nature. People are profiting from misleading adware, sometimes known as
scareware, such as
Antivirus 2009.
Similarly, software bundled with free, advertising-supported programs such as
P2P acts as spyware (and, if removed, disables the 'parent' program), yet people are willing to download it. This presents a dilemma for proprietors of anti-spyware products whose removal tools may inadvertently disable wanted programs. For example,
WhenUSave is ignored by popular anti-spyware program
Ad-Aware (but removed as spyware by most scanners) because it is part of the popular (but recently decommissioned) eDonkey client.
[6] To address this dilemma, the
Anti-Spyware Coalition was formed to establish and document best practices regarding acceptable software behavior.
[citation needed]
[edit] Spyware, viruses and worms
Unlike
viruses and
worms, spyware does not usually self-replicate. Like
many recent viruses, however, spyware—by design—exploits infected computers for commercial gain. Typical tactics include delivery of unsolicited pop-up advertisements, theft of personal information (including financial information such as
credit card numbers), monitoring of Web-browsing activity for
marketing purposes, and routing of
HTTP requests to advertising sites.
However, spyware can be dropped as a payload by a worm.
[edit] Routes of infection
Spyware does not directly spread in the manner of a computer virus or worm: generally, an infected system does not attempt to transmit the infection to other computers. Instead, spyware gets on a system through deception of the user or through exploitation of software vulnerabilities.
Most spyware is installed without users' knowledge. Since they tend not to install software if they know that it will disrupt their working environment and compromise their privacy, spyware deceives users, either by
piggybacking on a piece of desirable software such as
Kazaa, or by tricking them into installing it (the
Trojan horse method). Some "rogue" spyware programs masquerade as security software.
The distributor of spyware usually presents the program as a useful utility—for instance as a "Web accelerator" or as a helpful
software agent. Users download and install the software without immediately suspecting that it could cause harm. For example,
Bonzi Buddy, a program bundled with spyware
[7] and targeted at children, claims that:
He will explore the Internet with you as your very own friend and sidekick! He can talk, walk, joke, browse, search, e-mail, and download like no other friend you've ever had! He even has the ability to compare prices on the products you love and help you save money! Best of all, he's FREE![8]
Spyware can also come bundled with other software. The user downloads a program and installs it, and the installer additionally installs the spyware. Although the desirable software itself may do no harm, the bundled spyware does. In some cases, spyware authors have paid shareware authors to bundle spyware with their software. In other cases, spyware authors have repackaged desirable freeware with installers that slipstream spyware.
Some spyware authors infect a system through security holes in the Web browser or in other software. When the user navigates to a Web page controlled by the spyware author, the page contains code which attacks the browser and forces the download and installation of spyware. The spyware author would also have some extensive knowledge of commercially-available anti-virus and firewall software. This has become known as a "
drive-by download", which leaves the user a hapless bystander to the attack. Common
browser exploits target security vulnerabilities in Internet Explorer and in the
Sun Microsystems Java runtime.
The installation of spyware frequently involves Internet Explorer. Its popularity and history of security issues have made it the most frequent target. Its deep integration with the Windows environment and scriptability make it an obvious point of attack into
Windows. Internet Explorer also serves as a point of attachment for spyware in the form of
Browser Helper Objects, which modify the browser's behavior to add toolbars or to redirect traffic.
In a few cases, a
worm or
virus has delivered a spyware payload. Some attackers used the
Spybot worm to install spyware that put pornographic pop-ups on the infected system's screen.
[9] By directing traffic to ads set up to channel funds to the spyware authors, they profit personally.
[edit] Effects and behaviors
A spyware program is rarely alone on a computer: an affected machine usually has multiple infections. Users frequently notice unwanted behavior and degradation of system performance. A spyware infestation can create significant unwanted
CPU activity, disk usage, and network traffic. Stability issues, such as applications freezing, failure to boot, and system-wide crashes, are also common. Spyware, which interferes with networking software, commonly causes difficulty connecting to the Internet.
In some infections, the spyware is not even evident. Users assume in those situations that the performance issues relate to faulty hardware, Windows installation problems, or another
infection. Some owners of badly infected systems resort to contacting
technical support experts, or even buying a new computer because the existing system "has become too slow". Badly infected systems may require a clean reinstallation of all their software in order to return to full functionality.
Only rarely does a single piece of software render a computer unusable. Rather, a computer is likely to have multiple infections. The cumulative effect, and the interactions between spyware components, causes the symptoms commonly reported by users: a computer, which slows to a crawl, overwhelmed by the many parasitic processes running on it. Moreover, some types of spyware disable software
firewalls and anti-virus software, and/or reduce browser security settings, thus opening the system to further
opportunistic infections, much like an
immune deficiency disease. Some spyware disables or even removes competing spyware programs, on the grounds that more spyware-related annoyances make it even more likely that users will take action to remove the programs. One spyware maker, Avenue Media, even
sued a competitor, Direct Revenue, over this; the two later
settled with an agreement not to disable each others' products.
[10]
Some other types of spyware use
rootkit like techniques to prevent detection, and thus removal. Targetsoft, for instance, modifies the "
Winsock" Windows Sockets files. The deletion of the spyware-infected file "inetadpt.dll" will interrupt normal networking usage.
A typical Windows user has administrative privileges, mostly for convenience. Because of this, any program the user runs (intentionally or not) has unrestricted access to the system. As with other
operating systems, Windows users too are able to follow the principle of
least privilege and use non-administrator
least user access accounts, or to reduce the
privileges of specific vulnerable Internet-facing
processes such as Internet Explorer (through the use of tools such as
DropMyRights). However, as this is not a default configuration, few users do this.
In
Windows Vista, by default, a computer administrator runs everything under limited user privileges. When a program requires administrative privileges, Vista will prompt the user with an allow/deny pop-up (see
User Account Control). This improves on the design used by previous versions of Windows.
[edit] Advertisements
Many spyware programs display advertisements. Some programs simply display pop-up ads on a regular basis; for instance, one every several minutes, or one when the user opens a new browser window. Others display ads in response to the user visiting specific sites. Spyware operators present this feature as desirable to advertisers, who may buy ad placement in pop-ups displayed when the user visits a particular site. It is also one of the purposes for which spyware programs gather information on user behavior.
Many users complain about irritating or offensive advertisements as well. As with many
banner ads, spyware advertisements often use animation or flickering banners, which can be visually distracting and annoying to users. Pop-up ads for
pornography often display indiscriminately. Links to these sites may be added to the browser window, history or search function. When children are the users, this could possibly violate
anti-pornography laws in some jurisdictions.
A number of spyware programs break the boundaries of illegality; variations of “Zlob.Trojan” and “Trojan-Downloader.Win32.INService” have been known to show undesirable child pornography, key gens, cracks and illegal software pop-up ads, which violate child pornography and copyright laws.
[11][12][13][14]
A further issue in the case of some spyware programs concerns the replacement of
banner ads on viewed web sites. Spyware that acts as a
web proxy or a
Browser Helper Object can replace references to a site's own advertisements (which fund the site) with advertisements that instead fund the spyware operator. This cuts into the margins of advertising-funded Web sites.
[edit] "Stealware" and affiliate fraud
A few spyware vendors, notably
180 Solutions, have written what the
New York Times has dubbed "
stealware", and what spyware researcher Ben Edelman terms
affiliate fraud, a form of
click fraud. Stealware diverts the payment of
affiliate marketing revenues from the legitimate affiliate to the spyware vendor.
Spyware which attacks
affiliate networks places the spyware operator's affiliate tag on the user's activity — replacing any other tag, if there is one. The spyware operator is the only party that gains from this. The user has their choices thwarted, a legitimate affiliate loses revenue, networks' reputations are injured, and vendors are harmed by having to pay out affiliate revenues to an "affiliate" who is not party to a contract.
[15]
Affiliate fraud is a violation of the
terms of service of most affiliate marketing networks. As a result, spyware operators such as 180 Solutions have been terminated from affiliate networks including LinkShare and ShareSale.
[citation needed]
[edit] Identity theft and fraud
In one case, spyware has been closely associated with
identity theft.
[16] In August 2005, researchers from security software firm Sunbelt Software suspected the creators of the common
CoolWebSearch spyware had used it to transmit "
chat sessions,
user names,
passwords, bank information, etc.";
[17] however it turned out that "it actually (was) its own sophisticated criminal little trojan that's independent of CWS."
[18] This case is currently under investigation by the
FBI.
The
Federal Trade Commission estimates that 27.3 million Americans have been victims of identity theft, and that financial losses from identity theft totaled nearly $48 billion for businesses and financial institutions and at least $5 billion in out-of-pocket expenses for individuals.
[19]
Spyware-makers may commit
wire fraud with
dialer program spyware. These can reset a
modem to dial up a premium-rate telephone number instead of the usual
ISP. Connecting to these suspicious numbers involves long-distance or overseas charges which invariably result in high call costs. Dialers are ineffective on computers that do not have a modem, or are not connected to a telephone line, and are now very rare due to the decline in use of dial-up internet access.
[edit] Digital rights management
Some copy-protection technologies have borrowed from spyware. In 2005,
Sony BMG Music Entertainment was
found to be using rootkits in its
XCP digital rights management technology
[20] Like spyware, not only was it difficult to detect and uninstall, it was so poorly written that most efforts to remove it could have rendered computers unable to function.
Texas Attorney General Greg Abbott filed suit,
[21] and three separate
class-action suits were filed.
[22] Sony BMG later provided a workaround on its website to help users remove it.
[23]
Beginning on 25 April 2006, Microsoft's
Windows Genuine Advantage Notifications application
[24] was installed on most Windows PCs as a "critical security update". While the main purpose of this deliberately uninstallable application is to ensure the copy of Windows on the machine was lawfully purchased and installed, it also installs software that has been accused of "
phoning home" on a daily basis, like spyware.
[25][26] It can be removed with the RemoveWGA tool.
[edit] Personal relationships
Spyware has been used to surreptitiously monitor electronic activities of partners in intimate relationships, generally to uncover evidence of infidelity. At least one software package, Loverspy, was specifically marketed for this purpose. Depending on local laws regarding communal/marital property, observing a partner's online activity without their consent may be illegal; the author of Loverspy and several users of the product were indicted in California in 2005 on charges of wiretapping and various computer crimes.
[27]
[edit] Browser cookies
Anti-spyware programs often report Web advertisers'
HTTP cookies, the small text files that track browsing activity, as spyware. While they are not always inherently malicious, many users object to third parties using space on their personal computers for their business purposes, and many anti-spyware programs offer to remove them.
[28]
[edit] Examples
These common spyware programs illustrate the diversity of behaviors found in these attacks. Note that as with computer viruses, researchers give names to spyware programs which may not be used by their creators. Programs may be grouped into "families" based not on shared program code, but on common behaviors, or by "following the money" of apparent financial or business connections. For instance, a number of the spyware programs distributed by
Claria are collectively known as "Gator". Likewise, programs that are frequently installed together may be described as parts of the same spyware package, even if they function separately.
- CoolWebSearch, a group of programs, takes advantage of Internet Explorer vulnerabilities. The package directs traffic to advertisements on Web sites including coolwebsearch.com. It displays pop-up ads, rewrites search engine results, and alters the infected computer's hosts file to direct DNS lookups to these sites.[29]
- Internet Optimizer, also known as DyFuCa, redirects Internet Explorer error pages to advertising. When users follow a broken link or enter an erroneous URL, they see a page of advertisements. However, because password-protected Web sites (HTTP Basic authentication) use the same mechanism as HTTP errors, Internet Optimizer makes it impossible for the user to access password-protected sites.[30]
- HuntBar, aka WinTools or Adware.Websearch, was installed by an ActiveX drive-by download at affiliate Web sites, or by advertisements displayed by other spyware programs—an example of how spyware can install more spyware. These programs add toolbars to IE, track aggregate browsing behavior, redirect affiliate references, and display advertisements.[31][32]
- WeatherStudio has a plugin that displays a window-panel near the bottom of a browser window. The official website notes that it is easy to remove (uninstall) WeatherStudio from a computer, using its own uninstall-program, such as under C:\Program Files\WeatherStudio.[36] Once WeatherStudio is removed, a browser returns to the prior display appearance, without the need to modify the browser settings.
- Zango (formerly 180 Solutions) transmits detailed information to advertisers about the Web sites which users visit. It also alters HTTP requests for affiliate advertisements linked from a Web site, so that the advertisements make unearned profit for the 180 Solutions company. It opens pop-up ads that cover over the Web sites of competing companies (as seen in their [Zango End User License Agreement]).[15]
- Zlob trojan, or just Zlob, downloads itself to a computer via an ActiveX codec and reports information back to Control Server[citation needed]. Some information can be the search-history, the Websites visited, and even keystrokes.[citation needed] More recently, Zlob has been known to hijack routers set to defaults.[37]
[edit] Legal issues
[edit] Criminal law
Unauthorized access to a computer is illegal under
computer crime laws, such as the U.S.
Computer Fraud and Abuse Act, the U.K.'s
Computer Misuse Act, and similar laws in other countries. Since owners of computers infected with spyware generally claim that they never authorized the installation, a
prima facie reading would suggest that the promulgation of spyware would count as a criminal act. Law enforcement has often pursued the authors of other malware, particularly viruses. However, few spyware developers have been prosecuted, and many operate openly as strictly legitimate businesses, though some have faced lawsuits.
[38][39]
Spyware producers argue that, contrary to the users' claims, users do in fact give
consent to installations. Spyware that comes bundled with shareware applications may be described in the
legalese text of an
end-user license agreement (EULA). Many users habitually ignore these purported contracts, but spyware companies such as Claria say these demonstrate that users have consented.
Despite the ubiquity of EULAs and of "
clickwrap" agreements, under which a single click can be taken as consent to the entire text, relatively little
caselaw has resulted from their use. It has been established in most
common law jurisdictions that a clickwrap agreement can be a binding contract
in certain circumstances.[40] This does not, however, mean that every such agreement is a
contract, or that every term in one is enforceable.
Some jurisdictions, including the U.S. states of
Iowa[41] and
Washington,
[42] have passed laws criminalizing some forms of spyware. Such laws make it illegal for anyone other than the owner or operator of a computer to install software that alters Web-browser settings, monitors keystrokes, or disables computer-security software.
In the United States, lawmakers introduced a bill in 2005 entitled the
Internet Spyware Prevention Act, which would imprison creators of spyware.
[43]
[edit] Administrative sanctions
[edit] US FTC actions
The US
Federal Trade Commission has sued Internet marketing organizations under the "
unfairness doctrine"
[44] to make them stop infecting consumers’ PCs with spyware. In one case, that against Seismic Entertainment Productions, the FTC accused the defendants of developing a program that seized control of PCs nationwide, infected them with spyware and other malicious software, bombarded them with a barrage of pop-up advertising for Seismic’s clients, exposed the PCs to security risks, and caused them to malfunction, slow down, and, at times, crash. Seismic then offered to sell the victims an “antispyware” program to fix the computers, and stop the popups and other problems that Seismic had caused. On November 21, 2006, a settlement was entered in federal court under which a $1.75 million judgment was imposed in one case and $1.86 million in another, but the defendants were insolvent
[45]
In a second case, brought against CyberSpy Software LLC, the FTC charged that CyberSpy marketed and sold "RemoteSpy" keylogger spyware to clients who would then secretly monitor unsuspecting consumers’ computers. According to the FTC, Cyberspy touted RemoteSpy as a “100% undetectable” way to “Spy on Anyone. From Anywhere.” The FTC has obtained a temporary order prohibiting the defendants from selling the software and disconnecting from the Internet any of their servers that collect, store, or provide access to information that this software has gathered. The case is still in its preliminary stages. A complaint filed by the
Electronic Privacy Information Center (EPIC) brought the RemoteSpy software to the FTC’s attention.
[46]
[edit] Netherlands OPTA
An administrative fine, the first of its kind in Europe, has been issued by the Independent Authority of Posts and Telecommunications (OPTA) from the Netherlands. It applied fines in total value of Euro 1,000,000 for infecting 22 million computers. The spyware concerned is called DollarRevenue. The law articles that have been violated are art. 4.1 of the Decision on universal service providers and on the interests of end users; the fines have been issued based on art. 15.4 taken together with art. 15.10 of the Dutch telecommunications law. A part of these fines has to be paid personally by the directors of these companies, i.e. not from the accounts of their companies, but from their personal fortunes.
[47] Since an appeal has been lodged, the fines will have to be paid only after a Dutch law court makes a decision in this case. The culprits maintain that the evidence for violating the two law articles has been obtained illegally. The names of the directors and the names of the companies have not been revealed, since it is not clear that OPTA is allowed to make such information public.
[48]
[edit] Civil law
Former
New York State Attorney General and former
Governor of New York Eliot Spitzer has pursued spyware companies for fraudulent installation of software.
[49] In a suit brought in 2005 by Spitzer, the California firm
Intermix Media, Inc. ended up settling, by agreeing to pay US$7.5 million and to stop distributing spyware.
[50]
The hijacking of Web advertisements has also led to litigation. In June 2002, a number of large Web publishers sued
Claria for replacing advertisements, but settled out of court.
Courts have not yet had to decide whether advertisers can be held
liable for spyware that displays their ads. In many cases, the companies whose advertisements appear in spyware pop-ups do not directly do business with the spyware firm. Rather, they have contracted with an
advertising agency, which in turn contracts with an online subcontractor who gets paid by the number of "impressions" or appearances of the advertisement. Some major firms such as
Dell Computer and
Mercedes-Benz have sacked advertising agencies that have run their ads in spyware.
[51]
[edit] Libel suits by spyware developers
Litigation has gone both ways. Since "spyware" has become a common
pejorative, some makers have filed
libel and
defamation actions when their products have been so described. In 2003, Gator (now known as Claria) filed suit against the website
PC Pitstop for describing its program as "spyware".
[52] PC Pitstop settled, agreeing not to use the word "spyware", but continues to describe harm caused by the Gator/Claria software.
[53] As a result, other anti-spyware and anti-virus companies have also used other terms such as "potentially unwanted programs" or
greyware to denote these products.
[edit] WebcamGate
In the 2010
WebcamGate case, plaintiffs charged two suburban Philadelphia high schools secretly spied on students by surreptitiously and remotely activating webcams embedded in school-issued laptops the students were using at home, and therefore infringed on their privacy rights. The school loaded each student's computer with
LANrev's remote activation tracking software. This included the now-discontinued "TheftTrack". While TheftTrack was not enabled by default on the software, the program allowed the school district to elect to activate it, and to choose which of the TheftTrack surveillance options the school wanted to enable.
[54]
TheftTrack allowed school district employees to secretly remotely activate a tiny webcam embedded in the student's laptop, above the laptop's screen. That allowed school officials to secretly take photos through the webcam, of whatever was in front of it and in its line of sight, and send the photos to the school's server. The LANrev software disabled the webcams for all other uses (
e.g., students were unable to use
Photo Booth or
video chat), so most students mistakenly believed their webcams did not work at all. In addition to webcam surveillance, TheftTrack allowed school officials to take screenshots, and send them to the school's server. In addition, LANrev allowed school officials to take snapshots of instant messages, web browsing, music playlists, and written compositions. The schools admitted to secretly snapping over 66,000 webshots and
screenshots, including webcam shots of students in their bedrooms.
[54][55]
[edit] Remedies and prevention
As the spyware threat has worsened, a number of techniques have emerged to counteract it. These include programs designed to remove or to block spyware, as well as various user practices which reduce the chance of getting spyware on a system.
Nonetheless, spyware remains a costly problem. When a large number of pieces of spyware have infected a Windows computer, the only remedy may involve backing up user data, and fully reinstalling the operating system. For instance, some versions of
Vundo cannot be completely removed by Symantec, Microsoft, PC Tools, and others because it infects rootkit, Internet Explorer, and Windows' lsass.exe (Local Security Authority Subsystem Service) with a randomly-filenamed dll (dynamic link library).
[edit] Anti-spyware programs
Many programmers and some commercial firms have released products dedicated to remove or block spyware.
Steve Gibson's
OptOut pioneered a growing category. Programs such as PC Tools'
Spyware Doctor, Lavasoft's
Ad-Aware SE (free scans for non-commercial users, must pay for other features) and Patrick Kolla's
Spybot - Search & Destroy (all features free for non-commercial use) rapidly gained popularity as effective tools to remove, and in some cases intercept, spyware programs. On December 16, 2004,
Microsoft acquired the
GIANT AntiSpyware software,
[56] rebranding it as
Windows AntiSpyware beta and releasing it as a free download for Genuine Windows XP and Windows 2003 users. In 2006,
Microsoft renamed the beta software to
Windows Defender (free), and it was released as a free download in October 2006 and is included as standard with Windows Vista as well as Windows 7.
Major anti-virus firms such as
Symantec,
PC Tools,
McAfee and
Sophos have come later to the table, adding anti-spyware features to their existing anti-virus products. Early on, anti-virus firms expressed reluctance to add anti-spyware functions, citing lawsuits brought by spyware authors against the authors of web sites and programs which described their products as "spyware". However, recent versions of these major firms' home and business anti-virus products do include anti-spyware functions, albeit treated differently from viruses. Symantec Anti-Virus, for instance, categorizes spyware programs as "extended threats" and now offers
real-time protection from them (as it does for viruses).
Recently
[when?], the anti-virus company
Grisoft, creator of
AVG Anti-Virus, acquired anti-spyware firm Ewido Networks, re-labeling their Ewido anti-spyware program as AVG Anti-Spyware Professional Edition. AVG also used this product to add an integrated anti-spyware solution to some versions of the
AVG Anti-Virus family of products, and a
freeware AVG Anti-Spyware Free Edition available for private and non-commercial use. This shows a trend by anti virus companies to launch a dedicated solution to spyware and malware. Zone Labs, creator of
Zone Alarm firewall have also released an anti-spyware program.
Anti-spyware programs can combat spyware in two ways:
- They can provide real time protection against the installation of spyware software on the computer. This type of spyware protection works the same way as that of anti-virus protection in that the anti-spyware software scans all incoming network data for spyware software and blocks any threats it comes across.
- Anti-spyware software programs can be used solely for detection and removal of spyware software that has already been installed onto the computer. This type of spyware protection is normally much easier to use and more popular. With this spyware protection software the user can schedule weekly, daily, or monthly scans of the computer to detect and remove any spyware software that have been installed on the computer. This type of anti-spyware software scans the contents of the windows registry, operating system files, and installed programs on the computer and will provide a list of any threats found, allowing the user to choose what to delete and what to keep.
Such programs inspect the contents of the Windows registry, the operating system files, and installed programs, and remove files and entries which match a list of known spyware components. Real-time protection from spyware works identically to real-time anti-virus protection: the software scans disk files at download time, and blocks the activity of components known to represent spyware. In some cases, it may also intercept attempts to install start-up items or to modify browser settings. Because many spyware and adware are installed as a result of browser exploits or user error, using security software (some of which are antispyware, though many are not) to
sandbox browsers can also be effective to help restrict any damage done.
Earlier versions of anti-spyware programs focused chiefly on detection and removal. Javacool Software's
SpywareBlaster, one of the first to offer real-time protection, blocked the installation of
ActiveX-based and other spyware programs.
Like most anti-virus software, many anti-spyware/adware tools require a frequently-updated database of threats. As new spyware programs are released, anti-spyware developers discover and evaluate them, making "signatures" or "definitions" which allow the software to detect and remove the spyware. As a result, anti-spyware software is of limited usefulness without a regular source of updates. Some vendors provide a subscription-based update service, while others provide updates free. Updates may be installed automatically on a schedule or before doing a scan, or may be done manually.
Not all programs rely on updated definitions. Some programs rely partly (for instance many antispyware programs such as Windows Defender,
Spybot's TeaTimer and Spysweeper) or fully (programs falling under the class of
HIPS such as BillP's WinPatrol) on historical observation. They watch certain configuration parameters (such as certain portions of the Windows registry or browser configuration) and report any change to the user, without judgment or recommendation. While they do not rely on updated definitions, which may allow them to spot newer spyware, they can offer no guidance. The user is left to determine "what did I just do, and is this configuration change appropriate?"
Windows Defender's SpyNet attempts to alleviate this through offering a community to share information, which helps guide both users, who can look at decisions made by others, and analysts, who can spot fast-spreading spyware. A popular generic spyware removal tool used by those with a certain degree of expertise is
HijackThis, which scans certain areas of the Windows OS where spyware often resides and presents a list with items to delete manually. As most of the items are legitimate windows files/registry entries it is advised for those who are less knowledgeable on this subject to post a HijackThis log on the numerous antispyware sites and let the experts decide what to delete.
If a spyware program is not blocked and manages to get itself installed, it may resist attempts to terminate or uninstall it. Some programs work in pairs: when an anti-spyware scanner (or the user) terminates one running process, the other one respawns the killed program. Likewise, some spyware will detect attempts to remove registry keys and immediately add them again. Usually, booting the infected computer in
safe mode allows an anti-spyware program a better chance of removing persistent spyware. Killing the process tree may also work.
A new breed of spyware (Look2Me spyware by NicTechNetworks is a good example) hides inside system-critical processes and start up even in safe mode, see
rootkit. With no process to terminate they are harder to detect and remove. Sometimes they do not even leave any on-disk signatures.
Rootkit technology is also seeing increasing use,
[57] as is the use of
NTFS alternate data streams. Newer spyware programs also have specific countermeasures against well known anti-malware products and may prevent them from running or being installed, or even uninstall them. An example of one that uses all three methods is Gromozon, a new breed of malware. It uses alternate data streams to hide. A
rootkit hides it even from alternate data streams scanners and actively stops popular
rootkit scanners from running.
[edit] Security practices
To detect spyware, computer users have found several practices useful in addition to installing anti-spyware programs.
Many system operators install a
web browser other than IE, such as
Opera,
Google Chrome or
Mozilla Firefox. Though no browser is completely safe, Internet Explorer is at a greater risk for spyware infection due to its large user base as well as vulnerabilities such as
ActiveX..[citation needed]
Some ISPs—particularly
colleges and universities—have taken a different approach to blocking spyware: they use their network
firewalls and
web proxies to block access to Web sites known to install spyware. On March 31, 2005,
Cornell University's Information Technology department released a report detailing the behavior of one particular piece of proxy-based spyware,
Marketscore, and the steps the university took to intercept it.
[58] Many other educational institutions have taken similar steps. Spyware programs which redirect network traffic cause greater technical-support problems than programs which merely display ads or monitor users' behavior, and so may more readily attract institutional attention.
[citation needed]
Some users install a large
hosts file which prevents the user's computer from connecting to known spyware-related web addresses. However, by connecting to the numeric IP address, rather than the domain name, spyware may bypass this sort of protection.
Spyware may get installed via certain
shareware programs offered for download. Downloading programs only from reputable sources can provide some protection from this source of attack. Recently,
CNet revamped its download directory: it has stated that it will only keep files that pass inspection by Ad-Aware and
Spyware Doctor.
[citation needed]
The first step to removing spyware is to put a computer on "lockdown". This can be done in various ways, such as using anti-virus software or simply disconnecting the computer from the internet. Disconnecting the internet prevents controllers of the spyware from being able to remotely control or access the computer. The second step to removing the spyware is to locate it and remove it, manually or through
.
.png)