| Most spyware programs are not like viruses because
they don't self replicate but monitor web-browsing activity
for marketing purposes.
Spyware programs are bundled with software and usually,
legally installed on a users computer mainly due to the
ignorance of installation settings or failure to read the
End User License Agreement. (or EULA) More on EULA's in a
minute.
Spyware could immediately after installation or in
the future cause privacy issues, substantial loss of system
performance or responsiveness, major stability issues
(crashes and hangs), and difficulty connecting to the
internet, among many others, especially when several spyware
packages from several companies are all active on your
computer.
In fact,
spyware and adware infection brings about more visits to
professional computer repairers than any other single cause.
Even more surprisingly, most users have more
spyware and/or adware on their system than viruses! Users
need only keep an anti-spyware program installed,
up-to-date, and scan their computer with it regularly. More
on protection later in this guide
The EULA is a scrolling text box during installation
that contains the conditions of which you are allowed to use
the software. Most users simply agree to it or hit next
without reading it. Most spyware programs are distributed
with great success in this manner.
Some spyware/adware are similar to and can even be
categorized as a Trojan Horse. The definition of a Trojan
horse involves something dangerous that comes in disguise of
something desirable. An example of this is: You download
Game A. Game A installs itself but also installs, without
your knowledge, spyware that logs your web activity to which
Game A's programmer sells said logs to companies that buy
that info. It may also install adware software so it will
display pop-up ads that when clicked will pay the programmer
of Game A. Even "rogue" anti-spyware can be installed.
(More on "rogues" later in this guide) Clearly, the lines
between spyware/adware and trojan horses are a little gray.
Some spyware plainly tells the user during
installation that it is going to install. Just as an
example, Company X's software. If the user does not know
that Company X's software is really spyware, if they know
what spyware is, they go ahead and install the program
without asking their self, What is Company X's business?
Owners of badly infected systems frequently buy an
entire new computer system because their current system has
become too slow. Some of these systems are still very
current, speed-wise, and could handle average to moderate
computer use if it weren't for 60 to 100 spyware programs
running at system startup.
Some examples of adware and spyware avenues of attack
are:
LSP's or Layered Service Providers
A Layered Service Provider is a system driver linked
deep in the networking services of Windows. It has access
to, as well as the ability to modify, every piece of data
entering, (your keyboard or mouse) and leaving the computer
(data sent over the internet or text or images displayed on
your screen). A few LSP's are necessary to allow Windows to
connect you to other computers, including the internet.
Spyware may also install itself as an LSP, thus having
access to all the data you transmit and receive including
credit card numbers and passwords.
Browser Hijacks
A browser hijacker is a program or registry setting
that changes IE start and search pages. If your browser
starts with a different start page and you didn't change it,
you probably got hijacked. Hijackers often not only change
these pages, but also add a program a start-up that will
restore the hijacked settings. You can change it back but
every time you restart, your start page has reverted back to
an advertisers page.
BHO's or Browser Helper Object
A BHO is a small program that extends
Microsoft's Internet Explorer's functionality. Usually they
are visible, harmless add-on toolbars in IE. They can also
have hidden devious functions that violate privacy issues
like browser hijacking, logging info you input in forms on
the web including passwords!!, display ads, follow your
moves across the internet by reporting site addresses you
visit and time spent there, and redirect you or display
other pages than what was requested.
Basically, let's say, for example, Bob the
programmer writes a program. We'll call it Program A.
Program A is worth a lot of money and normally he could sell
it. Instead, Bob inserts places in his program that display
ads from one or more companies. Then he puts it online free
for download. John Doe downloads it and installs Program
A. Program A installs a program called a BHO or Browser
Helper Object into Microsoft Internet Explorer. More on
BHO's later in this guide. Then, John Doe surfs the
internet looking at a page about his car stereo. The BHO
sees this and looks through its vast library of companies
that it advertises for. It finds an ad for a rival car
audio company and spawns a pop-up to said rival. So John
clicks on the ad thinking his site he was looking at wants
him to follow the ad. If he buys something, Bob the
programmer gets a cut of the sale. This might be ok except
This is only one of many uses for BHO's. Some uses
are actually legitimate.
"Some" examples of legit BHO's are:
"Some" Search Toolbars - Example:
Google Toolbar
Yahoo Toolbar - which actually has a honorable
anti-spyware program built-in.
Translation Toolbars |
