What is Spyware !


 

Spyware has eclipsed viruses as the fastest growing online threat, infecting nearly 90% of Internet connected PCs. If you are like most internet users, chances are you are infected with not just one, but many, of these programs. Simply surfing the internet, reading email, downloading music or other files can infect your PC without you knowing it.

What is spyware?

The term "spyware" generically refers to software programs made by unscrupulous marketing companies that allow them to snoop on your browsing activity, see what you purchase, and cause pop-up ads to appear on your computer.

More specifically, Adware is any software program that causes advertising banners to be displayed to the user. Spyware is any software program that sends data about your surfing habits back to a third party without asking you for permission.

Why are these programs a problem?

Spyware causes lots of problems on your PC without you ever suspecting it's there. Have you ever noticed that your computer runs a lot better when you first purchase it than it does months later? The most likely culprit is spyware.

Why should I care?

  • Spyware Consumes resources on your PC.
  • Slows it down.
  • Causes it to crash.
  • Interferes with your web browser, slowing it down or causing downloads to fail. It can even hijack your browser, redirecting you and your children to sites with objectionable material.
  • Slows down your internet connection because while you are surfing, it is sending information about your surfing habits to ad companies, who then target you with popup ads that fit your preferences.
  • Costs you money - If you are paying for dialup internet access, spyware is literally costing you money.

    In short, while spyware is typically not hazardous to your PC, it is annoying and unnecessary. It's the next generation of spam.

    How did I get it?

    Spyware can infect your system in many different ways: visiting a Adult web site, opening a spy-carrying email attachment, downloading it as part of another (often "free") software program. Your privacy, and even your identity, is at high risk if you surf the Internet with spyware running on your PC, if you use file-sharing programs like KaZaa or WinMX your also opening your computer to spyware. Traditional anti-virus programs and firewalls don't offer protection from invasive and harmful spyware programs that can manifest themselves in many ways on your PC.

    Be careful! There are programs out there that claim to stop spyware, but will actually install it on your PC and prevent anti-spyware programs from operating correctly in the future.

    General Spyware types

    About:Blank: About:Blank is another name for the CoolWebSearch morphing spyware.This is one of the most insidious and prevalent spyware programs currently on the net, largely because it is nearly impossible to remove. This particular spyware has been unusually active over the past two weeks (October, 2004).

    About:Blank displays the following characteristics:

  • Replaces your home page with a new one titled "about:blank". This page contains a pseudo-search engine with various subjects like "art", "cars", and "shopping".
  • Installs a Browser Helper Object into Internet Explorer. This BHO consumes system resources and slows down your internet connection.
  • Restores itself after its file directory is deleted.
  • Restores its registry settings once they have been deleted.
  • Is difficult to remove from memory.
  • Starts with the operating system. If you remove it from the auto-start settings, it will restore itself there.
  • Later versions change their executable to avoid detection by the simple hash recognition algorithms that most anti-spyware products use.
  • May also store executable code in your temporary internet explorer files.

    Autosearch: Autosearch falls within the class of spyware known as homepage and browser hijackers. It installs an unwanted toolbar within Internet Explorer and can dramatically slow down your browser. Should you type in a web address incorrectly, Autosearch will redirect you to www.tunders.com. This site displays ads and is not a search engine.

    Claria: Claria is currently the top Adware pest found on the internet. Claria either injects ads into your browser or displays them on their own popup windows,Interestingly, Claria is a re-brand of what was formally known as "Gator".Claria often distributes its application by bundling it with popular free software such as Kazaa and other peer-to-peer programs. When downloaded, the application serves pop-up and pop-under ads to people while they're surfing the Web. Ads can be keyed to sites so that a pitch for low mortgage rates, for example, can appear when a surfer visits a rival financial company's site.This spyware program consumes over 18Mb of disk space on average with hidden files.

    MyWay Search Bar: MyWay is a search toolbar that installs into Internet Explorer and Netscape Navigator, adding search functions and popup blocking. It reports your surfing activity anonymously to MyWay affiliates, helping them to serve targeted advertising to you. As a BHO, MyWay shares the memory that your browser uses, detects events, creates additional windows while you are surfing, and monitors your activity. When a new browser window is opened, MyWay will send a configuration request about 5k in size. This also slows your internet access and can cause the PC to crash

    CommonName: CommonName is a browser hijacker that installs an unwanted toolbar into Internet Explorer which displays links to paid sponsors’ websites as well as a search textbox. It also searches for terms that you type into the Address bar or within selected search engines, such as msn, Yahoo, and AskJeeves, and then hijacks your request by directing you to a sponsored website. The company claims that over 22 million desktop computers are running their software. CommonName includes re-installation software that will attempt to defeat your efforts to remove it and will slow down the performance of your browser. This software consumes approximately 16Mb of hard drive space with hidden files.

    Cydoor: causes popup and pop-under ads to be displayed while you are browsing the internet. It also re-routes your web requests through third-party servers for the purpose of capturing your web surfing habits. Cydoor can not be uninstalled using the Windows uninstaller but can be manually removed.Cydoor consumes about 3.4Mb of hard drive space.

    Hotbar Spyware: Hotbar is a program that embeds a toolbar into your browser. It monitors every URL that you visit as well as phrases which you enter into search engines and sends this information back to a third party. The information is used to target ads on your computer,both in popups as well as directly embedded within web pages.

    CoolWebSearch Variants: One of the most complex, sophisticated, and devious browser hijackers ever invented, CoolWebSearch (one word - "cool web search" is technically not correct) is the name given to a range of various browser hijackers. The latest versions have grown increasingly aggressive and complicated and manual removal is virtually impossible. some times a re-installation of the entire operating system is required, thus use of a reputable spyware remover is highly recommended. New variants of CoolWebSearch are released every few weeks, making it increasingly important to ensure that your spyware remover has the latest updates.

    CoolWebSearch Symptoms

  • Hijacks to various search engines. Different variants of CoolWebSearch will redirect you to different sites.
  • When a URL is mistyped in the browser, CoolWebSearch will redirect the page to affiliate websites as well as CoolWebSearch.com.
  • Installs bookmarks to adult websites in the favorites menu.
  • Installs toolbars into the browser.
  • Slows down PC.
  • Can cause reboots.
  • Targets anti-spyware websites, usually vendors of spyware removal tools. Once infected with CoolWebSearch, you are unable to visit these websites to download their products.
  • Will open porn popups if it thinks the website being viewed is pornographic in nature.
  • Can cause significant slowdowns when attempting to type into a browser.
  • Will add CoolWebSearch.com to the trusted sites list

    Removing CoolWebSearch

    CoolWebSearch is very difficult to remove manually. The latest versions are virtually impossible to clean short of re-installing the operating system or restoring a previous version of the Windows registry,thus use of a good spyware remover product is recommended.Unfortunately, most spyware removers will not work against Cool Web Search, so a nice spyware remover called CWShredder is commonly used to destroy this parasite. However, this tool will no longer be updated after the current version (1.59), because the author (who volunteers his time)sold it to InterMute.and the good news is they are now looking after CWShredder you will find a link on my links page. They just released CWShredder version 2

    Past CoolWebSearch Variants

  • CoolWebSearch DataNotary – hijacks to dataNotary.com and replaces the default stylesheet used by IE. This stylesheet includes javascript that actively watches the currently loaded page and tries to guess when the user is viewing porn sites.
  • CoolWebSearch BootConf – Also replaces the CSS file, hijacks MSN search, and installs a program, bootconf.exe, that resets all hijacked settings every time the computer is restarted.
  • CoolWebSearch MSInfo – Similar to the previous, but points to true-counter.com.
  • CoolWebSearch SvcHost – This variant causes an error when the user attempts to access one of many well-known websites (such as Yahoo search). The error page is then hijacked and the user is sent to slawsearch.com.
  • CoolWebSearch DNSRelay – This variant hijacks URLs that have been typed without a leading “http://” or “www” to activexupdate.com.

    NewDotNet: The new.net application is an Internet Explorer plug-in that gives the appearance of providing extra top-level domains (.shop, .xxx and .mp3, for example). Unlike many spyware programs, it does not secretly collect information, and the latest versions no longer inflict unrequested pop-up ads on the user. It does, however, install itself without the knowledge or permission of the user, and is designed to generate revenue for the new.net company. It redirects search queries to the new.net search engine, and is classified as a security risk because the update component stealth downloads any code the new.net server instructs it to.The program functions by inserting itself into the Winsock system. In consequence, a new.net infection is a frequent cause of lost network connectivity. A typical symptom for dial-up systems is that the user is able to dial out normally but cannot access the Internet. Older version of new.net often caused Internet Explorer to crash from time to time. It is believed that the later versions do not suffer from this issue.if this is removed manually and without the knowledge of how to remove it. your browser will no longer display web pages

    Browser Helper Object

    A Browser Helper Object is a small program that is installed on your PC and runs within your browser. Usually, a BHO is installed on your system by another software program. BHOs are typically installed by toolbar accessories and can track your internet usage and collect other information that is used on the internet.

    Dialer

    Dialers are software that install themselves to your dial-up settings and dials numbers without your knowledge. Once dialer software is downloaded the user is disconnected from their Internet service provider and another phone number is dialed and the user is billed for the time used. They are malicious in nature and can rack up expensive and unwanted bills.

    Homepage Hijacking

    One of the most common symptoms of spyware infection is “homepage hijacking”, or when your default browser homepage has been forcibly changed to a new website without your permission. Most current spyware programs will also prevent you from changing your homepage back either by disabling the functionality in your “options” menu setting or by installing some type of program that will regularly switch it back to the rogue website. Even if you can reset your homepage, upon reboot it will be reset to the Homepage Hijacker setting.Hijackers may also route all of your website requests through an unknown third-party for tracking. Aside from being an invasion of privacy, this can dramatically slow down your browser.

    Keyloggers

    A keylogger is a program that records keystrokes the user types in on the keyboard. Keyloggers record this information in a log and then usually send that log to a server with your information. Keyloggers can record information such as passwords, credit card information, and personal identification numbers if entered into the keyboard while these programs are running.Keyloggers are highly invasive and are a major threat on the internet today.

    Layered Service Provider

    A Layered Service Provider, or LSP, is a piece of software that is tightly woven into the networking services of a computer. In particular, when using the protocol of the internet, TCP/IP, the LSP integrates itself with the TCP/IP layer of your network. As such, the LSP has access to all TCP/IP traffic coming into and leaving a computer. If the LSP is from a "good" author, then the communication can be enhanced and protected in many helpful ways. However, when spyware authors use an LSP, it can be used to spy on the habits and data of the user. Also, because the computer will not see any of the data until the LSP lets it through, it is possible to change information so that the spyware vendor benefits. Recent examples of this include replacing the top Google search results with links to paid advertisers. These links are indistinguishable from real search results.Worse still, because the LSP is very tightly woven into the TCP/IP layer, trying to remove it without the proper precautions may cause your computer to be unable to reconnect to the internet. In such cases, the only solution is a complete reinstallation of the operating system. For this reason, use of automated spyware removal tools is highly recommended.

    Retrospies

    Retrospy software is software that actively attacks anti-spyware programs in an effort to not be detected. They may also use disguise themselves by using common system file names. Retrospies are malicious and usually use many types of deception in order to avoid detection.

    Nine out of 10 PCs connected to the Internet are infected with spyware. A recent spy audit report published by Earthlink and Webroot found an average of 26.5 spyware traces are present on a given PC. In a six-month period, two million scans found 55 million pieces of spyware. 92% of corporate IT managers at companies with more than 100 employees claim they have a "major" spyware problem.


    Back to the Top




    HOME