SPYWARE

A.Chaitanya(3/4 IT) chaitanya_9arumalla@yahoo.co.in, B.Gopi Prasad(3/4 IT) Gopi_1270@yahoo.co.in, Vignan’s Engineering College, Vadlamudi.

Abstraction:
Millions of computer users are being watched, not just by employers and Organizations, but by the software that they use frequently without their knowledge. This spyware has become the center for collecting of the private data and threatens the corporate secured data. Even it can change computer settings, resulting in slow connection speeds, different home pages, and loss of Internet or other programs. In an attempt to increase the understanding of spyware,we have to understand the “What exactly is spyware? How does it work? What is its impact on users and the businesses that employ them?How to prevent them?are discussed.

.

What is a spyware
Spyware is software designed to collect information from computer system users without their knowledge. Typically, spyware can be classifiedas a type of trojan horse, which is a type of technology-based security incident, allowing for information security policy violation. It can be termed also as computer software that is installed surreptitiously on a personal computer to intercept or take partial control over the user's interaction with the computer, without the user's informed consent.

History and development
The first recorded use of the term spyware occurred on October 16, 1995 in a Usenet post that poked fun at Microsoft's business model. However, in early 2000 the founder of Zone Labs, Gregor Freund, used the term in a press release for the ZoneAlarm Personal Firewall. Since then, "spyware" has taken on its present sense. According to a 2005 study by AOL and the National CyberSecurity Alliance, 61 percent of surveyed users' computers had some form of spyware. 92 percent of surveyed users with spyware reported that they did not know of its

spyware does not usually self-replicate. however. Other spyware behavior. even for statistical or research purposes. virus and worm Unlike viruses and worms. Like many recent viruses. Adware and spyware are similar to viruses in that they can be malicious in nature. occurs in the background. theft of personal information (including financial information such as credit card numbers). Although most adware is spyware in a different sense for a different reason: it displays advertisements related to what it finds from spying on you. These classify as "adware" in the sense of advertising-supported software. adware and tracking The term adware frequently refers to any software which displays advertisements. Some observers describe the Alexa Toolbar. Programs such as the Eudora mail client display advertisements as an alternative to shareware registration fees. The user receives many pop-up advertisements. and 91 percent reported that they had not given permission for the installation of the spyware. Routes of infection Spyware does not directly spread in the manner of a computer virus or . people are now profitting from these threats making them more and more popular. an Internet Explorer plug-in published by Amazon. however. but not as spyware. and provides the user with a specific service. Claria Corporation's Gator Software and Exact Advertising's BargainBuddy are examples. as spyware. Visited Web sites frequently install Gator on client machines in a surreptitious manner. spyware by design exploits infected computers for commercial gain. Many of these adware distributing companies are backed by millions of Spyware. and some anti-spyware programs such as AdAware report it as such. Adware in this form does not operate surreptitiously or mislead the user. such as reporting on websites the user visits. or routing of HTTP requests to advertising sites. The data is used for "targeted" advertisement impressions. spyware has become one of the preeminent security threats to computer systems running Microsoft Windows operating systems. monitoring of Web-browsing activity for marketing purposes. dollars of adware-generating revenues. Comparison Spyware. whether or not the user has consented. Typical tactics furthering this goal include delivery of unsolicited popup advertisements. The prevalence of spyware has cast suspicion upon other programs that track Web browsing. and it directs revenue to the installing site and to Claria by displaying advertisements to the user.com.] As of 2006.presence.

Its popularity and history of security issues have made it the most frequent target. However as this is not a default configuration. Its deep integration with the Windows environment and scriptability make it an obvious point of attack into Windows. all of which slow the computer down. Users frequently notice unwanted behavior and degradation of system performance. Internet Explorer also serves as a point of attachment for spyware in the form of Browser Helper Objects. tricking them into installing it (the Trojan horse method). along with other threats. Advertisements The installation of spyware frequently involves Internet Explorer. Most spyware is installed without users' knowledge. Some . mostly for convenience. Instead.worm: generally. a worm or virus has delivered a spyware payload. they profit personally.[9] By directing traffic to ads set up to channel funds to the spyware authors. Unlike users of many other operating systems. As with other operating systems. few users do this. either by piggybacking on a piece of desirable software such as Kazaa or Limewire. A spyware infestation can create significant unwanted CPU activity. which are significantly less susceptible to malware. Effects and behaviors A spyware program is rarely alone on a computer: an affected machine can rapidly be infected by many other components. spyware deceives users. disk usage. attackers used the Spybot worm to install spyware that put pornographic pop-ups on the infected system's screen. Because of this. and network traffic. which modify the browser's behaviour to add toolbars or to redirect traffic. Since they tend not to install software if they know that it will disrupt their working environment and compromise their privacy. Targetsoft) modify system files so they will be harder to remove. or to reduce the privileges of specific vulnerable Internet-facing proceses such as Internet Explorer (through the use of tools such as DropMyRights).dll" will interrupt normal networking usage. spyware gets on a system through deception of the user or through exploitation of software vulnerabilities. Some other types of spyware (for example. Spyware. an infected system does not attempt to transmit the infection to other computers. while being spyware themselves. This is because these programs are not granted unrestricted access to the operating system by default. Targetsoft modifies the "Winsock" Windows Sockets files. has led some Windows users to move to other platforms such as Linux or Apple Macintosh. The deletion of the spyware-infected file "inetadpt. Some "rogue" anti-spyware programs masquerade as security software. Stability issues. Windows users too are able to follow the principle of least privilege and use non-administrator least user access accounts. a typical Windows user has administrative privileges. any program the user runs (intentionally or not) has unrestricted access to the system too. In a few cases.

advertisements that instead fund the spyware operator. Links to these sites may be added to the browser window. A further issue in the case of some spyware programs has to do with the replacement of banner ads on viewed web sites. have written what the New York Times has dubbed "stealware". The user has their choices thwarted.[citation needed] Identity theft and fraud In one case. who may buy ad placement in pop-ups displayed when the user visits a particular site.[12] In August 2005. for instance. many spyware advertisements use animation or flickering banners which can be visually distracting and annoying to users. this could possibly violate antipornography laws in some jurisdictions. a form of click fraud. networks' reputations are injured. Spyware that acts as a web proxy or a Browser Helper Object can replace references to a site's own advertisements (which fund the site) with Spyware which attacks affiliate networks places the spyware operator's affiliate tag on the user's activity — replacing any other tag. As with many banner ads. and what spyware researcher Ben Edelman terms affiliate fraud. When children are the users. notably 180 Solutions. Stealware diverts the payment of affiliate marketing revenues from the legitimate affiliate to the spyware vendor. spyware operators such as 180 Solutions have been terminated from affiliate networks including LinkShare and ShareSale. Pop-up ads for pornography often display indiscriminately. spyware has been closely associated with identity theft. The spyware operator is the only party that gains from this. researchers from security software firm Sunbelt Software believed that the makers of the common CoolWebSearch .[11] Affiliate fraud is a violation of the terms of service of most affiliate marketing networks. "Stealware" and affiliate fraud A few spyware vendors. history or search function. Many spyware programs display advertisements. if there is one. This cuts into the margins of advertising-funded Web sites. Some programs simply display pop-up ads on a regular basis. As a result. a legitimate affiliate loses revenue. It is also one of the purposes for which spyware programs gather information on user behavior. one every several minutes. Spyware operators present this feature as desirable to advertisers. Many users complain about irritating or offensive advertisements as well. Others display ads in response to specific sites that the user visits. or one when the user opens a new browser window. and vendors are harmed by having to pay out affiliate revenues to an "affiliate" who is not party to a contract.

Note that as with computer viruses.com. When users • . but on common behaviors. While they are not always inherently malicious. researchers give names to spyware programs which may not be used by their creators. Dialers are ineffective on computers that do not have a modem. or by "following the money" of apparent financial or business connections. Programs may be grouped into "families" based not on shared program code. a number of the spyware programs distributed by Claria are collectively known as "Gator". the small text files that track browsing activity. For instance. even if they function separately. and many anti-spyware programs offer to remove them. [13] but it turned out that "it actually (was) its own sophisticated criminal little trojan that's independent of CWS. redirects Internet Explorer error pages to advertising. or are not connected to a telephone line. Spyware-makers may commit wire fraud with dialer program spyware."[14] This case is currently under investigation by the FBI. programs which are frequently installed together may be described as parts of the same spyware package. as spyware. Connecting to these suspicious numbers involves long-distance or overseas charges which invariably result in high call costs. takes advantage of Internet Explorer vulnerabilities. Likewise. These can reset a modem to dial up a premium-rate telephone number instead of the usual ISP. many users object to third parties using space on their personal computers for their business purposes.".[23] Internet Optimizer. Examples of spyware These common spyware programs illustrate the diversity of behaviors found in these attacks. It displays popup ads. The package directs traffic to advertisements on Web sites including coolwebsearch. etc. rewrites search engine results. user names. also known as DyFuCa. bank information. Spyware and cookies Anti-spyware programs often report Web advertisers' HTTP cookies. • The Federal Trade Commission estimates that 27. CoolWebSearch. and alters the infected computer's hosts file to direct DNS lookups to these sites.spyware had used it to transmit "chat sessions.3 million Americans have been victims of identity theft. a group of programs. passwords. and that financial losses from identity theft totaled nearly $48 billion for businesses and financial institutions and at least $5 billion in out-of-pocket expenses for individuals.

charging them with having "engaged in a nationwide scheme to use deception and coercion to extract payments from consumers. such as the U.net. Websearch. Since the owners of computers infected with spyware generally claim that they never authorized the installation. so that the advertisements make unearned profit for the 180 Solutions company.[26] The FTC has filed a complaint against Movieland. It also alters HTTP requests for affiliate advertisements linked from a Web site. and were thus obligated to pay. • Legal issues related spyware Criminal law Unauthorized access to a computer is illegal under computer crime laws. or by advertisements displayed by other spyware programs — an example of how spyware can install more spyware. Internet Optimizer makes it impossible for the user to access password-protected sites. Spyware that comes bundled with shareware applications may be described in the legalese text of an end-user license agreement (EULA). was installed by an ActiveX drive-by download at affiliate Web sites.tv or Popcorn. the Better Business Bureau. redirect affiliate references. It opens pop-up ads that cover over the Web sites of competing companies. users do in fact give consent to installations.S. aka WinTools or Adware. Downloads itself to your computer via an ActiveX codec and reports information back to MotherShip Server. and claiming that consumers had signed up for a threeday free trial but did not cancel their membership before the trial period was over.follow a broken link or enter an erroneous URL. demanding payment of at least $29.[11] HuntBar. and even Key Strokes.'s Computer Misuse Act and similar laws in other countries. the Websites you visited. [23] • Zango (formerly 180 Solutions) transmits detailed information to advertisers about the Web sites which users visit. or just Zlob. a prima facie reading would suggest that the promulgation of spyware would count as a criminal act. particularly viruses. and others by consumers claiming they were held hostage by its repeated pop-up windows and demands for payment. accompanied by music that lasted nearly a minute. • . Some information can be as your search history. track aggregate browsing behavior. These programs add toolbars to IE. the Washington State Attorney General's Office. is a movie download service that has been the subject of thousands of complaints to the Federal Trade Commission (FTC). because password-protected Web sites (HTTP Basic authentication) use the same mechanism as HTTP errors. Computer Fraud and Abuse Act. However. Many users habitually ignore these purported contracts. Spyware producers argue that. the U. Law enforcement has often pursued the authors of other malware." The complaint alleges that the software • repeatedly opened oversized pop-up windows that could not be closed or minimized.K.com and eleven other defendants (list). but spyware companies such as Claria claim these demonstrate that users have consented. contrary to the users' claims. also known as Moviepass.95 to end the pop-up cycle. they see a page of advertisements. and display [24][25] advertisements. Movieland.[27][28] Zlob trojan.

[36] The hijacking of Web advertisements has also led to litigation. however. or disables computersecurity software. have passed laws criminalizing some forms of spyware. including the U. It has been established in most common law jurisdictions that a clickwrap agreement can be a binding contract in certain circumstances. but settled out of court. ended up settling by agreeing to pay US$7.[35] In a suit brought in 2005 by Spitzer. Inc. under which a single click can be taken as consent to the entire text. Such laws make it illegal for anyone other than the owner or operator of a computer to install software that alters Web-browser settings. Some jurisdictions. monitors keystrokes.5 million and to stop distributing spyware. some makers have filed libel and defamation actions when their products have been so described. which would imprison creators of spyware.S.Despite the ubiquity of EULAs and of "clickwrap" agreements. a number of large Web publishers sued Claria for replacing advertisements. In the United States. lawmakers introduced a bill in 2005 entitled the Internet Spyware Prevention Act. states of Iowa and Washington. Gator (now known as Claria) filed suit against the website PC Pitstop for describing its . relatively little case law has resulted from their use. the California firm Intermix Media. In 2003. In June 2002. Civil law Former New York State Attorney General and now current Governor Eliot Spitzer has pursued spyware companies for fraudulent installation of software. mean that every such agreement is a contract or that every term in one is enforceable. This does not. Since "spyware" has become a common pejorative. Libel suits by spyware developers Litigation has gone both ways.

Anti-spyware programs Remedies and prevention Lavasoft's Ad-Aware 2007 Many programmers and some commercial firms have released products designed to remove or block spyware. Microsoft renamed the beta software to Windows Defender. and it was released as a free download in October 2006. In early spring. but continues to describe harm caused by the Gator/Claria software. 2006. Microsoft currently ships the product for free with . agreeing not to use the word "spyware". pioneered a growing category. other antispyware and antivirus companies have also used other terms such as "potentially unwanted programs" or greyware to denote these products.[38] PC Pitstop settled. spyware programs. rebranding it as Windows AntiSpyware beta and releasing it as a free download for Genuine Windows XP and Windows 2003 users. as well as various user practices which reduce the chance of getting spyware on a system. mentioned above.[39] As a result.program as "spyware". Steve Gibson's OptOut. Programs such as Lavasoft's Ad-Aware SE and Patrick Kolla's Spybot .Search & Destroy rapidly gained popularity as effective tools to remove. As the spyware threat has worsened. a number of techniques have emerged to counteract it. These include programs designed to remove or to block spyware. More recently Microsoft acquired the GIANT AntiSpyware software. and in some cases intercept.

AVG also used this product to add an integrated antispyware solution to some versions of the AVG Anti-Virus family of products. This type of anti-spyware software scans the contents of the windows registry. This type of spyware protection is normally much easier to use and more popular. Anti-spyware software programs can be used solely for detection and removal of spyware software that has already been installed onto your computer. and installed programs on your computer and will provide a list of any threats found. citing lawsuits brought by spyware authors against the authors of web sites and programs which described their products as "spyware". creator of Zone Alarm firewall have also released an anti-spyware program. relabeling their Ewido anti-spyware program as AVG Anti-Spyware Professional Edition. adding anti-spyware features to their existing anti-virus products. the anti-virus company Grisoft. This type of spyware protection works the same way as that of anti-virus protection in that the anti-spyware software scans all incoming network data for spyware software and blocks any threats it comes across. for instance. recent versions of these major firms' home and business antivirus products do include anti-spyware functions. With this spyware protection software you can schedule weekly. • . creator of AVG Anti-Virus. Symantec Anti-Virus. plus made a freeware AVG Anti-Spyware Free Edition available for private and non-commercial use.Windows Vista. They can provide real time protection against the installation of spyware software on your computer. albeit treated differently from viruses. operating system files. in real-time protection blocks an instance of the AlwaysUpdateNews from being installed. daily. Anti-spyware programs can combat spyware in two ways: • 1. Early on. This shows a trend by anti virus companies to launch a dedicated solution to spyware and malware. Zone Labs. 2. Recently. categorizes spyware programs as "extended threats" and now offers real-time protection from them (as it does for viruses). Other well-known anti-spyware products include: • • • • • PC Tools's Spyware Doctor Sunbelt Software's Counterspy Trend Micro's HijackThis Webroot Software's Spy Sweeper ParetoLogic's Anti-Spyware and XoftSpy SE Major anti-virus firms such as Symantec. However. acquired anti-spyware firm Ewido Networks. or monthly scans of your computer to detect and remove any spyware software that has been installed on your computer. anti-virus firms expressed reluctance to add anti-spyware functions. McAfee and Sophos have come later to the table.Microsoft Anti-Spyware.

and installed programs. antispyware developers discover and evaluate them. using security software (some of which are antispyware. Updates may be installed automatically on a schedule or before doing a scan. Likewise. Earlier versions of antispyware programs focused chiefly on detection and removal. booting the infected computer in safe mode allows an anti-spyware program a better chance of removing persistent spyware. If a spyware program is not blocked and manages to get itself installed. As a result. A new breed of spyware (Look2Me spyware by NicTechNetworks is a good example) is . though many are not) to sandbox browsers can also be effective to help restrict any damage done. Some programs work in pairs: when an anti-spyware scanner (or the user) terminates one running process. Javacool Software's SpywareBlaster. Usually. A popular generic spyware removal tool used by those with a certain degree of expertise is HijackThis. Killing the process tree can also work. As new spyware programs are released. it may resist attempts to terminate or uninstall it. who can spot fast-spreading spyware. In some cases. which helps guide both users. who can look at decisions made by others. they can offer no guidance. Spybot's TeaTimer and Spysweeper) or fully (programs falling under the class of Hips such as BillP's WinPatrol) on historical observation. Like most anti-virus software. and is this configuration change appropriate?" Windows Defender's Spynet attempts to alleviate this through offering a community to share information. without judgment or recommendation. and analysts. blocked the installation of ActiveXbased and other spyware programs. anti-spyware software is of limited usefulness without a regular source of updates. many anti-spyware/adware tools require a frequently-updated database of threats. Some programs rely partly (for instance many antispyware programs such as Windows Defender. one of the first to offer real-time protection. While they do not rely on updated definitions. Such programs inspect the contents of the Windows registry. and blocks the activity of components known to represent spyware. the other one respawns the killed program. while others provide updates free. which scans certain areas of the Windows OS where spyware often resides and presents a list with items to delete manually. it may also intercept attempts to install start-up items or to modify browser settings. making "signatures" or "definitions" which allow the software to detect and remove the spyware.allowing you to choose what you want to delete and what you want to keep. some spyware will detect attempts to remove registry keys and immediately add them again. Some vendors provide a subscription-based update service. Not all programs rely on updated definitions. The user is left to determine "what did I just do. or may be done manually. They watch certain configuration parameters (such as certain portions of the Windows registry or browser configuration) and report any change to the user. Because many spyware and adware are installed as a result of browser exploits or user error. and remove files and entries which match a list of known spyware components. As most of the items are legitimate windows files/registry entries it is advised for those who are less knowledgeable on this subject to post a HijackThis log on the numerous antispyware sites and let the experts decide what to delete. Real-time protection from spyware works identically to real-time anti-virus protection: the software scans disk files at download time. which may allow them to spot newer spyware. the operating system files.

Many system operators install a web browser other than IE. and sometimes feature popups prompting users to install them. Microsoft and the Washington state attorney general filed suit against Secure Computer for its Spyware Cleaner product. may add more spyware of their own. A rootkit hides it even from alternate data streams scanners and actively stops popular rootkit scanners from running. such as Opera or Mozilla Firefox. directing them to purchase programs which do not actually remove spyware — or worse.starting to hide inside system-critical processes and start up even in safe mode. or even uninstall them. Microsoft's case against Secure Computer remained pending. a new breed of malware. 2006.com UltimateClea ner WinAntiViru s Pro 2006 WinFixer WorldAntiSp y Your Privacy Guard • Fake anti-spyware programs Malicious programmers have released a large number of fake antispyware programs. Security practices To deter spyware. Sometimes they do not even leave any on-disk signatures. computer users have found several practices useful in addition to installing anti-spyware programs. and widely distributed Web banner ads now spuriously warn users that their computers have been infected with spyware. the Washington attorney general announced that Secure Computer had paid $1 million to settle with the state. Rootkit technology is also seeing increasing use. They are called rogue software. It uses alternate data streams to hide.[41][42] The recent proliferation of fake or spoofed antivirus products has occasioned some concern. An example of one that uses all three methods is Gromozon. or registry cleaners. With no process to terminate they are harder to detect and remove. 2006. As of that date. Known offenders include: • On January 26.Though no browser is completely safe. • • • • • • • • • • • • AntiVirus Gold AV System Care ContraVirus errorsafe (AKA system doctor) Malware MagicAntiSpy PAL Spyware Remover PCSecuresyste m Pest Trap PSGuard SecurePCclean er SpyAxe SpywareStrike • • • • • • • • • • • • Spyware Quake Spydawn Spylocked SpyShredder SysProtect Spy Sheriff Spy Wiper Registryclean erxp.[43] On December 4.[40] as is the use of NTFS alternate data streams. antivirus. Internet Explorer is at a greater risk for spyware infection due to its . Newer spyware programs also have specific countermeasures against well known anti-malware products and may prevent them from running or being installed. Such products often bill themselves as antispyware.

In response to the emergence of spyware.lavasoft. rather than the domain name. Recently.html Conclusion Security has become one of the primary concerns when an organization connects its private Network to the Internet. While there is no silver bullet to solve all ofthese problems.com/about/protection/in dex.de/en/index. CNet revamped its download directory: it has stated that it will only keep files that pass inspection by Ad-Aware and Spyware Doctor. A number of jurisdictions have passed anti-spyware laws.large user base as well as vulnerabilities such as ActiveX. spyware may bypass this sort of protection. there is hope. and File Transfer Protocol. the problem can bemanaged e®ectively with a comprehensive de¯nition of the trusted computing baseand a program to maintain it. With the right support from policy and technology.de/ • http://spybot.org/contact. Spyware. remains a problem that is di±cult to manage. Downloading programs only from reputable sources can provide some protection from this source of attack. Cornell University's Information Technology department released a report detailing the behavior of one particular piece of proxy-based spyware. a small industry has sprung up dealing in anti-spyware software.qwest. Spyware programs which redirect network traffic cause greater technical-support problems than programs which merely display ads or monitor users' behavior. Some ISPs particularly colleges and universities have taken a different approach to blocking spyware: they use their network firewalls and web proxies to block access to Web sites known to install spyware. and so may more readily attract institutional attention. though not a particularly new problem when de¯ned generally. which usually target any software that is surreptitiously installed to control a user's computer. Marketscore.com/athome/ security/spyware/software/defaultmspx • http://www. Internet mail. . can be defeated. including spyware.com • http://isc.htm •http://www. and the steps the university took to intercept it.com/aswfeatures. Regardless of the business.[45] Many other educational institutions have taken similar steps. 2005.com http://spywarewarrior.html • http://www. References: • http://spywarewarrior.virustotal. Spyware may get installed via certain shareware programs offered for download.malware.[citation needed] Some users install a large hosts file which prevents the user's computer from connecting to known spyware related web addresses.sans.microsoft.safernetworking. Like other security incidents. However. Running anti-spyware software has become a widely recognized element of computer security best practices for Microsoft Windows desktop computers. Telnet. an increasing number of users on private networks are demand access to Internet services such as the World Wide Web (WWW). by connecting to the numeric IP address.php •http://www. On March 31.

Sign up to vote on this title
UsefulNot useful