Spyware 28951 225136131 2008-07-12T01:56:57Z CliffC 2208024 /* Examples of spyware */ tighten up movieland description a bit, it's all in the article <!-- Note to editors: DO NOT USE THIS ARTICLE AS A PLATFORM FOR PROMOTIONAL OR PURELY COMMERCIAL LINKS. Such content will be deleted. Specific software is to be mentioned in this article only if it is notable in and of itself. See comment down below under external links. See also, [[WP:N]], [[WP:CORP]], and [[WP:MOS]] --> <!-- Deleted image removed: [[Image:Spyware infestation.png|thumb|200px|A large number of [[toolbar]]s, some added by spyware, overwhelm an [[Internet Explorer 6]] session, running on [[Windows XP]] ]] --> '''Spyware''' is [[computer software]] that is installed [[wikt:surreptitiously|surreptitiously]] on a [[personal computer]] to intercept or take partial control over the user's interaction with the computer, without the user's [[informed consent]]. While the term ''spyware'' suggests software that secretly monitors the user's behavior, the functions of spyware extend well beyond simple monitoring. Spyware programs can collect various types of [[Personally identifiable information|personal information]], such as Internet surfing habit, sites that have been visited, but can also interfere with user control of the computer in other ways, such as installing additional software, redirecting [[Web browser]] activity, accessing websites blindly that will cause more harmful viruses, or diverting advertising revenue to a third party. Spyware can even change computer settings, resulting in slow connection speeds, different home pages, and loss of [[Internet]] or other programs. In an attempt to increase the understanding of spyware, a more formal classification of its included software types is captured under the term [[privacy-invasive software]]. In response to the emergence of spyware, a small industry has sprung up dealing in [[anti-spyware]] software. Running anti-spyware software has become a widely recognized element of [[computer security]] best practices for [[Microsoft Windows]] [[desktop computer]]s. A number of jurisdictions have passed anti-spyware laws, which usually target any software that is surreptitiously installed to control a user's computer. ==History and development== The first recorded use of the term [[:wikt:spyware|spyware]] occurred on [[October 16]], [[1995]] in a [[Usenet]] post that poked fun at [[Microsoft]]'s [[business model]].<ref name="coinage">Vossen, Roland (attributed); October 21, 1995; [http://groups.google.com/group/rec.games.programmer/browse_thread/thread/86a426b0147496d8/3b5d1936eb4d0f33?lnk=st&q=&rnum=8#3b5d1936eb4d0f33 Win 95 Source code in c!!] posted to rec.games.programmer; retrieved from groups.google.com November 28, 2006.</ref> ''Spyware'' at first denoted ''[[hardware]]'' meant for [[espionage]] purposes. However, in early 2000 the founder of [[Zone Labs]], Gregor Freund, used the term in a [http://www.zonealarm.com/store/content/company/aboutUs/pressroom/pressReleases/2000/za2.jsp press release] for the [[ZoneAlarm|ZoneAlarm Personal Firewall]].<ref name="wienbar">Wienbar, Sharon. "[http://news.cnet.com/2010-1032-5307831.html The Spyware Inferno]". ''News.com''. [[August 13]] [[2004]].</ref> Since then, "spyware" has taken on its present sense.<ref name="wienbar" /> According to a 2005 study by [[AOL]] and the National Cyber-Security Alliance, 61 percent of surveyed users' computers had some form of spyware. 92 percent of surveyed users with spyware reported that they did not know of its presence, and 91 percent reported that they had not given permission for the installation of the spyware.<ref name="aolstudy">"[http://www.staysafeonline.info/pdf/safety_study_2005.pdf AOL/NCSA Online Safety Study]". ''America Online'' & ''The National Cyber Security Alliance''. 2005.</ref> As of 2006, spyware has become one of the preeminent security threats to computer systems running Microsoft Windows [[operating system]]s. Computers where [[Internet Explorer]] (IE) is the primary [[web browser|browser]] are particularly vulnerable to such attacks not only because IE is the most widely-used,<ref name="pcworld-ie">Spanbauer, Scott. "[http://www.pcworld.com/article/id,117550-page,1/article.html Is It Time to Ditch IE?]". ''Pcworld.com''. [[September 1]] [[2004]]</ref> but because its tight integration with Windows allows spyware access to crucial parts of the operating system.<ref>Keizer, Gregg. "[http://www.techweb.com/wire/software/170100394 Analyzing IE At 10: Integration With OS Smart Or Not?]". ''TechWeb Technology News''. [[August 25]] [[2005]].</ref><ref name="pcworld-ie"/> Before [[Internet Explorer 7]] was released, the browser would automatically display an installation window for any [[ActiveX]] component that a website wanted to install. The combination of user naiveté towards [[malware]] and the assumption by [[Internet Explorer]] that all ActiveX components are benign, led, in part, to the massive spread of spyware. Many spyware components would also make use of flaws in [[Javascript]], Internet Explorer and Windows to install without user knowledge or permission. The [[Windows Registry]] contains multiple sections that by modifying keys values allows software to be executed automatically when the operating system boots. Spyware can exploit this design to circumvent attempts at removal. The spyware typically will link itself from each location in the [[Windows Registry|registry]] that allows execution. Once running, the spyware will periodically check if any of these links are removed. If so, they will be automatically restored. This ensures that the spyware will execute when the operating system is booted even if some (or most) of the registry links are removed. ==Comparison== ===Spyware, adware and tracking=== The term ''[[adware]]'' frequently refers to any software which displays advertisements, whether or not the user has consented. Programs such as the [[Eudora (e-mail client)|Eudora]] mail client display advertisements as an alternative to [[shareware]] registration fees. These classify as "adware" in the sense of advertising-supported software, but not as spyware. Adware in this form does not operate surreptitiously or mislead the user, and provides the user with a specific service. Most adware is ''spyware'' in a different sense than "advertising-supported software," for a different reason: it displays advertisements related to what it finds from spying on you. [[Claria Corporation]]'s Gator Software and Exact Advertising's BargainBuddy are examples. Visited Web sites frequently install Gator on client machines in a surreptitious manner, and it directs revenue to the installing site and to Claria by displaying advertisements to the user. The user receives many [[pop-up advertisement]]s. Other spyware behavior, such as reporting on websites the user visits, occurs in the background. The data is used for "targeted" advertisement impressions. The prevalence of spyware has cast suspicion upon other programs that track Web browsing, even for statistical or research purposes. Some observers describe the [[Alexa Toolbar]], an Internet Explorer plug-in published by [[Amazon.com]], as spyware, and some anti-spyware programs such as [[Ad-Aware]] report it as such. Many of these adware distributing companies are backed by millions of dollars of adware-generating revenues. Adware and spyware are similar to viruses in that they can be malicious in nature. However, people are now profiting from these threats, making them more and more popular. Similarly, software bundled with free, advertising-supported programs such as [[Peer-to-peer|P2P]] act as spyware, (and if removed disable the 'parent' program) yet people are willing to download it. This presents a dilemma for proprietors of anti-spyware products whose removal tools may inadvertently disable wanted programs. For example, [http://www.better-spyware-removal.com/spyware-test-results.html recent test results] show that bundled software (WhenUSave) is ignored by popular anti-spyware program [[Ad-Aware]], (but removed as spyware by most scanners) because it is part of the popular (but recently decommissioned) eDonkey client. To address this dilemma, the [[Anti-Spyware Coalition]] has been working on building consensus within the anti-spyware industry as to what is and isn't acceptable software behavior. To accomplish their goal, this group of anti-spyware companies, academics, and consumer groups have collectively published a series of documents including a [http://www.antispywarecoalition.org/documents/DefinitionsJune292006.htm definition of spyware], [http://www.antispywarecoalition.org/documents/20060629RiskModelDescription.htm risk model], and [http://www.antispywarecoalition.org/documents/BestPractices.htm best practices] document. ===Spyware, virus and worm=== Unlike [[computer virus|viruses]] and [[computer worm|worms]], spyware does not usually self-replicate. Like [[e-mail spam#Using other people's computers|many recent viruses]]; however, spyware—by design—exploits infected computers for commercial gain. Typical tactics furthering this goal include delivery of unsolicited pop-up advertisements; theft of personal information (including financial information such as [[credit card number]]s); monitoring of Web-browsing activity for [[marketing]] purposes; or routing of [[HTTP]] requests to advertising sites. ==Routes of infection== [[Image:Windows ActiveX security warning (malware).png|thumb|280px|right|[[Malicious]] [[website]]s attempt to install spyware on readers' [[computers]].]] Spyware does not directly spread in the manner of a computer virus or worm: generally, an infected system does not attempt to transmit the infection to other computers. Instead, spyware gets on a system through deception of the user or through exploitation of software vulnerabilities. Most spyware is installed without users' knowledge. Since they tend not to install software if they know that it will disrupt their working environment and compromise their privacy, spyware deceives users, either by [[piggybacking]] on a piece of desirable software such as [[Kazaa]], or by tricking them into installing it (the [[Trojan horse (computing)|Trojan horse]] method). Some "rogue" anti-spyware programs masquerade as security software, while being spyware themselves. The distributor of spyware usually presents the program as a useful utility—for instance as a "Web accelerator" or as a helpful [[software agent]]. Users download and install the software without immediately suspecting that it could cause harm. For example, [[Bonzi Buddy]], a program bundled with spyware<ref>{{cite web |url=http://www.accessmylibrary.com/coms2/summary_0286-7669487_ITM |title=Prying Eyes Lurk Inside Your PC; Spyware Spawns Efforts at Control. |publisher=The Gale Group, Inc. |accessdate=2008-06-05}}</ref> and targeted at children, claims that: <blockquote>''He will explore the Internet with you as your very own friend and sidekick! He can talk, walk, joke, browse, search, e-mail, and download like no other friend you've ever had! He even has the ability to compare prices on the products you love and help you save money! Best of all, he's FREE!''<ref>[http://www.bonzi.com/bonzibuddy/bonzimail.asp ''Bonzi.com'']{{Dead link|date=July 2007}}. Retrieved [[July 10]] [[2005]].</ref></blockquote> Spyware can also come bundled with [[shareware]] or other downloadable software, as well as music CDs. The user downloads a program and installs it, and the installer additionally installs the spyware. Although the desirable software itself may do no harm, the bundled spyware does. In some cases, spyware authors have paid shareware authors to bundle spyware with their software. In other cases, spyware authors have repackaged desirable freeware with installers that add spyware. A third way of distributing spyware involves tricking users by manipulating security features designed to prevent unwanted installations. Internet Explorer prevents websites from initiating an unwanted download. Instead, it requires a user action, such as clicking on a link. However, links can prove deceptive: for instance, a [[pop-up ad]] may appear like a standard Windows [[dialog box]]. The box contains a message such as "Would you like to optimize your Internet access?" with links which look like buttons reading ''Yes'' and ''No''. No matter which "button" the user presses, a download starts, placing the spyware on the user's system. Later versions of Internet Explorer offer fewer avenues for this attack. Some spyware authors infect a system through security holes in the Web browser or in other software. When the user navigates to a Web page controlled by the spyware author, the page contains code which attacks the browser and forces the download and installation of spyware. The spyware author would also have some extensive knowledge of commercially-available anti-virus and firewall software. This has become known as a "[[drive-by download]]", which leaves the user a hapless bystander to the attack. Common [[browser exploit]]s target security vulnerabilities in Internet Explorer and in the [[Sun Microsystems]] [[Java (programming language)|Java]] runtime. The installation of spyware frequently involves Internet Explorer. Its popularity and history of security issues have made it the most frequent target. Its deep integration with the Windows environment and scriptability make it an obvious point of attack into [[Microsoft Windows|Windows]]. Internet Explorer also serves as a point of attachment for spyware in the form of [[Browser Helper Object]]s, which modify the browser's behaviour to add toolbars or to redirect traffic. In a few cases, a [[Computer worm|worm]] or [[Computer Virus|virus]] has delivered a spyware payload. Some attackers used the [[Spybot worm]] to install spyware that put pornographic pop-ups on the infected system's screen.<ref>"[http://www.symantec.com/avcenter/venc/data/w32.spybot.worm.html Security Response: W32.Spybot.Worm]". ''Symantec.com''. Retrieved [[July 10]] [[2005]].</ref> By directing traffic to ads set up to channel funds to the spyware authors, they profit personally. ==Effects and behaviors== A spyware program is rarely alone on a computer: an affected machine can rapidly be infected by many other components. Users frequently notice unwanted behavior and degradation of system performance. A spyware infestation can create significant unwanted [[central processing unit|CPU]] activity, disk usage, and network traffic, all of which slow the computer down. Stability issues, such as application or system-wide crashes, are also common. Spyware, which interferes with networking software commonly causes difficulty connecting to the Internet. In some infections, the spyware is not even evident. Users assume in those situations that the issues relate to hardware, Windows installation problems, or a virus. Some owners of badly infected systems resort to contacting [[technical support]] experts, or even buying a new computer because the existing system "has become too slow". Badly infected systems may require a clean reinstallation of all their software in order to return to full functionality. Only rarely does a single piece of software render a computer unusable. Rather, a computer is likely to have multiple infections. As a 2004 AOL study noted, if a computer has any spyware at all, it typically has dozens of different pieces installed. {{Fact|date=May 2008}} The cumulative effect, and the interactions between spyware components, causes the symptoms commonly reported by users: a computer, which slows to a crawl, overwhelmed by the many parasitic processes running on it. Moreover, some types of spyware disable software [[Firewall (networking)|firewalls]] and anti-virus software, and/or reduce browser security settings, thus opening the system to further [[opportunistic infection]]s, much like an [[immune deficiency]] disease. Some spywares disable or even remove competing spyware programs, on the grounds that more spyware-related annoyances make it even more likely that users will take action to remove the programs. One spyware maker, Avenue Media, even [[lawsuit|sued]] a competitor, Direct Revenue, over this; the two later [[settlement (law)|settled]] with an agreement not to disable each others' products.<ref name="competitor removal">Edelman, Ben; December 7, 2004 (updated February 8, 2005); [http://www.benedelman.org/news/120704-1.html Direct Revenue Deletes Competitors from Users' Disks]; benedelman.com; retrieved November 28, 2006.</ref> Some other types of spyware (for example, Targetsoft) modify system files so they will be harder to remove. Targetsoft modifies the "[[Winsock]]" Windows Sockets files. The deletion of the spyware-infected file "inetadpt.dll" will interrupt normal networking usage. Unlike users of many other operating systems, a typical Windows user has administrative privileges, mostly for convenience. Because of this, any program the user runs (intentionally or not) has unrestricted access to the system too. Spyware, along with other threats, has led some Windows users to move to other platforms such as [[Linux]] or [[Apple Macintosh]], which are significantly less susceptible to malware. This is because these programs are not granted unrestricted access to the operating system by default. As with other [[operating system]]s, Windows users too are able to follow the principle of [[least privilege]] and use non-administrator [[least user access]] accounts, or to reduce the [[Privilege (computing)|privileges]] of specific vulnerable Internet-facing [[process (computing)|proceses]] such as Internet Explorer (through the use of tools such as [http://msdn2.microsoft.com/en-us/library/ms972827.aspx DropMyRights]). However as this is not a default configuration, few users do this. ===Advertisements=== Many spyware programs display advertisements. Some programs simply display pop-up ads on a regular basis; for instance, one every several minutes, or one when the user opens a new browser window. Others display ads in response to specific sites that the user visits. Spyware operators present this feature as desirable to advertisers, who may buy ad placement in pop-ups displayed when the user visits a particular site. It is also one of the purposes for which spyware programs gather information on user behavior. Many users complain about irritating or offensive advertisements as well. As with many [[Web banner|banner ads]], many spyware advertisements use animation or flickering banners which can be visually distracting and annoying to users. Pop-up ads for [[pornography]] often display indiscriminately. Links to these sites may be added to the browser window, history or search function. When children are the users, this could possibly violate [[anti-pornography]] laws in some jurisdictions. A further issue in the case of some spyware programs has to do with the replacement of [[banner ad]]s on viewed web sites. Spyware that acts as a [[web proxy]] or a [[Browser Helper Object]] can replace references to a site's own advertisements (which fund the site) with advertisements that instead fund the spyware operator. This cuts into the margins of advertising-funded Web sites. ==="Stealware" and affiliate fraud=== A few spyware vendors, notably [[180 Solutions]], have written what the ''[[New York Times]]'' has dubbed "[[stealware]]", and what spyware researcher Ben Edelman terms ''affiliate fraud'', a form of [[click fraud]]. Stealware diverts the payment of [[affiliate marketing]] revenues from the legitimate affiliate to the spyware vendor. Spyware which attacks [[affiliate network]]s places the spyware operator's affiliate tag on the user's activity—replacing any other tag, if there is one. The spyware operator is the only party that gains from this. The user has their choices thwarted, a legitimate affiliate loses revenue, networks' reputations are injured, and vendors are harmed by having to pay out affiliate revenues to an "affiliate" who is not party to a contract.<ref name="edelman-180">Edelman, Ben (2004). "[http://www.benedelman.org/spyware/180-affiliates/ The Effect of 180solutions on Affiliate Commissions and Merchants]". ''Benedelman.org''. Retrieved [[November 14]] [[2006]].</ref> Affiliate fraud is a violation of the [[terms of service]] of most affiliate marketing networks. As a result, spyware operators such as 180 Solutions have been terminated from affiliate networks including LinkShare and ShareSale.{{Fact|date=February 2007}} ===Identity theft and fraud=== In one case, spyware has been closely associated with [[identity theft]].<ref>Ecker, Clint (2005). ''[http://arstechnica.com/news.ars/post/20050805-5175.html Massive spyware-based identity theft ring uncovered]''. Ars Technica, [[August 5]] [[2005]].</ref> In August 2005, researchers from security software firm Sunbelt Software believed that the makers of the common [[CoolWebSearch]] spyware had used it to transmit "[[Internet chat room|chat sessions]], [[user name]]s, [[password]]s, bank information, etc.",<ref>Eckelberry, Alex. [http://sunbeltblog.blogspot.com/2005/08/massive-identity-theft-ring.html "Massive identity theft ring"], ''SunbeltBLOG,'' [[August 4]] [[2005]].</ref> but it turned out that "it actually (was) its own sophisticated criminal little trojan that's independent of CWS."<ref>Eckelberry, Alex. [http://sunbeltblog.blogspot.com/2005/08/identity-theft-what-to-do.html "Identity Theft? What to do?"], ''SunbeltBLOG,'' [[August 8]] [[2005]].</ref> This case is currently under investigation by the [[Federal Bureau of Investigation|FBI]]. The [[Federal Trade Commission]] estimates that 27.3 million Americans have been victims of identity theft, and that financial losses from identity theft totaled nearly $48 billion for businesses and financial institutions and at least $5 billion in out-of-pocket expenses for individuals.<ref>[http://www.ftc.gov/opa/2003/09/idtheft.htm FTC Releases Survey of Identity Theft in U.S. 27.3 Million Victims in Past 5 Years, Billions in Losses for Businesses and Consumers]. Federal Trade Commission, [[September 3]] [[2003]].</ref> Spyware-makers may commit [[wire fraud]] with ''[[dialer]]'' program spyware. These can reset a [[modem]] to dial up a premium-rate telephone number instead of the usual [[Internet service provider|ISP]]. Connecting to these suspicious numbers involves long-distance or overseas charges which invariably result in high call costs. Dialers are ineffective on computers that do not have a modem, or are not connected to a telephone line. ===Digital rights management=== Some copy-protection technologies have borrowed from spyware. In 2005, [[Sony BMG Music Entertainment]] was [[2005 Sony BMG CD copy protection scandal|found to be using]] [[rootkit]]s in its [[XCP]] [[digital rights management]] technology<ref name="Sony scandal">Russinovich, Mark. [http://blogs.technet.com/markrussinovich/archive/2005/10/31/sony-rootkits-and-digital-rights-management-gone-too-far.aspx "Sony, Rootkits and Digital Rights Management Gone Too Far,"], ''Mark's Blog,'' [[October 31]], [[2005]], retrieved November 22, 2006</ref> Like spyware, not only was it difficult to detect and uninstall, it was so poorly written that most efforts to remove it could have rendered computers unable to function. [[Texas]] state [[attorney general]] [[Greg Abbott]] filed suit,<ref name="Texas AG lawsuit">Press release from the Texas Attorney General's office, November 21, 2005; [http://www.oag.state.tx.us/oagnews/release.php?id=1266 Attorney General Abbott Brings First Enforcement Action In Nation Against Sony BMG For Spyware Violations]; retrieved November 28, 2006.</ref> and three separate [[class-action]] suits were filed.<ref name="class-action suits">[http://news.bbc.co.uk/1/hi/technology/4424254.stm "Sony sued over copy-protected CDs; Sony BMG is facing three lawsuits over its controversial anti-piracy software"], ''BBC News,'' November 10, 2005, retrieved November 22, 2006.</ref> Sony BMG later provided a workaround on its website to help users remove it.<ref name="Sony workaround">[http://cp.sonybmg.com/xcp/english/updates.html Information About XCP Protected CDs], retrieved November 29, 2006.</ref> Beginning in [[April 25]], [[2006]], Microsoft's [[Windows Genuine Advantage]] Notifications application<ref>[http://support.microsoft.com/kb/905474/ Microsoft.com - Description of the Windows Genuine Advantage Notifications application], retrieved [[June 13]], [[2006]]</ref> installed on most Windows PCs as a "critical security update". While the main purpose of this deliberately non-uninstallable application is making sure the copy of Windows on the machine was lawfully purchased and installed, it also installs software that has been accused of "phoning home" on a daily basis, like spyware.<ref>Weinstein, Lauren. [http://lauren.vortex.com/archive/000178.html Windows XP update may be classified as 'spyware'], ''Lauren Weinstein's Blog,'' [[June 5]] [[2006]], retrieved [[June 13]], [[2006]]</ref><ref>Evers, Joris. [http://news.zdnet.com/2100-3513_22-6081286.html?tag=nl.e589 Microsoft's antipiracy (sic) tool "phones home" daily], ''ZDNet News,'' [[June 7]] [[2006]], retrieved [[June 13]], [[2006]]</ref> It can be removed with the RemoveWGA tool. ===Personal relationships=== Spyware has been used to surreptitiously monitor electronic activities of partners in intimate relationships, generally to uncover evidence of infidelity. At least one software package, Loverspy, was specifically marketed for this purpose. Depending on local laws regarding communal/marital property, observing a partner's online activity without their consent may be illegal; the author of Loverspy and several users of the product were indicted in California in 2005 on charges of wiretapping and various computer crimes.<ref>[http://www.usdoj.gov/criminal/cybercrime/perezIndict.htm Creator and Four Users of Loverspy Spyware Program Indicted (August 26, 2005)<!-- Bot generated title -->]</ref> ===Spyware and cookies=== Anti-spyware programs often report Web advertisers' [[HTTP cookie]]s, the small text files that track browsing activity, as spyware. While they are not always inherently malicious, many users object to third parties using space on their personal computers for their business purposes, and many anti-spyware programs offer to remove them. ===Examples of spyware=== These common spyware programs illustrate the diversity of behaviors found in these attacks. Note that as with computer viruses, researchers give names to spyware programs which may not be used by their creators. Programs may be grouped into "families" based not on shared program code, but on common behaviors, or by "following the money" of apparent financial or business connections. For instance, a number of the spyware programs distributed by [[Claria]] are collectively known as "Gator". Likewise, programs which are frequently installed together may be described as parts of the same spyware package, even if they function separately. <!-- Please avoid turning this into another unmaintainable list of "all known spyware". If you have a cited, sourced description of a piece of spyware that exhibits notably different behavior, or illustrates a typical spyware behaviour that these examples don't, please add it—but feel free to REMOVE one of the listed examples if it becomes redundant. This list should not grow longer than (say) five entries. --> *'''[[CoolWebSearch]]''', a group of programs, takes advantage of Internet Explorer vulnerabilities. The package directs traffic to advertisements on Web sites including ''coolwebsearch.com''. It displays pop-up ads, rewrites [[Web search engine|search engine]] results, and alters the infected computer's [[hosts file]] to direct [[Domain Name System|DNS]] lookups to these sites.<ref name="doxdb">"{{cite web |url=http://www.doxdesk.com/parasite/database.html |title= Parasite information database |archiveurl=http://web.archive.org/web/20050206012416/http://www.doxdesk.com/parasite/database.html |archivedate=2005-02-06}}".{{Dead link|date=July 2007}} ''Doxdesk.com''. Retrieved [[July 10]] [[2005]].</ref> *'''[[Internet Optimizer]]''', also known as '''DyFuCa''', redirects Internet Explorer error pages to advertising. When users follow a broken link or enter an erroneous URL, they see a page of advertisements. However, because password-protected Web sites (HTTP Basic authentication) use the same mechanism as HTTP errors, Internet Optimizer makes it impossible for the user to access password-protected sites.<ref name="doxdb" /> *'''[[Zango]]''' (formerly '''[[180 Solutions]]''') transmits detailed information to advertisers about the Web sites which users visit. It also alters HTTP requests for [[affiliate marketing|affiliate]] advertisements linked from a Web site, so that the advertisements make unearned profit for the 180 Solutions company. It opens pop-up ads that cover over the Web sites of competing companies.<ref name="edelman-180"/> *'''[[HuntBar]]''', aka '''WinTools''' or '''[http://securityresponse.symantec.com/avcenter/venc/data/adware.websearch.html Adware.Websearch]''', was installed by an ActiveX [[drive-by installation|drive-by download]] at affiliate Web sites, or by advertisements displayed by other spyware programs—an example of how spyware can install more spyware. These programs add toolbars to IE, track aggregate browsing behavior, redirect affiliate references, and display advertisements.<ref name ="caspywareic"> [http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453072528 CA Spyware Information Center - HuntBar]</ref><ref name="pchell">[http://www.pchell.com/support/huntbar.shtml What is Huntbar or Search Toolbar?]</ref> *'''[[Movieland]]''', also known as '''Moviepass.tv''' and '''Popcorn.net''', is a movie download service that has been the subject of thousands of complaints to the [[Federal Trade Commission]] (FTC), the [[Washington]] [[State Attorney General|State Attorney General's Office]], the [[Better Business Bureau]], and other agencies. Consumers complained they were held hostage by a cycle of oversized [[pop-up window]]s demanding payment of at least $29.95, claiming that they had signed up for a three-day free trial but had not cancelled before the trial period was over, and were thus obligated to pay.<ref name= "FTCNEWSRELEASE"> {{cite web |url= http://www.ftc.gov/opa/2006/08/movieland.htm |title= FTC, Washington Attorney General Sue to Halt Unfair Movieland Downloads |publisher= [[Federal Trade Commission]] |date= [[2006-08-15]] }}</ref><ref name= "WANEWSRELEASE"> {{ cite web |url= http://www.atg.wa.gov/pressrelease.aspx?id=4286 |title= Attorney General McKenna Sues Movieland.com and Associates for Spyware |publisher= Washington State Office of the Attorney General |date= [[2006-08-14]] }}</ref> The FTC filed a [[complaint]], since [[Settlement (litigation)|settled]], against Movieland and [[Movieland#Defendants|eleven other defendants]] charging them with having "engaged in a nationwide scheme to use [[deception]] and [[coercion]] to extract payments from consumers."<ref name= "FTCCOMPLAINT"> {{cite web |url= http://www.ftc.gov/os/caselist/0623008/060808movielandcmplt.pdf |title= Complaint for Permanent Injunction and Other Equitable Relief (PDF, 25 pages) |publisher= [[Federal Trade Commission]] |date= [[2006-08-08]] }}</ref> *'''[[Zlob trojan]]''', or just '''Zlob''', Downloads itself to your computer via an [[ActiveX]] codec and reports information back to '''Control Server'''. Some information can be as your search history, the Websites you visited, and even Key Strokes. More recently, Zlob has been know to hijack Routers set to defaults.<ref name= "NEW MALWARE CHANGES ROUTER SETTINGS"> [http://blogs.pcmag.com/securitywatch/2008/06/new_malware_silently_changes_r.php PCMAG, New Malware changes router settings], PC Magizine, [[June 13]] [[2008]].</ref> ==Legal issues related to spyware== ===Criminal law=== Unauthorized access to a computer is illegal under [[computer crime]] laws, such as the U.S. [[Computer Fraud and Abuse Act]], the U.K.'s [[Computer Misuse Act]] and similar laws in other countries. Since the owners of computers infected with spyware generally claim that they never authorized the installation, a ''[[prima facie]]'' reading would suggest that the promulgation of spyware would count as a criminal act. Law enforcement has often pursued the authors of other malware, particularly viruses. However, few spyware developers have been prosecuted, and many operate openly as strictly legitimate businesses, though some have faced lawsuits.<ref>"[http://blogs.zdnet.com/Spyware/?p=655 Lawsuit filed against 180solutions]". ''zdnet.com'' [[September 13]], [[2005]]</ref><ref>Hu, Jim. "[http://news.com.com/2110-1024_3-5287885.html 180solutions sues allies over adware]". ''news.com'' [[July 28, 2004]]</ref> Spyware producers argue that, contrary to the users' claims, users do in fact give [[consent]] to installations. Spyware that comes bundled with shareware applications may be described in the [[legalese]] text of an [[end-user license agreement]] (EULA). Many users habitually ignore these purported contracts, but spyware companies such as Claria claim these demonstrate that users have consented. Despite the ubiquity of EULAs and of "[[clickwrap]]" agreements, under which a single click can be taken as consent to the entire text, relatively little [[case law]] has resulted from their use. It has been established in most [[common law]] jurisdictions that a clickwrap agreement can be a binding contract ''in certain circumstances.''<ref name="clickwrap legality">Coollawyer; 2001-2006; [http://www.coollawyer.com/webfront/internet_law_library/articles/law_library_user_agreement_article.php Privacy Policies, Terms and Conditions, Website Contracts, Website Agreements]; coollawyer.com; retrieved November 28, 2006.</ref> This does not, however, mean that every such agreement is a [[contract]] or that every term in one is enforceable. Some jurisdictions, including the U.S. states of [[Iowa]]<ref>"[http://nxtsearch.legis.state.ia.us/NXT/gateway.dll/2007%20Iowa%20Code/2007code/1/26150/26151/26513?f=templates&fn=defaultURLquerylink.htm CHAPTER 715 COMPUTER SPYWARE AND MALWARE PROTECTION]". ''nxtsearch.legis.state.ia.us''. Retrieved [[July 14]] [[2007]].</ref> and [[Washington]],<ref>[http://apps.leg.wa.gov/RCW/default.aspx?cite=19.270 Chapter 19.270 RCW: Computer spyware]. ''apps.leg.wa.gov''. Retrieved [[November 14]], [[2006]]</ref> have passed laws criminalizing some forms of spyware. Such laws make it illegal for anyone other than the owner or operator of a computer to install software that alters Web-browser settings, monitors keystrokes, or disables computer-security software. In the [[United States]], lawmakers introduced a bill in 2005 entitled the [[Internet Spyware Prevention Act]], which would imprison creators of spyware.<ref>Gross, Grant. [http://www.infoworld.com/article/07/03/16/HNspywarebill_1.html US lawmakers introduce I-Spy bill]. ''InfoWorld,'' [[March 16]] [[2007]], accessed [[March 24]] [[2007]].</ref> ===Administrative sanctions=== An administrative fine, first of its kind in Europe, has been taken by the Independent Authority of Posts and Telecommunications (OPTA) from the Netherlands. It applied fines in total value of Euro 1,000,000 for infecting 22 million computers. The spyware is called DollarRevenue. The law articles which have been violated are art. 4.1 of the Dutch telecommunications law; the fines have been given based on art. 15.4 taken together with art. 15.10. A part of these fines has to be paid by the directors of these companies in their own person, i.e. not from the accounts of their companies, but from their personal fortunes.<ref>OPTA, "Besluit van het college van de Onafhankelijke Post en Telecommunicatie Autoriteit op grond van artikel 15.4 juncto artikel 15.10 van de Telecommunicatiewet tot oplegging van boetes ter zake van overtredingen van het gestelde bij of krachtens de Telecommunicatiewet" from 5 november 2007, http://opta.nl/download/202311+boete+verspreiding+ongewenste+software.pdf</ref> Since a protest procedure has been taken, the fines will have to be paid after a Dutch law court will take a decision in this case. The culprits maintain that the evidence for violating the two law articles has been obtained illegally. The names of the directors and the names of the companies have not been revealed, since it is not clear that OPTA is allowed to make such information public.<ref>According to H. Moll and E. Schouten, [http://www.nrc.nl/economie/article868499.ece/Limburgse_ICT-baas_blijkt_spywarekoning "Limburgse ICT-baas blijkt spywarekoning"], in NRC Handelsblad, 21 december 2007, the companies are:<br>ECS International, Worldtostart and Media Highway International. The directors are: Arjan de Raaf and Peter Emonds. Their accomplice having the nickname "Akill" has been arrested in Hamilton, New Zealand, for being the manager of a huge network of zombie computers.</ref> ===Civil law=== Former [[New York State]] [[Attorney General]] and former New York State [[Governor]] [[Eliot Spitzer]] has pursued spyware companies for fraudulent installation of software.<ref>"[http://www.oag.state.ny.us/press/2005/apr/apr28a_05.html State Sues Major "Spyware" Distributor]". ''Office of New York State Attorney General''. [[April 28]] [[2005]].</ref> In a suit brought in 2005 by Spitzer, the California firm [[Intermix Media, Inc.]] ended up settling by agreeing to pay US$7.5 million and to stop distributing spyware.<ref>Gormley, Michael. {{cite web |url=http://news.yahoo.com/news?tmpl=story&u=/cpress/20050615/ca_pr_on_tc/spitzer_spyware |title= "Intermix Media Inc. says it is settling spyware lawsuit with N.Y. attorney general" |archiveurl=http://web.archive.org/web/20050622082027/http://news.yahoo.com/news?tmpl=story&u=/cpress/20050615/ca_pr_on_tc/spitzer_spyware |archivedate=2005-06-22}}. ''[[Yahoo!]] News''. [[June 15]] [[2005]].</ref> The hijacking of Web advertisements has also led to litigation. In June 2002, a number of large Web publishers sued [[Claria]] for replacing advertisements, but settled out of court. Courts have not yet had to decide whether advertisers can be held [[liability|liable]] for spyware which displays their ads. In many cases, the companies whose advertisements appear in spyware pop-ups do not directly do business with the spyware firm. Rather, they have contracted with an [[advertising agency]], which in turn contracts with an online subcontractor who gets paid by the number of "impressions" or appearances of the advertisement. Some major firms such as [[Dell Computer]] and [[Mercedes-Benz]] have sacked advertising agencies which have run their ads in spyware.<ref>Gormley, Michael. "[http://www.usatoday.com/tech/news/computersecurity/2005-06-25-companies-spyware_x.htm Major advertisers caught in spyware net]".{{Dead link|date=July 2007}} ''[[Business Week]]''. [[June 24]] [[2005]].</ref> ===Libel suits by spyware developers=== Litigation has gone both ways. Since "spyware" has become a common [[pejorative]], some makers have filed [[slander and libel|libel]] and [[defamation]] actions when their products have been so described. In 2003, Gator (now known as Claria) filed suit against the website PC Pitstop for describing its program as "spyware".<ref>Festa, Paul. "[http://news.com.com/2100-1032_3-5095051.html See you later, anti-Gators?]". ''News.com''. [[October 22]] [[2003]].</ref> PC Pitstop settled, agreeing not to use the word "spyware", but continues to describe harm caused by the Gator/Claria software.<ref>"[http://www.pcpitstop.com/gator/default.asp Gator Information Center]". ''pcpitstop.com'' [[November 14]] [[2005]].</ref> As a result, other antispyware and antivirus companies have also used other terms such as "potentially unwanted programs" or [[greyware]] to denote these products. ==Remedies and prevention== As the spyware threat has worsened, a number of techniques have emerged to counteract it. These include programs designed to remove or to block spyware, as well as various user practices which reduce the chance of getting spyware on a system. Nonetheless, spyware remains a costly problem. When a large number of pieces of spyware have infected a Windows computer, the only remedy may involve backing up user data, and fully reinstalling the operating system. ===Anti-spyware programs=== [[Image:Ad-aware 2008 Free screenshot.png|thumb|300px|right|Lavasoft's [[Ad-Aware]] 2008]] Many programmers and some commercial firms have released products designed to remove or block spyware. [[Steve Gibson (computer programmer)|Steve Gibson]]'s ''OptOut'' pioneered a growing category. Programs such as Lavasoft's ''[[Ad-Aware SE]]'' (free scans for non-commercial users, must pay for other features) and Patrick Kolla's ''[[Spybot - Search & Destroy]]'' (all features free for non-commercial use) rapidly gained popularity as effective tools to remove, and in some cases intercept, spyware programs. More recently [[Microsoft]] acquired the ''[[GIANT AntiSpyware]]'' software, rebranding it as ''Windows AntiSpyware beta'' and releasing it as a free download for Genuine [[Windows XP]] and [[Windows 2003]] users. In 2006, [[Microsoft]] renamed the beta software to [[Windows Defender]] (free), and it was released as a free download in October 2006 and is included as standard with [[Windows Vista]]. Other well-known commercial anti-spyware products include: * [[PC Tools (Windows software suite)|PC Tools]]'s [[Spyware Doctor]] (free scans but you have to pay to remove the spyware) * [[DriveSentry]] (free version (3.1) will remove spyware) * [[ParetoLogic]]'s Anti-Spyware and [[XoftSpy SE]] (free version does not remove spyware) * [[Sunbelt Software]]'s [[Counterspy]] (15-day free trial) * [[Trend Micro]]'s [[HijackThis]] (free) * [[Webroot Software]]'s [[Spy Sweeper]] (free version does not remove spyware) Major anti-virus firms such as [[Symantec]], [[McAfee]] and [[Sophos]] have come later to the table, adding anti-spyware features to their existing anti-virus products. Early on, anti-virus firms expressed reluctance to add anti-spyware functions, citing lawsuits brought by spyware authors against the authors of web sites and programs which described their products as "spyware". However, recent versions of these major firms' home and business anti-virus products do include anti-spyware functions, albeit treated differently from viruses. Symantec Anti-Virus, for instance, categorizes spyware programs as "extended threats" and now offers [[real-time protection]] from them (as it does for viruses). Recently, the anti-virus company [[Grisoft]], creator of [[AVG Anti-Virus]], acquired anti-spyware firm Ewido Networks, re-labeling their Ewido anti-spyware program as AVG Anti-Spyware Professional Edition. AVG also used this product to add an integrated anti-spyware solution to some versions of the [[AVG Anti-Virus]] family of products, plus made a [[freeware]] AVG Anti-Spyware Free Edition available for private and non-commercial use. This shows a trend by anti virus companies to launch a dedicated solution to spyware and malware. Zone Labs, creator of [[Zone Alarm]] [[firewall]] have also released an anti-spyware program. [[Image:Alwaysupdate-adware-winspy.PNG|thumb|225px|left|[[Windows Defender|Microsoft Anti-Spyware]], in real-time protection blocks an instance of the AlwaysUpdateNews from being installed.]] Anti-spyware programs can combat spyware in two ways: *1. They can provide real time protection against the installation of spyware software on your computer. This type of spyware protection works the same way as that of anti-virus protection in that the anti-spyware software scans all incoming network data for spyware software and blocks any threats it comes across. *2. Anti-spyware software programs can be used solely for detection and removal of spyware software that has already been installed onto your computer. This type of spyware protection is normally much easier to use and more popular. With this spyware protection software you can schedule weekly, daily, or monthly scans of your computer to detect and remove any spyware software that has been installed on your computer. This type of anti-spyware software scans the contents of the windows registry, operating system files, and installed programs on your computer and will provide a list of any threats found, allowing you to choose what you want to delete and what you want to keep. Such programs inspect the contents of the Windows registry, the operating system files, and installed programs, and remove files and entries which match a list of known spyware components. Real-time protection from spyware works identically to real-time anti-virus protection: the software scans disk files at download time, and blocks the activity of components known to represent spyware. In some cases, it may also intercept attempts to install start-up items or to modify browser settings. Because many spyware and adware are installed as a result of browser exploits or user error, using security software (some of which are antispyware, though many are not) to [[Sandbox (computer security)|sandbox]] browsers can also be effective to help restrict any damage done. Earlier versions of anti-spyware programs focused chiefly on detection and removal. Javacool Software's [[SpywareBlaster]], one of the first to offer real-time protection, blocked the installation of [[ActiveX]]-based and other spyware programs. Like most anti-virus software, many anti-spyware/adware tools require a frequently-updated database of threats. As new spyware programs are released, anti-spyware developers discover and evaluate them, making "signatures" or "definitions" which allow the software to detect and remove the spyware. As a result, anti-spyware software is of limited usefulness without a regular source of updates. Some vendors provide a subscription-based update service, while others provide updates free. Updates may be installed automatically on a schedule or before doing a scan, or may be done manually. Not all programs rely on updated definitions. Some programs rely partly (for instance many antispyware programs such as Windows Defender, [[Spybot]]'s TeaTimer and Spysweeper) or fully (programs falling under the class of [[Intrusion-prevention system|Hips]] such as BillP's WinPatrol) on historical observation. They watch certain configuration parameters (such as certain portions of the Windows registry or browser configuration) and report any change to the user, without judgment or recommendation. While they do not rely on updated definitions, which may allow them to spot newer spyware, they can offer no guidance. The user is left to determine "what did I just do, and is this configuration change appropriate?" [[Windows Defender]]'s Spynet attempts to alleviate this through offering a community to share information, which helps guide both users, who can look at decisions made by others, and analysts, who can spot fast-spreading spyware. A popular generic spyware removal tool used by those with a certain degree of expertise is [[HijackThis]], which scans certain areas of the Windows OS where spyware often resides and presents a list with items to delete manually. As most of the items are legitimate windows files/registry entries it is advised for those who are less knowledgeable on this subject to post a HijackThis log on the numerous antispyware sites and let the experts decide what to delete. If a spyware program is not blocked and manages to get itself installed, it may resist attempts to terminate or uninstall it. Some programs work in pairs: when an anti-spyware scanner (or the user) terminates one running process, the other one respawns the killed program. Likewise, some spyware will detect attempts to remove registry keys and immediately add them again. Usually, booting the infected computer in [[safe mode]] allows an anti-spyware program a better chance of removing persistent spyware. Killing the process tree can also work. A new breed of spyware (Look2Me spyware by NicTechNetworks is a good example) is starting to hide inside system-critical processes and start up even in safe mode. With no process to terminate they are harder to detect and remove. Sometimes they do not even leave any on-disk signatures. [[Rootkit]] technology is also seeing increasing use,<ref name="rootkit">Roberts, Paul F. "[http://www.eweek.com/article2/0,1759,1829744,00.asp Spyware meets Rootkit Stealth]". ''eweek.com''. [[June 20]] [[2005]].</ref> as is the use of [[NTFS]] [[Fork (filesystem)|alternate data streams]]. Newer spyware programs also have specific countermeasures against well known anti-malware products and may prevent them from running or being installed, or even uninstall them. An example of one that uses all three methods is Gromozon, a new breed of malware. It uses alternate data streams to hide. A [[rootkit]] hides it even from alternate data streams scanners and actively stops popular [[rootkit]] scanners from running. ===Rogue anti-spyware programs=== {{see also|List of fake anti-spyware programs}} {{see also|Rogue software}} Malicious programmers have released a large number of rogue (fake) anti-spyware programs, and widely distributed Web [[banner ad]]s now spuriously warn users that their computers have been infected with spyware, directing them to purchase programs which do not actually remove spyware—or else, may add more spyware of their own.<ref>Roberts, Paul F. "[http://www.eweek.com/article2/0,1759,1821127,00.asp Spyware-Removal Program Tagged as a Trap]{{Dead link|date=June 2008}}". ''[[eWeek]]''. [[May 26]] [[2005]].</ref><ref>Howes, Eric L. "[http://www.spywarewarrior.com/rogue_anti-spyware.htm The Spyware Warrior List of Rogue/Suspect Anti-Spyware Products & Web Sites]". Retrieved [[July 10]] [[2005]].</ref> The [[as of 2005|recent]] proliferation of fake or spoofed antivirus products has occasioned some concern. Such products often bill themselves as antispyware, antivirus, or registry cleaners, and sometimes feature popups prompting users to install them. This software is called [[rogue software]]. It is recommended that users do not install any freeware claiming to be anti-spyware unless it is verified to be legitimate. Some known offenders include: {{col-begin}} {{Col-1-of-2}} * [[AntiVirus Gold]] * [[ContraVirus]] * [[Errorsafe]] (AKA system doctor) * [[MacSweeper]] * [[PAL Spyware Remover]] * [[Pest Trap]] * [[PSGuard]] * [[SpywareStrike]] * [[Spyware Quake]] {{Col-2-of-2}} * [[Spydawn]] * [[Spylocked]] * [[SpyShredder]] * [[Spysheriff|Spy Sheriff]] * [[Spy Wiper]] * [[UltimateCleaner]] * [[WinAntiVirus Pro 2006]] * [[WinFixer]] * [[WorldAntiSpy]] {{col-end}} On [[January 26]], [[2006]], Microsoft and the Washington state attorney general filed suit against Secure Computer for its Spyware Cleaner product.<ref>McMillan, Robert. [http://www.pcworld.com/news/article/0,aid,124508,00.asp Antispyware Company Sued Under Spyware Law]. ''PC World,'' [[January 26]] [[2006]].</ref> On [[December 4]], [[2006]], the Washington attorney general announced that Secure Computer had paid $1 million to settle with the state. As of that date, Microsoft's case against Secure Computer remained pending.<ref>Leyden, John. [http://www.theregister.co.uk/2006/12/05/washington_anti-spware_lawsuit/ Bogus anti-spyware firm fined $1m]. ''The Register,'' [[December 5]] [[2006]].</ref> ===Security practices=== To deter spyware, computer users have found several practices useful in addition to installing anti-spyware programs. Many system operators install a [[web browser]] other than IE, such as [[Opera (web browser)|Opera]] or [[Mozilla Firefox]]. Though no browser is completely safe, Internet Explorer is at a greater risk for spyware infection due to its large user base as well as vulnerabilities such as [[ActiveX]]. Some ISPs—particularly [[college]]s and universities—have taken a different approach to blocking spyware: they use their network [[firewall (networking)|firewall]]s and [[Web proxy|web proxies]] to block access to Web sites known to install spyware. On [[March 31]], [[2005]], [[Cornell University]]'s Information Technology department released a report detailing the behavior of one particular piece of proxy-based spyware, ''[[Marketscore]]'', and the steps the university took to intercept it.<ref>Schuster, Steve. "{{cite web |url=http://www.cit.cornell.edu/computer/security/marketscore/MarketScore_rev2.html |title= Blocking Marketscore: Why Cornell Did It |archiveurl=http://web.archive.org/web/20070214111921/http://www.cit.cornell.edu/computer/security/marketscore/MarketScore_rev2.html |archivedate=2007-02-14}}". Cornell University, Office of Information Technologies. [[March 31]] [[2005]].</ref> Many other educational institutions have taken similar steps. Spyware programs which redirect network traffic cause greater technical-support problems than programs which merely display ads or monitor users' behavior, and so may more readily attract institutional attention.{{Fact|date=February 2007}} Some users install a large [[hosts file]] which prevents the user's computer from connecting to known spyware related web addresses. However, by connecting to the numeric IP address, rather than the domain name, spyware may bypass this sort of protection. Spyware may get installed via certain [[shareware]] programs offered for download. Downloading programs only from reputable sources can provide some protection from this source of attack. Recently, [[CNet]] revamped its download directory: it has stated that it will only keep files that pass inspection by Ad-Aware and Spyware Doctor.{{Fact|date=February 2007}} The first step to removing the virus(spyware) is to put your computer on "lockdown." This can be done in various ways such as using your anti-virus software, or simply disconnect your computer from all internet activies. This will make whoever is in control of the virus unable to have any control of your computer. The second step to removing the spyware is to locate it and remove it, manually or by virus protection software. Also, stay away from websites that have potential threats to your computer. ==Programs distributed with spyware== <!-- LIST ONLY SOFTWARE NOTABLE ENOUGH TO HAVE ITS OWN ARTICLE, AND CITE SOURCES. --> *[[Bonzi Buddy]]<ref>"[http://sarc.com/avcenter/venc/data/adware.bonzi.html Symantec Security Response - Adware.Bonzi]". ''Symantec''. Retrieved [[July 27]] [[2005]].</ref> *[[Dope Wars]]<ref>Edelman, Ben (2005). "[http://www.benedelman.org/spyware/installations/dopewars-claria/ Claria's Misleading Installation Methods - Dope Wars]". Retrieved [[July 27]] [[2005]]</ref> *[[ErrorGuard]]<ref>"[http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=453094197 eTrust Spyware Encyclopedia - ErrorGuard]". ''Computer Associates''. Retrieved [[July 27]] [[2005]].</ref> *[[Grokster]]<ref>Edelman, Ben (2004). "[http://www.benedelman.org/news/100904-1.html Grokster and Claria Take Licenses to New Lows, and Congress Lets Them Do It]". Retrieved [[July 27]] [[2005]]</ref> *[[Kazaa]]<ref>Edelman, Ben (2004). "[http://www.benedelman.org/spyware/claria-license/ Claria License Agreement Is Fifty Six Pages Long]". Retrieved [[July 27]] [[2005]].</ref> *[[Morpheus (computer program)|Morpheus]]<ref name="p2p">Edelman, Ben (2005). "[http://www.benedelman.org/spyware/p2p/ Comparison of Unwanted Software Installed by P2P Programs]". Retrieved [[July 27]] [[2005]].</ref> *[[RadLight]]<ref>"[http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=54732 eTrust Spyware Encyclopedia - Radlight 3 PRO]". ''Computer Associates''. Retrieved [[July 27]] [[2005]]</ref> *[[WeatherBug]]<ref>"{{cite web |url=http://www.doxdesk.com/parasite/WeatherBug.html |title= doxdesk.com: database: WeatherBug |archiveurl=http://web.archive.org/web/20050206011153/http://www.doxdesk.com/parasite/WeatherBug.html |archivedate=2005-02-06}}".{{Dead link|date=July 2007}} ''Doxdesk.com''. Retrieved [[July 27]] [[2005]].</ref> *[[EDonkey2000]]<ref name="p2p" /> *[[Sony]]'s [[Extended Copy Protection]] involved the installation of spyware from audio [[compact disc]]s through [[autorun]]. This practice sparked [[2005 Sony BMG CD copy protection scandal|considerable controversy]] when it was discovered. *[[WildTangent]]<ref name="sunbelt-wild">"[http://research.sunbelt-software.com/threat_display.cfm?name=WildTangent&threatid=14225 WildTangent]".{{Dead link|date=July 2007}} ''Sunbelt Software''. Retrieved [[July 27]] [[2005]].</ref> The antispyware program [[CounterSpy]] used to say that it's okay to keep WildTangent, but it now says that the spyware Winpipe is "possibly distributed with the adware bundler WildTangent or from a threat included in that bundler".<ref>[http://research.sunbelt-software.com/threatdisplay.aspx?name=Winpipe&threatid=15154 Winpipe]</ref> ===Programs formerly distributed with spyware=== *[[AOL Instant Messenger]]<ref name="sunbelt-wild" /> (AOL Instant Messenger still packages Viewpoint Media Player, and WildTangent) *[[DivX]] (except for the paid version, and the "standard" version without the encoder). DivX announced removal of GAIN software from version 5.2.<ref>"[http://www.pcpitstop.com/gator/Confused.asp How Did I Get Gator?]". ''PC Pitstop''. Retrieved [[July 27]] [[2005]].</ref> *[[FlashGet]] (trial version prior to program being made freeware)<ref>"[http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=453077947 eTrust Spyware Encyclopedia - FlashGet]". ''Computer Associates''. Retrieved [[July 27]] [[2005]]</ref> ==Notes== {{reflist|2}} ==See also== *[[:Category:Spyware removal]] – programs which find and remove spyware *[[Spy software]] *[[Adware]] *[[Malware]] *[[Rootkits]] *[[Trojan horse (computing)]] *[[Employee monitoring software]] *[[Computer insecurity]] *[[Defensive computing]] *[[Phone home]] ==External links== <!-- ==============================({{NoMoreLinks}})============================== --> <!-- DO NOT ADD MORE LINKS TO THIS ARTICLE. WIKIPEDIA IS NOT A COLLECTION OF LINKS --> <!-- If you think that your link might be useful, instead of placing it here, put --> <!-- it on this article's discussion page first. Links that have not been verified --> <!-- WILL BE DELETED --> <!-- ============================================================================= --> ; Guide * [http://guides.radified.com/magoo/guides/spyware/remove_spyware_01.htm Magoo's Guide to Eliminating Spyware] — information on how to get rid of spyware and keep it from returning. * [http://spywarewarrior.com/asw-features.htm The Spyware Warrior Guide to Anti-Spyware Programs] at Spyware Warrior * [http://www.firewallguide.com/spyware.htm Anti-spyware Guides] — a page listing a lot of spyware guides. * [http://www.putertuner.com/ PuterTuner.com] — a step by step guide, with downloads, on what tools to use and how to use them for removing spyware and adware. ; Removal * [http://www.2-spyware.com/ Spyware and Malware removal tools] — parasites encyclopaedia and instructions how to remove spyware and malware programs. * [http://www.bleepingcomputer.com/forums/forum55.html Spyware & Malware Removal Self-Help Guides] — self-help guides on preventing and removing different types of spyware and malware. * [http://forums.whatthetech.com/Self_Help_Fixes_for_Spyware_Malware_f97.html Self Help Fixes for Spyware / Malware] - Spyware removal guides ; Prevention * [http://www.windowsecurity.com/articles/Spyware-Evolving.html How Spyware And The Weapons Against It Are Evolving] — article discussing causes and possible remedies of the spyware problem. * [http://www.cert.org/tech_tips/securing_browser/ Securing Your Web Browser] — document that describes how to securely configure your web browser. ; Testing and comparison * [http://www.consumersearch.com/www/software/anti-spyware-reviews/reviews.html Consumer Search] — a third-party ratings and comments on different reviews in other websites, in which the ratings are based on credibility in testing, evaluating and identifying the best Anti-Spyware. ; Organizations * [http://www.antispywarecoalition.org/ Anti-Spyware Coalition] — a group developing formal definitions and [[best practice|best-practice]]s. * [http://www.stopbadware.org/ StopBadware.org] — A non-profit group (sponsored by Google, Lenovo, and Sun) that aims to provide "reliable, objective information about downloadable applications". [[Category:Spyware]] [[Category:Malware]] [[Category:Rogue software]] [[Category:Computer network security]] [[Category:Internet advertising and promotion]] [[Category:Espionage techniques]] [[Category:Espionage devices]] [[ar:Spyware]] [[bs:Spyware]] [[ca:Programari espia]] [[cs:Spyware]] [[da:Spyware]] [[de:Spyware]] [[el:Spyware]] [[et:Nuhkvara]] [[es:Programa espía]] [[fa:جاسوس‌افزار]] [[fr:Logiciel espion]] [[ko:스파이웨어]] [[hr:Spyware]] [[id:Spyware]] [[it:Spyware]] [[he:רוגלה]] [[ku:Spyware]] [[hu:Spyware]] [[nl:Spyware]] [[ja:スパイウェア]] [[no:Spionprogramvare]] [[pl:Spyware]] [[pt:Spyware]] [[ro:Spyware]] [[ru:Spyware]] [[sq:Spyware]] [[simple:Spyware]] [[sk:Spyware]] [[sr:Спајвер]] [[fi:Vakoiluohjelma]] [[sv:Spionprogram]] [[th:ซอฟต์แวร์สอดแนม]] [[vi:Phần mềm gián điệp]] [[tr:Casus yazılım (spyware)]] [[uk:Шпигунські програмні продукти]] [[zh:间谍软件]]