MINDPRIDE Computer Services

Home | About Us | Our Services | Contact Information | Tutorials, Articles & Dictionaries | Site Map



About Us



Virus Alerts




Refer A Friend

Site Map



Privacy Policy




Spyware - Adaware


Tips > Adware and Spyware

Author's notes
The following discussion is targeted to basic and intermediate skill level home users. Advanced users may find some material of interest in Annotated additional resources. Also, some parts of the discussion including, but not limited to, excerpts from various End User License Agreements, make for tedious reading. Last update: February 22, 2004 (22 February 2004).
Special note about certain cites listed under Annotated additional resources
Certain on the sites listed below under Annotated additional resources are not currently online. According to currently available information, these sites have been the target of Distributed Denial of Service Attacks (DDOS) that have overwhelmed the host server. Attempts to download HijackThis or to login to forums that assist in interpreting the results of a scan have resulted in domain unavailable, page cannot be found or other errors. Reportedly the FBI has been alerted to the attacks, but little is known about the reason behind the attacks or the identity of the perpetrator or perpetrators of the attacks. One can reasonably surmise that these attacks have been orchestrated by dark elements that profit by foisting Adware/Spyware upon unsuspecting users. Suffice it to say, that these attacks are an outrageous affront to not only the eminently decent folks, who write programs for and provide assistance to thousands of home users, but to all legitimate users of the Web.
Adware is a program that runs on your computer, monitors your surfing habits and delivers targeted advertisements, typically in the form of pop-up windows. Spyware is a program that runs on your computer, monitors your Web surfing habits and reports the habits to a remote computer. Both Adware and Spyware purloin precious system resources, resulting in performance degradation. Case in point: A customer presents a machine (Win98SE) complaining that the computer "runs slow." Known Adware/Spyware programs were observed and tools were run to remove these programs. After removal of over 500 files, folders and registry keys and some other tweaking system resources went from 16% (fresh boot) to 88%. In addition to seriously sapping system resources, some Adware/Spyware programs can create Internet connectivity problems, and can even cause system crashes.
Adware/Spyware evolution
Adware/Spyware has perniciously evolved into a hydra, referred to in various venues as as "malware", "scumware", "foistware", "crapware" and "parasites." For purposes of this discussion, we will use the term "Adware/Spyware" with the understanding that the relatively benign definitions appearing above no longer reflect the true parameters of these increasingly polymorphic programs. Emerging forms of Adware/Spyware, such as Browser Helper Object (BHOs), re-directors, Home Page hijackers and dialers go far beyond monitoring browsing habits and spawning pop-up and pop-under Javascript windows. These Adware/Spyware mutants can, for example, change your browser's start page to a pornographic or shopping site, re-direct you to pornographic or shopping sites when you use certain search engines and direct your dial-up connection to phone 900 numbers. The grim news for home users is that some of these programs are exceedingly difficult to remove from one's system, requiring in most cases a trip to the computer repair shop.
Theater of the Absurd: Act One
At www.kazanon.com, a "free" file-sharing anonymizer: "You can FINALLY - ANONYMOUSLY - safely and securely download, swap, and trade music, movies, software, everything - with your FAVORITE program (Kazaa, Morpheus, Grokster, WinMX, or any of the P2P programs!) KAZANON makes you TOTALLY ANONYMOUS and INVISIBLE - NO ONE WILL EVER KNOW YOUR REAL IDENTITY, LOCATION, or IP ADDRESS." If one read's the kazanon EULA ,as posted on 10/14/03, it is clear that this is not the case. From the EULA: "VII -The user understands, acknowledges, and gives express permission for the application and/or associated components to collect personal information, including, but not limited to, name, demographic data, interests, profession, education, marital status, sex, age, income, and any other information Odysseus Marketing, Inc. decides to collect regarding user, at its sole discretion." If you remain keen on downloading and installing this egregious example of Addware/Spyware, be aware of the following additional excerpts from the EULA:
  • VIII -The user understands, acknowledges, and gives express permission for the application and/or associated components to collect information and data regarding Internet activity, including web sites visited, search queries conducted, applications installed and used, files present on user's hard drive or system, transactions conducted, and any other behavioral data deemed necessary by Odysseus marketing, Inc in its sole discretion.
  • XI -User hereby understands and gives permission for application and/or any associated components to alter applications, files, and/or data so as to display information and/or marketing messages, including but not limited to file sharing applications, media viewers, and/or player applications.
  • XII -User hereby understand, acknowledges, and gives express permission for application and/or associated components to disable or delete applications and/or files deemed unfriendly or harmful to Odysseus Marketing, Inc or any of its partners in Odysseus Marketing Inc.'s sole discretion without notice to the user, and may auto-reinstall application and/or any associated components, unless approved auto-uninstall application is used.
According to the EULA, if one one installs kazanon and later develops reservations about using it, one must un-install kazanon using its un-installer. On October 14, 2003 the following appeared on the un-installer page: "The uninstall process is under construction. Try back in a few days."
Security experts who have taken an in-depth look at Kazanon have concluded that it does not, in fact, cloak a user's identity. It does, however, install a component of known Adware/Spyware that can download still more Adware/Spyware without the user's knowledge.
Theater of the Absurd: Act Two
ZDNet in an article posted on February 4, 2004 (http://zdnet.com.com/2100-1104_2-5153485.html) reported of a defunct program named SpyBan, an alleged anti-Adware/Spyware program, that actually installed Look2Me, known Adware/Spyware. According to ZDNet, citing Download. com, the program was downloaded 44,000 times.
What Adware/Spyware can do
Adware/Spyware can do all of the following:
  • Install a DLL (dynamic link library) file or other executable on your computer.
  • Infect your computer with a virus. Investigators have determined that the worm known in various venues as W32/Novarg.A, W32/Shimg, W32/Mydoom, or W32/Mimail.R had its genesis in Kazaa and migrated to e-mail.
  • Communicate continuously with a Web server ("phoning home") to transparently install more programs on your computer, continuously monitor your computer activities, and transmit activity data to the Web server.
  • Invite other Adware/Spyware programs to enter your computer.
  • Scan the files on your hard drive.
  • Change your browser's Home Page and prevent you from re-setting the Home Page.
  • Insert unwanted sites into your Favorites or Bookmarks folder.
  • Remove Internet Options from Internet Explorer®, effectively causing you to lose control of your browser.
  • Hinder removal by providing no un-install option or, in the case of "tricklers", re-install itself after you un-install and re-boot.
  • Monitor your keystrokes.
  • Spawn pop-up advertisements even you are not online.
  • Attempt to disable or actually disable Adware/Spyware removal programs.
  • Read, write to and delete files on your hard drive.
  • Re-direct you to knockoff, pornographic or shopping sites.
  • Interfere with the removal of legitimate programs. After starting to un-install a McAfee application, the un-installer quit, advising that we had to first quit Bonzai Buddy before the un-install could be completed. We later ran Spybot to dispatch the creature back to the jungle.
  • Cause your computer to freeze or crash.
  • Cause you to spend money to have a computer technician rid your system of Adware/Spyware. Some forms of Adware/Spyware are much more difficult to remove than a virus.
Legal issues
Companies and developers that supply Adware/Spyware are largely insulated from legal action for costs of Adware/Spyware removal, loss of productivity and other claims on account of the End User License Agreement (EULA). A EULA is a contract between a company or developer and a user that sets forth the terms under which the user acquires a license to use the program. In the case of boxed software, the user accepts the EULA upon removing the shrink wrap from packaging containing disk, breaking the seal on a jewel case or by installing the program. In the case of a program distributed online, one accepts the EULA upon clicking a "Yes" or "I agree" button on the page displaying the EULA. Most Web sites have a "Terms of Use" or "Privacy Policy" page where one typically finds the EULA for programs downloaded from the site. The EULA is most times displayed using very small fonts, may be ten to 20 printed pages and usually contains a provision allowing unilateral changes without prior notice to users. Even if one thoroughly reads a EULA, it is not possible to unearth all the terms and conditions that a user agrees to, since the EULA frequently incorporates by reference one or more other EULAs. While making a second, third or fourth EULA part of the first EULA is legally proper, it effectively prevents even a determined user from understanding the ramifications of hitting the "Download Now" button. If a person with legal training vets a typical Adware/Spyware EULA, it becomes abundantly clear that a competently drafted EULA will effectively insulate a company or developer against legal action by a disgruntled consumer.
While the Federal Trade Commission has received complaints about Adware/Spyware, it has done little more than pay lip service to privacy issues. Don't look to the effete, Pecksniffian politicians in Washington or state capitols to protect users. Although poorly drafted measures targeting Adware/Spyware are sporadically hyped by politicians seeking to curry favor with privacy advocates, they serve to benefit only self-perpetuating political interest, not users. First Amendment, definitional and jurisdictional issues conflate to stymie the few intelligent, low key folks who contemplate a viable legislative solution.
According to an article posted on cnet news.com (http://news.com.com/2100-1032-5095051.html, See you later, anti-Gators, October 22, 2003), Gator (now named "Claria") filed a civil action alleging trade libel and other theories of recovery aginst PC Pitstop, a site that classified Gator as Spyware. PC Pitstop settled the action and removed material offending Gator from its Web site. Gator claimed that its programs are not Spyware since users who download Gator products receive clear notice of what will be installed and since users receive value in the form of useful applications, such as file-sharing programs. Spyware on the other hand, according to Gator, is secretly installed and provides no benefit to users. While a settlement does not make legal precedent, it can have a chilling effect on parties similarly situated to the defendant. It has chilled us. Gator has been removed from our list of Adware/Spyware. For the record, if you have installed a Gator product, it is not Spyware, you knowingly installed it and you are enthralled by the functionality of the umbrella program.
Installing Adware/Spyware
How is Adware/Spyware installed on a system? It is typically installed unknowingly by a user, who installs a freeware program, such as Kazaa, Xupiter or Grokster. If you download freeware, read the End User License Agreement (EULA) carefully. You may agree to the installation of Adware/Spyware programs. Consider the following extracts from the EULA for Xupiter, a freeware search agent: To further enhance your media viewing experience, Xupiter reserves the right to run advertisements and promotions based on URLs and/or search terms users enter when navigating the Internet. Our software license requires that users browser start page be set to Xupiter.com in order to continue use of the Xupiter toolbar, from time to time we verify that users start page url is set to Xupiter.com, if it is not we reserve the right to alter it back. Think about it: If you install Xupiter, you agree to relinquish substantial control over your Web browser to Xupiter. If that does not concern you or if you can't live without small purple gorillas, enchanting insects or cute cursor changes, stop reading right now and enjoy the pop-up and pop-under advertisements.
File-sharing programs
You are much more likely to introduce Adware/Spyware into your system if you download and install file-sharing programs, such as Kazaa, Morpheus and Grokster, than if you abstain from using file-sharing programs. Few people read the End User License Agreement (EULA) before downloading and installing programs. Only a Philadelphia lawyer would read and understand Kazaa's EULA, estimated to contain 5,000 words. Even if one reads and understands Kazaa's EULA, there is more to digest. Some EULAs incorporate by reference other EULAs. Consider the this extract from the EULA, Section 9.1 (Third Party Software) of Kazaa's EULA that provides in part: " During the process of installing the Software, you may be offered the possibility to download or install software from third party software vendors pursuant to licences or other arrangements between such vendors and yourself ("Third Party Software"). In the event you do not wish to download this THIRD PARTY SOFTWARE you should uncheck the appropriate boxes. Please note that the THIRD PARTY SOFTWARE is subject to different licences or other arrangements, which you should read carefully. By downloading and using this THIRD PARTY SOFTWARE you accept these THIRD PARTY SOFTWARE licences or other arrangements and acknowledge that you have read them and understand them." It gets better. Section 10.1 of Kazza's EULA provides: "10.1 This Licence as well as all disputes arising out of or in connection with this Licence shall be governed by the laws of the New South Wales, Australia, without regard to or application of choice of law rules or principles." How many people will pour over the EULAs before downloading and installing programs? How many people can pick up the phone to call a friend who is well versed in the statutes of New South Wales? If you download a file-sharing program, you are getting a pig in a poke, a pig that invades your privacy, can infect your computer with a virus and pokes you with pop-up and pop-under advertisements.
Typical user reaction following installation of file-sharing program
The following was culled from a Google group search, using as the search logic the name of a popular, free file-sharing program: "'Spyware and Adware Avalanche!' You will be swamped with spyware and adware. For a free program you expect flashing ad banners etc... but this?? If you remove the adware and spyware it renders the program useless. Also some of this stuff can't be removed with add/remove programs. Even ad-aware and spybot don't detect everything that this piece of garbage can deliver. I ultimately had to replace my hard drive."
Other vehicles for Adware/Spyware introduction into a system
As mentioned, file-sharing programs are significant hosts of Adware/Spyware, but these insidious programs can be introduced into a system by other means, including:
  • Security holes in browsers.
  • Instant Messaging programs.
  • Browser search bars/toolbars. If you can't live without a search bar, get the Google toolbar bar, the only one that we recommend.
  • Some seemingly benign programs from well-known commercial entities.
  • Advertisements (usually pop-ups) displaying dire error messages or offering to stop pop-ups or spam and prompting the user to "Click Now" to immediately get the fix. Even if you click "No", "Cancel" or "Don't install", a program may be downloaded and installed on your system. Don't click on these pop-ups. Use <Ctrl> + <F4> to close the pop-up window. In addition, don't follow any links in spam for free downloads.
  • Downloaded games.
  • "Drive-by download". A "drive-by download", according to whatis.com, is " (A) program that is automatically downloaded to your computer, often without your consent or even your knowledge. Unlike a pop-up download, which asks for assent (albeit in a calculated, contrived manner likely to lead to a 'yes'), a drive-by download is carried out invisibly to the user: it can be initiated by simply visiting a Web site or viewing an HTML e-mail message."
  • Physical access to a machine.
Some examples
Adware/Spyware programs that present the potential for serious system performance degradation, invasion of privacy and system crashes include, but are not limited to, the following:
  • Alexa.
  • BargainBuddy.
  • BDE/Brilliant Digital.
  • CoolWebSearch. (Some variants use HOSTS file to block access to anti-Adware/Spyware sites.)
  • Cydoor.
  • DownloadWare.
  • Grokster.
  • IGetNet.
  • IMesh.
  • Kazanon.
  • Lop.
  • MediaUpdate.
  • New.net
  • RapidBlaster.
  • SaveNow.
  • Vloading.
  • webHancer.
  • Xupiter Toolbar.
While dialers don't fit the classic definition of Adware/Spyware, they are included in this discussion since they are installed and run without your knowledge or informed consent, just as Adware/Spyware programs do. If you consider a $1,700 phone bill a matter of some consequence, you will want to know about dialers. Dialers are programs that enter your computer by boring though security holes in your browser or instant messaging program and are typically installed by clicking on a link on an adult or other shady site. They can also be installed if you click on a link in an e-mail message. When the site loads, the dialer is installed. These programs use a dial-up modem connection to call 900 and international numbers, resulting in exorbitant charges (typically $5 per minute or $300 per hour) on your phone bill. These programs can dial anytime that your computer is on and your modem is connected to a phone line. On average, 10% of the machines that come to our shop for repair have a resident dialer. To battle dailers, make certain that you download and install all critical updates and refrain from visiting - or accepting an e-mail invitation to visit - adult sites. For more information on safeguarding your computer from dialers, see our discussion of protecting your PC.
Un-installing Adware/Spyware generally
Un-installing Adware/Spyware will in many cases cripple the umbrella program. For example, if you downloaded and installed a program to remember your name and password and you un-install the Adware/Spyware component, the name and password storage functionality will likely be lost. In some cases, the Adware/Spyware programs contain tricklers that attempt to re-install files as you delete them. In some cases, un-installing a Adware/Spyware program will prevent you from accessing the Internet. Removal of Adware/Spyware folders, files and registry keys should not be taken lightly. We use PepiMK Software's Spybot Search and Destroy (free, but donation requested) to remove Adware/Spyware in the shop. It can be download from this site. A word of caution: Don't use this program, unless you understand what it will do. Some sites will not allow entry unless the site's Adware/Spyware is loaded. Using Spybot may make entry into these sites difficult, if not impossible. Note that the program developer provides updates to address recently discovered Adware/Spyware programs. To make efficacious use of the program, you must check for updates and download and install them before running the program. We recently encountered problems downloading the updates. Try selecting one of the mirrors, in particular Rootboxen.net (USA).This page, which includes screen shot, shows how to update Spybot. (Tip: Apparently, a considerable load is being heaped upon Spybot's main and mirror sites. Be patient when downloading updates.) Read this excellent, brief tutorial to learn about running Sypbot generally. Be advised that Spybot is not a cure-all. Spybot is a free program and the developer and his colleagues simply do not possess the resources to keep pace with the developers. In quite a few cases, one must resort to the always dangerous act of editing the registry and deleting files in safe mode to remove especially obstinate Adware/Spyware programs.
Spybot versus Norton AntiVirus 2004
Aside from the stability, support and performance issues that have plagued Norton AntiVirus 2004, it is not as effective as Spybot in identifying and removing Adware/Spyware. Digressing a bit from Adware/Spyware, we have investigated error messages at Symantec's site, only to find that Symantec is aware of the error and that there is no fix. If your subscription to NAV 2003 has not expired, renew it before it expires. Incredibly, the following appears on a Symantec page pushing the properties of two of its products: "Although most malware programs are legitimate, they are often installed to your computer without your direct knowledge. This poses privacy concerns for many people."
Un-installing Brower Helper Objects (BHOs)
According to the developer of HijackThis, an excellent, free BHO removal tool: "Autoloading entries can load a Registry script, VB script or JavaScriptfile, possibly causing the IE Start Page, Search Page, Search Bar and Search Assistant to revert back to a hijacker's page after a system reboot. Also, a DLL file can be loaded that can hook into several parts of your system." Certain BHOs will put you in an endless loop. After you remove them by using Spybot, when you re-boot, they will find that they have re-installed themselves. (We call this form of scumware, a "Freddie Kruger program." Like the horror movie character, after you think that you have permanently disposed of the program, it keeps coming back.) Spybot and Ad-aware use databases to identify certain files and registry sub-keys and values that are associated with known Adware/Spyware programs. Polymorphism (the capacity to assume different forms) is apparently becoming rampant, as developers of Adware/Spyware try to keep one step ahead of the developers of removal tools by making minor changes in code or re-directing to dynamically addressed sites. Lop, it has been observed, has 20 or more know variants that install themselves in various locations on your system. Even if you apply the most recent Spybot includes file and run Spybot, you may not be able to rid your system if the program. In the unlikely event that a BHO contains an un-install option, in many cases the un-install is incomplete. A CLSID value will be remain in the registry, linking to an executable that will re-install the program. For more information on un-installing BHOs, read this outstanding article. Recently, Spybot found Vloading and MediaUpdate, both "tricklers", and fixed them, but they re-installed themselves upon re-boot. In such cases, download and install HijackThis or follow the manual removal instructions at doxdesk.com (links at bottom of page). If you follow either of these routes, back up the registry and if you are running XP®, set a manual restore point. While we are not quite there yet, it may be necessary in the near future to re-install the operating system to finally put some especially pernicious pests to rest.
Avoiding installation of Adware/Spyware
Adware/Spyware avoidance must be approached generally in the context of an overall strategy to protect your PC against security threats. See our discussion of Protecting Your PC. Specifically, use a browser that is more secure than Internet Explorer®. Mozilla is an open-source, free browser that handles security issues far better than Internet Explorer®, and its e-mail client includes effective spam blocking features. The default browser and e-mail client on one of our machines, we categorically suggest it to users willing to spend some time learning how to use it. If you are running Internet Explorer®, download, install and update an excellent freeware/donationware program called SpywareGuard (Runs real-time scans against Adware/Spyware and provides download and browser hijacking protection.). If you use the program, we recommend that you make a donation using PayPal.
Your choice
A rapidly dwindling number of users are willing tolerate Adware/Spyware in exchange for the functionality of the umbrella program. Others have found that the price exacted by Adware/Spyware outweighs the benefits of the using the umbrella program. Whatever your position on Adware/Spyware, it seems abundantly clear that Adware/Spyware poses real potential for serious system performance degradation, start page hijacking, re-directing, invasion of privacy, system crashes and other .
Additional resources
The following is a list of assets useful in contending with Adware/Spyware:


  Services What We Offer Areas Covered Rates & Discounts
Estimates Maintenance Plans Links Phone Tech Support
About Us Refer A Friend Why Us? Reference Dictionaries Tutorials
Privacy Policy Service Protocol Disclaimer Contact Us

Web Page Designed By  ADAM
Copyright © 1981 - 2008
MINDPRIDE CONSULTING All rights reserved.
Revised: November 21, 2007