Spyware, Adware, Hijackers, Dialers and Trojan Horses

Introduction

For the past couple of years there has been a new threat introduced to your computer that anti virus software does not remove. This software will track your movements on the Internet or even worse, actually hijack your web connections and direct you to pages that you did not ask for. These types of programs are called Spyware, Browser Hijackers, and Dialers.

There is also another type of program called Adware. Adware are programs that are usually free, that have advertisements built into the software. That means when you run the software, it will pull down advertisements from the Internet and display them somewhere.

Spyware is software that is advertised as Freeware or Adware but that install in your computer, generally without your knowledge, other programs that run in the background collecting data about you, your personal information, software you use, etc, all without your permission. The software will then send this information back to the creator's servers where it is collected.

There are many different types of Spyware I have described a few types below (most of these are relatively harmless but can be regarded as an invasion of privacy):

• Adware Networks
  Ad networks are companies that pay software developers and web sites money for allowing their ads to be shown when people use their software or visit their sites. These ads are generally in the form of popups and present you with some sort of advertisement. This allows the advertising network to track your movements across the Internet by reading the information contained in cookies every time you connect to a site that they are on.
   
• Backdoor Santas
  These are programs that you download off the Internet and contain valid uses. However they collect statistics of your computer use, the sites you go to, the type of hardware, etc and transmit this information back to their servers. Programs of this type are Comet Cursor, Alexa, Hotbar, and Cuteftp.
   
• Stalking Horses
  These types of spyware are generally bundled into many popular programs and often, but not always, are presented in the installation as desirable additions to the main software, the trojan horse, that you are installing. Example programs of this type are EZula's TopText, Cydoor, Onflow, and Webhancer.
   
• Trojan Horse.
  These types of software are usually very popular downloads and are free. They almost always contain at least one Stalking Horse and software for ad-serving networks. Many times you are given the option to install these stalking horses or ad-serving program, but they are sometimes hidden in the fine print of the License Agreement. In some situations, if you choose not to install the Spyware, you will not be able to use main program or Trojan Horse. Examples of programs that are Trojan Horses are KaZaA Media Desktop, Grokster, and Morpheus .

There are other types of malicious software that can be installed on your computer. They are described as follows.

• Browser Hijackers
  Software that tends to Hijack your browsers web connections for their own purposes. They change your homepage to another no matter how many times you change it or you can do a search in Google, but instead of getting the results back from Google, your search request is actually hijacked and sent to another search engine.
   
• Dialers
  Software that gets installed on your computer that has the ability to make phone calls from your computer, if you have a modem, without your knowledge. These programs will connect to other computers, through your phone line, which are usually porn sites. These numbers are pay per call so you get charged for the amount of time your computer is connected.
   
• Malware
  Software that gets installed on your computer without your knowledge that changes system settings, not limited to your browser settings, that cause harmful effects to occur on your computer.

It is also important to note, that practically all Spyware and Hijackers tend to target Internet Explorer and not other browsers such as Netscape or Mozilla Firefox. If you are not against switching your browser, then switching to an alternate Web Browser and immediately greatly reduce your risk of infecting your computer with one of these programs.

Why do people make these programs?

The simple answer? To make money.

A big trend during the Internet boom was to provide free software to downloaders. Why would they offer it for free? It is because these programs would gather statistics about the users activities on the Internet or on their computer, what hardware they have, what software they use, etc. Then they would sell this information to third-party organizations without your knowledge.

Hijackers are another newer breed of software that takes over control of certain operations of your web browser. By doing this they can redirect browsers to sites of their choice where they gain a commission for the user going there. Even worse, these Hijackers can redirect search results from their own search engines to you, when you do a search on a popular search engine.

Dialers make their money by having your computer connect to numbers where you get charged exorbitant fees while you are connected.

How do you get Spyware, Hijackers, and Dialers?

The most common method of being infected is to not have the proper security settings in your browser or old versions. Internet Explorer is generally targeted by Spyware/Hijackers and unless you have the browser's security settings configured properly, you will have a good chance of getting infected.

Spyware can also be installed via programs downloaded off of the Internet, through cookies when you connect to a site, or from site popups that ask you to install something. The programs are generally free downloads. Sometimes, if you read the privacy policy of software before downloading. It will note that software will be installed on your computer than gathers information about your activities and sends it back. It is your choice at this point if the usefulness of the software outweighs your loss of privacy.

Certain Internet advertising companies such as Valueclick or DoubleClick install cookies on your computer every time you load one of their advertising banners. These cookies, allow them to see what sites you go to and what you do on these sites. Cookies can be used to gather information about you, they are also used for valid reasons when visiting many sites. Therefore disabling cookies, could cause loss of functionality to sites you may frequent.

You can also get spyware from a popup that you see at a web site asking if you would like to install their greatest and latest piece of software. Use extreme caution when accepting these types of offers.

Hijackers and Dialers, on the other hands, are almost always installed by going to a site where you will see a popup displayed saying that you must have this new piece of software that only they can provide to you. The most common popup scams are:

• When they say you have a security hole and to click here to fix it.
• Software that makes you able to connect to sites faster.
• You have open ports on your computer! Click on the ad to download a utility to fix it.
• Ads that say they can make your computer run faster.

It is not unheard of for these programs to even install themselves just by reading an email, though proper security updates and patches can minimise if not eliminate this risk.

Though, these programs can install themselves on your computer via these methods, that does not mean you should panic and throw your computer out. It does mean, though, that you should pay attention to what you click on and read the fine print. Even more important, you should add a Spyware checker and Removal software, like Spybot, into your routine for protecting your computer like you already do with virus scanning.

How do I know if I have Spyware or a Hijacker on my Computer?

There are only two ways of knowing if this type of software is installed on your computer.

The first way is if you notice your web browser behaving strange. Some common symptoms are :

• Your home page changes on its own.
• You can not change settings in your browser.
• Your search results seem strange.
• You have toolbars on your web browser that you did not install.
• You are getting a lot more popups.
• Your browser suddenly starts crashing.

If you have any of these symptoms then you most likely have a some sort of Spyware or Hijacker installed on your computer.

The second way of detecting spyware is to use a Spyware removal program routinely and let it search through your computer and optionally remove any spyware if it finds them. It is sad, but with how bad these programs have become, running Spyware Checkers routinely as you do a anti virus program is really a requirement these days.

How do I remove Spyware and Hijackers?

A word of caution before you use any of these programs. Spyware is sometimes tightly integrated into other legitimate programs that you use and disabling them could cause those programs to fail. For example, Kazaa, a popular file sharing service, installs spyware when you install it. By removing this spyware, Kazaa will no longer work. In my opinion, removing the spyware and preserving your privacy is more important but it is ultimately your choice to decide.

Spybot - Search and Destroy is an excellent utility. It will search your computer for any known Spyware and Hijackers and remove them from your system. It does this by scanning your registry, files, cookies, and other storage places against a large database of known offenders. When it finds a Spyware/Hijacker it will present it in a list of others that if found and allow you to choose which you want to delete. You can then have Spybot remove these entries and delete the files.

• You can download this Spybot here: Spybot - Search and Destroy

Ad-Aware is another excellent piece of software for removal of Spyware and Hijackers. It has the same features as Spybot, but was one of the first programs to be created for removal of these types of programs and is recommended that you scan with this software as well as Spybot.

• You can download Ad-Aware here: Ad-Aware

HijackThis is another tool that you can use when all else fails or to remove any leftover traces of a removed Hijacker , Spyware, or Trojan. Unfortunately, HijackThis seems very simple to use, but in fact, is an incredibly powerful tool and if you don't understand what you are doing you can cause serious damage to your system. (Sorry - no link for this one - too dangerous!)

How do I prevent myself from getting infected again in the future

The first step before you protect yourself from future infections, is to first clean your system.

Then make sure both you system and any Anti-Virus software is fully up to date. (Please note: Microsoft have recently announced that they are discontinuing security updates for Internet Explorer on any platform other than Windows XP - that's a sneaky way of saying you really must upgrade to Windows XP)

Once you are clean and up to date, you should Immunize your system. What that means is that you tell Windows certain programs that it is not allowed to run. This protects you because if you go to a site that attempts to install malicious software, it will not be able to because the operating system has been told to not allow that particular program to be able to run. (Remarkably Windows XP - Service Pack 2 does this very well!)

Spybot -S & D offers an immunise feature that will protect your computer. Unfortunately new variants of Spyware/Hijackers tend to get let loose in the wild before Spybot - S&D can update it's database of known malicious programs. With this in mind, I recommend that you use the program SpywareBlaster as they update their database more frequently.

SpywareBlaster from Javacool Software allows you to protect your browser from risk of infection by immunising your system. The program contains a huge list of known malicious cookies, ActiveX controls, and web sites which it enters into your registry and browser settings so you cannot run these programs, download from certain sites, or accept cookies from ad servers.

SpywareBlaster can be found here: SpywareBlaster

The second program you should use is SpywareGuard from Javacool Software. This software acts like a anti-virus software, but instead of scanning for viruses, scans for known Spyware and Hijackers. This will display alerts and stop you from mistakenly installing Spyware and Hijackers on your computer. This software can run alongside your existing anti-virus software with no problems.

SpywareGuard can be found here: SpywareGuard

Conclusion

Spyware and Browser Hijackers are becoming a serious problem for a computer users. With proper use of the tools at your disposal you can minimise the risk and with care safely remove these programs from your computer.

Also see: Simple and easy ways to keep your computer safe and secure on the Internet

This article has been adapted from various sources around the web with a lot of the more technical language removed to (hopefully) make it easier for the layman to read and understand!

With thanks to Bleeping Computer and Experts Exchange for their assistance!