Five Behaviors On Which Spyware Companies Prey

By Robert P. Lipschutz

Adware vendors, in their quest to infiltrate computers everywhere, benefit from confusion, a lack of user knowledge, and the realities of human nature. However, by using a combination of defensive strategies, you can lower the impact of adware on your computer. If you wish to enjoy the benefits of “free” Internet software, the primary carrier of adware, diligence is key.

Adware is sneaky and elusive. It is typically bundled or hidden within other software, its full presence buried deep within lengthy license agreements. Once installed, adware goes about changing your settings without asking and working behind the scenes to fulfill its mission, which is to deliver offers, deals, and advertisements to your eyeballs. This article will help you from becoming another adware victim by discussing four steps you can take to prevent and remove this software scourge.

1 – Users Don’t Read EULA’s

The best way to avoid adware is to stop downloading free software from the Internet, software that often contains adware. If you are unwilling to do that then you must read about what you are installing. Adware vendors know that most people won’t, so they pack end user license agreements (EULAs) full of language that gives them extensive rights. For example, EULAs might give adware vendors the right to track your browsing and searching behavior, display advertisements whenever they choose, install toolbars in your browser, and, quite often, ongoing permission to install any additional programs they desire. That equates to a huge imposition on your browsing experience at the very least and, in the worst case, a complete surrender of your computer. But it’s all stated right there in the EULA, and you’ve agreed to it.

If adware companies really wanted you to read the EULA, they would make it easier.

You’ll find EULAs within Web pages, in windows that pop up during the install, and as links shown in the Microsoft Windows Service Pack 2 ActiveX security warning dialog boxes. While most people won’t read a EULA no matter how it’s presented, adware vendors intentionally make them more difficult to wade through by displaying them in small windows that can’t be increased in size and by providing no print or search options. The text in the title bar says one
thing-“Please read the Save! License agreement carefully”- but the interface makes it hard to comply.

Some vendors like Grokster go even further by inundating you with multiple license agreements, all of which make their own claims on your machine.

To protect yourself, you must scan and read EULAs. Often called license agreements, terms of use, or even privacy agreements, these lengthy tomes can be full of venomous language. Look for terms like third-party software, partners, ads, advertisements, and install to find the bad stuff. Beware of software that claims “No spyware” as adware vendors don’t consider themselves spyware.

2 – Users don’t use “Add/Remove Programs” in Control Panel

Use Add/Remove Programs in Control Panel to get rid of many common spyware and adware

So what can you do if adware has already made its way onto your computer? Historically, adware vendors have neglected to provide an uninstall option for their software. This made them an easy target for industry detractors who called out their non-standard behavior as an illegal lock-in. To get around this, adware vendors increasingly include entries in the Add or Remove Programs Control Panel. They are banking on the fact that users won’t know how to uninstall programs. So you won’t be one of those users, here’s what you do:

1. Open the Control Panel from the Windows Start Menu.

2. Choose the “Add or Remove Programs” Control Panel.

Find the installed programs you wish to remove, click on the Change/Remove button and follow the uninstall directions. In general, removing a program is easy. The difficult part is determining which program or programs to remove given that useful applications are interspersed with the adware. Unfortunately, although you can sort by name, size, frequency of use, and date last used, Microsoft has neglected to allow sorting by “date of install”. This should change with the new Microsoft Vista operating system, but for now the onus is on you to slog through the typically long list of programs to find the offenders.

Not surprisingly, adware vendors use some basics as well as a few sneaky tricks to complicate the removal process. First, they install a large amount of adware, which can overwhelm the consumer attempting to uninstall these programs. Grokster and Kazaa both include more than five different adware programs that get spread throughout the Add or Remove Programs control panel. So just a few “free” programs can generate volumes of adware.

Also, adware vendors rig the uninstall game in their favor in terms of how the host software and adware software uninstalls work. Of course, you can’t uninstall the adware and expect the “free” software to work. For example, if you uninstall the Zango adware, you can no longer play the Zango games. That’s expected. But if you uninstall the “free” host software, wouldn’t you expect the adware to be uninstalled also? It doesn’t always work like that. If you install the Zango game, Zango Muncher, the Zango adware remains and must be uninstalled separately.

Grokster plays the same game and, in this case, uninstalling all the adware will not return your machine to its original state. Your computer has been irreversibly altered. When using Add or Remove Programs, you are relying on the adware and host software vendors to do the right thing and some of them just don’t.

Gain uses a different tactic. It takes responsibility for uninstalling the adware after you uninstall the host applications but most people won’t know which host software is associated with the GAIN adware. Gain provides a tool on its Web site that discovers GAIN-supported software, or you can browse the Add or Remove Programs panel for these GAINware applications: ScreenScenes, DashBar, Weatherscope, Precision Time, Date Manager, WebSecureAlert, Gator eWallet, OfferCompanion, and SearchScout Toolbar. Many third-party publishers also include GAIN adware.

3 – Users don’t know how to reset their Home Page

If a spyware resets your home page, set it back using Tools Options in Internet Explorer.

Many adware packages muck with your browser settings as well. They will, for example, change your home page or add toolbars. Adware vendors know that most users can’t or won’t undo these changes. In some cases, you can simply switch your home page back or deselect the toolbar. Toolbars can be hidden by right-clicking on the toolbar area in your browser and deselecting unwanted toolbars. Your home page can be set in the browser options. In Internet Explorer, go to the Tools menu and select Internet Options.

In Mozilla Firefox, go to the Tools menu and select Options.

Unfortunately, some adware vendors monitor your home page setting and change it back as quickly as you’ve reset it. In those tougher situations, you’ll need to get rid of the adware as discussed below.

4 – Users think they are are protected because they have antivirus software


Anti Virus and Anti Spyware are not the same thing. Get an effective anti spyware package!

Adware vendors benefit greatly from the confusion in the marketplace around viruses, spyware, and adware. Most people lump them all together and assume they can be handled the same way. Many have trusted anti-virus software like Norton AntiVirus and McAfee VirusScan to protect them from the latest Internet threats. By and large, neither of these products will protect you from adware. McAfee has a separate product aimed at spyware/adware protection and only recently has Norton announced that spyware protection will be included in Norton Antivirus 2006.
PC Pitstop recommends PC Pitstop Exterminate to provide real-time protection, full-system scans, and removal of a large collection of spyware and adware products. While the anti-virus products don’t make a peep when adware from Gain, 180Solutions, or WhenU is installed,
anti-spyware products tell you loud and clear what is going on.

5 – Parents don’t teach their children

As we’ve said in previous articles, spyware vendors target children and teenagers. So everything that you learn about spyware, you must pass along to your children. Don’t get smart on your own. Teach your children about EULAs. Explain to them that each EULA they see might contain a number of computer risks that mom and dad aren’t going to be pleased to take. With some education for your kids, you’ll need to remove far fewer programs from your computer. Your computer is only as protected as your most careless family member.

So remember to read EULAs, uninstall any existing adware not tied to free software you use, and consistently check and maintain browser settings. And, perhaps most importantly, you must understand that traditional anti-virus products will not safeguard your computer against adware and its threats. For that level of protection, you must turn to anti-spyware products like Pest Patrol, which provide the extra insurance necessary to make sure your computer remains your own instead of the unwitting victim of an adware hijacking.

Robert P. Lipschutz is president of Thing 7, a technology consulting company.

Want to get monthly tips & tricks?

Subscribe to our newsletter to get cybersecurity tips & tricks and stay up to date with the constantly evolving world of cybersecurity.

Related Articles

Botnets, Now What?

Just when I was becoming accustomed to using spyware removal tools and running the occasional Pitstop virus scan (few people keep their antivirus current these days), something new comes along.

Have you ever wondered why your machine seems like it’s operating in mud or is just ignoring you? Well that’s probably because it’s operating just fine for someone else. Yep, we’re talking Botnets. Botnets are using your CPU, draining your memory, just waiting to be told what to do by someone making money from your investment. You don’t mind do you?

Read More

PC Pitstop Top 25 Spyware and Adware

PC Pitstop has long been a source of information about unwanted software and how it spreads. Now we’re using our test results database to give you weekly updates about which programs are the most prolific. The prevalence numbers indicate the percent of PCs tested at PC Pitstop where we detected that file running. Our detection works by file name, so some products may be listed multiple times if they consist of two or more files. To check for spyware, adware, unneeded programs, and many other common PC problems, try PC Pitstop Exterminate or our full system scan.

Read More