An Unofficial guide to spywares and online safety

[Rahul964]

How to remain safe while being online:

First of all you should understand what types of threats are there on the net...
While most users are aware of virus and worms threat, they usually overlook the other biggest threat ie the spywares.

What are spywares ?
Spywares are programs that get installed on your computer without your knowledge and collect data about your usage patterns like what sites you visit, what programs you run, even your personal details like age, gender and financial details too : all those things that can be useful for a marketing company to send you customized advertising. These programs send this data back to their websites where they are given to spammers and advertisers. All these things happen without the user's knowledge and that is the most ironical point of the story.

Categories of spywares:

Adwares:
Adwares usually monitors your usage patterns and show you ads corresponding to them. Adwares are usually installed as freewares and it is quoted in their EULA (End User License Agreement) that the program will show relevant ads.

Many of the adwares are freeware version of programs which are availible as paid versions. Examples of these programs : Opera, Divx, Download Accelerator Plus, Flashget etc. While these programs specifically tells the user that they can upgrade to their paid version if they dont want to get these advertisements but not every adware is like that.

Browser Hijackers:


This is a broad category in which parasites like home page hijackers and search hijackers can be included.
Home page hijackers change the start page of the user's browser to some specific sites and some notorious of these are very difficult to remove.
Search hijackers change the search behaviour of the user's browser and when user searches for something on the Internet, these search sites give them the results.

Usually both of the hijackers stated above work on clickthrough systems. Here they are affiliates to other companies which give them money according to the hits they recieve through them. So, the ultimate goal of hijackers is to make the users click on the links through which they earn their revenue. As this is a difficult task, the program authors go extreme ways to achieve it and create difficult to remove parasites. Recent examples of such parasite are CoolWebSearch and AboutBlank.

[Rahul964]

Dialers:
Dialers are programs that promise to make some "premium content" availible to the users by making calls through them. All their objective is to make the users dial the number which are usually long distance numbers of their affiliates.

Tracking Cookies:
Cookies were meant to be used for customizing the websites according to the user's preferences. But marketing companies found another use of them. This useful feature is being abused by marketing companies by putting "third party cookies". Third party cookies means cookies stored by websites other than you are visiting - most often put through banners and ad rotators. These cookies can keep track of what sites you visit that contains their ads.

Keyloggers:
Keyloggers arent thankfully installed by marketing companies. Usually they are installed by some trojans or hackers. Here hackers refer to those breed of computer users who use such programs to break into other's computers to steal passwords or to destroy those systems. These programs monitor each keypress on your system and keep track of them and send it back to their originators. There are many sophisticated keyloggers which have their own SMTP engine to mail back the tracking records.

Sources of Spywares:
How do these programs get installed ?
These programs are usually installed as bundled with other programs. While most users dont care to read the Terms and Conditions of the programs they are installing, third party tools such as these are installed easily.
Browser hijackers are usually installed as ActiveX controls while the user is visiting their affiliate's websites. The most common source of spywares are porn and cracks websites. These websites promise the user to enable them to view their content if they install these add ons.
A new class of them is called betraywares. These programs promise to remove spywares but they are themselves housing many of them. A whole new breed of search assistants, pop up blockers, online form filling tools, password keepers comes under this list.

How to tell you are infected ?
Usually when spywares are installed on your system, your network traffic increases. If you feel your computer is not behaving the way it was supposed to be, most probably you are infected. You should check what programs are getting loaded when the computer is starting up and what programs are running in the task manager. If you notice some suspicious entries in task manager or startup list, look out what programs are these. If you are on an always on connection, you should monitor the network traffic of your computer.

[Rahul964]

How to remain safe from spywares ?
Spywares will not get installed if the user himself will not allow it to install. If the user is careful in monitoring what programs get installed to his computer, it become very difficult for spywares to get installed.

The user should pay attention to the Terms and Conditions or EULA of them program being installed. Reference to third party installation should be given more attention.

Not every freeware is a spyware. But those free programs which utilize the internet to deliver their objectives should be looked at suspicously. Usually Search Assistants or popup blockers apart from reputable companies should be avoided.
The user should remain careful of sites he visits. Most of the users get infected while browsing the "underground" sites. Websites that provides cracks or porn websites are often source of dialers and hijackers. The user should use his intuition while browsing these sites. They will not come to you if you dont go to them.

Use antispywares:
Programs like Spybot Search & Destroy (http://www.safer-networking.org/) and Ad Aware (http://www.lavasoft.de/) are considered reputed in removing spywares. Spyware Blaster (http://www.javacoolsoftware.com/) is a great utility that will not let the spywares getting installed in the first place. All these program should be updated regularly as new parasites gets discovered daily.

Use Firewall:
Firewalls have become a necessity these days. And those with with always on connection should enable firewall on their systems. Firewall monitors the network traffics and blocks unnecessary connections. They are also effective against worms propogating through random ip addresses.

Use Antivirus:
Antivirus are now just as essentials as operating systems are. Antivirus should be updated regularly too as new virus are discovered on daily basis.

Use Windows Update regularily:
As new vulnerabilities are discovered, parasites exploiting them too arise. So patches to fix them should be installed regularily.