Keep spies from skulking into your PC

[Mobo]

Taken from USA Today

The intruders are clever, secretive and silent as they slip past the door. They may arrive in disguise. You may unwittingly invite them in. They can lie low for months before striking. When they do, the person or entities that unleashed them may hijack your computer or learn everything about your online behavior, down to keystrokes. Spies lurk in our PCs, and the menace is mounting.

Sounds like a promo for a cheesy thriller. But spyware software is of genuine concern. Spyware refers broadly to any program that surreptitiously shows up on your computer's hard drive to track and report back to some third party about your Web surfing and other PC activities. It often (but not always) piggybacks on free software you download.

Though spyware is as unwelcome as a computer virus, the aim is typically not to wreak havoc. Rather, it is to keep you humming so those quietly monitoring your behavior can benefit at your expense. At the lesser extreme, your computer is served pop-up ads; at its most severe, your data gets in the wrong hands and you get ripped off.

Spyware is proliferating. The National Cyber Security Alliance, a coalition of online companies and government agencies, found last year that 91% of 120 U.S. consumers with broadband had computers infected with spyware. Denise Garcia, an analyst for research firm GartnerG2, says the number of people expected to use ad-blocking software, including programs to help combat spyware, is more than 35 million, more than double last year's totals.

The anti-spyware forces are about to get a boost from America Online. It plans to bundle free spyware protections in a soon-to-arrive software upgrade. By default, AOL members will be able to have their systems scanned automatically for spyware once a week, though they can scan more frequently. Users will have the option to remove the spyware, and will be told how severe the threat is. AOL follows the lead of ISP rival EarthLink. It started providing subscribers anti-spyware tools in October.

Meanwhile, the leading anti-virus companies, Symantec (through Norton AntiVirus 2004) and McAfee are also targeting spyware. Today, in fact, McAfee will unveil its McAfee AntiSpyware, which promises to stop spyware before it is installed on your system. Several other companies sell (or offer free) spyware fighters, including Ad-aware, PestPatrol, Spybot — Search & Destroy, SpyCop and STOPzilla.

Apparently, not even a personal tech columnist is immune. The other day I ran Web-root's $30 Spy Sweeper anti-spyware software on my home computer. The program uncovered 825 traces of spyware, and 32 actual programs. Fortunately, Spy Sweeper was able to remove or quarantine the offending bits and bytes, most of which, as best I could determine, were set loose not by identify thieves but rather cybermarketers hoping to tailor advertisements based on what makes me tick online.

Even at its most benign, spyware can bog down your system and result in a bevy of annoying pop-ups and other ads. To say nothing of how your privacy may be violated.

Probably the most common (and usually legit) flavor of spyware is called adware, which may result in those intrusive pop-ups. In most instances, your personal identity is kept anonymous. How do you get adware? It is usually ushered in with software you downloaded, often at peer-to-peer file-sharing sites. Indeed, 94% of the broadband users in the National Cyber Security Alliance study did not know that spyware is often bundled with such programs. You might know if you took the time to read the lengthy and oft-incomprehensible legalese licensing agreements that accompany the stuff you download. Few do. You may also discover that refusing to accept the adware, or deep-sixing it later, will render the program you had hoped to exploit useless.

In the more diabolical — and fortunately rarer — spyware camp are programs sometimes dubbed "keyloggers" or snoopware, because they log every keystroke and take periodic snapshots of your screen. These may be employed by people bent on stealing your identity, stealing your credit card numbers or destroying your reputation.

Snoop programs do serve legitimate constituencies. Parents may load them on a home machine to make sure Junior is avoiding trouble on the Net. Bosses may use them to monitor employees who work from home. And husbands and wives who suspect their spouses of cheating can use them as virtual private eyes.

Naturally, if you are at the receiving end, you want to exorcise these demons, often easier said than done. One of the adware programs swept up by Spy Sweeper on my system was BackWeb from BackWeb Technologies, a company that works with IBM, Hewlett-Packard, Siemens and others. Talk about mixed messages: Spy Sweeper assessed BackWeb as a "medium" threat to my system but nonetheless indicated that the program "is generally used for legitimate purposes" and "should only be removed by advanced users after careful research and consideration." In my case, it arrived with a download of free Kodak picture software. Kodak says the program is used legitimately to make sure users have the latest version of Kodak's software. A BackWeb executive also said the software isn't spyware. And BackWeb has successfully lobbied some anti-spyware software companies to have BackWeb removed from their lists.

What measures should you take to keep spyware at bay?

Understand the risk. Tread carefully as you prowl the Internet. Painful as it may be, carefully read licensing agreements and privacy notices before you download software. Be especially wary at controversial sites, including **** and peer-to-peer music sites. But again it is not always clear. Brilliant Digital's Altnet is listed as another medium threat by Webroot and is bundled with the file-sharing program Kazaa. "What is the threat?" asks Altnet executive Derek Broes. "Am I selling your information? No. Am I gathering your browsing habits? No. Am I gathering your credit card information? No." Instead, he says, Altnet rewards users who responsibly upload licensed files to the peer-to-peer network.

I'd avoid downloads at pop-up windows no matter how alluring the offer. You can also get infected via a random "drive-by download" by visiting a site embedded with spyware code.

Take a free audit. Webroot (www.webroot.com/services/spyaudit_03.htm), EarthLink (www.earthlink.net/spyaudit) and PestPatrol (www.pestpatrol.com) all will scan your system for spyware at no charge.

Run anti-spyware utilities. In my experience the freebie programs work fine. You may want to spend $30 or so for a program that comes with technical support.

You may also want to run more than one anti-spyware program, because no one piece of software seems to catch everything. For example, SpyCop didn't uncover adware on my PC, but it found a trace of SpectorSoft's eBlaster keylogger on my system that Spy Sweeper and Norton AntiVirus failed to notice. (I believe I may have actually transferred the program myself from an old computer on which I had previously tested Spector.) It's scary just the same because Spector is a cyber-Mata Hari's dream. It can record your e-mail, chats, instant messages and Web travels and report back to the person who has you under surveillance. SpyCop gave me the option to automatically rename (and thus deactivate) the SpectorSoft file in question. But I was also advised to go directly to Spector's tech support people for instructions on removing the program. I did. Having already grappled with spam, viruses and other security threats, the last thing you want to face is yet another computer scourge. But by surfing the Net responsibly, and aided by a software utility or two, you have a reasonable chance of keeping this latest breed of spy in check.