On the lookout for spyware

Organizations are increasingly eyeing spyware as a threat that needs to be blocked from reaching end users' desktops.

A catchword for software programs that watch what end users are doing at their computers, spyware is said to encompass everything from marketing cookies, pop-ups and adware downloaded with peer-to-peer file-sharing programs to malicious Trojans and keyloggers designed to steal personal data. Even at its most benign, spyware is generating anger in corporations that see it jamming up user desktops, causing malfunctions and slowdowns.

"It's an insidious scourge of the Internet" says Lisa Hagen, IT manager at biotechnology manufacturing firm Labcyte in Sunnyvale, Calif. "These are pieces of software that get installed unbeknownst to you."

Over the past year, Hagen has seen instances where employees' desktop machines were "acting weird" from the effects of adware, which Hagen tries to combat by having employees use anti-spyware software, including StopZilla. Other IT managers recount similar stories.

Daniel VanMeter, system security specialist at Kansas University Medical Center in Kansas City, says he's seen increasing numbers of network users approach the IT department to complain that their machines won't boot up or are malfunctioning. It often turns out there are hundreds of different spyware/adware programs interfering with each other, causing the computer to choke on them, he notes.

Vendors respond

Spyware complaints were once heard mainly among home PC users. Thus, most spyware-eradication software is designed for individual users. But as corporations increasingly express alarm, anti-spyware software developers are leaping into the corporate market, selling multi-user licenses with centralized management for security professionals.

Anti-virus vendors, which have long gone after dangerous keyloggers and Trojans that get lumped into the spyware category, are broadening their reach to go after adware. Trend Micro recently added the anti-spyware freeware Spybot to its anti-virus software.

David Stang, co-founder and vice president of research at anti-spyware vendor PestPatrol, which recently entered the corporate market, says detecting and eradicating spyware relies on the kind of signature-based technique used to define a computer virus.

"There's an analogy with anti-virus, and the techniques for wrestling with it remain the same," Stang says. PestPatrol's database runs to 23,000 spyware signatures, and the company typically adds about 75 new signatures per week.

The adware components in spyware often are designed so they are hard to detect and eradicate because one adware program "may add 30 registry entries and a half-dozen files," Stang says.

Anti-spyware software has a tougher job than anti-virus software cleaning up desktop computers, he adds.

Peer-to-peer file-transfer software such as Grokster and marketing adware such as Claria's Gator software are said to be among the most prevalent adware "downloaders." Downloaders typically report back to servers about what users are doing on the Web and present advertising information.