The underlying technology behind spyware is Microsoft's Browser Helper Object programming interface for Internet Explorer. BHO programs are not scripts. They are Dynamic Link Libraries that have full control of your computer while you Web surf. A good BHO can turn Explorer into a PDF viewer. A bad BHO can turn the browser into a doorway through which the bad guys can steal your corporate data, make your computers unwitting participants in a distributed denial-of-service attack or throw pop-up ads onto your screen. Spyware also can update itself and even install other software.

BHODemon is a freeware tool for detecting BHOs. It doesn't remove BHOs, but it does let you disable (and later re-enable, if you wish) a BHO. It also makes recommendations about whether a particular BHO is benign or harmful. If you leave BHODemon running in the background, it will watch for incoming BHOs and warn you before they attach themselves to your browser. It has no central console, which means you'll need to visit a sampling of clients to run BHODemon to determine the extent to which spyware is a problem on your network. BHODemon is available from the Web site www.definitivesolutions.com.