NCL119-122 154 — Winter 2003 North Carolina Libraries Spyware by Ralph Lee Scott ired to the C orld C Antivirus programs monitor your computer to detectviruses, while firewalls block access to your com- puter by hackers. Common antivirus programs and firewalls do not protect your computer against Spyware. Spyware comes attached to programs or Web pages that you want to use and that you have allowed to be placed on your computer willingly. Spyware programs are very invasive. They track your keystrokes, keep a record of which Web sites you have visited, suddenly redirect your browser to a page you did not select, or even crash the browser completely. Spyware comes in several classes: Hijacker programs, including Whazit, IEMonit.Adult, PowerSearcher, ToolbarCC; Spying programs, including I-Lookup, WurldMedia, Huntbar, Bargain Buddy, Cydoor; Malware, including Look2Me, PowerScan, DyFuCa, MagicControls; Keyloggers (iSpyNow); and Tracker programs, including AceMoney, QuickZip, Easi Mp3, and Magic Mail Monitor. Hijackers will replace your browser start page with another page. Spying programs track Internet sites you have visited and report back to the data collector where you have been. Malware crashes your browser and then attempts to find passwords and credit card information, which is then reported back to the hacker. Keyloggers track each keystroke you make on your computer, which are also reported back to the hacker. Tracker programs track your computer use, including to whom you write e-mails and which tunes you download. Often these programs come bundled with screensavers, music, and other software that you download from Web sites or via e-mails. An inventive computer science student at the Uni- versity of Dortmund, Patrick Kolla, has developed a shareware program to ferret out the Spyware on your computer. The program is called “Spybot—Search and Destroy” and is available at www.security.kolla.de (Occa- sionally, I have been redirected to: www.safer- networking.org for the download). Spybot is available free, but Kolla asks that you send him a few dollars (via PayPal) to help him maintain and update the software. Spybot supports all of the major browsers (IE, Netscape, and Opera) and operating systems (Windows 95 through Windows XP). Kolla provides monthly free, self-installing updates. When you install and launch Spybot, it offers you a choice of five different programs to run: Search and Destroy, Recovery, Immunize, Up- date, and Donations. Spybot currently supports versions in 13 different languages. Spybot—Search and Destroy will scan your com- puter for Spyware and note what spy programs there are and their locations. A typical scan can take several min- utes, especially if you have a large number of files to re- view. After the scan is over, you can click on individual Spyware programs installed on your computer, and find who placed it on your computer, what it does, and what sort of security risk it poses. After reviewing the informa- tion, you then have the option of placing the offending software in a backup section on your computer. If you run Spybot on your computer you will be simply amazed at the number of Spyware programs that have been squirreled away on your machine by people you did not know. I found hundreds on my computer and get dozens of new ones each day with normal Web use. In addition to being malicious, these programs often consume large amounts of computer disk space and memory. I have had occasions where my computer was “out of memory,” but in fact these programs had simply used up all the available storage space! After creating the backup section, Spybot then al- lows you via their Recovery section, to either keep the Spyware (if you want to continue using it) or delete it permanently. This is a two-step process that allows you first to select individually each Spyware program on your computer, and then either remove it, or continue using it on a program-by-program basis. Another option is to “immunize” your computer against Spyware. This Spybot program allows you to provide basic permanent protection against known bad Web pages. There is an option that allows reviewing and confirming each page as it is blocked. Spybot allows you to run in Basic or Advanced modes. The Advanced mode allows for additional cus- tomizing of Spybot. The default mode is the Basic Spybot program, but you can change the default to the Advanced mode permanently if you wish. There are other Spybot–type programs which you can find on the Web using your favorite search engine. This column is the second in a four-part series on com- puter security. The next installment will deal with the various types of viruses and antivirus programs available. http://www.security.kolla.de