Spyware

Posted on 29 Aug 2006 at 11:56

• 
• 

 1 of 2

Gallery

Your first line of defence will be your anti-spyware program. If spyware has managed to slip past it, download the latest updates, and go immediately to its website to see what additional advice the manufacturer is giving.

Anti-spyware products work pretty much the same way as anti-virus software. The applications require regular updates of spyware signatures in order to remain effective. More advanced software looks not only for signatures but also for patterns of software behaviour, sometimes called heuristics. For example, some spyware runs two copies of itself so that if the first is deleted the second can reinstall it. This kind of suspicious behaviour will be brought to the attention of the user, who can make a decision on the problem.

Many anti-spyware and anti-virus removers suggest you scan using the PC's Safe Mode. It is easier to spot spyware when you are in Safe Mode, since it shuts down many of the computer's higher functions, and any program using them. For example, third-party Windows services won't be active in Safe Mode.

SAFE AS HOUSES

Safe Mode has another advantage when it comes to debugging your system. To go into Safe Mode, hold down the F8 key while starting your PC. Once you're in, run your security software and it has a greater chance of cleaning the system totally than if the scan were completed in normal mode. This is because some spyware is very difficult to remove if it is running.

More cunning spyware programs will always have at least two copies running and once one is deleted the other takes over. Running your scan in Safe Mode can defeat this, but spyware writers are becoming increasingly wise to this. New variants of the CoolWebSearch spyware, for example, can load even in Safe Mode.

Every so often, a particularly nasty piece of spyware will require the use of both your anti-spyware program and manual intervention. For these infections, use a handy tool called HijackThis to see exactly what is running on your system. Written by Dutch coder Merijn Bellekom, it has become one of the most popular tools for this kind of work because of its reliability at detecting system changes.

Typically, users of HijackThis are advised to run the program, then send the logs in for one of the experts to look at. However, you can have a go yourself. In our tutorial above we explain the various components of the program, and what sorts of things you need to look for.

With the way spyware is developing, some infections will always get through. But by using a variety of anti-spyware applications, correct computer configuration and good practice online, you can minimise the threat.