Your Computer and Photography Professional

Viruses, Adware and Spyware

A Virus is a computer program that can copy itself and infect a computer without the permission or knowledge of the owner. In order to replicate they attach themselves to executable files that may be part of a legitimate program. When the user attempts to start the application the malicious code is executed as the program opens without the knowledge of the user. Viruses can be broken down into two categories: Resident Viruses, which are malicious scripts that load into memory upon execution and wait for new hosts to access the file or program in order to spread. The other is Non-resident Viruses, which immediately search for new hosts to infect. Once they infect a new host control is transferred to the program that was infected and gives the “Hacker” who implanted that malicious code control over your system. The term virus is commonly misused to refer to other types of adware, malware, and spyware programs that do not have to ability to manifest in other systems. Even with an anti-virus program installed on your system you can still get infected. Viruses are becoming increasingly cleaver. Today there are several stealth techniques that are used to trick to anti-virus programs into thinking that your system is clean. When anti-virus detects an infection the warning is intercepted and then re-routed to the virus instead of the operating system. Another popular technique is Self-Modification. Anti Virus programs are designed to detect byte patterns in programs that may be suspicious. These patterns are referred to by Incident Response (IR) as virus signatures. However it is becoming increasingly tougher to detect these signatures. Polymorphic code uses mutating algorithms that slowly change the pattern of code over a period of time rendering virus scanners useless. Diversity of software systems on a network helps to regulate the potential of viruses. Users of Microsoft Outlook and Internet Explorer are especially vulnerable to the spread of viruses. Microsoft software is targeted by virus writers due to the fact that it is the most widely used desktop software.

Adware is the common name used to describe software that is given to the user with advertisements embedded in the application. Adware is considered a legitimate alternative offered to consumers who do not wish to pay for software. There are many ad-supported programs, games or utilities that are distributed as adware (or freeware). Today we have a growing number of software developers who offer their goods as “sponsored” freeware (adware) until you pay to register. If you’re using legitimate adware, when you stop running the software, the ads should disappear, and you always have the option of disabling the ads by purchasing a registration key.

(2) Another use of the phrase adware is to describe a form of spyware that collects information about the user in order to display advertisements in the Web browser. Unfortunately, some applications that contain adware track your Internet surfing habits in order to serve ads related to you. When the adware becomes intrusive like this, then we move it into the spyware category and it then becomes something you should avoid for privacy and security reason

Spyware is software that is installed surreptitiously on your computer to collect information about the system and browsing habits without informed consent. Spyware programs can also interfere with control of your computer by changing settings that result in slower connection speeds, different home pages, and/or loss of internet connectivity as well as the function of other programs. Software that operates in this manner has been more formally classified as privacy-invasive software. As of 2006 spyware has become one the predominant security threat to computer systems running Microsoft Windows operating systems. Computers in particular that use Internet Explorer are most vulnerable to these kinds of attacks due to the integration of the web browser that is tied in to crucial parts of the operating system. The Windows Registry contains multiple sections that by modifying key values allows software to be executed automatically when the operating system boots. Spyware exploits this design in order to prevent removal. It will typically link itself from each location in the registry that allows execution. Once running, the spyware will intermittently check if any of the links have been removed. If so, they will be restored. This ensures that the spyware will execute when you boot your system even it most of the registry links are removed.