Spyware: How can it be removed?

14 March 2006
Summary Rivalling viruses in the ingenuity they display in spreading across networks, spyware and adware sometimes prove extremely difficult to eradicate. How can you recognise them and protect your PC? Read on for an explanation.

Introduction

Nuisance pop-up advertisements, slow computer performance, connections to the Internet by your PC without your knowledge: web users that have yet to experience these irritating effects of spyware are few and far between, considering that such "parasites" are so widespread today. According to a recent experiment conducted by Symantec, all it takes is one hour's browsing on the web for your PC to be invaded by spyware and suspicious cookies. After visiting innocuous sites, such as those offering online shopping or information, 850 suspect items were found on the test computer. According to some experts, the nuisance caused by spyware could rival the damage generated by viruses in the future.

Spyware and adware: what are they?

By definition, spyware is a program that installs on your computer without your knowledge and proceeds to spy on your online browsing activities: the objective of this type of spying is often to display targeted advertisements according to your centres of interest (it is then called "adware"). Spyware can frequently be found in free software downloaded from the Internet or contained in CDs offered in magazines: in a way, it represents the cost of accessing this free software. In exchange for viewing the advertisements, web users can access several applications without dipping into their pockets.
The Kazaa music download platform is the most well-known software that subsidises its use by infecting the user's computer with spyware. Although the "free in return for ads" deal seems honest enough at first sight, the situation quickly spirals into a nightmare for users finding their screen swarming with pop-up advertisements and their Internet connection noticeably slowed down. Some types of spyware or adware also display advertisements intended for an adult audience whose content could offend children. Another recent trend of increasing concern is that some forms of spyware are combined with Trojan horses, which cause a great deal more damage than pop-up advertisements. This is the case with those that change your web browser's default homepage and sometimes prevent any other browsing. To make the change behind the user's back, these undesirable programs take advantage of loopholes in the most widespread software.

How can you avoid them?

Refraining from downloading software when you are unsure of its origin may offer protection to a certain extent, but such a precaution is greatly inadequate, since some applications that are well known and used for legitimate purposes also include spyware. As for programs combined with Trojan horses that change the browser's homepage, you can pick them up simply by surfing on the Internet, as they exploit the loopholes in the web browsers. The only way to guarantee protection is to update all your software and use anti-spyware tools.

Once it has taken hold, how can it be removed?

Whereas some types of spyware can easily be removed, others are particularly stubborn and difficult to root out. As with certain viruses, they tend to come back and boot automatically whenever you start the operating system.

If the spyware comes from downloaded free software, first try to uninstall the "parent program". It is pointless deleting just the spyware, because in most cases, you will be unable to use the parent program, as the spyware comes in return for its free use. But some types of spyware continue to reside in the system, even after deleting the parent program. You can try to remove it using the Windows "Add/Remove Programs" tool.

Spyware is often hidden and not clearly displayed in the list of installed programs. Specific detection and deletion software must then be used. In most cases, these tools help to resolve the problem. They detect and subsequently delete all the files belonging to the spyware.

However, some forms of spyware cannot be deleted by such specialist software. They resurface via the changes that they have made to the Windows registry, in which case you should first try using software that lists and then deletes the suspect items in the registry (the most widely known tool is Hijack This). Caution: this method should only be used by experienced users who know exactly which line to delete, because modifying the registry can affect your computer's performance.

With spyware combined with Trojan horses that modify the browser's homepage, conventional deletion tools may sometimes prove ineffective. Check out the Symantec website and specialist forums on IT security to find a deletion kit specifically designed to combat this type of threat.

Despite all of these procedures, some spyware may still come back. You should then clean them out by starting your computer in safe mode. The process behind the spyware may still be running, in which case you can stop it using the Windows Task Manager (simply press the "Ctrl+Alt+Del" combination to open the manager). If you do not know which item to stop, look up the name of each process on the Internet. Several specialist sites provide the list of legitimate and suspicious processes. Once these processes have been stopped or your computer started in safe mode, repeat the previous steps. The spyware that has caused you so much grief should finally be gone.