printer friendly version

Spyware and viruses - two separate problems requiring separate defences

To the untrained eye, spyware and computer viruses may appear to be one and the same but in actual fact there are vast differences between the two.

Companies need to understand what the differences are if they are to get to grips with the potentially crippling impact of spyware. “Understanding the unique properties of spyware is critical for any business because in order to institute a practical plan for protection against the dangers spyware poses, companies need to know what they are dealing with – and it is not a virus,” says Brett Casey, CEO at specialist IT security management and consulting company, Securicom.

He says that while viruses are mainly focused on causing a nuisance or physically damaging IT infrastructure, spyware is designed to execute far more malicious objectives and with devastating consequences.

In the hands of cyber criminals, spyware can be used to violate personal privacy, access confidential business information and steal financial assets. And because spyware is usually financially motivated and backed by increasing investment from a thriving industry, it is advancing at a rapid rate, becoming progressively more complex to identify and combat.

So what is spyware?

Casey explains that spyware is software that covertly monitors activity on a computer and gathers information to be sent back via an Internet connection to whoever planted it.

Without the user knowing, Spyware in the form of key-loggers or Trojans is used to track Internet habits and harvest important information including passwords, credit-card details, Internet-banking logon details and e-mail addresses.

Spyware is often embedded in ‘free’ Internet downloads, music files and P2P networks. It can also be hyper-linked onto a webpage and distributed as part of spam messages. There have also been reports of spyware being installed by technicians and disgruntled employees.

According to Casey, spyware is curiously difficult to locate and very complicated to remove from a system. This is because unlike viruses, which are designed to spread themselves openly and obviously across networks, spyware is generally unwittingly downloaded by a computer user and then hides in the system.

There are also far more variations of spyware than there are viruses because spyware is programmatically designed to spin-off its own variations which leads to a substantially greater number of spyware programs to contend with.

Spyware also typically impacts multiple registry entries and leaves dozens of application files spread across a computer’s hard-drive or deep within the hardware. Newer spyware variations are even capable of reinstalling components and repopulating registry entries that have been removed and can also randomise various elements of the program so that they leave a different footprint, which makes them harder to track. Worse still, if left unchecked, many spyware applications are actually capable of downloading additional programmes.

One such example is Look2Me, a particularly malicious spyware application that uses Internet Explorer as the launching point to insert another file into the Windows area that controls system start-up processes. By hooking itself in this way, Look2Me can trick a computer into thinking that it is a critical process that must not be removed; so when attempts are made to remove it, Look2Me automatically reboots the computer to restore itself.

“Removing aggressive spyware applications like Look2Me is particularly difficult and traditional anti-virus solutions are simply not designed for that sort of task. Spyware removal requires highly-specialised techniques that are very different from the fundamental processes performed by anti-virus software.

“And that is why companies that do not know the difference between viruses and spyware are falling short. They are not doing enough to protect themselves against spyware infection. An anti-virus solution, no matter how effective it may be in warding off virus attacks, is simply no match for spyware,” warns Casey.

He concludes, saying that dealing with spyware is a complex challenge that requires specialist tracking and removal techniques.

“Companies need a dedicated solution designed specifically to help navigate the unique threats of spyware. The ideal is to have a layered solution deployed to protect the perimeter, with the entire network infrastructure actively participating in the security strategy,” says Casey.

Share this article:

Further reading: