About Spyware, Adware, and Browser Hijacking Software
This document applies to all PCs and products that use a PC, such as printers.
This document explains the differences between spyware, adware, and hijacking software. It helps resolve issues caused by these types of software. Some indications that the computer might contain spyware are shown in the following list:
- Poor system performance, especially while browsing the Internet.
- The computer stops responding more frequently.
- The computer takes longer to open the Windows desktop.
- Browser closes unexpectedly or stops responding.
- Performing a search from a search page provides results on a different site.
- Clicking a link does nothing or goes to an unrelated Web site.
- The browser home page changes and cannot be reset. Usually about:Blank is set as your new home page.
- Pop-up advertising windows display when the browser is not open or over Web pages that do not normally have pop-ups.
- Additional toolbars are added to the browser.
- Web pages are automatically added to the list of favorites.
- Desktop icons are automatically added to the desktop.
Be cautious when installing no-cost software. The cost of installing the software might be slower Internet connection times, annoying pop-up ads, or an increase in unwanted emails (spam).
Spyware, adware, and browser hijacking definitions
There are many types of software related to advertising and aggressive marketing. The types of advertising software vary, but are generally the following:
NOTE:Click the topic or the accompanying plus (+) sign to expand the information.
Adware - Self-supporting software that displays ads and often tracks and reports your Internet activity
- Software that supports itself or another program by displaying ads while you are connected to the Internet. Most adware programs track how you browse the Internet and report the information to an interested party.
Browser hijacking software - Aggressive software that changes your browser settings and usually affects such things as your homepage, search bars, Internet speed, and can redirect links to other sites
- Aggressive advertising software programs that change the settings of your browser without your knowledge. These can be annoying and might resemble a virus at first (slow Internet connection and lots of network activity). Typical changes from hijacking software are: the browser's home page address, search bars, tool bars, the creation of desktop shortcuts, and intermittent advertising pop-ups. When a browser is hijacked, it might also redirect links to other sites that advertise or collect your usage information.
Misleading software programs - Software downloaded from Web sites that often present a "virus warning" and offer to remove a virus or spyware, but in actuality they can open malicious code, redirect Web clicks, or open firewalls to allow Trojans
- Software that is downloaded and installed from Web sites that appear to be normal, "useful" software programs, but are not. This type of software often comes from visiting a Web site that pops up a virus warning alert (even though the computer might not be infected). The reader of the pop-up thinks they are purchasing and installing software to remove a virus or spyware; but in actuality, there is no problem. Worse still, some software silently opens malicious code that can log key presses, redirect Web clicks, or even open firewalls to allow Trojans. Beware of programs that have similar names to popular legitimate security software, such as Windows AntiVirus, WinDefender, AntiVirus2008, System Defender, and similar.
Spyware - Software that collects or tracks personal information or activity from your computer and transmits it to an interested party
- Software that gathers and transmits information without your knowledge. Spyware programs usually track information about the Web sites visited, browser and system information, and your computer IP address (the number that represents a network device on the Internet).
Prevent and remove unwanted ads and marketing material
The following items can help you find unwanted adware and spyware, and prevent, remove, or disable them:
To prevent adware from being installed on your system, buy and use full versions of software that are not supported by advertising. If you want to download and use software that claims to be free, carefully read the license agreement and cancel the installation if there is something that you do not agree to or understand. Know the software before you install it.
Prevent spyware and hijacking software by not clicking yes on security warning screens that pop-up from a Web page you do not know or trust
Normally, spyware and hijacking software are installed when you "consent" to a security warning window that displays over a Web page. The Security Warning window contains the following similar text:
Do you want to install and run <name of free program that might contain spyware>. Signed on <date and time> by <name of software vendor or advertiser>.
By clicking Yes on a malicious Security Warning screen, a script or control is integrated into the browsing system. The script or control changes the behavior of your Web browser to suit the needs of the aggressive advertiser.
To prevent this from happening, never click Yes on Security Warning windows that appear with Web pages that you do not trust. Close these windows by clicking No or pressing the Alt and F4 keys together at the same time.
Detect and remove adware, spyware, and hijacking software with trusted professional removal software
Aggressive spyware and browser hijacking software can be extremely difficult to remove. Do not try to remove these kinds of software without the aid of spyware removal software. You can manually remove most nonaggressive adware by uninstalling the software that it came with or removing the adware itself using Windows Add/Remove programs.
To remove the more aggressive forms of spyware, use professionally developed products, such as the following products:
Free Microsoft Security Essentials (in English). For more information about Microsoft Security Essentials, see Using Microsoft Security Essentials to Protect Against Viruses and Spyware .
Free security and threat scans from Symantec (in English).
Trial offers from Symantec (in English).
If professionally developed anti-spyware software cannot detect spyware software or add-ons, the spyware software might be new. Perform the following steps to temporarily disable suspicious add-ons in Internet Explorer until you can update the anti-spyware software, and it can detect and remove the spyware software.
NOTE:These steps apply to Internet Explorer 8 (or greater).
- From the Windows desktop, open Internet Explorer.
- Click Tools , and then click Manage Add-ons .
- Scroll through the list of add-on programs.
- To disable an unwanted add-on, click the name of the add-on in the list, and then click Disable .
- Click Close to close the Manage Add-ons window, and then close Internet Explorer.