BEWARE SPYWARE - INFECTIONS ON RISE.

Byline: Greg Bolt The Register-Guard

About a week ago, Cameron Nichols' laptop started to slow down. Then it would freeze up when he tried to get onto certain Web sites. Finally, it replaced his regular desktop image with an ad.

When Nichols, a University of Oregon sophomore, took the balky Dell into the UO's computer shop, he found that he had become one of the thousands of campus victims of the latest PC plague: spyware.

"Within a matter of a few days it really went downhill," Nichols said, while a technician worked to clean the malignant files off his hard drive. "Multiple times I'd try to get on a Web site and it would freeze up."

What happened was that sneaky little files that most likely slipped onto his hard drive while he was visiting Web sites were working behind the digital scenes to hijack his computer. Individual spyware files can be relatively benign - if you don't mind being spied on - but collect enough of them or get infected by particularly insidious ones and you can kiss your data goodbye.

The problem has caused headaches on college campuses across the country, as well as in homes and businesses. People connected to large, fast networks such as those at universities are especially vulnerable because the files easily can be loaded in the background without any telltale slowdown in computer performance.

"This fall, probably about 75 percent of our business has been dealing with either viruses or spyware," said Patrick Chinn, a network computing consultant at the UO. "Our business is kind of cyclical in that every fall term we usually see some kind of trend emerge, whether it's a good trend or bad trend. This fall term compared to last fall term, the amount of spyware removal we've been doing is just astronomical."

Spyware has become a kind of catch-all term for files that can do several different things. Basic spyware does just that: It spies on you, marking the time you're online, which sites you visit, what you do there.

Usually it will collect the information and then send it along to some other computer, where marketers or analysts will combine it with data from millions of other Web surfers and look for trends or product preferences that they can then sell to businesses.

More nefarious spyware, sometimes known as "adware," takes the information and then starts directing advertising to the computer based on the user's Web activities. This often shows up in the form of annoying pop-up ads, sometimes so many and so fast from the plethora of adware files hiding on the hard drive that the computer is overwhelmed and freezes.

The most dangerous spyware often is called "malware." These nasty files look for passwords, credit card numbers, Social Security numbers and similar security information and relay it to cybercriminals, who can use it to steal your identity - and your money.

Spyware comes from the Web, and those most certain to get it are those using Microsoft's Internet Explorer browser, Chinn said. People get it either by visiting questionable Web sites or by downloading software.

Norm Myers, computer services coordinator for the UO residence halls, said it's often hard to tell which Web sites are secretly peddling spyware but said those offering too-good-to-be-true deals or other gambits should be approached with caution. Web-based game and gambling sites are another common source of spyware, but at times even mainstream sites will attach a little spyware to your computer, ostensibly to help serve you better.

One common way students collect spyware is through file-sharing or peer-to-peer programs they download from the Web and use to share and obtain music, often in violation of copyright laws. Users often are warned that the deal involves accepting other files, but few seem to pay attention.

"When you run the program's installer, in the license agreement legalese that nobody bothers to read, it actually tells you that if you click `agree' and go ahead and install this, we're going to install all this other software too," Chinn said. "Nobody reads it. People go ahead and install it anyway."

Some spyware is so tied into these programs that they will quit working if you try to delete it. And some are so tricky that they can tell when you're trying to delete spyware and hide themselves, a trait found in recent viruses.

"There are companies out there that have spyware that disable the spyware detection," Myers said. "The best thing we can figure out is they're hiring the virus writers to write the spyware."

Several signs point to a spyware infection. One of them is getting hammered with pop-up ads. Another is suddenly seeing new programs you don't remember installing show up on your desktop or seeing a different browser's toolbar show up on your regular browser.

"The third general symptom that people describe, they'll say, 'My computer was working just fine and now it runs so slowly it's useless. I can barely make it do anything,' ' Chinn said. "That usually means there's stuff running in the background that is not good."

University technicians often have a running contest to see who can find the most spyware files on infected computers. Myers said he's seen more than 3,000 virus and spyware files on a single hard drive, and up to 2,000 spyware files alone.

Michael Buckley, a microcomputing consultant in the UO tech shop, said the record there is more than 3,100. That's way up from last year.

"A year ago, this was not the problem it is right now," he said.

Getting rid of spyware can be relatively easy or a major hassle, depending on your operating system and how much and what kind of spyware kind you have. To get rid of spyware, the UO tells all its students and staff to regularly run two free programs, Spybot and Ad-Aware, both available to individual users on the Web (safer-networking.org and lavasoftusa.com, respectively).

The programs will scan your hard drive and look for and delete any of about 20,000 known spyware files. Spybot also comes with a free immunization tool, which helps block incoming spyware, Myers said.

"Using one or both of those programs is a good baseline maintenance procedure for people," Chinn said. "It will help keep things to a minimum. It's not going to prevent infection, but it will at least try to catch it and clean it up."

Depending on your operating system and how much spyware you have, it can take anywhere from 20 minutes to several hours to run the programs. But even then, some computers may be so infected that stronger measures are needed.

The good news is that spyware is strictly a software problem; it doesn't damage the computer's hardware. The worst-case scenario is that the hard drive will have to be wiped completely clean and the Windows operating system reinstalled, but that means losing all the data on the computer.

That can be devastating news for a student finishing an end-of-term project who doesn't have the data backed up. Between that and the slowdown in less infected computers, spyware can put students in low gear just when they need speed.

"I've had folks bring in their laptops who, when they opened up Microsoft Word and tried to start typing, their computer is so infected that they type and 15 seconds later the letters appear on the screen," Chinn said. "So it's a real hit to productivity, especially as we approach the end of fall term and students hit crunch time on their projects."

Myers said Internet Explorer is particularly vulnerable because spyware writers can exploit an opening in the programming code that allows such files to sneak onto the hard drive. That's led UO techs to start recommending that students use a different browser.

Chinn said the one they recommend is Firefox, an offshoot of another popular browser, Mozilla. Firefox is an open-source program available free on the Web (mozilla.org), and Chinn said it will block about 90 percent of the spyware that gets through Internet Explorer.

Like viruses, spyware is almost entirely a PC problem, which leads to the other piece of advice Chinn and other UO techs give.

"People say, `Well, what can I use to prevent spyware?' ' Chinn said. "And the short answer is: Use a Macintosh."

RECOGNIZING PROBLEMS

Signs that indicate your computer is infected

A barrage of pop-up ads

A hijacked browser

A sudden or repeated change in your home page

New and unexpected toolbars

New and unexpected icons on your computer screen

Keys that don't work

Random error messages 

Sluggish or downright slow performance

- Federal Trade Commission

WHAT TO DO

Tips on how to keep spyware off your hard drive

Update your operating system and browser: Your OS may offer free software "patches" to fix vulnerabilities that spyware exploits.

Download only from trusted sites: Beware that some "free" software applications, such as games and file-sharing programs, come bundled with other software, including spyware.

Don't install any software without knowing what it is: Read the small-print user agreement before downloading. If it's hard to find or understand, think twice about installing it.

Minimize "drive-by" downloads: Make sure your browser security setting is high enough to stop unauthorized downloads, at least the "medium" setting on Internet Explorer.

Don't click on links in pop-ups: It could install spyware on your computer. Instead, close pop-up windows by clicking on the "X" icon in the title bar.

Don't click on links in spam offering anti-spyware downloads: Some software offered in spam actually installs spyware.

Install a firewall and trusted anti-spyware program: Two widely used spyware programs are Spybot (www.safer-networking.org) and Ad-Aware (www.lavasoftusa.com)

- Federal Trade Commission