Windows Security Checklist - Part 27: Spyware and EULA Hooping

by Larry Stevenson, aka Prince_Serendip, CastleCops Staff Writer
June 26, 2005

No one application nor technique can protect you at 100%, but you can still get pretty close to that. When these guidelines are followed by Windows users, it can bring their chances of being infected by malwares almost to zero. Now we begin our next installment of the Windows Security Checklist - Part 27: Spyware and EULA Hooping.

It is not as complicated as it may first appear, although there is a lot of information to absorb. The Security Experts, 1st Responders, Special Response Team members and Host consultants at CastleCops can help you, if you have questions about any of these techniques or featured applications.

Not Reading the EULA Can Give You Spyware and Adware

Whether you prefer downloading freeware or like to pay for software, almost every one includes an End-User License Agreement, EULA for short. Simple or complicated, the EULA represents your contractual obligations, rights and benefits regarding the software you use. (Are you starting to yawn already? Keep reading. Your future happiness may depend on it?)

You do not own your software, but have agreed to hold and honor licenses to use them. By simply using any software you are under the contractual clauses of its EULA. EULAs are binding contracts governed by the laws for all contracts in your state, province or country. The courts can hold the clauses of a contract to be unenforceable or unconscionable, but generally speaking, EULAs are legal contracts. If a child, under the age of consent clicks the "I Agree" button on an EULA, generally the parent is responsible for keeping the terms of the contract. Be sure to instruct your children about EULAs, to always ask you first if they choose to download and install programs.

Think about it? Would you buy a car without reading the terms of the loan? Buy a house without going over all the papers? Enter into a written agreement with your employer and sign your name without reading it first? Nearly all of you are saying, "Of course not!" Ahh, but that's exactly what you're doing when you click "I Agree" to an EULA without looking at it, without reading it completely. An EULA is like reading a ten-page essay on a boring subject. People skip over them, click the "I Accept or Agree" button and move on. If they have problems with the software later, that's when they learn of their rights and obligations. That could lead to consternation, difficulties and even to the courts.

Spyware and adware can be installed on your computer with your permission. How? The part about the spyware and adware is at the end of the EULA. Those engaged in distributing spyware count on the fact that you won't read nor understand what you're agreeing to, that you'll want the software in question bad enough not to pay attention. That's when they get you.

Some programs have some pretty dubious conditions of use hidden in the legalese of their EULA's. For example, by digitally signing the EULA (by clicking the "I Agree" button), you may inadvertently give permission for intrusive, and sometimes unstable, adware to be installed on your computer. If the intention to collect information from end users is not included in the EULA, then the program can be thought of as containing spyware. If it is included, it's not spyware because you agreed to allow it. Some anti-spyware scanners will not always flag information-gathering components if they have been noted in the software EULAs.

Spyware has many forms and varieties. Some are relatively benign and pop-up ads on your computer, but other spyware is more invasive. It will change your Internet "home" page (Browser Hijacker) or add a new toolbar to your browser (BHO--Browser Helper Object). Some will track your movements across the Internet and convey that information back to the people who created the spyware. Other forms of spyware can log your keystrokes (Keylogger) and find out things like usernames and passwords.

Many of you are shaking your heads in disbelief. Surely such things aren't possible? Oh, but they are possible and going on every, single day. What makes it all the worse is that in many instances you agreed to it. It's like agreeing to let some stranger roam around inside your house for a week. Remember, the people who deal in spyware prey on your basic, human weaknesses. Take the changing of your home page. This often happens when you install a program and as the installation ends, you're asked a question. The trick is that under the question is a line about changing your home page. They count on you not reading the box, but just clicking "Yes." The question is phrased so by clicking what you think is right also accomplishes their goal.

How to tell if you have spyware and adware on your machine without protection:

the computer suddenly seems to crash more often,

a new toolbar appears in your Web browser,

the computer seems slower, sluggish,

your "home" page changes suddenly and you didn't change it,

you get pop-up ads both on and offline,

you cannot open your antivirus, firewall or anti-spyware programs.

Protecting Your PC from Spywares, Adwares, and Hijackers

For further help with your security needs please consult the Windows Security Checklist archives.

For those of you who are feeling bad about yourself, for allowing "spyware" on your computer by not reading the EULA, let me tell you this: I learned most of these things the hard way. I'm hoping that you won't have to? So, remember to read the EULA, get a good anti-spyware program, and enjoy your time on the Internet.

Article Resources Best regards and always take care of your security.