Computer Support Newsletter

Tech-Tip

What are parasites? 'Parasite' is a shorthand term for “unsolicited commercial software” — that is, a  program that gets installed on your computer which you never asked for,  and which does something you probably don’t want it to, for someone else’s  profit.  The  parasite problem has grown enormously recently, and many millions of  computers are affected. Unsolicited commercial software can typically:  

• plague you with unwanted advertising  (‘adware’);
• watch everything you do on-line and send  information back to marketing companies (‘spyware’);
• add advertising links to web pages, for  which the author does not get paid, and redirect the payments from  affiliate-fee schemes to the makers of the software (such software is  sometimes called ‘scumware’);
• set browser home page and search settings to  point to the makers’ sites (generally loaded with advertising), and  prevent you changing it back (‘homepage hijackers’);
• make your modem (analogue or ISDN) call  premium-rate phone numbers (‘diallers’);
• leave security holes allowing the makers of  the software — or, in particularly bad cases, anyone at all — to  download and run software on your machine;
• degrade system performance and cause errors  thanks to being badly-written;
• provide no uninstall feature, and put its  code in unexpected and hidden places to make it difficult to remove.

Where do they come from? There  are three major ways unsolicited commercial software can make its way on  to your machine:  

• Some freeware programs are ‘bundled’ with  parasites, which are installed at the same time. Often if you are  careful to read the small print when you install the software it will  warn you about this, and it is sometimes possible to opt out. So always  skim the licence agreement when you install and don’t just click  Next-Next-Next... but you still can’t be sure they’ll tell you.
• Many parasites load using Internet Explorer’s  ActiveX installation option. When a web page includes a link to an  ActiveX program, a window will appear asking the user wishes to execute  it. If ‘Yes’ is clicked (or if IE security settings are set lower than  normal so that it never even asks*),  the software is allowed to run and can do anything at all it likes on  our computer, including installing parasites.  For this reason, you should never  click ‘Yes’ to a “Do you wish to download and install...” prompt unless  you are 100% sure you trust the publisher of the software, which might  not be the publisher of the web site you are viewed — read the dialogue  box very carefully.  Sometimes sites (or pop-up ads) try to fool  you into clicking ‘Yes’ by stating that the software is necessary to  view the site, or opening endless error windows if you click ‘No’, or  claiming that the digital certificate on the code means it is safe. It  means no such thing. ‘Microsoft Authenticode’, signed by companies like  Verisign, means only that the company that wrote the software is the  same as the company whose name appears on the download prompt — nothing  more.
• Some of the really bad parasites,  particularly homepage-hijackers and diallers, execute by exploiting  security holes in Internet Explorer, ways of getting code to run that  are not supposed to be possible, but are due to mistakes in the browser  code.  You can do your best to guard against this by  ensuring you have the latest updates and patches from Microsoft.  Still, there are usually a handful of security holes that have not yet  been corrected, so you can never be 100% sure you are safe.  One way of reducing your risk of exploitation  is to go to Tools->Internet Options->Security and set the security  level for the Internet Zone to ‘High’. (If no slider is visible, click  ‘Default level to make it appear first.) Then set the security level for  the Trusted Zone to ‘Medium’ and add the sites you use and trust to this  zone; you may need to do this quite often as many badly-designed sites  just won’t work in high-security mode.

Why dosn't my anti-virus software detect this? Technically,  most unsolicited commercial software isn’t viral: it doesn’t spread from  computer to computer, it just installs and runs on one system. That  doesn’t mean it’s not harmful, but anti-virus software does not attempt to  detect all software that could be harmful.  Actually  some anti-virus programs do detect some of the parasites outlined  on these pages, but not nearly all, and not all versions of them.  Parasites that install using IE security holes are more likely to be  targeted by the anti-virus software vendors, but the selection of targets  seems for the most part to be pretty arbitrary.  For  this reason there are now a number of anti-parasite packages around that  work as a complement to anti-virus software.  If  you think you have a parasite infested computer, call us to schedule a  visit to your office or home for our "Spring Special Clean-up".

Any suggestions/comment/requests for future newsletters can be sent to andys@relia-tech.com. We welcome all suggestions.