Chapter three Methods of spyware detection Filename matching File …

Short Description
The simplest form of spyware detection is filename matching. … subvert the detection software, spyware companies either change the filenames or employ …

Website: www.sunbelt-software.com | Filesize: 33kb

Content
Chapter three
Methods of spyware detection
Spyware applications are installed and working their clandestine trade. You know it
because pop-up ads appear every time you open a Web page, and your system is slower
than a car running uphill on ice. Now what? First, you have to find a good spyware
detection and removal tool. However, all detection applications are not created equal.
Aside from interface differences, the particular methods that these programs use can
greatly affect how well they identify rogue applications. In this chapter, we’ll look at the
differences in the detection methods employed by the most common spyware-detection
applications. We’ll also explain how spyware is different from viruses and why antivirus
applications generally can’t detect spyware.
Filename matching
The simplest form of spyware detection is filename matching. As the name suggests, this
method scans the drive for specific filenames of known spyware. The files are then
flagged for removal.
This form of detection works, but there is a considerable flaw in the theory. In an effort to
subvert the detection software, spyware companies either change the filenames or employ
a random naming strategy. Once the filenames are changed, the detection software is
unable to recognize…