Solved

Adware, Spyware detection

Posted on 2004-10-27
491 Views
Last Modified: 2008-02-20
 Hello Experts!
  I knew that the anti-virus softwares detect virus by search the pattern in a database containing virus information (please correct if I'm wrong). But I don't know how about anti adware and spyware do? Do they also search in a database, look in the registry or something else? If you can give me a piece of code (in Delphi, C/C++/C#, or VB/VB.NET) (for example, detect 1 adware, and destroy it), that's great!

  Thank you, and waiting for your answers!
0
Question by:dttri
    4 Comments
     
    LVL 35

    Accepted Solution

    by:
    They search both the file system and registry for known "fingerprints" of adware...  

    That is why you have to make sure you keep up to date with your "fingerprint database"

    Exactly like current antivirus tools :-)

    There is a discussion here: http://sourceforge.net/forum/forum.php?thread_id=1044403&forum_id=359734  About developing an opensource ad removal tool, which is quite interesting :-)

    Tim
    0
     
    LVL 48

    Assisted Solution

    by:Julian Hansen
    adware and spyware comes in a variety of flavours. Some are browser plugins that are activated whenever your browser is activated. Others insert themselves into your Startup Folder of your profile (or the all users profile) or into the Run command of the registry etc. Some spyware detection programs treat all cookies on your system as potential spyware and I know that AdAware from LavaSoft detects the about:blank setting in the IE Default page as a potential spyware setting.

    The code for checking for these things is standard code for reading the registry and file system - thre is no inherent property of spyware that makes them detectable by code - you have to know what you are looking for. Spyware solutions use a database of known spyware to detect if you have spyware on your machine.

    Failing this visual analysis is required i.e. look in your Startup folder in your profile and All Users, Run key in HKLM and HKCU, pluggins and extensions key of the Internet Explorer key in the registry.

    Destroying it = deleting it.
    0
     
    LVL 3

    Assisted Solution

    by:kumvjuec
    From a friend in such development, I came to know that it's really very easy to do. This is routine job to search for exes, dlls, keys, values and settings. Their data files keep gettings updated as new Adwares and Spywares get detected. They mostly have some classes which store the signatures like specific names for files and keys, filesizes for similar types of wares. They do not use patterns as the things are usually not as concealed as viruses. They have a matching tools which scan the system and look for suspect entries.
    The objects are created and loaded from the data files before the sscan starts.
    0
     
    LVL 7

    Author Comment

    by:dttri
     Thanks for all of your comments!
    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Suggested Solutions

    Title # Comments Views Activity
    code issue 8 57
    Order table with macro 3 50
    ClickOnce Install - Shortcut Question 3 14
    count7 challenge 12 26
    Go is an acronym of golang, is a programming language developed Google in 2007. Go is a new language that is mostly in the C family, with significant input from Pascal/Modula/Oberon family. Hence Go arisen as low-level language with fast compilation…
    This is about my first experience with programming Arduino.
    An introduction to basic programming syntax in Java by creating a simple program. Viewers can follow the tutorial as they create their first class in Java. Definitions and explanations about each element are given to help prepare viewers for future …
    Viewers will learn how to properly install Eclipse with the necessary JDK, and will take a look at an introductory Java program. Download Eclipse installation zip file: Extract files from zip file: Download and install JDK 8: Open Eclipse and …

    931 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now