Adware

Programs belonging to this class display advertising, usually in the form of banners. They also redirect search requests to advertising sites. Apart from displaying advertising, there is usually no other visible sign that adware is present on the host system: they do not add icons to the system tray, and there is no sign in the Program Menu that files have been installed. Adware programs often do not have a de-installation routine.

Installation

Adware can be installed to the host system in two ways:

1. via freeware and shareware which contains advertising components;
2. when the user visits a web-site which is 'infected' with adware; the adware will then be installed to the host system without the user's explicit consent.

The majority of freeware / shareware programs will stop displaying advertisements once they have been purchased and registered. These programs often include integrated adware from third-party vendors. As a rule, such adware remains on the host machine even after the program with which it was installed on the host machine has been registered. In addition to this, if the adware is still being used by a program in order to display advertising, deleting the adware can cause the program in question to crash or malfunction.

Adware of this type is effectively designed to subsidize freeware/ shareware programs by causing such programs to display advertising to the user. The advertiser pays an advertising agency, which in turn pays the Adware developers. Consequently, Adware helps reduce the costs of developing certain software, as the income from the Adware provides motivation for developers to write new programs and perfect existing ones) and also reduces the amount users might otherwise have spent on software.

If the user visits a 'infected' web-site, the Adware will usually be installed to the host machine using hacker techniques, either by exploiting loopholes in the browser's security, or by using Trojan programs (Trojan-Dropper, Trojan-Downloader) which are designed to install other programs without the user's knowledge or consent. Adware programs which act in this way are often called 'Browser Hijackers'.

Displaying advertising

Adware uses two main methods to display advertising:

• downloading advertising text and images from web or FTP servers belonging to the advertisers
• redirecting internet browser search requests to advertising sites

In some cases, the browser will be redirected if the web site requested does not exist e.g. if the user makes a mistake when entering the address

Information leakage

In addition to displaying advertising, such programs may also harvest confidential data about the host machine and the user:

• the host machine’s IP address;
• the operating system and browser version used;
• a list of sites regularly visited by the user;
• search requests;
• other data which could be used to conduct future advertising campaigns

Because of this, Adware is often called ‘Spyware’. (Such programs should not be confused with Trojan-Spy programs.)