User guide

85
6.1.4 Rootkits
Rootkits are malicious programs that grant Internet attackers unlimited access to a system, while concealing their
presence. Rootkits, after accessing a system (usually exploiting a system vulnerability), use functions in the operating
system to avoid detection by antivirus software: they conceal processes, files and Windows registry data. For this
reason, it is almost impossible to detect them using ordinary testing techniques.
There are two levels of detection to prevent rootkits:
1. When they try to access a system: They are still not present, and are therefore inactive. Most antivirus systems are
able to eliminate rootkits at this level (assuming that they actually detect such files as being infected).
2. When they are hidden from the usual testing: ESET NOD32 Antivirus users have the advantage of Anti-Stealth
technology, which is also able to detect and eliminate active rootkits.
6.1.5 Adware
Adware is a short for advertising-supported software. Programs displaying advertising material fall under this category.
Adware applications often automatically open a new pop-up window containing advertisements in an Internet
browser, or change the browser’s home page. Adware is frequently bundled with freeware programs, allowing their
creators to cover development costs of their (usually useful) applications.
Adware itself is not dangerous – users will only be bothered with advertisements. Its danger lies in the fact that adware
may also perform tracking functions (as spyware does).
If you decide to use a freeware product, please pay particular attention to the installation program. The installer will
most likely notify you of the installation of an extra adware program. Often you will be allowed to cancel it and install
the program without adware.
Some programs will not install without adware, or their functionality will be limited. This means that adware may often
access the system in a “legal” way, because users have agreed to it. In this case, it is better to be safe than sorry.If there
is a file detected as adware on your computer, it is advisable to delete it, since there is a high probability that it contains
malicious code.
6.1.6 Spyware
This category covers all applications which send private information without user consent/awareness. Spyware uses
tracking functions to send various statistical data such as a list of visited websites, email addresses from the user‘s
contact list, or a list of recorded keystrokes.
The authors of spyware claim that these techniques aim to find out more about users’ needs and interests and allow
better-targeted advertisement. The problem is that there is no clear distinction between useful and malicious
applications and no one can be sure that the retrieved information will not be misused. The data obtained by spyware
applications may contain security codes, PINs, bank account numbers, etc. Spyware is often bundled with free versions
of a program by its author in order to generate revenue or to offer an incentive for purchasing the software. Often,
users are informed of the presence of spyware during a program‘s installation to give them an incentive to upgrade to a
paid version without it.
Examples of well-known freeware products which come bundled with spyware are client applications of P2P (peer-to-
peer) networks. Spyfalcon or Spy Sheriff (and many more) belong to a specific spyware subcategory – they appear to be
antispyware programs, but in fact they are spyware programs themselves.
If a file is detected as spyware on your computer, it is advisable to delete it, since there is a high probability that it
contains malicious code.
6.1.7 Packers
Packer is a runtime self-extracting executable that rolls up several kinds of malware into a single package.
The most common packers are UPX, PE_Compact, PKLite and ASPack. The same malware may be detected differently
when compressed using a different packer. Packers also have the ability to make their "signatures" mutate over time,
making malware more difficult to detect and remove.