Antivirus companies target spyware, worms

Leading antivirus software makers Symantec and Network Associates Inc. (NAI) announced updates to their products on Monday, touting protection against "spyware" and Internet worms to entice customers.

Symantec, of Cupertino, California, unveiled a new version of its flagship product, Norton AntiVirus 2004. The new version of Norton AntiVirus can detect a range of snooping programs that are not technically viruses, but still pose a threat to Internet users' privacy, Symantec said.

NAI announced a new version of its antivirus software, McAfee VirusScan, continuing the race between the antivirus software vendors. The latest version of McAfee VirusScan also spots spyware and adware, allowing users to detect and remove the suspect software applications from systems running VirusScan.

Spyware and adware programs silently monitor a user's activity on the Internet, keeping track of information such as the Web sites a user visits.

Norton AntiVirus 2004 will scan e-mail and instant message attachments, flagging known spyware programs before they are installed. The program will also spot spyware and adware programs that have already been installed and report those to the user, according to Symantec.

Norton AntiVirus also flags legal adware (advertising software) programs such as the popular Gator software from The Gator Corp. of Redwood City, California, according to Kelly Martin, senior product manager for Norton Antivirus 2004.

A popular example of adware (or advertising software), Gator performs useful tasks for users such as remembering and filling in user names, passwords and other data for online forms. However, the program also tracks user behavior and buying habits for the company's customers and delivers targeted "pop-up" advertisements to desktops.

Norton AntiVirus will not automatically remove adware like Gator, which is often governed by a licensing agreement that the user acknowledged when the program was installed, Martin said.

The focus on spyware comes after research on end users identified the stealth programs as a leading concern among Norton AntiVirus users, even when users didn't know they had the programs installed, she said.

"Even if users were not able to articulate 'I have spyware,' they were telling us about dialling programs that were calling out to a third party or having their (Web browser) hijacked or the home page rerouted to another site," Martin said.

"This was a big ticket issue for our user base," she said.

Following two weeks of high-profile worm outbreaks, Sunnyvale, California-based NAI is calling attention to a new WormStopper feature. That feature enables VirusScan to spot worm-like activity such as a high volume of e-mail and repetitive e-mail content, NAI said.

While the new feature won't stop infections, per se, it will slow the spread of mass-mailing worms like the recent Blaster and Sobig.F worms, NAI said.

One security expert said that features to spot spyware are long overdue in mainstream antivirus programs.

"It's about time," said Richard Smith, an independent security analyst based in Boston.

Installations of the shadowy programs have escalated in recent years, with the growing popularity of peer-to-peer file sharing programs such as Kazaa and Morpheus, Smith said. Those programs often bundle adware programs with the main file-sharing software, he said.

Symantec, NAI and other companies that are serious about stopping spyware might benefit from snatching up niche spyware detection companies such as Enigma Software Group Inc., maker of SpyHunter.

Such companies already have large databases of spyware, adware and other programs that could jump start the detection capabilities of more mainstream antivirus products, he said.