Spyware compiles information about users' Internet activity, such as Web sites visited, searches made, etc, but does not display any advertisements. This sub-category was responsible for just over 6.5 percent of all spyware detections in January.
The third sub-category is PUPs. Although not strictly speaking spyware, PUPs (Potentially Unwanted Programs) are classed as such given their similar behavior. These programs are installed without users' knowledge and can interfere with the use of a computer. PUPs accounted for over 26 percent of spyware detections.
The ranking of the most active spyware in January once again saw Gator in first place. This adware offers free use of an application in turn for displaying certain ads. Some versions of Gator even replace banners on Web sites visited for ones the malicious code creates itself.
Lop, the second adware in the list, has jumped from the eighth place last month to second place in January. It installs a search window in Internet Explorer and displays a stream of pop-up ads. This malicious code also creates shortcuts to Web sites on the desktop and in the "Favorites" section and it changes the browser home page for the page of the company that created the code.
| Name | Last Month |
| Adware/ Gator | 1 = |
| Adware/ Lop | 8 (up) |
| Application/ MyWebSearch | 5 (up) |
| Application/ Winantivirus2006 | 2 (down) |
| Adware/ WUpd | 4 (down) |
| Adware/ nCase | 3 (down) |
| Adware/ SaveNow | New |
| Adware/ VideoActiveXObject | New |
| Adware/ cws | New |
| Adware/ SpySheriff | New |
Winantivirus2006, in fourth place, refers to a family with several variants. One of these is a PUP that exploits vulnerabilities in file or application formats to download other malware variants such as the Downloader.LHW Trojan. Another variant of Winantivirus2006 is a type of adware.
"The problem with these PUPs is not only that they are annoying, but that many download a Trojan or other kind of malware in order to steal users' confidential data," explains Luis Corrons, Technical Director of PandaLabs.
WUpd is adware designed to collect information about users' Internet activity (Web sites visited, searches made, etc.) It then uses that information to display pop-up ads specifically related to personal preferences. WUpd can update itself whenever there is a new version available.
nCase, which has dropped from the third place it held last month to sixth position, is a type of adware that runs in the background and displays ads connected with the keywords the user has entered while using the Internet. SaveNow, which is in seventh place, is another adware program that offers information about the weather in exchange for the user viewing certain adverts.
VideoActiveXObject, the next malicious code on the list, is designed to register users' browsing habits and show them ads in accordance with their preferences. This adware also connects to certain Web sites to download malware onto compromised computers.
Finally, this month's ranking is completed by Cws and SpySheriff, two examples of adware that use banners, pop-ups, etc, to display adverts for their creators or for third parties.
"There are two main points to consider this month. Firstly, there are four new entries in the list, this is more than usual. Secondly, traditional spyware is giving way to adware. This trend started a few months back and is now consolidating," explains Corrons.
