Spyware and Bloatware Flashcards

Malware that secretly monitors user activity and transmits collected data to an attacker or third party without consent. Unlike destructive malware, spyware is designed to stay hidden as long as possible — every day undiscovered is more data collected. Goals: advertising/behavioral tracking, identity theft, credential theft, affiliate fraud. Installed via P2P downloads, fake security software, or bundled installers. Difficult to remove — may deeply embed in OS and reinstall itself when partially removed.

A spyware capability that intercepts and records all web browsing activity — URLs visited, search queries, time on pages, form content, and shopping behavior. The collected profile is sold to advertisers or used to identify banking and e-commerce sessions for credential theft. Browser-monitoring spyware captures data even in private/incognito mode, because it runs as an OS-level process, not inside the browser. The result: targeted ads for things the user researched privately.

A spyware monetization technique: spyware injects the attacker's affiliate referral code into the victim's online shopping sessions. When the victim completes a purchase, the retailer's affiliate program credits the attacker with a referral commission. The victim pays the normal price; the retailer pays a commission to the attacker. No data needs to be stolen — the attacker earns money from every purchase made on any infected machine. Profitable at scale across thousands of infected systems.

A spyware delivery vector: a pop-up or webpage claims the system is infected and urges installation of a "free security scanner." The scanner is itself spyware. The social engineering is effective because users are primed to act when they believe they are already under attack. The result: the user installs malware while trying to remove malware. Defense: legitimate security software is never delivered via unsolicited pop-ups. Dismiss all such alerts and use only known, reputable security brands.

Three primary ways spyware reaches a system: (1) Peer-to-peer (P2P) downloads — files shared on P2P networks frequently bundle spyware with claimed content; (2) Fake security software — scareware pop-ups trick users into willingly installing spyware disguised as an AV tool; (3) Bundled installers — legitimate applications ship with spyware pre-selected during installation; users who click through without reading install it unknowingly. Defense: official sources only, custom install options, read every install screen.

Dedicated malware scanning tools that detect spyware, adware, and PUPs that standard antivirus may miss. General-purpose AV is optimized for viruses and trojans; anti-malware tools like Malwarebytes specifically target surveillance behaviors — keyloggers, browser monitors, affiliate injectors, and rootkits. Run alongside (not instead of) standard AV. Particularly valuable for active spyware infections where a second detection engine improves removal odds. Can identify and remove persistent spyware that has evaded the primary AV product.

Unnecessary software pre-installed on new devices by manufacturers or retailers without the user's choice. Manufacturers receive payment from software vendors to include their apps on shipped devices. Ranges from trial software and streaming apps to shopping tools and "system optimizers." Security concerns: expanded attack surface (each app is exploitable software), potentially unpatched vulnerabilities, privacy-violating data collection, and auto-start processes that degrade performance. The Lenovo Superfish incident (2015) is the defining example of bloatware becoming a critical security vulnerability.

Bloatware is a security concern, not just an annoyance. Each pre-installed application: (1) is potentially exploitable software present from day one; (2) may not receive regular security updates, leaving known CVEs unpatched indefinitely; (3) may collect and transmit user data without meaningful consent. A device fresh from the box with 20 bloatware applications has 20 additional attack surface components — all before the user installs a single desired application. Security best practice: remove all bloatware before deploying devices, or use a clean OS image with no OEM additions.

Remove bloatware in this order, from safest to most aggressive: (1) Built-in OS uninstaller (Settings → Apps) — works for most; always try first; (2) Application's own uninstaller — found in the program folder or Start menu; use if not listed in OS; (3) Third-party uninstaller (Revo, IOBit) — last resort for stubborn cases; powerful but can remove OS dependencies if misused; create a backup or restore point before using. Never skip backup before aggressive removal.

Virus goal: replicate and spread (may destroy data). Spyware goal: stay hidden and collect data. This difference in objective drives opposite behavior: a virus may want to be noticed (destruction, ransom demands); spyware actively avoids being noticed because detection ends the surveillance. Spyware survives by mimicking legitimate processes, resisting uninstallation, and collecting data quietly. The longer it remains undetected, the more valuable data it extracts. This is why spyware specifically fights removal with persistence mechanisms and reinstall modules — detection is the end of its usefulness.