Privacy Watch: What Your Antivirus Software Won't Tell You

Some security apps ignore surveillance programs.

There may be software on your PC that hides itself like a virus, silently keeps tabs on your PC like a virus, and e-mails the data to the person who planted it like a virus. So why does your antivirus program not tell you about it? Good question.

For years, some people have used PC surveillance products to keep tabs on other people, much of it for legitimate purposes--by businesses that want to enforce computer policies, for instance. But they're becoming popular with jealous spouses and data thieves for spying on people.

These programs can run hidden from the user, recording every keystroke, taking pictures of the desktop, and quietly sending the information to another party on the Internet.

For a long time, applications like Symantec's Norton AntiVirus and Trend Micro's PC-cillin have found and removed hacker tools that perform the same functions. But these antivirus apps won't warn you about commercial spy software. Only Kaspersky Anti-Virus claims to trap both spyware and viruses.

The core problem here is philosophical, not technological. Antivirus companies guard against viruses by obtaining a sample of the malicious application, examining the underlying code, and then telling their programs to look for the virus's unique signature. Obtaining a copy of any of these snoopware apps shouldn't be tough--after all, the software is on sale every day.

"Traditionally it was very black-and-white--if [a suspect file] wasn't replicating, it wasn't a virus," says Vincent Weafer, senior director of Symantec Security Response. But it's not so easy to draw a line that separates legitimate from shady use of retail snoopware. Weafer, at least, is changing his view. The next version of Norton Antivirus will detect and block spying utilities.

In his book, The Art of Deception, hacker-turned-consultant Kevin Mitnick decries the double standard that antivirus companies seemingly apply to viruses and to spyware.

"Antivirus software [treats spyware] as not malicious, even though the intent is to spy on people," Mitnick writes. That creates "the risk that each of us might be under illegal surveillance at any time."

Until antivirus companies change their tune, you can ferret spyware out in other ways. Most firewalls can alert you when a program seeks to access the Internet, stopping spyware that e-mails data about you. And SpyCop ($50) is one of the few tools that scans specifically for all commercial snoopware applications.

But let's face it: Antivirus programs are the only protection that many PC users have. Shouldn't the creators of these programs make their shields as strong and complete as possible?

Andrew Brandt is senior associate editor for PC World. Click here for more Privacy Watch columns.