The Anti-virus Times

Thursday, July 13, 2023

If in the digital world there existed only useful and safe programs on the one hand and unequivocally malicious programs on the other hand, virus analysts, anti-virus companies and, of course, users themselves would have a much easier life. In reality, however, there exists a whole layer of non-malicious software that nonetheless, directly or indirectly, affects the security of computer devices. Our specialists study such software: after all, the task of a comprehensive anti-virus product is to reliably protect a user's digital environment. Many of our readers probably know that different developers of anti-virus solutions have their own classification systems for programs, and their threat detection routines operate according to those systems. Doctor Web, for example, considers unwanted software, potentially dangerous software, and adware to be on par with malware and puts them into separate categories.

Users often ask us how the Dr.Web anti-virus reacts to a certain program. In this Anti-virus Times issue, we will talk about programs that we define as unwanted, the threat they pose, and how to independently keep your operating system virus free and working normally.

According to the Doctor Web classification system, unwanted software refers to a large group of programs that have different functionality and in one way or another can do harm to users when in operation. Although such programs do not contain malicious code, they can negatively affect the security and stability of computer performance. Instances of such software are most often found among utilities for configuring and optimising an operating system, various application directories, programs for finding and installing drivers and updates, and some browsers and torrent clients. And here we have to make an important remark: of course, not all such programs are unwanted. Dr.Web detects only those instances that have the corresponding features. Let's recall the most important of them.

The first thing to note is the distribution model for unwanted software. Often such programs are installed on a computer covertly or through deception. Note that we are not talking about so-called hidden installation — this behaviour is typical for malware. Unwanted software is usually added to a system along with other programs from a single "bundle" — a distribution that installs not only the required program, but also an unwanted addition. In this case, the distinguishing feature is the intentional misleading of the user. Thus, the installation of additional programs is performed by default, and the custom installation options are made as invisible as possible.

As for functionality, these programs can change the settings of the operating system, display misleading notifications and ads, and install other software within the framework of affiliate programs. To better understand the nature of unwanted software, imagine such a situation: A user searches on the Internet for a driver for their device. A site from which the required file can allegedly be downloaded appears among the search results. While following the link, the user clicks on a big "Download" button. Instead of the needed driver, a third-party driver manager is downloaded, and it, in turn, installs a couple extra programs on the computer during the installation process, while simultaneously displaying ads. As a result, instead of having their problem solved, the user gets a set of unnecessary applications that shower them with notifications, offer paid versions for purchase, and interfere with their computer’s normal operation. With this approach, the operating system will quickly overflow with "garbage" and can become slow and unstable.

As you have probably guessed, unwanted software tracks closely with annoying promotions, ads, covertly installed third-party programs, and dubious functionality. However, even more dangerous programs exist. Some operating system optimisation utilities can inadvertently damage Windows’ integrity by deleting necessary files, restore points, and registry keys, thereby disrupting the operation of some programs or the OS itself. A similar threat is posed by application catalogues and utilities for searching for and installing drivers. Applications and drivers installed in this way can be outdated and have vulnerabilities that pose a danger to a device, especially when it lacks the protection of a comprehensive anti-virus. And that’s not to mention the fact that program "search engines" can invisibly install unnecessary software within the framework of affiliate programs — this is how developers monetise their work.

How then can you make sense of the variety of programs and protect against the installation of unnecessary programs? The easiest way is to use the Dr.Web anti-virus. Our analysts are constantly replenishing its virus databases, including with samples of unwanted software. But knowing how to maintain file order on your own is also useful. Below you can find some tips and recommendations in this regard.

In conclusion, we want to note that modern-day information security has many aspects and goes far beyond the detection of malicious files. Therefore, Doctor Web's anti-virus solutions implement complete and reliable algorithms that protect users from various types of threats; this includes detecting unwanted software.