Anti-Spyware programs match patterns of internet activity, files, and settings to Detect Spyware

Spyware programs have can be traced by a number of patterns that Anti-Spyware programs look at. Anti-Spyware programs will commonly look at patterns of internet activity, processes running, files installed, and settings on your computer.

Spyware will use certain ports and internet sites to report back information to their controllers. Anti-Spyware programs will observe such activity and find the programs that are responsible for said activity and delete them. Spyware programs also create so called hidden processes, which are not visible to the user directly through common methods. Anti-Spyware programs will mark these for cleanup as well.

Spyware programs distribute and run certain files that can be identified by a binary signature or "sum" or name that is common to these files. These files are typically program or settings files that spyware will use to do its harm. Anti-Spyware programs will identify these files for removal as well.

Spyware programs also have characteristic settings in your registry or files as well. These programs will create new registry entries for themselves like all other windows based programs that can be detected. Also many spyware programs change a number of registry entries without your knowledge or control. Eg, Hijackware will change the your home and search page settings to a site that they are pushing for advertisers. This is just one example of many of the malicious changes spyware will make to your registry.