Editing Spyware (section)

===How anti-spyware software works===
Anti-spyware programs can combat spyware in two ways:
# They can provide [[Real time protection|real-time protection]] in a manner similar to that of [[Anti virus|anti-virus]] protection: all incoming [[computer network|network]] data is scanned for spyware, and any detected threats are blocked.
# Anti-spyware software programs can be used solely for detection and removal of spyware software that has already been installed into the computer. This kind of anti-spyware can often be set to scan on a regular schedule.
Such programs inspect the contents of the [[Windows registry]], [[operating system]] files, and [[software|installed programs]], and remove files and entries which match a list of known spyware. Real-time protection from spyware works identically to real-time anti-virus protection: the software scans disk files at download time, and blocks the activity of components known to represent spyware.
In some cases, it may also intercept attempts to install start-up items or to modify browser settings. Earlier versions of anti-spyware programs focused chiefly on detection and removal. Javacool Software's [[SpywareBlaster]], one of the first to offer real-time protection, blocked the installation of [[ActiveX]]-based spyware.

Like most anti-virus software, many anti-spyware/adware tools require a frequently updated database of threats. As new spyware programs are released, anti-spyware developers discover and evaluate them, adding to the list of known spyware, which allows the software to detect and remove new spyware. As a result, anti-spyware software is of limited usefulness without regular updates. Updates may be installed automatically or manually.

A popular generic spyware removal tool used by those that requires a certain degree of expertise is [[HijackThis]], which scans certain areas of the Windows OS where spyware often resides and presents a list with items to delete manually. As most of the items are legitimate windows files/registry entries it is advised for those who are less knowledgeable on this subject to post a HijackThis log on the numerous antispyware sites and let the experts decide what to delete.

If a spyware program is not blocked and manages to get itself installed, it may resist attempts to terminate or uninstall it. Some programs work in pairs: when an anti-spyware scanner (or the user) terminates one running process, the other one respawns the killed program. Likewise, some spyware will detect attempts to remove registry keys and immediately add them again. Usually, booting the infected computer in [[safe mode]] allows an anti-spyware program a better chance of removing persistent spyware. Killing the process tree may also work.