Does MySpace install spyware or adware on computers?

MySpace itself doesn't install any nefarious software onto your computer, no viruses, spyware, adware, or anything else, but there was a recent incident with an advertiser on MySpace who was surreptitiously installing spyware on the computers of people who viewed the advert, obviously something that's not at all good!

The Washington Post has a good, understandable article about the situation entitled MySpace Ad Served Adware to Millions, in which it explains that the advertisement was for the site DeckOutYourDeck.com (not an active link for what I hope are obvious reasons) and when you viewed it with the latest version of Internet Explorer or any non-MSIE-browser, you were prompted whether you wanted to open a file called exp.wmf.

If you had an older version of Microsoft Internet Explorer (MSIE), however, the file was opened automatically and did its nasty deed without you having a clue anything was happening. Without you knowing it, your "... machine would silently download a Trojan horse program that installs junk software in the PurityScan/ClickSpring family of adware. This stuff bombards the user with pop-up ads and tracks their Web usage. Only a little more than half of the anti-virus programs used at anti-virus testing service AV-Test.org flagged the various programs that the Trojan tried to download as malicious or suspicious."

Worse: "Using software that captures and analyzes Web traffic, La Pilla found that the installation program contacted a Russian-language Web server in Turkey that tracks how many times the program was installed, presumably because most of this adware is installed by third parties who get paid for each installation. The data there indicate that the adware was installed on 1.07 million computers, La Pilla said, adding that all seven of the Internet addresses contacted by the downloader Trojan appear to be inactive at this time."

When asked about this advert and its negative impact on users, Hemanshu Nigam, head of security at MySpace, responded:

"This is a criminal act. This ad is being delivered by ad networks who distribute these ads to over a thousand sites across the Internet in addition to ours. We are working to have these ad networks remove this ad so that they do not appear on our site. At the same time we strongly urge all Internet users to follow basic Internet security practices such as running the latest version of the Windows operating system, installing the latest Windows security patches, and running the latest anti-spyware and anti-adware software. If users have applied the simple patch available from Microsoft.com, they will not be vulnerable to this criminal act."

Finally, don't just sit there reading this, pop over to Microsoft and make sure you have the very latest version of MSIE -- and Windows, for that matter -- so you aren't vulnerable to this sort of attack!

• Windows MSIE 7.0 Download Center
• Windows MSIE 6.0 Download Center

Note that if you are still running MSIE6, you might well want to download MSIE 7 beta, which is pretty darn stable and a huge improvement in terms of both interface and security features. Or chuck the whole lot and switch to Firefox instead.

Oh, and if you are surfing the web - which you're obviously doing since you're here on my site! -- then you must have both a solid antivirus solution and anti-spyware solution. I recommend AVG Antivirus for the former and Spy Sweeper for the latter.