Wu, M.-W.M.-W.WuHuang, Y.Y.HuangWang, Y.-M.Y.-M.WangSY-YEN KUO2020-06-112020-06-112006https://scholars.lib.ntu.edu.tw/handle/123456789/500943Spyware, a type of potentially unwanted programs (PUPs), has become a significant threat to most Internet users as it introduces serious privacy disclosure and potential security breach to the systems. Current anti-spyware tools use signatures to detect spyware programs. Over time, spyware programs have grown more resilient to this technique; they utilize critical areas of the system to survive reboots and set up mini-installers that re-install a spyware program after it's been detected and removed. Since existing anti-spyware tools are stateless in the sense that they do not remember and monitor the spyware programs that were removed, they fail to permanently remove these self-healing spyware programs. This paper proposes STARS (Stateful Threat-Aware Removal System): a tool that at run time intercepts critical system accesses and assures removed spyware does not re-install itself after a successful removal of spyware program in the system. If a re-installation (self-healing) is detected, STARS infers the source of such activities and discovers additional "suspicious" programs. Experimental results show that STARS is effective in removing self-healing spyware programs that existing anti-spyware tools fail to do. © 2006 IEEE.[SDGs]SDG16Anti-spyware tools; Privacy disclosure; Spyware detection; Electronic document identification systems; Internet; Security systems; Computer crimeconference paper10.1109/PRDC.2006.152-s2.0-40349106306https://www.scopus.com/inward/record.uri?eid=2-s2.0-40349106306&doi=10.1109%2fPRDC.2006.15&partnerID=40&md5=63d97af46fa70d7d005bf3a006d0a264