Stopping Spyware at the Source

Both DirectRevenue and Zango said they had changed their practices but that the approaches they used during the periods covered by the cases were legal.

The FTC campaign "will disrupt the economic benefit of advertising with spyware," said Alex Eckelberry, president of Sunbelt Software, a security software company in Clearwater, Fla. "You cut off the money supply, and these guys are toast."

Leibowitz said some advertisers don't know they are part of a spyware campaign because they assume, or are given assurances, that consumers will get conspicuous disclosure about the software installation and will have to consent before it is downloaded.

Because adware distributors often use affiliates that are paid by the click, they have an incentive to get their programs running on as many computers as possible.

"Internet advertising is a maze of twisty passages, with lots of middlemen who cover their tracks," said David Methvin, chief technology officer for PC Pitstop, a company that helps people test and tune their computers.

Computer security experts said the spyware problem is diminishing as a result of FTC enforcement actions, the New York inquiry and security fixes developed by Microsoft.

"We have seen a change in how adware companies notify people when they sign up for software, and they limit their distributors," said Ari Schwartz, deputy director of the Center for Democracy and Technology, a nonprofit advocacy group in the District that has done extensive research on the issue.

Reputable companies that care about their brands have backed away from online advertising that elicits hostile reactions from consumers, Methvin said. "What is left is a 'distilled essence of fraud' fueled by small companies that continue to advertise aggressively."

There is no specific federal law aimed at spyware, Schwartz said, though 17 states have adopted statutes. Trade groups such as the New York-based Direct Marketing Association also have issued guidelines for marketers, which insist that consumers be given clear and conspicuous notice, identification of the software and an easy way to uninstall it.

Cindy Skrzycki is a regulatory columnist for Bloomberg News. She can be reached atcskrzycki@bloomberg.net.