how spy comes in

Hi,

i was wondering how spyware get into win xp even the user do not have admin rights(power user). anyone have any idea?

you dont need admin rights to install things like that. They are designed to install using flaws in the system or run without -really- being installed on the system. Many reside as cookies in temp folders which all users have access to writing in, so as long as he can get online he can get spyware. Same thing goes with viruisis.

they get in when you visit perticular web sites who use cookies to moniter there experience with you. A lot of web site use cookies some for valid purposes some for tracking information about you such as your surfing habits.
they also come in with software program that you download for free you get the free download but at the same time another program is downloaded on to your computer. Fortunately there are now ways for you to detect that the other program is there, and ways to get rid of it.
Spywares are getting sophisticated with time, they can monitor your keystrokes.

All this information is useful to the global marketers who can then target the sort of junk mail they send you, or to Web advertisers who can place appropriate advertisements on Web pages you visit.

That is all........ you are using internet as any user be it admin or guest you download files or surf a few sex sites and get spywares they don't have to do with type of user surfing just your computers privacy setting if you allow cookies they will be installed by any web site.

XTC46 has a good point, they work on very similar principles to viruses. You can get them from websites, e-mail, P2P, and there may even be network aware ones. You might like to look on them as "infections" rather than installations.

Another classic source is from downloaded "trojan" programs. Some of these do not require installation as such, and load spyware as well as the "nice utility" you thought you had downloaded.

A screensaver might be a good example. All you download is a file (.scr), but it is an EXECUTABLE............as screensavers are a standard feature of Windows, the user can then run this executable without requiring any special authority. If it also contains spyware...............

There is a big difference between having the authority to install an application and just downloading and running an executable file, or opening an executable in your e-mail or P2P.

For that reason a lot of corporate environments do not allow P2P applications and scan e-mails for executables, which are quarantined or deleted.

You have to bear in mind that there is a balance between protecting your systems from its users, and allowing them to do their jobs. Sometimes it is a very fine balance.

Hope that helps :)