EarthLink and Webroot Release Six-Month SpyAudit Report
CoolWebSearch Identified as the Most Virulent Adware Program

ATLANTA and BOULDER, Colo., Aug. 4, 2004—Today EarthLink (NASDAQ: ELNK), one of the nation’s leading Internet service providers, and Webroot Software, a producer of award-winning privacy, protection and performance software, released their third SpyAudit Report, which has tracked the growth of spyware on consumer PCs for the first half of 2004.

Since the SpyAudit report’s inception on January 1, 2004, more than two million scans have been performed. The scans discovered approximately 54.8 million instances of spyware, for an average of 26.5 traces per SpyAudit scan. Scans nearly doubled from the first to the second quarter. For each category, the instances of adware increased month-over-month, while adware cookies, system monitors and Trojans decreased slightly overall. The complete report is available at

"As the saying goes, big things come in small packages — and EarthLink’s SpyAudit application, which is small and easy to run, has enabled millions of consumers to find the spies that reside on their PCs," stated Matt Cobb, EarthLink’s vice president of core applications. "SpyAudit helps a consumer identify threats to their machines so they can take action and continue to enjoy all that the Internet has to offer."

Cobb also stressed that not all Internet applications and files are classified as spyware. The majority of Internet-related programs help improve a consumer’s Internet experience.

More on Adware
Webroot defines adware as any advertising-supported software application that has the ability to display pop-up, pop-under, and banner advertisements on your computer. Some adware may track your Web surfing habits. COAST, the consortium of anti-spyware technology vendors,, has documented that adware can slow your Web browser’s performance, and in a worst-case scenario, may have the ability to download third-party software programs on your computer without your knowledge or consent.

Webroot’s research team found that CoolWebSearch (CWS) is a particularly virulent form of adware and one of the top adware threats found on the Web. Analysis shows that CWS is the most defiant threat in current existence, and the anti-spyware company has identified and written definitions for close to 100 CWS variations, each one more complex to remove than the last.

"The increased prevalence of adware in the report is concerning, and consumers should know that not all adware is harmless or benign," said David Moll, Webroot’s CEO. "Some of the most notorious programs in the spyware family are classified as adware."

"CoolWebSearch is a nasty example of adware that hijacks homepages and Web searches, triggers a crippling amount of pop-ups, and changes a user’s browser settings," added Moll.

CWS’s most common exploit is to hijack a user’s homepage and direct it to a paying client’s Web site. Particularly damaging CWS variants can:

  • Pop-up so many ads that a computer locks up or crashes.
  • Add pornography links to a favorites list.
  • Change a consumer’s browser settings.
  • Deposit large numbers of files throughout a PC’s system, which quickly reduces performance.

CWS has the ability to modify itself, so finding and removing it is an ongoing challenge for consumers. Once CWS is discovered by an anti-spyware application, such as EarthLink’s Spyware Blocker, powered by Webroot, Internet users should take action to immobilize or erase the program from their PCs.

The results from the SpyAudit report are culled from EarthLink and Webroot’s SpyAudit detection programs that run analyses of Internet users PCs and provide audited reports of spyware residing on the machines. The SpyAudit report charts the overall number of scans and figures for each of the defined spyware categories from January 1, 2004 to June 30, 2004.

To further inform consumers about the dangers of spyware, EarthLink and Webroot offer SpyAudit, a free-of-charge spyware detection program. SpyAudit provides a fast, detailed report in minutes and is available to all Internet users at or

Overall Results
The information below depicts the quarterly growth, the running six-month total number of scans, instances of spyware found per scan, and an average of spy instances per scan, along with a categorical breakdown of spyware installations.

Overall ResultsFirst QuarterSecond QuarterSix-month Total (Jan. 1–June 30, 2004)
SpyAudit Scans703,0021,368,7752,071,777
Spyware Instances Found18,611,34436,203,21954,814,563
Average Instances of Spyware Found per Scan26.526.526.5
Spyware Installations by Category
Adware Cookie14,799,87427,868,76742,668,641
System Monitor122,553210,256332,809

Monthly ResultsMayJuneSix-month Total (Jan. 1–June 30, 2004)
SpyAudit Scans443,382504,6322,071,777
Spyware Instances Found11,765,24113,132,50754,814,563
Average Instances of Spyware Found per Scan26.626.026.5
Spyware Installations by Category
Adware Cookie8,989,81710,005,39542,668,641
System Monitor75,11574,268332,809

Webroot Software, a privately held company based in Boulder, Colorado, creates innovative privacy, protection and performance products and services for millions of users around the world, ranging from enterprises, Internet service providers, government agencies and higher education institutions, to small businesses and individuals. The company provides a suite of high-quality, easy-to-use software that guides and empowers consumers as they surf the Web, protecting personal information and returning control over computing environments. Webroot’s software consistently receives top ratings and recommendations by respected third-party media and product reviewers. In addition to buying these products online at, Webroot products are found on the shelves of leading retailers around the world, including: Best Buy, CompUSA, Circuit City, Fry’s, Staples and MicroCenter. To find out more about Webroot, visit or call 1-800-772-9383.

# # #