University of Washington computer scientists sampled more than 20 million Internet sites looking for programs that can covertly enter computers. While most spyware can be a nuisance—generating pop-ups, loading unwanted programs—it can also perform such malicious tasks as gathering personal data or using your modem to dial costly toll numbers.

The study examined popular categories of Web sites including games, news and celebrity sites. Among the findings:

* More 5 percent of executable files contain piggybacked spyware.
* One in 62 Internet domains performs "drive-by download attacks" to force spyware on users who simply visit the site.
* Game and celebrity Web sites appeared to pose the greatest risk for piggybacked spyware, while sites that offer pirated software topped the list for drive-by attacks.

"For unsuspecting users, spyware has become the most 'popular' download on the Internet," said Hank Levy at the university's Department of Computer Science & Engineering.

There is some good news:

The study employed a Web crawler to visit sites and look for spyware. It made two crawls, in May and October last year, and noted a 93 percent reduction in drive-by download attacks. That may be because more people are using anti-spyware tools and employing automated patch programs such as Windows Update. Also, civil lawsuits have been brought against spyware distributors.

Most spyware is relatively benign but can inundate a victim with pop-up advertisements. More malicious programs steal passwords and financial information. In a worst-case scenario, spyware can render a computer useless.

"You should download software only from reputable sources," said University of Washington associate professor Steven Gribble. "And it's a good idea to avoid the more shady areas of the Web."

The research is being presented today at the 13th Annual Network and Distributed System Security Symposium in San Diego.

OSLO, Norway (AP) _ Many American online computer users are unaware that choice of browser affects Internet security, and few switch browsers even when they know the risk, a Norwegian study said Monday.

The Oslo-based browser-maker Opera Software ASA, which touts its own browser as being one of the most secure, released a survey of 2,835 online users in the United States, which indicated that only 51 percent of what it called the "adult online population'' were aware that the type of browser can affect a computer's vulnerability to malicious software, such as viruses and spyware.

The poll, first released to The Associated Press, also showed that only 11 percent of those asked said they had switched browsers for security reasons. The survey was conducted in March 25-29 by the Harris Interactive polling group and had a margin of error of about 5 percentage points.

Malicious software often targets a specific type of browser, and generally those that are the most widely used. The poll said that 49 percent of those asked did not know that their choice of browser can make a difference, including 17 percent who thought it had no effect.

Although a small percentage said they had switched browsers for security reasons, 66 percent said they would consider a change if it would improve security.

"Changing to a more secure browser is one of the simplest ways for Web users to make surfing safer and minimize the risk of falling victim to virus, spyware or 'phishing' attacks,'' said Opera's chief technical officer Haakon Wium Lie, referring to various techniques of tricking Internet users to hand over personal information, such as credit card numbers and passwords.

The tiny Norwegian browser company claimed that Internet security upgrades were a key part of its Opera 8 version, released last month. Among the features is a special window that rates the security of the page visited on a scale of one to three.

Opera commands less than 0.2 percent of the Windows market, far behind the industry leading Internet Explorer from Microsoft Corp. and various open-source browsers, such as Mozilla Firefox.

Marc Hassinger, spokesperson for business and finance communications at BMW Deutschland, said the BMW.de doorway pages only redirected users to relevant pages - for example, one doorway page that frequently used the German word for “used car” redirected users to a page about BMW used car sales. He said this was done so that German web users searching for a second-hand BMW car dealership would find an index of dealerships around the country.

“We can’t see a ‘manipulation’ which they said was happening regarding those websites,” Mr Hassinger said.

Matt Cutts, a software engineer at Google, wrote last month in his weblog that the company would begin to take a tougher line on web spamming by non-English language websites.

On Saturday Mr Cutts wrote that BMW.de had been removed, for violating the guideline: “Don’t deceive your users or present different content to search engines than you display to users.”

However Mr Hassinger said the “doorway” pages had been removed last Thursday after BMW noticed criticism on some blogs.

“Nevertheless Google has decided to spread this information which has created this, I’d almost say, media hype,” he said. “They spread it on Saturday, a few days after the pages had been taken off. They hadn’t talked to us beforehand which we found a bit surprising.”

He said there had been talks between BMW and Google and that he was confident the website would soon be re-included by Google.

Mr Hassinger added that only 0.4 per cent of BMW.de’s traffic came from search engines such as Google, because most people wanting to visit the site either knew or could guess the correct address.

Mr Cutts also wrote on his blog that Ricoh.de, the German website of the Japanese electronics and office equipment company, would be removed from Google for similar reasons. The website could not be found on a Google search on Monday, but Google’s spokeswoman said she could not comment on whether that site had also been removed.