Although some computer users may actively seek pirated software in hopes of saving money, the chances of infection by unexpected malware are one in three for consumers and three in 10 for businesses, according to a new study commissioned by Microsoft Corp. and conducted by IDC. As a result of these infections, the research shows that consumers will spend 1.5 billion hours and US$22 billion identifying, repairing and recovering from the impact of malware, while global enterprises will spend US$114 billion to deal with the impact of a malware-induced cyberattack.

The global study analyzed 270 websites and peer-to-peer networks, 108 software downloads, and 155 CDs or DVDs, and it interviewed 2,077 consumers and 258 IT managers or chief information officers in Brazil, China, Germany, India, Mexico, Poland, Russia, Thailand, the United Kingdom and the United States. Researchers found that of counterfeit software that does not come with the computer, 45 percent comes from the Internet, and 78 percent of this software downloaded from websites or peer-to-peer networks included some type of spyware, while 36 percent contained Trojans and adware.

“The cybercrime reality is that counterfeiters are tampering with the software code and lacing it with malware,” said David Finn, associate general counsel in the Microsoft Cybercrime Center. “Some of this malware records a person’s every keystroke — allowing cybercriminals to steal a victim’s personal and financial information — or remotely switches on an infected computer’s microphone and video camera, giving cybercriminals eyes and ears in boardrooms and living rooms. The best way to secure yourself and your property from these malware threats when you buy a computer is to demand genuine software.”

The IDC study, titled “The Dangerous World of Counterfeit and Pirated Software,” was released today as part of Microsoft’s “Play It Safe” campaign, a global initiative to bring awareness to issues related to software piracy.

“Our research is unequivocal: Inherent dangers lurk for consumers and businesses that take a chance on counterfeit software,” said John Gantz, chief researcher at IDC. “Some people choose counterfeit to save money, but this ‘ride-along’ malware ends up putting a financial and emotional strain on both the enterprise and casual computer users alike.”

The following are among the highlights from the consumer survey:

•  Sixty-four percent of the people respondents knew who had used counterfeit software experienced security issues.

•  Forty-five percent of the time, counterfeit software slowed their PCs, and the software had to be uninstalled.

•  Forty-eight percent of respondents noted that their greatest concern with using counterfeit software was data loss.

•  Twenty-nine percent were most concerned with identity theft.

Embedding counterfeit software with dangerous malware is a new method for criminals to prey on computer users who are unaware of the potential danger.

The IDC white paper also explored the surprising level of end-user software installations made on corporate computers, exposing another method for the introduction of unsecure software into the workplace ecosystem. Although 38 percent of IT managers acknowledge that it happens, 57 percent of workers admit they install personal software onto employer-owned computers. What is alarming is that respondents told IDC that only 30 percent of the software they installed on their work computers was problem-free. Sixty-five percent of IT managers agree that user-installed software increases an organization’s security risks. For many in the enterprise, user-installed software may be a blind spot in ensuring a secure network.

Customers are encouraged to visit http://www.microsoft.com/security to learn about malware and ensure their machines are not infected; if malware is present, the site offers tools to remove the infection. Customers shopping for new computers are encouraged to buy from a reputable source to ensure they are receiving genuine Microsoft software.

More information about the IDC study is available at the Microsoft Play It Safe website, http://www.play-it-safe.net, and newsroom, http://www.microsoft.com/news/ipcrimes.