Baidu - founded in 2000 and commanding roughly 60 per cent of the mainland's search-engine market - and Yahoo China, the other giant in the field, stand accused in lawsuits of routinely using spyware - a type of software that installs itself surreptitiously on users' PCs - to drive users to their sites and boost their market share. Although spyware is a legal grey area in China, its rampant use has turned Web surfing into a supremely frustrating experience. Often described interchangeably by such terms as adware and malware (malicious software designed to infiltrate computers), spyware can be used to steal information, hijack websites, cause pop-up ads to appear, open unsolicited advertising links, spread Trojan Horse viruses or just send back information to its designer about what you are looking at on the Web. And because spyware is associated with such illegal activities as identity theft, it may be undermining consumer confidence in the Web.

'Complaints are common in China as the search-engine market is still in the early stages [of development] and consumer rights are weaker than in the US,' says Liu Bin, a new-media analyst at Beijing-based consultancy BDA.

The reason such software is proliferating around the globe is simple: profit. The more clicks an advertising link receives, or the more computers are 'tricked' into opening certain websites, the more money search-engine companies and the websites hosting advertising links stand to make.

Some kinds of spyware are more benign than others and major multinationals are reputed to use adware simply to find out more about their customers. Michael Gazeley, Hong Kong managing director of online security firm Network Box, says toymakers, for example, can use adware to see what webpages children are reading and to predict upcoming toy trends.

But industry experts say companies on the mainland are going further. At internet cafes - where most of the country's 123 million 'netizens' go online - search-engine firms have usually paid proprietors to install software so that when a user logs on, they are diverted via the search engine to an advertiser's webpage. This generates frustration for the user and a few extra yuan for the search engine.

Although there are no reliable figures on the percentage of mainland computers infected with spyware, experts agree that few consumers are aware of it. 'Computers may slow down but owners don't know why as the Chinese are new to the internet,' says Hong Bo, editor in chief of online IT news site Donews.com. Nor are computers in Hong Kong immune.

Gazeley says these days you would be 'hard pushed to find any computer using Microsoft windows that does not have spyware on it'.

Arguably, at the top of what is now a multimillion-dollar industry on the mainland is Zhou Hongyi. Labelled by his enemies (he has many) as the 'godfather of hooligan-ware', 36-year-old Zhou is chairman of Qihoo, a search engine and bulletin-board provider.

A former president of Yahoo China, Zhou began his hi-tech career in the late 1990s, when he created 3721, a pioneering toolbar service that allowed users to input Chinese characters into their browser's address bar instead of English. It was wildly popular. Zhou claims that in 2002, 70 per cent of China's internet users had 3721.

But the toolbar became a victim of its own success. As the starting point for internet searches, it was an incredibly lucrative advertising tool and rival companies quickly began designing software that would bump 3721 off computers and replace it with toolbars of their own. The spyware wars had begun.

According to Zhou, Baidu was one of the first challengers. 'It is very difficult for users to have more than one address bar so Baidu tried to delete our software and vice versa.'

Users would turn on their computers in the morning and find their Web browser configurations had been changed. And they were often stuck with the changes; 3721 and others began designing toolbars that would not only override those of competitors but would, as hooligan-ware, be almost impossible to uninstall.

Zhou sold 3721 to Yahoo China in 2003 for US$120 million, becoming president of the latter into the bargain. He says all internet firms now use spy software. 'Baidu, Yahoo, Taobao [China's answer to eBay] ... they all use spyware. Nobody says no to spyware. Those who aren't using it are fools because they lose the benefits.'

It is a striking claim given that Jack Ma, the pugilistic head of Alibaba (which owns Yahoo China and Taobao, and which is in turn 40 per cent owned by Yahoo), often speaks about the importance of morality and fair play on the Net. But it is a claim that is unlikely to surprise consumers. In a survey carried out last year by the Beijing Internet Union, 200,000 votes ranked Yahoo China among the top 10 spyware users, alongside Baidu, eBay, 3721 and Taobao.

Replaced by Ma as head at Yahoo China, Zhou often spars with his successor. Zhou is now suing Ma for US$450,000 for defamation. And one of his recent ventures has deepened the animosity. In late July, Zhou's firm launched an anti-spyware download called 360Safe, which includes Yahoo Assistant, with its 3721 toolbar, among the spyware it disables. Zhou aims to destroy the spyware industry within two years - and make another fortune in the process.

Alibaba, an e-commerce site, rubbishes Zhou's comments and says it does not use spyware. 'We are being unfairly attacked by parties trying to advance their own interests,' says Joe Tsai, its chief financial officer.

In September, a Beijing-based group calling itself the Anti-Hooligan Software Federation (AHSF), composed of 80 lawyers, online advertisers and consumers, filed a lawsuit demanding a token 94 yuan from Yahoo China in compensation for bombarding their computers with pop-up advertisements without consent. The group maintains that Yahoo China is violating privacy and damaging computers.

Citing the Consumer Interest Protection Law, the federation has plans to sue 129 other firms, including Baidu, products and services provider Sohu and eBay, on similar grounds. 'We want an end to this behaviour,' says Dong Haiping, the group's head. 'We want them to respect rules and we want compensation.' The group is also lobbying for legal changes to make it harder for spyware companies to operate.

It is estimated that in the US, up to 30 per cent of all website clicks are fraudulent. In July, Google agreed to a US$90 million settlement in a class-action lawsuit brought against it by click-fraud firm Click Defence on behalf of advertisers saying the search-engine giant had not done enough to protect them from click fraud. The agreement, however, set a discouraging precedent for future lawsuits, says Ben Edelman, an anti-spyware lawyer currently suing Yahoo in America on behalf of US advertisers. 'Google got in return an agreement that no advertiser can sue it for click fraud dating up to the settlement, even though US$90 million is less than 1 per cent of the billions they are making.'

In India, an investigation by The Times of India discovered 'click farms', where cheap labour was being used to click repeatedly on pop-up ads to generate income for the websites that hosted them.

While the poor quality of the data on the spyware and click fraud industries reflects their innate opacity, a lack of transparency on the part of search-engine companies is also to blame. Because a better under-standing of the scale and scope of click fraud would allow advertisers to more accurately price their risks, and the fees they pay per click, it is hardly surprising search engines prefer not to address the issue.

'When faced with lawsuits, Yahoo, Google and others are very unwilling to reveal information about its prevalence, whether they are policing it adequately or even facilitating it. They are no more open than Baidu,' says Derek Bambauer, an expert on Chinese internet use at Wayne State University, in the US.

The extent of click fraud in China is equally uncertain. Mark Natkin, a Beijing-based specialist on Chinese telecoms and IT and managing director of Marbridge Consulting, says: 'It is fairly pervasive.' He says its effects are evident in 'a growing preference among advertisers to opt for a flat-rate advertising fee instead of pay per click'.

While this may help protect against click fraud, he says, it will affect search-engine revenue growth as only larger companies are able to afford flat-rate fees. Expected to total US$820 million this year, mainland advertising revenues are forecast to hit US$3.2 billion by 2010.

Zhou Rengen's suspicions were aroused when he began receiving mounting bills from Baidu. Although Baidu had recently increased the cost of a hit on Zhou's link, he says, he compensated by scaling back the number of search lists he appeared on. 'When I started with Baidu, 1,000 renminbi would last one week. But suddenly the money went faster and faster. Recently, on some days, I have spent 1,000 renminbi in one morning.'

Like the hospital director, he engaged in a little cyber-sleuthing and found that while some hits were coming from well-known websites such as Sina and Sohu, where he had asked Baidu to place his link, as well as from Baidu.com itself, some 70 per cent originated from a single source, cpro.baidu.com.

Clicking on the link also brought him to Baidu Knows, but confusingly for Zhou, the Baidu Knows webpage had no link to his website. There was no apparent way a user of the site could jump from it to his webpage.

Approaching Baidu separately with their respective complaints, Zhou and Liu were first rebuffed then offered money in return for their silence. Liu was initially offered 110,000 yuan in late June. Complaining that this was not enough, he returned to Baidu headquarters several days later to protest outside. Baidu raised its offer to 280,000 yuan, on the condition Liu publish a letter on the popular Sina website saying he was wrong to have criticised the company.

'Baidu told me the money was 'special treatment for an old client',' says Liu. 'When I asked about where the hits were coming from and whether they were defrauding me, they did not respond.'

Rejecting Baidu's offer, Liu received a letter in August from the firm's lawyers threatening legal action for defamation and reminding him he had 'disturbed social order' with his public protest. Liu says he welcomes any lawsuit brought by Baidu. After complaining, he suddenly stopped receiving hits from the cpro.baidu.com service and his bills have dropped by two-thirds. Fearing Baidu might destroy evidence, Liu and Zhou printed scores of webpages detailing the links between their sites and Baidu Knows.

Zhou's lawyer, Zhang Xinwei, is also a Baidu client and says the company offered him a secret deal involving preferential services when he first raised concerns about its services. Zhang says that when he mentioned this deal to the Chinese media, Baidu asked other websites not to publish the story. Baidu is now suing Zhang for publicly discussing the deal.

Baidu has refused to comment on the status of cpro.baidu.com, instead issuing a statement saying: 'Baidu places the highest priority on preventing fraudulent clicks ... [and] we believe our anti-fraudulent clicks measures have been working.'

Although Baidu's apparent offer of 'hush money' seems damning, the finger of blame may in fact point elsewhere. Liu says that while Baidu may be behind the alleged fraud, the culprit could also be Baidu's network of outsourced sales agents. Splitting revenue with Baidu, it is in the agents' interest to see the websites of the advertisers they sign up clicked on as often as possible. Using a spyware device, says Liu, it would be easy to register a visit to a site such as Baidu Knows as a hit on an advertiser's website. The agent through which Zhou signed up to Baidu said his firm no longer worked with Baidu but would say no more.

Despite the question marks hanging over the behaviour of search-engine companies, apportioning blame in the cases of Zhou and Liu will not be easy. Existing laws are vague, judges' knowledge of cybercrime is sketchy and proving any wrongdoing will be tricky. 'They will need affirmative, direct proof that the website they saw was the same when the click was made to their site,' says Edelman.

It is unclear how many similar cases there are involving the clients of the mainland's search engines or the damage such claims are doing to Baidu's image but changes are taking place. After consultations with the AHSF, the Ministry of Information Industry has said it will start to blacklist malware manufacturers and distributors. Dong is upbeat. 'I had not expected the government to pay much attention to the issue but now we are discussing ... defining spyware.'

However, attempts to define and legislate against spyware at a state level in the US have so far failed, say anti-spyware campaigners.

'They call it an anti-spyware law but you might call it a pro-spyware law,' says Edelman of such an initiative, adding that in the US, search companies including Yahoo have lobbied strongly to water down legislation. One of the problems is defining spyware without impinging on legitimate downloaded software and data collection libraries.

In Hong Kong, efforts to legislate against spyware have faced similar hurdles. The Hong Kong Computer Emergency Response Team, which is responsible for monitoring spyware, says its focus is on education. 'We are doing a lot of education to the public to read user agreements before installing ... software,' says S.C. Leung, the team's senior consultant.

While enhanced vigilance on the part of PC users may offer a way forward, the options for firms that want to advertise online are increasingly unattractive.

Liu Wenhua: 'I have to keep using [Baidu] as they are important to my business. But I am very disappointed. They are supposed to be a model Chinese company.'

Glossary

Click fraud: clicking online advertising links with ill intent. Advertisers tend to sign with big names such as Yahoo or Google, but their links will often be posted on hundreds of websites. These sites split click revenue with the original host, making it in their interest to see a link clicked multiple times. Firms hoping to drain a competitor's advertising budget could also use click fraud.

Pay per click: an advertiser pays the search-engine company an agreed amount every time their link is clicked. It has been hailed as a breakthrough in advertising as it allows companies to target specific market segments and, in theory, not have to pay unless someone genuinely interested in them opens their webpage.

Adware: adware is being increasingly used by companies. Often PC users download it consentingly when they click on a user-agreement form (who reads the small print?) to download an unrelated product or upgrade. Once installed on your computer, adware will send back information to its designer about what you are looking at online, thereby helping to target potential customers and spot market trends.

Malware: software surreptitiously downloaded then used to damage or disable computer systems. Malware is usually hidden inside software and downloaded without the user's consent.