1. A method, comprising: monitoring, with a user device, whether at least one process operating as software on the user device performs a transmission from the user device on a network; monitoring whether the at least one process performs a user update by at least one of invoking a routine to draw on a display or sending output signals for a speaker; and selecting the at least one process as a spyware candidate if the at least one process performs the transmission from the user device on the network but does not perform the user update.