Spybot - Search & Destroy · Spybot - Search & Destroy can detect and remove spyware of different kinds from your computer. Spyware is a relatively new kind of threat that common

DescriptionSpybot-Search&Destroycandetectandremovespywareofdifferentkindsfromyourcomputer.Spywareisarelativelynewkindofthreatthatcommonanti-virusapplicationsdonotcoveryet.IfyouseenewtoolbarsinyourInternetExplorerthatyoudidn'tintentionallyinstall,ifyourbrowsercrashes,orifyoubrowserstartpagehaschangedwithoutyourknowing,youmostprobablyhavespyware.Butevenifyoudon'tseeanything,youmaybeinfected,becausemoreandmorespywareisemergingthatissilentlytrackingyoursurfingbehaviourtocreateamarketingprofileofyouthatwillbesoldtoadvertisementcompanies.Spybot-S&D;isfree,sothere'snoharmintryingtoseeifsomethingsnoopedintoyourcomputer,too:)

Spybot-S&D;canalsocleanusagetracks,aninterestingfunctionifyoushareyourcomputerwithotherusersanddon'twantthemtoseewhatyouworkedon.Andforprofessionalusers,itallowstofixsomeregistryinconsistenciesandofferssomeextendedreportingfeatures.

LicenseSpybot-S&D;comesundertheDedicationPublicLicense.

Requirements

MicrosoftWindows95,98,ME,NT,2000orXP(32and64bit),2003,Vista.CompatiblewithbootablePEdisks(e.g.BartPE)andWine.Minimumof10MBfreeharddiskspace,morerecommendedforupdatesandbackups.

UsageWerecommendthatyoucontinuebyreadingthetutorialnext.

©2000-2008SaferNetworkingLtd.Allrightsreserved.

I.FreewareFirstofall,thereasonswhySpybot-S&D;isfree:

I.a.DedicationSpybot-S&D;isdedicatedtothemostwonderfulgirlonearth:)

I.b.BinaryWhatdoyougetifyoubuysoftware?Lotsofonesandzeros,nothingmore.Iftheyweredistributedasart,Icouldunderstandpayingforit.Butifthemaingoaloftheirorderistoearnmoney-byfeesorads-Idonotlikeit!

I.c.ConclusionThismeansthatIgrantyouthelicensetouseSpybot-S&D;asmuchasyoulike.Butifyoulikeit,Iasktwothingsofyou:sayaprayerforme(andthemostwonderfulgirlwhileyouareatit;))toyourgod-orwhateveryoubelieve-andwishussomeluck.

II.Limitations

II.a.ReverseEngineeringReverseEngineeringisnotallowedaswithnearlyanysoftware.Ifanyonehasdoubtsinthehonestyofthecode,Iwillgiveinsighttoatrustedorganizationlikeauniversityundercertainlimitations(forexampleonlyonecopy,foralimitedtime,andthathastoberemovedaftertheevaluationtimehasended).

II.b.WarrantyItriedmyverybesttomakethecodeofSpybot-S&D;asstableaspossible,andIgiveyouthewarrantythatIplacednocodetocauseintentionalharmtoyoursystem.However,removingthethreatstargetedbySpybot-S&D;sometimesinvolvescuttingdeepintothesystemsometimes,andIcannotguaranteethatyoursystemwillberunningthesameasbefore.Forexample,spywarehostsmaystopworking.NeithercanIgiveyouanywarrantythatSpybot-S&D;willremoveeveryspyonyoursystem,orthatitwillgiveyounofalsepositives.Foryourownverificationthelocationoftheproblemisshownwithevery

entry,andifyouhaveanyquestionsremainingyoucanvisitthesupportforumformoreinformation.

II.c.LiabilityUndernocircumstancescanyoumakemeliableforanydamage,howevercaused,including,butnotlimitedtodamageyoumightdotoyoursystemusingSpybot-S&D.;

II.d.UseofapplicationinwholeFreeuseislimitedtotheapplicationinwhole.Usageofpartsonly,forexamplethedatabaseortheplug-ins,isnotpermitted.

II.e.CorporateuseAscompaniesarenotindividualpersonsandwouldhaveproblemsfullfillingtheaboveterms,thereisalicenseforcorporateusersthatcanbefoundatsafer-networking.ie(onlinelink).

III.DistributionHerearesomebasicrulesaboutdistributingSpybot-S&D.;

III.a.PrivatedistributionYoumaygiveawaysinglecopiesofthesoftwareaslongasyoudonotmodifythislicenseorotherfilesofthearchive.

III.b.MirroringIfyouwanttomirrorSpybot-S&D;,feelfreetodosoaslongasyoudonotmodifytheoriginalarchive.Ifyouwanttobekeptuptodateaboutmajorupdates,youcansubscribetothemailinglist.OfficialmirrorsneedtofulfilltheMirrorPolicy(onlinelink).

III.c.PublishingYoumaypublishSpybot-S&D;inabookormagazine(orothermedia)bysimplysendingawrittenrequestforpermission,includingadescriptionofyourspecificneeds.IrequestacopyofthemediainwhichSpybot-S&D;ispublishedascompensation.

IV.Privacy

IV.a.Applicationofflineprivacy

http://www.safer-networking.ie

http://www.safer-networking.org/en/mirrorpolicy/index.html

EventhoughSpybot-S&D;scansyoursystem,itwillnotsearchspecificallyforanypersonallyidentifiableinformation.Everythingthatisnotdetectedasapossiblethreatwillbeignored.Possiblethreatswillbeshownand,iflogoptionsareswitchedon,writtentoalocallogfile.

IV.b.ApplicationonlineprivacySpybot-S&D;hasonlinefunctionalityin5cases:1.Update:TheUpdatefunctionnowusesanftp-protocoltodownloadaninfofilecontainingupdatedescriptions(thisiscalledspybotsd.ini,anditwillnotbedeleted,soyoucanlookatit)andtodownloadtheupdatefilesyouselect.Noinformationotherthanthoseyourbrowserwouldalsoshowwillbetransmitted.2.News:Onthewebsite(onlinelink)ofSpybot-S&D;youwillfindtheNewssection.HereyoucanreadaboutthemostimportantnewsallaroundSpybot-S&D.;3.BugReport:Thebugreportfunctionsendstheproblemdescriptionyouenterandanautomaticallycreatedreporttooursupportstaff.Youcanmodifytheextentofthereportonthesettingspage,andyoucanpreviewthiscontentswhileyouarewritingthebugreport.Fileslistedintheattachboxwillbesentasattachments.Theheaderwillcontaintheinformation(sendername&address)youhaveenteredinsettings.4.Productinfo&opt-outlinks:thosemayoftenlinktodubiouspages.Youmayopenthematyourownrisk,butyoushouldtakecaretomeetsomesecuritymeasures(likefirewall,latestIEupdates,updatedantivirussoftware)first.5.Otherlinks:DuetothenatureoftheInternetIcannotgiveyouanyguaranteeregardingotherlinksfoundonmywebpages(neithermyown,thesupportforum,orthedonationsite).ButIhaveputmytrustinthemanddonotbelieveanyharmcancomefromthem.


http://www.safer-networking.org/en/news/index.html

Imageofprogramwizard

Firstrun Tutorial

ThefirsttimeyoustartSpybot-S&D;,itwilldisplayaWizard,asmallwindowhelpingyouthroughthefirststeps.Itgivesyouthepossibilitytoaddorremovetheiconsyouhaveorhavenotcreatedduringinstall,forexample.Letusjustsayyouwantthemandprocedetothenextpage.

IfyouareusingaproxyinInternetExplorer,Spybot-S&D;willshowyouthisproxyandabuttonwillgiveyoutheopportunitytouseitforSpybot-S&D;,too.Ifthetextfieldisblank,youdonotneedtodoit,butinmostcasesthiswillshowaninternetaddress,andyoushouldimportthisproxysetting.

Thenextpagedealswithupdates.Itisveryimportanttokeepup-to-date.Usingthetwobuttonsthispageofferswilldotheupdatesforyou,ifyouwanttodoitatalaterpoint,usetheupdatefeatureintheSpybot-S&D;section.

Thelastpageofthewizardwillaskyoutoreadthehelpfile.Itlookslikeyouarealreadydoingthis:)

Doingascan Tutorial

Afterthewizardhasfinished,youmayfindyourselfontheSettingsorUpdatepage.AsthedefaultsettingsareOKrightnow,andyouhavealreadyupdated,letusignorethemfornowanddothefirstscan.

Imageofuserinterfacewithscanresults

Interpretingtheresults

Ontheleftsideoftheprogramyoucanfindanavigationbarthatcanleadyoutoallfunctionsoftheprogram.Thefirstsectionthere(thetop-mostbutton)islabeledSpybot-S&D;andleadsyoutothemainpage.Rightnow,youwillseeonlyanemptylistandatoolbaratthetop.ThefirstbuttoninthistoolbarisnamedCheckforproblems-thatisthebuttonyouhavegottopresstostartthescanning.Leanbackandwatchthescanprogress.

Interpretingtheresults Tutorial

Atthispoint,youcouldjustjumptothelastpoint,andremovetheresults.InsteadwerecommendthatyoufirsthavealookatwhatallthestuffisthatSpybot-S&D;detected.Thefirstthingyoushouldknowistodistinguishbetweentheredentries,whichrepresentspywareandsimilarthreats,andthegreenentries,whichareusagetracks.

Fortheusagetracks(Ihopeyouhavefollowedthatlinktoreadwhattheyare),removalisnon-critical,butdependsonyourpersonalpreferences.

Ignoringtheusagetracksfornow,youshouldhavealookattheredentrieswhichrepresenttherealthreats.While,ofcourse,youcantrustusthatwearechoosingthetargetsusingstrictcriteria,youcancheckforyourself.Ifyouclickoneachproductandthenonthegreybuttonontherightyoucanreadtheproductinformationintheboxpoppingup.

Decisiononexceptions Tutorial

Allproblemsdisplayedinredareregardedasrealthreatsandshouldbedealtwith.Butwhileyoureadtheproductdescription(youcanfinditbyselectinganiteminthelistandthenclickingonthegreybuttonontherightside),youmaystilldecidetokeepathreat,orjustausagetrack.MaybeyoudonotwantyourlistofmostrecentlyusedWorddocumentsremoved?Atthispointyouhavethreeoptions.

Youcoulddecideonignoringall.InthatcaseyoucouldopentheFilesetspageintheSettingssectionoftheprogram,anddisabletheUsagetracksentries.Orifyouwanttojustkeepalltracksfromaspecificproduct,justright-clickaproductintheresultslist.Finally,ifyouwanttokeepjustonefile,thatispossiblethesameway.

Removingthethreatsfound Tutorial

Sonowyoushouldknowabouteverythingyouhavefound.ItistimetousetheFixselectedproblemsbutton.

Onceyoustartthinkingaboutremovingtheusagetracks,too,youmaythinkthattickingallthegreenentriesishardwork.Thisisforasimplereason-toforceyou,thenewbie-tolookattheresults.Onceyouknowwhatyouaredealingwith,thereisahiddenSelectallbuttonavailableforyouonthesettingspage(onlywhenstartedinadvancedmode).


Settingthebasicoptions Settings

Allimportantsettingsarelistedinatreeinthissection.PleasenotethatthesesettingsareonlyvisibleifyoustartSpybot-S&Dinadvancedmode-thedefaultmodewillnotshowthem.Thedescriptionthatfollowsissortedbythetreesmaincategories.

Installation

Thissectionletsyouchangethedesktopiconaswellasthestartmenuandquicklaunchitem.

Mainsettings

Thesearesomemiscellaneoussettingsaboutessentialwarningandconfirmationdialogs.Hereyoucanforexamplechangeyourbackuppreferences.

Automation

Spybot-S&Dhastwokindsofautomationsettings–onsystemstartandonprogramstart.HereyoucansetwhethertostarttheprogramwhenyoustartupyourWindows,ortocheckforupdatesautomatically,ortodelaythescanonsystemstartforaspecifieddelayoruntilotherprograms(scanners)haveterminated.

Logfilesettings

Spybot-S&Dcanwritedetailsabouteachscanintotextfiles.Hereyoucanselectwhethertodothis,whetherthedateandtimeshouldbeincludedinthefilename,andwhethertoappendortooverwritethelogfile.

Look&Feel

YoucanswitchafewdetailsaboutthelookofSpybot-S&D.Justtrytheoptionsandseewhatlookyoulikemost.Afterawhile,youmaywantto

disabletheintroducinginformationpanels,forexample.

BugReport

Ifyouareunsureaboutproblems,youmaysendabugreporttoSaferNetworkingLimited.Thissectionisabouthowtheemailingshouldbehandled.Youshouldatleastselecttoincludesysteminformationandscanresultsinthebugreport(youcanpreviewitbeforesending).Also,ifyouwanttoreceivethesameemailasSaferNetworkingLimited,youmayselecttosendacopytoyourself(youneedtochangeSMTPsettingstodothis–seetheBugReporthelp).

Expertsettings

Thesearesomesettingsthenormalusermaynotneed,butthatcouldbeusefultothepoweruser.Forexample,youcansetupexternalapplicationstoviewresultdatahere.

YoucanfindthemainsettingsbychoosingSettingsfromtheSettingssectioninthetoolbartotheleft.


Scheduler Settings

TheSchedulerpageallowsyoutoaddanentrytoautomaticallyrunSpybot-S&DtotheWindowsscheduler.Todothis,youfirsthavetoclicktheAddbutton,thensetthenecessaryproperties(scheduledtimeetc.)throughtheEditbutton.YoucanremoveatasklateronbyusingtheRemovebutton.Customoptionsthatyouwillseearecheckboxestodecideifyouwanttoautomaticallyfixproblemsafterthescheduledscan,andtoclosetheprogramafterscanning/fixinghasfinished.

TheEditbuttonopensthedefaultWindowstaskpropertiesdialog,sothatyoucanchangethetasklikeanyotherWindowsSchedulertask.


Choosingtheinterfacelanguage Settings

IfyoudownloadedSpybot-S&D;fromtheInternet,itwillcomewithalotoflanguagesalreadyincluded,butnotthehelpfiles(toreducethedownloadsize).Youshouldusetheupdatefunctiontodownloadadditionalfilesforyourlanguageafteryouhaveselectedit.

Ifyourlanguageisnotyetshown,youcangototheSettingspageandenabletheoptiontodownloadforeignlanguageupdates.Inthatcase,yournextupdatewillshowyoutheupdatesforallavailablelanguages,eventhosenotyetinstalledonyourmachine.

YoucanfindthelanguagesettingsbychoosingLanguagesfromtheSettingssectioninthetoolbartotheleft.


Choosingwhattoscan(filesets) Settings

Spybot-S&D;usestheconceptofIncludeFilestomakeitmoreflexible.EachIncludeFileisafilecontainingthedescriptionofsomeproblemsthatSpybot-S&D;candetectandfix.

Thesefilesaredividedintocategories,soyoucanselectwhatyouwouldliketotargetinyournextscan.

Thebasiccategoriesare"Spybots"(whichcontainstheincludesforspywareandadware)andUsagetracks.ForeachcategoryyoumayseeIncludeFileswithashortdescriptiononwhattheydoandthenumberoffiles,registryentriesanddirectoriesthatwillbechecked.

YoucanselecttheIncludeFilesyouwishtouseforyournextscanbytogglingthecheckboxnexttothem.

IfyouseeanIncludeFileinitalicletters,thenitisonenotoriginatingfromSafer-NetworkingLimited.AstheIncludeFileformatispublic,anyonemaywriteIncludeFiles.However,asIncludeFilescandoalotofharmtoyoursystemandSafer-NetworkingLimitedisnotliableforaforeignIncludeFile,youwillbeaskedwhetheryouarereallysureyouwanttouseanyfilethatisnotfromSafer-NetworkingLimited.

YouwillfindthefilesetssettingsbychoosingFilesetsfromtheSettingssectioninthetoolbartotheleft.


Choosingwhatnottoscan Settings

Rightnow,therearefivedifferentIgnoresections:

Ignoreproducts

Thissectionlistsallproductsdefinedinternallyandintheexternalincludefiles.Ifyouwanttoexcludeacompleteproduct,orincludeitagain,selectthefilefromthissectionandtogglethecheckboxinfrontoftheproductname.

IgnoreCookies

Cookiesareusagetracks,butyoumaywanttokeepsomeusefulcookies.Thissectionlistsallcookiescurrentlyonyoursystem,allowingyoutoexcludethemfromfurthersearches.

Ignorefileextensions

ThisconcernsthecommonWindowsfileopeningdialog.Itsaveslistsofopened(andsaved)filesbrokendownbytheirextensions.IfyoudonotwanttoremovetheWinWordfiles,forexample,youcouldselect.doctobeexcludedinthissection.

Ignoresingleentries

Ifyoudonotwanttoexcludeacompleteproduct,butonlyasinglefileorregistrysettingofit,youcanselectthatonefromtheresultslist.Thesearelistedhere,whereyoumayremovethemfromtheexcludelistagain.

Ignoresysteminternals

Ifyouhavegotsysteminternalsresultsonthelist,youcanremovethemfromtheIgnorelisthere.

Allthelistsinthesesectionshaveacontextmenuwithextendedselectionoptions.

YouwillfindtheseoptionsbychoosingoneofthefourIgnorefeaturesfromtheSettingssectioninthetoolbartotheleft.


Settingthedownloaddirectories Settings

SomescansdoalsotargettheinstallerfilesofproblemsdetectedbySpybot-S&D.Installersthattheusermustexplicitelydownloadhimselfwillonlybescannedforinthedirectoriesenteredintothislist.

YoucaneitheruseDragandDroptodropsomedirectoriesfromanExplorerwindoworusethecontextmenutoaddorremovedirectoriestoorfromthelist.

YouwillfindthedownloaddirectoriessettingsbychoosingDirectoriesfromtheSettingssectioninthetoolbartotheleft.


Choosingaskin Settings

Spybot-Search&Destroysupportstheconceptofbasicskins,toadjustprogramcolorstopersonalneeds.

Togetnewskins(atfirstthereareonlytwoavailable,theoriginalSpybot-S&D;andthePeace)youcanvisitthefollowinghomepages:http://www.safer-networking.org/en/download/index.htmlhttp://www.allsecpros.com/sbsd.html

ThenchooseyourfavoriteskinsandsimplydownloadthemandextractthemtotheSpybot-S&D;skinsfolder.

TheSkinsectionwillshowyoualistofavailableskins.Selectonetopreviewit.The(verysimple)previewwillbedisplayedintheleftpartofthewindow,withsomeinformationbelowthelistandtheskinlogoatthebottomofthepage.

Ifyouliketheskin,presstheApplyselectedbutton.

YoucanfindtheskinsettingsbychoosingSkinsfromtheSettingssectioninthetoolbartotheleft.


http://www.safer-networking.org/en/download/index.html

http://www.allsecpros.com/sbsd.html

IgnoreCookies Settings

Cookiesareusagetracks,butyoumaywanttokeepsomeusefulcookies.Thissectionlistsallcookiescurrentlyonyoursystem,allowingyoutoexcludethemfromfurthersearches.(Atthemoment,onlyInternetExplorerandNetscapeNavigatorandMozillacookiesaresupported-Operacookiescanonlybecompletelydeleted)


Ignorefileextensions SettingsThisisaboutthecommonWindowsfileopendialog.Itsaveslistsofopened(andsaved)filesdividedintoextensions.Ifyoudonotwanttoremovecommontextfiles,forexample,youcouldselect.txttobeexcludedinthissection.


Ignoreproducts SettingsThissectionlistsallproductsdefinedinternallyandintheexternalincludefiles.Ifyouwanttoexcludeacompleteproduct,orincludeitagain,selectthefilefromthissectionandtogglethecheckboxbeforetheproduct.


Ignoresingledetections SettingsIfyoudonotwanttoexcludeacompleteproduct,butonlyasinglefileorregistrysettingofit,youcanselectthatonefromtheresultslist.Thesearelistedhere,whereyoumayremovethemfromtheexcludelistagain.


IgnoreSystemInternals SettingsIfyouhaveputSystemInternalsresultsontheignorelist,youcanremovethem(fromtheignorelist)here.


Updating Spybot-S&D;

Inordertoavoidlargedownloadsandformoreflexibility,themainpartofscanninginformationislocatedinsidetheincludefiles.

Includefiles,aswellasnewerhelpfiles,newlanguages,updateddescriptionsetc.canbedownloadedusingtheintegratedupdatefunction.

Ofcourse,inordertoupdatetheprogram,youneedanopeninternetconnection.

Afterthat,youcanclicktheSearchforupdatesbutton.Thatopensanewwindow,enablingyoutoexecutetheupdateprogramm"SDUpdate".Afterdoingthat,alistofavailableupdateswillbedownloadedfromaSaferNetworkingLtd.serverandcomparedtothefilesalreadyinstalledonyoursystem.Newfileswillbeshowninthelist,whereyoucanselectthemandpresstheDownloadupdatesbuttonafterwards.Duringdownload,everyfinishedfilewillgetagreencheckmark.

Ifyouwanttoreadaboutupdatesfirst,visitourwebsiteorthesupportforum.

YoucanfindtheupdatefunctionbychoosingUpdatefromtheSpybot-S&D;sectioninthetoolbartotheleft.


Reportingabug Tools

Youshouldusethebugreportonlyasalastresort.First,pleasecheckfornewerversions,readtheFAQandvisitthesupportforum.

Ifallthathasn'thelpedsolveyourproblems,youmaywriteabugreport.BeforedoingthispleasecheckifyouhavegotacurrentversionofSpybot-S&D.;Toproveifyouareuptodateyoucanusetheintegratedupdatefunction(Spybot-S&D;section).AfterthischeckpleasegototheToolssection,thenchoosebugreportandpressNext.Ifthisisthefirsttimeyouarewritingabugreport,youmayneedtoadjustyouremailsettings.ClickthebuttonMailsettingsandchangethemtoyoursettings.Thedialogpoppingupwillallowyoutosetallnecessarydata.IfyouareusingOutlookorOutlookExpress,youmayevenimportyoursettingsandwillonlyhavetoenteryourpassword.

Oncetheemailsettingsarecorrect,youcanwriteyourbugdescriptionintothetextfieldforYourdetaileddescriptionofthebug.Then,pleasepresssystemgeneratedreport.Atthispoint,aspecifiedreportfromthemachinewillbelistedthatwillalsobesenttous.Ifyouwanttoattachafiletothereportpleasedragittotheboxatthebottom.Onceyouhavedonethatandverifiedthateverythingiscorrect,youcanpresstheSendbuttontosendtheemail.

Youwillfindmorebugreportoptionsinthemainsettings.


Optingout Tools

Ifyouhavesubscribedtosomeadvertisersservicebyaccidentinthepast,anddonotknowwheretooptoutagain,youmaybeluckytofindadvertiserlistedhere.Double-clicktheaddresstoeithervisitthewebsiteorsendanoptoutemail(youcandistinguishbetweenthetwobytheiconinfront).

Pleasedonotusethisfunctionasapreventivemeasure,becausethatwouldgiveyounoadvantages,butinsteadgivetheadvertiseryouraddress.

YoucanfindtheOptOutlistbychoosingOptOutfromtheToolssectioninthetoolbartotheleft.


Scanningyoursystem Spybot-S&D;

OnceyouhavestartedSpybot-Search&Destroy,youcanimmediatelystartscanning.

Havingstartedtheprogram,youwillalreadyseethescanscreen.Ifnot,pleaseselectSearch&DestroyintheSpybot-S&D;sectioninthetoolbartotheleft.

Thesearchscreencontainsatoolbarwiththemostimportantoptions.Letusstartascan:pleasepresstheCheckforproblemsbutton.

Youwillseethescanprogressinthestatusbaratthebottomofthewindow,andcanstoptheprogressatanypointbypressingtheStopcheckbuttonthathasjustappeared(itwillvanishagainoncethecheckhasfinished).

Ifthescanhasfoundsomething,thelistwillshowit.Therearetwobasickindsofresults:

Redentriesindicatespywareproblemsthatshouldbefixedtoavoidsecurityand/orprivacyproblems.Thisistheonlykindofproblemthatispreselectedtobefixed.

Greenentriesindicateusagetracks.Itcandonoharmtoremovethese.

Formostoftheproblemsthereismoreinformationavailable.Ontherightsideofthewindowyouwillfindagreybutton.Byclickingitawindowwillopenandshowyousomeinformationabouttheitemselected(ifthereisnoneselected,youcansimplyclickonitandtheinformationwillbedisplayed).

Youcannowselecttheproblemsyouwanttofix,byclickingthecheckboxinfrontofit,orbyselectingallusingthebuttonSelectallproblems(thisbuttonwillonlybeavailableafterenablingtheexpertbuttonsettinginadvancedmode).Moreselectionoptionsareavailableifyoulookintothecontextmenu(byright-clickingaproblem).Thecontextmenuwillalsoallowyoutoexcludesingleproblemsorwholeproductsfromfurtherscans(youmaylaterchangetheexcludesettingsinthesettingssection/Ignore...).Anotheroptionthe

contextmenuoffersistocopyorexporttheresultlistorafullreport.

Onceyouaresureyouhaveselectedwhatyouwanttoberemovedfromyourcomputer,presstheFixselectedproblemsbutton.Youwillseethefixingprogressatthebottomstatusbar.

Ifsomeproblemscannotbefixedrightnow(becausetheyarestillloadedandcan'tbeterminated,forexample),Spybot-S&D;offersanoptiontorunonnextsystemstart,soyoucancheckandfixagain.

Shouldyounoticeatanylaterpointthatyouhaveremovedmorespywarethanyouwanted,youcanalwaysrestoreitfromtheRecoveryintheSpybot-S&D-section.;

Youcanalsofine-tuneyourscanoptionsbyselectingspecialFilesetsandchangingsomeSettings.


Immunize Search&Destroy

Beginningfromversion1.2,Spybot-S&Dallowsyoutoimmunizeyourcomputeragainstsomespyware.Itcurrentlyoffersthreedifferentimmunities:

PermanentInternetExplorerimmunity

ThepermanentimmunityworksonsomeInternetExplorercontroloptionsthatarepartlyvisibleintheInternetExplorerinterface,partlyhiddenintheregistryonly.ItaddsdomainsknowntocontainbadcontentsintotheRestrictedZone,thusblockinginstallationofexecutablecodefromthosepages;italsoaddsblockoptionsforbadexecutablecodebyitsID,anditsetsknowntrackingcookiesnottobeacceptedbyInternetExplorer.

Tocutitshort:itmodifiesInternetExplorer,throughofficialways,toblockalotofthebadstuffknowntoSpybot-S&D.;

PermanentlyrunningbaddownloadblockerforInternetExplorer

ThisisasecondlayerofprotectionforIE.WhilethePermanentImmunityblocksinstallersbytheirActiveXID,thisoneblocksanythingthatshouldcomethroughbydifferentaspects.YoucanviewalogofblockedinstallersintheTools/Residentsection.

PermanentOperaimmunity

ThislistshowsallOperaprofiles,andhowmanyofthepluginsthatSpybot-S&Dknowsasbadarealreadyblockedineachprofile.Tosetthecompleteprotection,justtickthecheckboxinfrontoftheprofileyouwanttoprotect.Toremovetheprotection,untickthecheckbox.

NotmanybrowserpluginsarecurrentlyworkingforOpera,buttheattempttoinstallsomemaycrashOpera,andActiveXsupportforOperaisavailableinthird-partybetasoftware,sousethisfunctionasaprecautionagainstfuturemisuseofOperathroughspyware.

Thisfeaturewill(certainly)onlybedisplayedifyouhaveOperainstalledonyoursystem!


Recovery Spybot-S&D

TherecoverysectionisavailablebyselectingRecoveryfromtheSpybot-S&Dsectioninthetoolbartotheleft.

Ifyouhavefixedsomespywareproblemsinthepast,thislistwillshowit.Hereyoucanselectoneormoreproblems(seealsothecontextmenuforextendedselectionoptions)andeitherrecoverorfinallypurgethemfromyoursystem.

InadditiontotheRecoveryfeature,WindowsME,XPandVistausershavethepossibilitytoenablethecreationofSystemRestorePointsforeachfix.ThisoptioncanbesetintheMainSettingspartoftheSettingssection.WhengoingbacktoaSystemRestorePoint,theResidentTeaTimerneedstobeshutdown:WithTeaTimerrunning,itwilltakenoteofthechangesandasktoeitherAlloworDenythem.However,intheprocessofrestoringWindowswillrestarttoofasttoallowthechanges.


Productinformation

Inordertofindtheproductinformationintheresultslistpleaseclickonanitemandthenonthegreybuttonontherightside.ThereyouwillfindmoreinformationabouttheproblemsSpybot-S&D;istargeting.

TheinformationshowncontainsURLsonly,butassomeoftheseURLsmaydirectlystartan(ActiveX)download,youcannotopenthembyusingthestandarddouble-click.Instead,right-clicksomewhereintheinfofieldandselecttheURLyouwanttovisitifyouaresureyourbrowserissettosafesettings.

Youcanalsochoosetoexcludeaproductfromfurthersearchesbyright-clickingitandselectingExcludethisproductfromfurthersearches(thisdoesthesameasignoringaproductinthesettingssection).

Inthatcontextmenuyouwillalsofindtheoptiontocopytheresultsorafullreporttoeithertoatextfileortotheclipboard.


Blindusers

Spybot-S&Dhasbeenadjustedtofittheneedofblind(disabled)users.AlreadyduringtheinstallationtheuserhasthechoicetocreateanicontostartSpybot-S&Dinaspecialmode.Itwillalsoswitchtothatmodeifitdetectsthataccessibilitysupportisinstalled.Asathirdoption,theSettingspagecontainsanoptiontoswitchtothisspecialmode.

Inthisspecialblindusermode,thecontextmenus(theonesthatwouldappearifauserright-clicksonalist),thetoolbar(usuallyatthetoporbottomofeachpage)andtheglobalnavigationbarattheleftaremirroredintotwomainmenusubmenusthattheusercanuseforeasiernavigation.Thetwographicallists(theresultslistandtherecoverylist)willalsobeswitchedtotextformat.Asthecheckboxesarenotavailableinthistextformat,theselistswillcontainthetextCHECKEDorUNCHECKEDattheendofeachentry.Thischeckoptioncanbetoggledusingthespacekey.


SpywareandAdware Dictionary

Whatisspyware?Toputitsimply,spywareissoftwarethattransmitspersonallyidentifiableinformationfromyourcomputertosomeplaceintheinternetwithoutyourexplicitapprovalknowledge.

Spywareistypicallynottheproductyouinstallyourself,butsmalladd-ons,thatyoumayormaynotdisableduringinstall.Inmostcases,theEULAsomewherehasafewlinestellingyouaboutprivacymatters,buttypicallymostusersdonotreadthecompleteEULAandneverknowtheygotspywareontheirsystem.

Alessthreateningkindofmalware(i.e.malicioussoftware)isadware.Adwareissimilartospyware,butdoesnottransmitpersonallyidentifiableinformation,oratleastthecollectorpromisesnottosellit.Instead,aggregatedusageinformationiscollected.

Also,adwareisoftenaside-effectofspyware,asbothmonitoryouforasolepurpose–deliveringadvertisementstoyouthatareespeciallytailoredtoyourhabits.

Anotherkindthatisdetectedunderthespywarecategoryaretrackingcookies.Cookiesareusedallovertheinternetinusefulandlessusefulplaces.Advertisementcompaniesoftensetcookieswheneveryourbrowserloadsabannerfromthem.InthatcaseandifthatcookiecontainsaGUID,thecompanygetsnoticeabouteverysiteyouvisitthatcontainstheirads.


Systeminternals Dictionary

Thewindowsregistrycontainsalotofinformation.ItsconsistencycanbecheckedwithgoodcommercialprogramslikeSymantec™SystemWorks.ButtherearesomesmallthingsImisswiththoseprograms.HereiswhatSpyBot-S&D;searchesfor:

Missinghelpfiles–theregistrycontainsinformationaboutthelocationofsomehelpfiles.Ifthisinformationpointstoincorrectdirectories,Spybot-S&D;willinformyouaboutandallowtofix.

MissingsharedDLLs–theregistrycontainsalistofdynamiclinklibraries,wheretheyarelocatedandhowmanyprogramsareusingthem.SpyBot-S&D;checksifalllocationsarecorrectandallowstochangethemifnot.

Applicationpaths–someapplications(mostlythoseregisteredtoafileextension)areregisteredintheregistry.Iftheyarepointingtoaprogramfilenolongerexisting,Spybot-S&D;canchangetheirpathordeletetheirentry.

WrongUninstallinformation–everyprogramthathasitsownuninstallroutinestoressomeinformationaboutitintheregistry.Ifthisinformationisincorrect,Spybot-S&D;willtellyouabout.Forexample,theuninstallprogrammayhavebeenlocatedinsideatempdirectory(therearelotsofprogramsthatstupid!).

BrokenDesktopLinks–ifoneofthelinksonyourdesktoplinkstoafilethatnolongerexists,Spybot-S&D;willtellyouandallowyoutoeitherpointthelinktoanotherfileordeleteit.

Warning:Pleasebeawarethatchangestotheseitemscancorruptyoursystem!Ifyouarenotsurewhetherasettingisreallyaproblemyou´dbetterleaveitalone!ThiswarningespeciallyappliesifyouareusingMicrosoftOffice™.This

softwaresuitehassomeregistryentriespointingtowrongdirectoriesandsomeevenpointingtonon-existenthelpfiles.Ihavechangedthefirst,butIwouldnotdeletetheotherone,becausetheymaywellpointtofilesthatwillbeinstalledonthat"Installonfirstuse"basis.


Usagetracks Dictionary

Usagetracksareyourfingerprintsinyoursystem.Wheneveryouvisitapagewithyourbrowser,orjustopenanyfile,thatinformationisstoreddeepinsideWindows.Inmostcasesthatisveryuseful–ifyouwanttoopenthatfileagain,youcanselectitfromalistinsteadoftypingthewholefilenameorbrowsingthewholedirectorystructureagain.

Butinsomecasesyoumaywanttohideyouractivity,becausespywareandinternetattackersmayusethatinformation.Spybot-Search&Destroycanremovesomeofthemostimportantandcommontracksonyoursystem.


ToolsSpybot-Search&Destroyoffersmultipletoolstohelpyoulookingdeeperintoyoursystem.


Viewreport Tools

ThistoolallowsyoutocreateanewreportincludingallorjustaselectionofthereportsthatSpybot-S&Dcancreate.Youcanthensavethereporttoafileforfuturereference.Thetoolalsoallowsyoutoviewoldreportsagain.


Resident Tools

Residentisapermanentlyrunningapplicationtoprotectyoursystem.Currently,itconsistsofabrowserhelperforInternetExplorerthatwillblockdownloadoffilesknownasmalicious(spywareinstallersforexample).ThispageinsideSpybot-S&D;allowsyoutoinstall/uninstallthishelperaswellasviewthereportofwhichpagesithasblocked(thatshouldonlyappearifthefirstlayerofprotection,themainIEimmunity,didnotstoptheculprit).

ThesecondresidenttoolistheTeaTimer

Youcanfindtheresidenttoolsinthetoolssection.


WhatistheResidentTeaTimer? TeaTimer

TheResidentTeaTimerisatoolofSpybot-S&D;whichperpetuallymonitorstheprocessescalled/initiated.Itimmediatelydetectsknownmaliciousprocesseswantingtostartandterminatesthemgivingyousomeoptionshowtodealwiththisprocessinthefuture:YoucansetTeaTimerto:

beinformedwhentheprocesstriestostartagainautomaticallykilltheprocessorgenerallyallowtheprocesstorun

Thereisalsoanoptiontodeletethefileassociatedwiththisprocess.

Inaddition,TeaTimerdetects,whensomethingwantstochangesomecriticalregistrykeys.TeaTimercanprotectyouagainstsuchchangesagaingivingyouanoption:YoucaneitherAlloworDenythechange.AsTeaTimerisalwaysrunninginthebackground,ittakessomeresourcesofabout5MB.

WhydoesResidentTeaTimerterminatetheapplicationbeforeasking? TeaTimer

Becausethreatsliketolldialersaretimecritical-theycostfromthefirstsecondtheyhaveconnected.Inordertoprotectyou,thesehavetobeterminatedatthemomenttheyappearbeforetheycanconnectatall.

WhyistheTeaTimercalledTeaTimer? TeaTimer

Asweusedtoforgetourtea,whenweletitbrew,webuiltasmalltoolwithasystemtrayicontoremindus.WecalledthistoolTeaTimer.WhenwestartedtodeveloptheResidenttoolforSpybot-S&D;,wealsoneededasystemtrayiconforthis.Aswedonotlikehavingtoomanyiconsinthesystemtray,wedecidedtoputbothtoolstogetherandkeptthenameTeaTimer.ThenextversionoftheResidenttoolmightalsohavethefunctionsoftheoriginalTeaTimer.

YoucanfindtheResidentTeaTimerinthetoolssection.


ActiveX Dictionary

ActiveXisaMicrosofttechnologythatallowsInternetapplicationsthataremorepowerfulthansimplescripts.ActiveXapplicationsdoonlyworkinInternetExplorer,sotheuseofActiveXonwebsitesisnotrecommended.DuetothehugeamountofinfluenceActiveXapplicationscanhaveonthesystem(ActiveXapplicationshaveaccesstothesamefilesyouhaveaccessto,meaningallfilesinthecaseofmostprivatecomputers),itisrecommendedtobeverycarefulifdealingwithActiveX.

TherearetwotypesofActiveXapplications-signedandunsigned.ThecodeofunsignedActiveXapplicationshasnotbeencertifiedandshouldneverbetrusted.SignedActiveXapplicationsarecertified,butcanstillcontainmaliciouscode!SignedActiveXapplicationsshouldonlybetrustediftheycomefromtrustedwebsitesandonlyonapromptbase(meaningthatInternetExplorersettingswillaskeverytimeawebsitewantstoloadanActiveXapplication).

ManydialersandhijackersinstallthemselvesusingActiveXapplications.

ActiveX Tools

Spybot-S&D;isabletodisplayalistofinstalledActiveXapplications.ItalsohasasmalldatabaseintegratedthatwilldisplayagreencheckmarkinfrontofActiveXapplicationsknownaslegitimate,andaredsigninfrontifapplicationsknownasillegitimate.

Thislistcanbeexportedintoatextfileasareferenceandforfurtheranalysis.

Featureaddedinversion1.3:entriesthathavechangedsincethelastsnapshot(thefirstsnapshotwascreatedwhenyoustartedSpybot-S&D;forthefirsttime,lateronyoucancreatesnapshotsbyright-clickingthelistandselectingthecorrespondingmenuitem)aredisplayedinboldletters.Thisallowsyoutoseechangestothelistatonce.


BHO,BrowserHelperObject Dictionary

ABHOisasmallprogramthatextendsMicrosoft'sInternetExplorer.ExamplesofBHOusageincludevisibleadd-ontoolbarsinInternetExplorer,butcanalsobehiddenfunctions.Ad-andspywareaswellasbrowserhijackersoftenuseBHOstodisplayadsorfollowyourtrackacrosstheinternet,becauseaBHOhasaccesstoeachURLyouvisitandcanredirectyouordisplayotherpagesthanyourequested(ads,forexample).

BHOsoftenuseActiveXinstallationprograms.

BHO Tools

Spybot-S&Disabletodisplayalistofinstalledbrowserhelperapplications.Italsohasasmalldatabaseintegratedthatwilldisplayagreencheckmarkinfrontofbrowserhelpersknownaslegitimate,andaredsigninfrontifapplicationsknownasillegitimate.ItalsoallowstheusertoenableordisablesingleBHOs.

Thislistcanbeexportedintoatextfileasareferenceandforfurtheranalysis.

Featureaddedinversion1.3:entriesthathavechangedsincethelastsnapshot(thefirstsnapshotiscreatedwhenyoustartedSpybot-S&D;forthefirsttime,lateronyoucancreatesnapshotsbyright-clickingthelistandselectingthecorrespondingmenuitem)aredisplayedinboldletters.Thisallowsyoutoseechangestothelistatonce.


Browserpages ToolsSpybot-S&D;isabletolistallknownlocationswhereInternetExplorerstartandsearchpagesareanchored.IfyourbrowsergothijackedandyoucannotusethenormalInterentExplorercontrolpaneltoresetyourstartorsearchpage,youcanusethisSpybot-S&D;tooltolocatetheURL(pleasesendittodetections@spybot.infosothatitcanbeaddedtothenextupdate),andchangeit.


Hostsfile Dictionary

Thehostsfilecouldbedescribedasanaddressbook.Whilethenormaluserisaccustomedtoaccessothercomputersontheinternetusingnames(forexamplesecurity.kolla.de),everycomputerisaccessedbyanumericaddressatalowerlevel.Youmayalreadyhaveseenthisnumericaddresses;theylooklike127.0.0.1forexample.

Everytimeyoutrytoaccessanothercomputerbyusinghisname,yourcomputerlooksuphisaddressinanaddressbook.Firstitlooksintoalocaladdressbook(thehostsfile),andonlyifitcannotfindtheaddressthereitlooksinaverybigaddressbookintheinternet.

So,ifyouwanttoblockaninternetwebsite,youcouldsimplyredirectthissitesnametoaplacewherenothingwillbedeliveredfrom.Suchaplacewouldbeyourcomputerforexample.TheaddressIalreadymentioned,127.0.0.1isanaddressthatwillalwayspointtothelocal-your-computer.Byaddinganentrytothehostsfile(yourlocaladdressbook)thatredirectsanadsitetoyourmachine,youwouldtrickyourinternetbrowsertothinkthatadsitewouldbeonyourmachine,andasyourmachinedoesnotdeliverads,itwouldnotgettheadanditwillnotbedisplayed.

Anotherwayofusingthehostsfileisifyouwanttoaccesscomputersthatarenotlistedinanyaddressbookyet.Forexampleifyouhavealocalnetwork,youwouldnotlistyourlocalcomputersinanyinternetaddressbook,ifonlybecausethatwouldbeveryexpensive.Soyoucouldjustenterthemintothelocaladdressbook(yourhostsfile).

Spybot-S&D;usingthehostsfile Tools

Spybot-S&D;canaddapreparedlistofwebsitesknownforbadbehaviour(installingspywareortrackingusers,forexample)toyourhostsfile.Ifyouwanttodothis,werecommendyoualsoreadtheFAQaboutcuresforpossibleslow-downsonWindowsNTbasedsystems(WindowsNT,2000,XPandVista).Andifyoushouldnoticeyoucannotvisitasitethatworkedbefore,you

shouldchecktheHostsfilesectiontoseeifthatsiteisontheblocklist.


IETweaks Tools

Theseareverysmallchangesrecommendedtomakeyoursystemabitsaferandmoresecure.Lockingthehostsfilewillpreventmosthostshijackers(evenunknown)fromdoingharm;lockingtheIEsettingswillpreventotherusersofyourcomputertochangeyourpreferences.

YoucanalsochangetheInternetExplorertitletoauser-definedtext,orremoveapre-definedtext.


Processlist ToolsThistooldisplaysalistofallcurrentlyrunningprocesses,includingsomeinformationaboutthem.Italsoallowsyoutokillsomeprocesses,butpleasedonotusethisfunctionuntilyouknowwhatyouaredoing!


Systemstartup Tools

ThistoollistsallprogramsthatarestartedatWindowsstartup.IfthoseitemsareinthedatabasecomingwithSpybot-S&D,itwilldisplaysomemoreinformationaboutthem.Italsoallowsyoutodisable(andenable)items,aswellasdeletethem,changethemorinsertnewitems.

Theentrieswillbedisplayedindifferentcolours:

Green:legitimateprogramYellow:unknown,unneededorunambiguousprogram(e.g.malwareprogramsmightusethesamefilenameaslegitimateprograms)Red:maliciousprogram

OnWindows9xandME,theuserhasfullaccesstothislist.OnWindowsNT/2000/XP/Vista,thelistwilldisplaytheglobalandthecurrentuserentries.Forsomefunctionslikeseeingallentriesorevenchangingsome,theusermayneedadminorpoweruserrights.

Sinceversion1.3entriesthathavechangedsincethelastsnapshot(thefirstsnapshotiscreatedwhenyoustartedSpybot-S&D;forthefirsttime,lateronyoucancreatesnapshotsbyright-clickingthelistandselectingthecorrespondingmenuitem)aredisplayedinboldletters.Thisallowsyoutoseechangestothelistatonce.


Uninstallinfo Tools

ThistoollistsallprogramsthathaveregisteredsomekindofUninstallinformationwithWindows.Youcanuseittoremovetheuninstallinformationofnolongerexistingprogramsaswellastosimplygetanoverview.

Entriesthathavechangedsincethelastsnapshot(thefirstsnapshotiscreatedwhenyoustartedSpybot-S&D;forthefirsttime,lateronyoucancreatesnapshotsbyright-clickingthelistandselectingthecorrespondingmenuitem)aredisplayedinboldletters.Thisallowsyoutoseechangestothelistatonce.


LSP,LayeredServiceProvider Dictionary

ALayeredServiceProviderisasystemdriverlinkeddeepintothenetworkingservicesofWindows.Ithasaccesstoeverydataenteringandleavingthecomputer,aswellastheabilitytomodifythisdata.AfewsuchLSPsarenecessarytoallowWindowstoconnectyoutoothercomputers,includingtheInternet.ButSpywaremayalsoinstallitselfasanLSP,thushavingaccesstoallthedatayoutransmit.LSParecurrentlyusedbyCommonName,New.Net,NewtonKnowsandwebHancer.

WinsockLSPs Tools

Spybot-S&Disabletodisplayalistofinstallednetworkdriversasareferenceforprofessionals,andallowsthislisttobeexportedforfuturereference.

Sinceversion1.3entriesthathavechangedsincethelastsnapshot(thefirstsnapshotiscreatedwhenyoustartedSpybot-S&Dforthefirsttime,lateronyoucancreatesnapshotsbyright-clickingthelistandselectingthecorrespondingmenuitem)aredisplayedinboldletters.Thisallowsyoutoseechangestothelistatonce.


AboutTeaTimer

Spybot-Search&Destroyisanon-demandspywareandmalwarescanner.Thatmeansitscansforthreatswheneveryouchoosetodoso.ItalsoofferssomepreventivemeasureslikeitsImmunizefunction.

Resident,ofwhichTeaTimerisapart,isSpybot-S&D'spermanentlyrunningpartnerthatdoeson-accessscanning.Thismeansthatitwillinstantlydetectandcounteracttothreatsandunsolicitedsystemsettingschanges.


Event TeaTimer

Spybot-Search&DestroyhasdetectedachangetoaBrowserHelperObject.

Definition TeaTimer

Spybot-S&D;ResidentwatchesfornewordeletedBrowserHelperObjects(whicharepluginsforInternetExplorer,sometimesexpandingitsfunctionality,butoftenusedformaliciouspurposesaswell).

Userinteractions TeaTimer

DidyoujusttrytoinstallsomeInternetExplorerplugin?Ifitisnotshownasabadone,youshouldproceed.Ifthishappensoutoftheblueskywhilesurfingtheweb,youshouldgetcautious.


Event TeaTimer

Spybot-Search&DestroyhasdetectedachangetoanInternetExplorertoolbar.

Definition TeaTimer

Spybot-S&D;ResidentwatchesfornewordeletedInternetExplorertoolbars.




Event TeaTimer

Spybot-Search&DestroyhasdetectedachangetosomeActiveXinstallation.

Definition TeaTimer

Spybot-S&D;ResidentwatchesfornewordeletedInternetExplorerInternetinstallations.




Event TeaTimer

Spybot-Search&DestroyhasdetectedachangetosomecustomInternetExlorermenuentry.

Definition TeaTimer

Spybot-S&D;ResidentwatchesforcustomInternetExplorermenuentries.




Event TeaTimer

Spybot-Search&Destroyhasencounteredandterminatedaprocessthatislistedaspartofamalicioussoftware.

Definition TeaTimer

Spybot-S&D;Residentwatchesallapplicationsthatarebeingstartedonyourcomputer.Itknowsthesamebadfilesastheon-demandscannerofSpybot-S&D;,andifitencountersanapplicationthatisknownasathreat,itwillautomaticallyterminatethisapplication.


Aftertheprocesshasbeenterminated,youarepresentedwithafewchoices.YoucanassigntheactionResidentshouldtakethenexttimeitencountersthisthreat(likeautomaticallykillingit,and/ordeletingtheoffendingfile).

FrequentlyAskedQuestions TeaTimer

Q:WhydoesResidentterminatetheapplicationbeforeasking?A:Becausethreatsliketolldialersaretimecritical-theycostfromthefirstsecondtheyhaveconnected.Inordertoprotectyou,thesehavetobeterminatedbeforetheycanconnectatall,atthemomenttheyappear.


Event TeaTimer

Spybot-Search&DestroyhasdetectedachangetoInternetExplorerstartorsearchpagesetting.

Definition TeaTimer

Spybot-S&D;ResidentwatchesallknownInternetExplorerstartandsearchpagesettings,andwarnsyouaboutchangestothem.


IfyougetawarningaboutanInternetExplorerpagethathaschangedwhenyoudidnotchangeityourself,youshouldusuallydenyit(ifitisnotamicrosoft.compagethatisset-IEtendstochangepagesitselfonafreshcomputer).


Event TeaTimer

Spybot-Search&DestroyhasdetectedachangetoaSystemStartupentry.

Definition TeaTimer

Spybot-S&DResidentwatchesforchangestothissetting,andallowsyoutoreacttothem.


Notallstartupentriesarebad-youhavetodecideifyoutrusttheprogramthatasksthechange.Duringauser-initiatedsoftwareinstallationforexample,youwouldusuallyallowthischange.Ifthishappenswhilesurfingtheweborwithoutanyintendedsystemchanges,youshouldbecareful.


DictionaryThedictionarycontainssomeexplanationsofcommontermswhendealingwithmalware.


Dialer DictionaryAdialerisaverysmallprogram,ofteninstalledusingtheActiveXtechnology.Dialersoftenpromiseaccesstofreeporn,freegamesorfreecracksforcommercialsoftware.Onceinstalled,adialerofferstouseyourdial-updevicetocallintotheservice,usuallycallingaquiteexpensivephonenumber.Somedialersexplainthecostsoftheconnectiontheywillbemaking,sinceitisrequiredbylocallawinsomecountries,butmanydialersjustdisplayabuttonofferingtoconnect,withoutinformingtheuserofwhatishappeningbehindit.Intheworstcase,thedialersetsuptheexpensivenumberasthedefaultInternetconnection,meaningtheuserwillhavetopayhighratesforbeingonline,withoutevenknowingituntilreceivingthenexthighphonebill.


Firewall Dictionary

Afirewallisbasicallysomekindofsoftwareorhardwarethatcontrolsdatatransfers.Thetypicaluseofafirewallwouldbetosecuretheaccessacomputeroranetworkofcomputerstoanothernetwork(whichmayevenbetheinternet).Ahardwarefirewallissimplyaboxthatisputbetweenthelocalandthefarnetworkandthatallowsordeniestransfersbasedonpredefinedrules;asoftwarefirewallisasoftwareinstalledonacomputerandbasicallydoesthesame.Ithastheadvantagethatitcanalsosetrulesbasedonthesoftwarethatisdoingthetransfer,butthedisadvantagethatitdependsonhowwisetheuserusesit.


Browserhijacker Dictionary

AbrowserhijackerisasmallprogramorregistrysettingthatisresponsibleforchangedIEstartandsearchpages.Ifyourbrowserstartswithadifferentstartpage(oneyouhavenotchangedyourself),youmostprobablygothijacked.Intelligenthijackersdonotonlychangethesepages,butalsoaddasmallfilethatwillrestorethehijackedsettingsuponeachsystemstart.HijackersoftenuseActiveXinstallationprogramsand/orsecurityholes.


Javaapplet Dictionary

AJavaappletiscapableofdoingmorethanjustaJavaScript,buthasn'tgotthefullaccesstoyourmachinelikeafullJavaapplication.Anappletstillneedsthebrowsertoberunin,whileafullJavaapplicationcouldrunstand-alone(usingjusttheruntimeengine).


JavaScript DictionaryAJavascriptisaverysmallprogramthatisrunningonyourcomputerwhenvisitingwebsitesthathavedefinedsuchascript.Javascriptshavelittleaccesstoyourcomputer,butcanmodifyyourbrowser.


Keylogger Dictionary

ThenamekeyloggerwasdefinedbackinoldDOStimes,wherecomputerswerehandledjustbyusingakeyboard.Themostbasickeyloggersbackfromthattimejustlogthekeysyoupress.Thespy,apersonwithphysicalaccesstoyourmachine,couldgetthatlogatalaterpointandseeeverythingyoutyped.

Modernkeyloggersaremuchimproved.Theydonotonlylogthekeysyoupress,butdoalsomakescreenshotstoshowthespywhatWindowsyouareworkingwith,theycaptureinformationaboutyourinternetuse,andmuchmore.Thespydoesnotevenneedphysicalaccesstoyourmachinebecausemanycurrentkeyloggerssendtheirlogsbyemail.


Passwords Dictionary

Yousurelyknowwhatapasswordis.Whenaccessingprivatedataonaprotectedsystem,youneedapassword(sometimesalsocalledpassphrase)andmostoftenausernametotellthesystemyouridentity.

Mostthingsaboutpasswordshavealreadybeensaid,butsomethingscannotberepeatedtoooften.

1. Donottellyourpasswordstoanyone.Ifyouareaskedbyanyonetotellthemyourpassword,sayno.Theresimplyisnoreason.Ifsomeonetellsyouheisanadminandneedstoknowyourpassword,heislying.

2. Whenchoosingyourpassword,donotchoosesomethingthatotherscouldsimplyguess.Donotusethenameofyourspouseorcat,orthecompanynameprintedonyourcomputerormonitor.Whilethebestthingwouldbearandomstringofcharactersandnumbersandevenspecialcharacters,ifyoureallyneedsomethingthatiseasytoremember,takepartsofwordsandcombinethemintosomethingthatyoucanstillspeak,butthatgivesnosense.Attachafewnumberstoittobeonthesaferside.

3. Donotwriteyourpassworddownonastickyattachedtoyourscreen,oranywhereonyourworkspace.Ifyouneedtowriteitdown,putthepaperwithitintoyourwallet,butneveranywherenearthecomputer.

4. Donotsaveafilewithallyourpasswordsonyourcomputer.Ifyoucannotrememberthemall,writethemdown.Ifyoureallywanttosavetheminafile,encryptthatfile.


Trojanhorses Dictionary

EventhoughatrojanhorseissometimesalsocalledTrojan,itismoreaGreek.TheGreeksbuilttheso-called"trojanhorse"inthefightaboutTrojatogetintothetown,sotheyaretherealsnoops;)

Atrojanisaprogramthathasgottenontoyourmachinewithoutyourknowledgeandcontainsmaliciouscode,thatwouldforexampleallowpersonsusinganothercomputertoconnecttoyoursoveranetwork.Typicaltrojansareopentoanyonetryingtoconnect(anypersononyourlocalnetworkoreventheinternet).Specialtrojansaredesignedtomakeyourmachineaccessiblejusttothepersonwhoinfectedyourcomputerwiththetrojan.

Theaccessanoutsidercangainusingatrojanonyourmachinecanbenearlyanything.Fromwatchingallyourbehaviour(likeakeylogger),manipulatingyourcomputertobasicallydoinganythingyoucanalsodousingyourkeyboardandmouse.

Yourcomputercangetinfectedwithatrojanbymultipleways.Apersonwithphysicalaccesstoyourmachinecanplaceitthere,butyoucanalsoaccidentallyinstallityourselfbyopeninganunknownemailattachmentthatbychancecontainsatrojan.

Accordingtosomedefinitions,trojansarealsoprogramsthatsneakintootherprograms,forexampletogainaccess.Astheseprogramsareconsciouslyusedbytheother,theyarenottrojans,butarebackdoors.


Generalquestions

WhyisSpybot-S&D;thatfast?HowcanIcontributetothecause?WherearefeaturesliketheToolsorSettingssection?Whatisblindman.exefor?Arethereanycommandlineparameters?Ihavetwoinstallationsonmyharddisk.CanIscanbothatthesametime?HowcanIgetAdministratorrightsunderWindowsVista?IsSpybot-S&D;compatiblewithWinPE/BartPEbootableCDs?WhichbrowsersdoesSpybot-S&D;support?IsSpybot-S&D;compatiblewithotherresidentprotectiontools?Whatistheimmunizationfeatureandwhataretheotherpermanentprotectionoptions?WhatisnewatSpybot-S&D;1.5?

Updates

WhatfilesdoIneedtoupdate?Whyistheintegratedupdatenotworking?WhydoIreceivethemessage"updateisforbidden"/"badchecksum!!!"?WhydoesSpybot-S&D;freezeuponupdate?WhydoIreceivea"SocketError"?

Detections

WhydoesSpybot-S&D;alsoremoveIEtoolbarsthatseemusefultome?WhydootherspywareprogramsfindspiesinSypbot-S&D;'sdirectory?WhycanInotremovetheSti_Trace.log(orSchedLgU.txt)file?WhydoIreceiveadstitled"MessengerService",althoughSpybot-S&D;cannotfindanything?WhydoesSpybot-S&D;findsomanySpywareinstallers/howisthatDownloaddirectoriessettingused?

Whydootheranti-spywareapplicationsdetectsomanymoretrackingcookies?WhydoesSpybot-S&D;notdetectrunningprocesses?WhydoesMSAntiSpywarecomplainthatSpybot-S&D;addsbadsitestothetrustedzone?WhydoesSpybot-S&D;flagchangesintheWindowsSecurityCenter?

Bugsandproblems

WhatshouldIdoifmyinternetprogramsstoppedworking?WhydoesmynetworkreactveryslowlyafterinsertingtheHostsFile?Whyaretheresomeitemslefttoimmunize?Whyhasthenumberofscanneditemsbeenreduced(andnowsearchesforonlyafewitems)?WhatcanIdoifSpybot-S&D;flashesanddisappearsimmediately?WhycanInolongeraccessmyIEsettings?WhydoesSpybot-S&D;notscannetworkdrives(shares)?HowcanIdisablethenotificationspoppingupwhenadownloadwasblocked(e.g.AvenueA,Inc.,DoubleClick)?Whyaresomeproductssettobeignoredbydefault?WhatcanIdoifSpybot-S&D;freezesduringscan?

TeaTimer

HowdoIedittheBlack&WhitelistinresidentTeaTimer?HowdoIdisabletheTeaTimernotifications?WhatistheResidentTeaTimer?WhydoesResidentTeaTimerterminatetheapplicationbeforeasking?WhyisTeaTimercalledTeaTimer?

ErrorMessages

WhydoIreceivetheerrormessagethatthereisaprobleminHijackers.sbiandIshouldlookintotheIncludeerrors.logfile?WhydoIreceivetheerrormessage"ws2_32.dllmissing,EReadError"?/DoesSpybotnotrununderWindows95?WhydoIreceivetheerrormessage"NoZipFilespecified"whenIupdateorfix?

WhydoIreceivetheerrormessage"framedyn.dllismissing"?WhydoIreceivetheerrormessage"Problemsintheincludefile(Trojans.sbi)"?


WhyisSpybot-S&Dthatfast? FAQ#001

Therearedifferentwaystosearchforspies.Onewouldbetosearchthecompleteregistryandharddiskforsuspiciousentriesandfiles.Thatcantakealotoftime.

Spybot-S&Dtakesadvantageofthefactthatallspieshavetoanchorthemselvesatafewplacesoverthesystemtogetactive.Itstartstosearchatthisplaces,followingtheinformationgatheredtheretocatchthewholespy.


WhydoesSpybot-S&D;alsoremoveIEtoolbarsthatseemusefultome?

FAQ#002

NearlyallIEtoolbarshavesomethingincommon:theywanttomakethewebeasierforyou.Sadly,totailortheirinformationtoyourneeds,theyneedtocollectdataaboutyou;andmostprivacystatementsareunclearabouthowtheydousethisdatabesidesendingyouwhattheythinkiswhatyouwant.


WhatshouldIdoifmyinternetprogramsstoppedworking? FAQ#003

Ifyouremoveaspy,theapplicationthathasinstalleditmaynoticethisandrefusetoworkanylonger.Spybot-S&D;isabletoreplaceafewspieswithharmlessdummies;butwherethatisnotpossible,Irecommendeithertosearchforagoodalternativethatcomeswithoutspy-oradware,orusingtherecoveryoptioninSpybot-S&D;torestorethespy.Inthelatercase,youcandoitstepbystep,untilyoufoundthefilesthatareabsolutelynecessaryforthespy,andatleastkeepsomefilesfromyoursystem,likethedatasavedaboutyou.


WhydootherspywareprogramsfindspiesinSypbot-S&D;'sdirectory?

FAQ#004

Pleaselookatthepathwheresuchaprogramfoundthespyware.AsSpybot-S&Dhasnospywareintegrated,thismustbeafalsealarm.

Thereasonforsuchafalsealarmissimple:Spybot-S&Dsavesbackupsoftheproblemsyouhavefixed;tomakeitpossibletorecoverthemincasesomethingstopsworkingafterthefix.

IfthefilefoundisintheRecoverydirectoryinsidetheSpybot-S&Ddirectory,itissuchabackup.Itisnolongerofanyharmthere,asthefilewillnotbefoundandloadedfromthere.Butonceyouaresureyoudonotneedthebackup,gototheRecoverysectioninsideSpybot-S&Dandpurgethatfiles.

Currentversionscompresstherecoveryfilesintopassword-protectedziparchives,thusavoidingotherspywareapplicationswillgivefalsealarms.Someprogramsmightnotifyyouthattheycannotaccesstheseziparchives-thiscaneasilybeignored.Astherecoveryfilesarenamedafterthethreatsomeprogramsmightalsonaivelydetectthebackupsasthreatsjustbecauseofthefilename.Thiscanalsobeignored.

Inrecentweekstherewasanoticeablyhighnumberofcaseswhereotheranti-virusandanti-spywareprogramswronglydetectedpartsofSpybot-S&D,whichprobablyhastobetracedbacktoinsufficienttestingatthesecompanies.


HowdoIedittheBlack&WhitelistinresidentTeaTimer? FAQ#005

Pleaseright-clicktheResidenticoninthesystemtraySpybotS&DresidentandselectSettings.Thereyouwillfindfourlistsforremembereddecisions(allowed/deniedprocessesandregistrychanges).Inordertoremoveanentry,justclickonthecrossnexttoit.TeaTimerwillthen"forget"thisdecisionandyouwillbeaskedagainthenexttime.


WhycanInotremovetheSti_Trace.log(orSchedLgU.txt)file? FAQ#006

TheSti_Trace.logfileisopenedonmanymachines;mostoftenonWindowsME/2000/XP/Vista.ThereasonisthattheStillImageMonitorrunsallthetime,usingthisfile.YoucanusemsconfigtodisabletheStillImageMonitor,butasitisofnoharmIwouldsuggesttoaddthislogfiletothesingleignorelist.

ThesameisvalidfortheSchedLgU.txt;itisthelogfileofthescheduler.Iftheschedulerisrunning,thisfileiskeptopen.Ifyouarenotusingthescheduler,Isuggestdisablingit,thiswillnotonlyallowyoutobackupthisfile,butalsosavesomeRAM.

(Toaddaproblemtothesingleignorelist,simplyright-clickonitintheresultslist,andchoosetheappropriatemenuitem.)


WhydoIreceivetheerrormessagethatthereisaprobleminHijackers.sbiandIshouldlookintotheIncludeerrors.logfile?

FAQ#007

Thiserrorusuallyistheresultofupdatesyouhavemissedorinstalledonlypartially.Tosolvetheproblem,pleaseinstallallupdatescheckedbydefaultatleast,ifnotall.IfyoudonotwanttousetheupdatefunctionofSpybot-S&D;,takealookatthedownloadpage(onlinelink)hereanddownloadallmanualupdaters.

Thebackgroundofthisproblemareextensionstothedetectionenginewhichprovidenewwaysofdetectingmalware.TheseupdatesareusuallylabeledPlugin,contrarytotheweeklyDetectionupdate,andmightthereforebeoverlooked.Sinceversion1.4Spybot-S&D;andlaterallowyoutohidethesemessages,butthisisgenerallynotrecommendedsincemissingpluginsmightmeanmissingorreducedchancestofindthenewestmalware.



HowdoIdisabletheTeaTimernotifications? FAQ#008

ThereasonwhyTeaTimeraskedyouisbecauseitwouldaskyouaboutanysimilarchangesintheregistrywithoutregardingifitisgoodorbad.Therearesomanyregistrykeysthatitisimpossibletoclassifythembydefault.Sotheuserhastodecideifhewantstoallowitornot.TheTeaTimerismakingsnapshotfileswhenyoustartitthefirsttimeandthetooliscomparingthecurrentregistrywiththesnapshotfiles.

IfyouwanttomakenewsnapshotfilespleaseshutdowntheTeaTimerwiththeResidenticonandthenstartitmanuallyfromtheSpybotS&Dprogramfolder.Thereisnopossibilityyettohidethepopupswhichremindyouwhichkeysareblocked.Asaworkaround,youcanonlymakenewsnapshotfiles.


WhatfilesdoIneedtoupdate? FAQ#009

Updatescanbedividedintothefollowingcategoriesusually:

1. Detectionupdatesandplugins:theseupdatesareusuallypreselectedwhenyouusetheupdater,itishighlyrecommendedtodownloadthemwheneverthereareupdatesavailable,sincetheseareresponsibleforthedetectionrate.TheseareusuallynamedDetectionrules,Advanceddetectionlibrary,DetectionsupportlibraryorSomeplugin.

2. Localizedupdates:languagefilesandlocalizedproductinformation.ThesefilesarenotnecessaryifyouuseSpybot-S&D;exclusivelyinEnglish.Ifyouuseonlyoneotherlanguage,youjustneedyourlocalones.

3. Betaupdates:ifyouarewillingtohelpusimproveSpybot-S&D;,youmightdownloadtheseaswell.Donotforgettheusualbetadisclaimerthough:theremightbeabunchofnewfeatures,butthereisalsotheriskofnewbugs.

4. Malwaredocumentationandhelpupdates:asthenamealreadyindicates,theseareforthosewholiketoreadupsomeinformation,onmalwareandonSpybot-S&D.;

5. Fullupdates:rare,butwhenanewreleasecomesout,itwillusuallybeavailablethroughtheupdater.

Thesecondandthirdoptionarenotdisplayedbydefault;inversion1.4youcanenablethesecategoriesonthesettingspage,version1.5hastwocheckboxesforthemonthestartpageofthenewupdaterapplication.


Whyistheintegratedupdatenotworking? FAQ#010

Themainreasonforthisproblemisthatyouneedtouseaproxyservertoaccesstheinternet.Inthatcase,theproxyserverisalreadysetupinyourbrowser,whereyoucanlookupitssettingsandenterthemintoSpybot-S&D.;

InMozilla,youcanfindtheProxysettingsifyouopentheEditmenu,chooseSettings...atthebottom,andnavigatetothesectionAdvanced-Proxies.InInternetExplorer,seetheMenuExtras-Internetoptions,gotothetabConnectionsandclicktheSettingsbuttonatthebottom.InOpera,seetheMenuTools-Preferences,gotothetabAdvanced,sectionNetworkandclicktheProxyserversbutton.LookfortheHTTPproxythere.

BackinsideSpybot-S&D;gototheAdvancedMode(viamenuMode),thenchooseSettings→Settings,andscrolldowntotheentryAutomation-Webupdate-Useproxy.Nowchecktheboxbelowit,andadialogwillappearwhereyoucanenteryourproxysettings.

Theformatishost:port(thehostisthename,theportthenumberyoufoundinyourbrowser).Ifyouneedtoaccessyourproxyusingalogin,youcanusetheformatusername:password@host:port.


Whydoreceivetheerrormessage"ws2_32.dllmissing"(andothers)? FAQ#011

Spybot-Search&Destroy1.4wasincompatiblewithWindows95,whileversion1.3orearlierandversion1.5andlaterarecompatible.However,thelackoffollowingupdatesusuallycausesproblems(allfollowinglinksareonlinelinks):

HTMLHelp1.3Ifyoureceivethemessage"Errormessage:HHCTRL.OCXismissing",youareprobablyusinganoldversionofInternetExplorer,thustheneededHTMLhelpcomponentsarenotinstalled.Winsock2Ifyoureceivethemessage"Errormessage:WS2_32.DLLismissing",youneedaWinsockupdateforWindows95.MoreinformationisavailableinMicrosoft'sknowledgebase.ActiveAccessibility1.3Spybot-S&D;triestosupportsolutionsfordisabledpeople,soyouneedtoinstalltheActiveAccessibilityruntimepackageifyoureceivecomplaintsaboutproblemsinoleacc.dll.CommonControlsSpybot-S&D;mightalsoneedthisupdateifthingsarenotprobablydisplayedoryoureceivemessagesaboutothermissingfunctions.ShellFoldersIfyouarerunningoneoftheolderWindows95releasesanddonotevenhaveInternetExplorer4,youneedthisupdateforanewerSHFolder.dll,whichisresponsiblefortheApplicationDatafolderusedbymanyapplicationstostoredata.

WerecommendtheseupdatestoanyWindows95anyway,andwehaveincludedanoptiontodownloadandinstallmissingupdatesintheinstallerofSpybot-S&D;1.5.


http://www.microsoft.com/downloads/details.aspx?FamilyID=2363a6fc-cb70-464d-85e6-f598c11ccecf&DisplayLang=en

http://support.microsoft.com/?scid=kb%3Ben-us%3B194347&x=11&y=7

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q285189

http://www.microsoft.com/downloads/details.aspx?FamilyID=4179742f-1f3d-4115-a8ba-2f7a6022b533&DisplayLang=en

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=CB2CF3A2-8025-4E8F-8511-9B476A8D35D2

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=6AE02498-07E9-48F1-A5D6-DBFA18D37E0F

WhydoesmynetworkreactveryslowlyafterinsertingtheHostsFile?

FAQ#012

Pleasereadthisarticle(onlinelink).


http://accs-net.com/hosts/faq.html#19

WhydoIreceiveadstitled"MessengerService",althoughSpybot-S&D;cannotfindanything?

FAQ#013

ThesearesentusingtheMessengerserviceintegratedintoWindows2000andXP(trythenetsendcommandtoseeforyourself).

TodisabletheMessengerservice,gotoStart→AllPrograms→AdministrativeTools→Services.InServices,clickonServices(Local),thenontherightside,findMessengeranddisableit.

Note:noteveryonewillhaveAdministrativeToolsintheStartmenu.YouneedtomakeitvisibleunderTaskbarandStartMenuProperties(right-clickontaskbar→Properties).ThesafestwaytogettoComponentServicesistoenter%systemroot%\system32\com\comexp.mscintothecommandline.


WhydoesSpybot-S&D;findsomanySpywareinstallers/howisthatDownloaddirectoriessettingused?

FAQ#015

Detectionoffilesthatmightbefoundinvariablelocations,typicallytheinstallerarchivesofmalware,issometimesoptimizedbycombiningtheirlookup,inwhichcasetheyreceivethisgenericname.

TheDownloaddirectoriessettingcanbeusedtoputspecialattentionforsuchfilesonfoldersyouuseforincomingfiles.Spybot-S&D1.5alsoaddsafewguessedlocationstothisinternallytoreducetheriskofforgettingstandarddownloadfolders.

Itisunnecessary,evencounterproductive,toaddwholedrivestothissetting!


Whyaretheresomeitemslefttoimmunize? FAQ#017

Ifyouarenotimmunizingwithfulladministratorrights,Spybot-S&Dmightnothavepermissiontoimmunizealluseraccounts.

IfyouareusingWindowsVista,youshouldalsoreadthisFAQentryaboutgettingAdministratorrightsunderVista.


WhydoIreceivetheerrormessage"NoZipFilespecified"whenIupdateorfix?

FAQ#018

ThishappensifyouhaveZipMagicfromAladdinSystems(tomyknowledgeitcamefromOntrackbefore)installed.ZipMagicdisplaysallzipfilesasfolders,andevendeniesotherapplicationsaccesstotherealzipfile.

Toallowanotherapplicationdirectaccesstozipfiles,ZipMagichasasettingsomewhereonitsOptionspage.YouneedtoaddSpybotSD.exethere.Instructionsfromkinduserfollow:

1. OpentheZipMagicproperties,2. ClickontheiconApplicationsattheleft.3. ChecktheoptionTheseapplicationsseeZipfilesasfiles,4. PresstheAdd...button,and5. SelecttheSpybotSDexecutableinthedialogappearing(usuallyC:\Programfiles\Spybot-Search&Destroy\SpybotSD.exe).

ThiswilltellZipMagictoallowSpybot-S&D;accesstozipfilesagain.


HowcanIcontributetothecause? FAQ#019

Asyoumayhaveread,weareworkingfull-timeonthisfreeproject,butwehavegottopayhostingbillsanddevelopmentsoftware.Sowewouldbegladifyoucoulddonateasmallamount(onlinelink)toourcause.Thankyou:-)


http://www.safer-networking.org/en/donate/index.html

WherearefeaturesliketheToolsorSettingssection? FAQ#021

IfyouhaveafreshinstallationofSpybot-S&D,youmaymisssomefunctionsliketheToolsorSettingssection.TheyhavenotvanishedbutSpybot-S&Dhastwodifferentmodes.FromthemenubaritemModeyoucanchoosebetweenDefaultModewiththebasicfunctionsandAdvancedModewhereyouwillfindtheToolsandtheSettingssection.


Whyhasthenumberofscanneditemsbeenreduced(andnowsearchesforonlyafewitems)?

FAQ#022

PleaserunSpybot-Search&Destroy;andswitchtoAdvancedmodeviathemenubaritemMode,thenselectSettings→FileSetsintheleftbar.

There,pleaseright-clicksomewhereintothelistandchooseSelectallavailablechecks.


WhatcanIdoifSpybot-S&D;flashesanddisappearsimmediately? FAQ#023

ThismighthappenifyouenablealloftheProgramautomationsettings.Whileversion1.5shouldnotallowyoutolockyourselfoutthisway,hereareinstructionsonhowtorevertthis,e.g.forolderversions:

1. Youcandeletetheconfigurationfile(whichisnamedConfiguration.ini).WhereitislocateddependsonyourWindowsversion.

ForWindows95/98,thefileislocatedinC:\Windows\ApplicationData\Spybot-Search&Destroy\.ForWindowsME,thefileislocatedinC:\Windows\AllUsers\ApplicationData\Spybot-Search&Destroy\.ForWindowsNT/2000/XP,thefileislocatedinC:\DocumentsandSettings\AllUsers\ApplicationData\Spybot-Search&Destroy\.ForWindowsVista,thefileislocatedinC:\ProgramData\Spybot-Search&Destroy\.

Eitherdeletethatfile,oreditit(forexampleinnotepad),andsetalltheAutomationvaluesinittozero.

2. Youcandownloadasmalltoolthatwilldothosechangesforyou:clickhere(onlinelink).

Ifthisdoesnotfixtheproblem,yoursystemispossiblyinfectedbytheCoolWWWSearch.SmartKiller(v1andv2).Thisisanew,reallyuglyvariantofCoolWWWSearch.Whenrunning,itwillcloseeverybrowserwindowvisitingananti-spyware-site.ItwillevencloseSpybot-S&D;andsomeotheranti-spywareapplicationsaswell.

SoifyourcopyofSpybot-S&D;(ortheanti-spywareapplicationofyourchoice)closesafewsecondsafterstarting,oryourbrowsercloseswheneveryoutrytovisitananti-spywaresite,checkourCWS.SmartKillerremovalutility(onlinelink).


http://www.safer-networking.org/files/resetsettings.zip

http://www.safer-networking.org/files/delcwssk.zip

WhycanInolongeraccessmyIEsettings? FAQ#024

InternetExplorertellsyoutocontactyouradministratorwhenyoutrytoaccesstheIEsettings?

ThiscanhappenifyouuseSpybot-S&DinadvancedmodeandyouhaveusedtheImmunizefeaturewithoutreadingallthetext.

1. PleasestartSpybot-S&Dagaininadvancedmode(usuallyfromtheStartmenugroupSpybot-Search&Destroy,untilyouhavealreadychangedthedesktopicontoadvancedmode).

2. SelectToolsintheleftbar,thenIEtweaks.3. ThereyouwillseeagroupRecommendedmiscellaneouslocks.Untickthe

checkboxesinfrontofbothLockIE...options.4. YoumayneedtocloseallExplorerwindows,andmaybeevenrestart

Windowsbeforethesechangestakeplace.

Hint:thislockfunctionhasbeenaddedmostlyformulti-userenvironmentswhereyouwouldnotwantotherusersofyourcomputertochangeyourIEsettings.Ifyouaretheonlyuserofyourcomputer,thereisnorealneedtoenablethem.


Whatisblindman.exefor? FAQ#025

Someofyoumayhavenoticedanewfileblindman.exeinsidetheSpybot-S&D;folder,andhaveaskedyourselfwhatitisfor.Inshortwords:itdoesnothing.

IguessanexplanationisneededwhyafilethatdoesexactlynothingcomeswithSpybot-S&D.;Spybot-S&D;offersatooltocontroltheSystemstartupinitsToolssection.ThisincludestheabilitytodisableorenablestartupentriesfromtheAutostartgroup(foundinyourStartmenuunderPrograms).Thisgroupcontainslinkstotheactualfiles.Windowsstoresthoselinksasfileswiththeextension.lnk.WhenWindowsencountersa*.lnkfileinthatfolderuponstartup,itwillstartthelinkedapplication.Nowtheeasiestwaytodisablethoseentriesistochangetheextension.TheSystemstartuptoolofSpybot-S&D;doessimplychangetheextension.lnkto.disabled.Thiseasilypreventsthelinkedapplicationfrombeingstarted.ButasWindowsdoesnotknowthisextension,thiscouldslowthestartupdown.SoSpybot-S&D;doeslinkthatextensiontoblindman.exe.Windowsnowtriestorunthe.disabledfilewithblindman.exe-andasblindman.exedoesexactlynothing,thereisnoslow-downinbooting.

Somepeoplehavesuspecteditcouldevenbespywareitself.ForthoseIwillprinttheDelphisourcecode(blindman.dpr)here(theincludedresourcefileisblindman.resandcontainsjusttheicon):

programblindman;

{$R*.res}

begin

end.

Anyoneknowingaverysmallbitofprogrammingshouldseethatthisprogramistotallyharmless(actually,theversionshippedwithSpybot-S&D;1.5isabitlargerthantheabove,becauseoneofMicrosoftscertificationrequirementsisthateveryexecutablefileneedtocallGetVersionExatleastonce,andneedsto

crashoninsertedinjections,evenifjusta1millisecondemptydummy).


WhydoesSpybot-S&D;notscannetworkdrives(shares)? FAQ#026

Scanningnetworksharessoundslikeagoodideaatfirst-thescannerneedstobeinstalledonlyonasinglemachineandonepersoncandothescan.Tosimplyremoveinstallers,thisisnotabadideaatall,soSpybot-S&DallowstoaddnetworksharesaswellinitsDownloaddirectoriessetting.

Butscanningforandremovingfilesonothercomputerscanbedangerousaswell.Mostthreatsarenotonlyfiles,butalsolinkedbyregistryentries-removingjustthefileswouldcausethe'cleaned'Windowstoproducealotoferrors.Butwhilethosemessagesmaybeharmless(andremoteregistrycleaningcouldatleastbeaddedforNT/2000/XP/Vista),thereisanevenworsecase-somethreatsneedtoberemovedbyusingAPIcalls.RemovingLSPhijackersbyjustdeletingtheirfilewilldisablethenetworkaccessofthecleanedmachine,andrepairingLSPsbyfixingtheregistryisnotfail-safeeither.

Thatiswhyananti-spywaretoolneedstoberunoneachmachine.Wearedevelopingaclient/serverscanningsystemthatwillworkinnetworkenvironments.


WhydoIreceiveanerrormessage"framedyn.dllismissing"? FAQ#027

PleasevisitthisMicrosortsupportpage(onlinelink);youcandownloadthefilehere(onlinelink)forexample.Moreinformationisavailableinourforum(onlinelink).


http://support.microsoft.com/default.aspx?scid=kb;en-us;319114

http://www.dll-files.com/dllindex/dll-files.shtml?framedyn

http://forums.spybot.info/showthread.php?t=668

Arethereanycommandlineparameters? FAQ#030

HereisalistofcommandlineparametersthattheSpybot-S&Dmainexecutable(SpybotSD.exe)supports:

/taskbarhideRunsSpybot-S&Dcompletelyhidden(nowindow,notaskbaricon),somakeabsolutelysureyouuseitonlyincombinationwith/autoclose(otherwiseitwouldremaininmemorysittingidle).Usefulonlyincombinationwith/autocheck,/autoupdateor/autoimmunize,asitcannotbecontrolledwhencompletelyinvisible./minimizedStartsthewindowminimized./uninstallUninstallsSpybot-S&D.Thiscommandlineparameterisveryoutdated-unins000.exeshouldbeusedinstead!/blinduserStartswithsupportforblindusers(specialmenus)./autoupdateDoesanupdateafterstartingtheprogram./autocheckStartsscanningimmediately./autofixFixesproblemsafterscan./autocloseClosesprogramafterithasscannedorupdated./autoimmunizeRunstheimmunizationatprogramstart./onlyspywareFixesonlyspyware(red)entrieswith/autofix,leavingallusagetracksastheyare./easymodeStartswitheasierinterfaceforbeginners./createenglishUpdatestheEnglish.sbllanguagefilewiththenewesttexts;usefulonlyfortranslators.

AndhereisalistofcommandlineparametersthattheSpybot-S&Dinstaller(spybotsd15.exe)supports:

/sp-Willskipthefirstpageoftheinstallationwizard(Doyouwishtocontinue?...)/silentWilldisplaytheprogressduringinstallation,butnotthewizard./verysilentEventheprogresswillnotbeshown.Errorsetc.wouldstillbeshown./surpressmsgboxesWillusestandardactionsformessageboxes(nooverwritingoffiles,cancellingwherethealternativewouldberetrying...)/log(or/log="filename")Createsalogfileinthetempfolderthatcontainsdetailedinformationaboutactionstakingplaceduringtheinstallation./nocancelDisablestheCancelandClosebutton.Usefulwith/silent./norestartSuppressrebootseveniftheywerenecessaryattheendoftheinstallation./restartexitcode=NIfarestartisneeded,thesetupwouldreturnthespecifiedexitcode./loadinf="filename"(and/saveinf="filename")Canbeusedtouseasavedsetupconfiguration(orsaveone)./lang=languageOverridesthelanguagedialogwithapredefinedlanguage.UseISO2letterlanguagedescribershere./dir="x:\dirname"Installsintothatdirectoryinsteadofthedefaultone./group="foldername"Installsintoaprogramgroupofthatnameinsteadofthedefaultone./noiconsAvoidscreationofanyiconsfortheinstalledsoftware./type=typenameStartsinstallationwithagivetype.Supportedtypesare

full,blindandcompact.

/components="commaseparatedlistofcomponentnames"

Installsthegivencomponentsinsteadofthedefaultones.Supportedcomponentsare

main,blind(iconsforblindusers),language(alllanguagefiles),skins,updatedl(fordownloadingupdatesaspartoftheinstallation),updatew95(todownloadprerequisitesonWindows95),SDWinSec(toinstalltheSecurityCenterintegrationonVista),SDShredder(toinstallthestand-aloneshredder),andSDDelFile(toinstallthefileremovalhelper).

/tasks="commaseparatedlistoftasks"Specifiesalistoftasksthatshouldbeexecuted.Taskscurrentlysupportedare:

desktopiconquicklaunchiconlaunchsdhelperlaunchteatimer

/mergetasks="commaseparatedlistoftasks"Sameas/tasks,justwiththeexceptionthatstandardtasksarenotdisabledbydefault.

Note:PleasebeawarethattheSpybot-S&Dpathhastobeinquotationmarksandmultipleparametershavetobeseparatedbyaspace.

Example:"C:\ProgramFiles\Spybot-Search&Destroy\SpybotSD.exe"/taskbarhide/autoclose/autocheck/autofix/onlyspyware


WhydoesSpybot-S&D;freezeuponupdate? FAQ#032

Spybot-S&D;canbefreezedupiftheserversarereactingveryslowly.Thisoftenhappensthedaynewupdatesarereleased,whentoomanypeopletrytodownloadthematthesametime-itisjustdelayedthoughandveryslowinreacting.Thereareafewpossiblesolutionsforthisproblem:

1. Waitaminute,itshouldbeactiveagain.2. Selectadifferentdownloadlocation:AfterSearchforupdate,youcan

selectanothermirrorinthetoolbar.Todothat,clickthesmallarrownexttothecurrentlyselectedmirrorname.

3. Pleasetryagainlater.

InformationaboutupdatingisalsoavailableinoursectionHowto(onlinelink;includesascreenshot);takealookatpoint5ofthisdescriptionthatshowsyouhowtoselectadifferentdownloadlocation.


http://www.safer-networking.org/index.php?page=howto&detail=update&lang=en

WhatistheResidentTeaTimer? FAQ#033

TheResidentTeaTimerisatoolofSpybot-S&D;whichperpetuallymonitorstheprocessescalled/initiated.Itimmediatelydetectsknownmaliciousprocesseswantingtostartandterminatesthemgivingyousomeoptions,howtodealwiththisprocessinthefuture.YoucansetTeaTimerto:

beinformed,whentheprocesstriestostartagainautomaticallykilltheprocessorgenerallyallowtheprocesstorun

Thereisalsoanoptiontodeletethefileassociatedwiththisprocess.

Inaddition,TeaTimerdetectswhensomethingwantstochangesomecriticalregistrykeys.TeaTimercanprotectyouagainstsuchchangesagaingivingyouanoption:YoucaneitherAlloworDenythechange.

AsTeaTimerisalwaysrunninginthebackground,ittakessomeresourcesofabout5MB.


WhydoesResidentTeaTimerterminatetheapplicationbeforeasking?

FAQ#034

Becausethreatsliketolldialersaretimecritical-theycostfromthefirstsecondtheyhaveconnected.Inordertoprotectyou,thesehavetobeterminatedbeforetheycanconnectatall,atthemomenttheyappear.


WhyisTeaTimercalledTeaTimer? FAQ#035

Asweusedtoforgetourteawhenweletitbrew,webuiltasmalltoolwithasystemtrayicontoremindus.WecalledthistoolTeaTimer.

WhenwestartedtodeveloptheResidenttoolforSpybot-S&D,wealsoneededasystemtrayiconforthis.Aswedonotlikehavingtoomanyiconsinthesystemtray,wedecidedtoputbothtoolstogetherandkeptthenameTeaTimer.

AfutureversionoftheResidenttoolmighthavethefunctionsoftheoriginalTeaTimeragain.


Whydootheranti-spywareapplicationsdetectsomanymoretrackingcookies?

FAQ#037

Someanti-spywareapplicationshavestartedtodetectnearlyeverythird-partycookietheyfindasatrackingcookie.Inmanycases,thatismoreorlesscorrect,sincemanycontainaGUID(GenericUniqueIdentifier).

Butinsteadofbloatingourdetectiondatabasewiththousandsofcookiesoutthere,wepreferrecommendingtochangeyourbrowsersettingsabittoblockoutallthesethirdpartycookiesbeforetheyevencomeintoyoursystem(allfollowinglinksareonlinelinks):

InternetExplorer:Open"InternetOptions..."fromthe"Tools"menu.Choosethe"Privacy"tab,andraisetheSettingstoatleastMedium;orusethe"Advanced..."buttontoenabled"Overrideautomaticcookiehandling"andset"Third-partyCookies"to"Block".Screenshot1Screenshot2Firefox1.x:Open"Options"fromthe"Tools"menu.Clickthe"Privacy"icon,andopenthe"Cookies"category.Under"Allowsitestosetcookies",justsetthe"fortheoriginatingwebsiteonly"option.ScreenshotFirefox2.0:Type"about:config"intoFirefox'saddressbar,thentype"network.cookie.cookiebehavior"inthe"Filter"box.Thatwillleaveonesettingslinevisible;double-clickit,type"1"inthe"Enterintegervalue"box,thenclickOK.Mozilla/Netscape:Open"Preferences..."fromthe"Edit"menu.Openthecategory"Privacy&Security"andclickonitsfirstentry"Cookies".Inthegroup"CookieAcceptancePolicy",select"Allowcookiesfortheoriginatingwebsiteonly".ScreenshotOpera:Open"Preferences"fromthe"Tools"menu.Clickon"Privacy"inthelistontheleft,thenopenthepull-downlistabout"Thirdpartycookies"ontherightandsetitto"Refuseallcookies".ScreenshotOpera9:Open"Preferences"fromthe"Tools"menu,goto"Advanced"

http://www.safer-networking.org/images/3rdpcookies/ie-en-1.png

http://www.safer-networking.org/images/3rdpcookies/ie-en-2.png

http://www.safer-networking.org/images/3rdpcookies/firefox-en-1.png

http://www.safer-networking.org/images/3rdpcookies/netscape-en-1.png

http://www.safer-networking.org/images/3rdpcookies/opera-en-1.png

→"Cookies"andselect"AcceptcookiesonlyfromthesiteIvisit.".


DoIneedthisFAQ? FAQ#039

BeforeyoureadthisFAQorothersupportdocuments,wewouldrecommendthatyouusetheupdatefunctionandseeifyouhavethemostcurrentupdatesforSpybot-S&D;(weremovedsomeFAQentriesforversionsfromlastyearorearliertokeepthisFAQeasiertolookthrough).

Ifyouhave,wehopetobeabletohelpyoueitherhere,onthesupportforumorbyemail.


WhydoesSpybot-S&D;notdetectrunningprocesses? FAQ#040

Butitdoes!Thisisoftenmisunderstoodaswedonotdisplayanextralistofrunningprocessesafterthescan.Butwedonotseethatasnecessary-everyrunningprocessisidenticaltoafileontheharddisk,becauseaprocessismoreorlessthatfileloadedintomemory.

ButwhenyouuseSpybot-S&D;tofixproblems,itwillautomaticallyterminatethebadprocessesdetectedbeforedoinganythingelse.AndifyouareusingourTeaTimer,TeaTimerwilldetectmalwareprocessesassoonastheyarestartedandterminatethem.

Ourlogsofcoursedoincludeafulllistofprocesses,andsinceversion1.4Spybot-S&D;evenlistsopennetworkconnectionsperprocess(exceptforonVista),allowingyoutoeasilyseewhichprocessesareconnectingtotheoutsideandwhereto.


Ihavetwoinstallationsonmyharddisk.CanIscanbothatthesametime?

FAQ#041

Yes,ifyouhaveWindows2000,XP,2003orVista,Spybot-S&D;doesallowyoutoscaninactiveWindowsversionsaswell,includingtheregistryofotherinstallations!

Toscanyoursystemincludinginstallationsonotherpartitions,right-clickthelink/iconyouusetostartSpybot-S&D;,andadd/allhivestothecommandline(separatedbyaspacefromtherest).IfyounowstartSpybot-S&D;throughthislink,itwillautomaticallydetectotherinstallations,andscantheirsregistriesandfilesaswell.


HowcanIgetAdministratorrightsunderWindowsVista? FAQ#042

OnWindowsVista,Spybot-S&D;mighttellyouthatforsomeactions,youarenotbeingallowedtooperatethem,sincetheywouldrequireadministrationelevation.Youcansolvethisproblemasfollows:

1. Right-clicktheSpybot-Search&Destroy;entryinyourstartmenu,insteadofjustleft-clickingtostartit.

2. ChooseRunasadministratorfromthecontextmenu.


IsSpybot-S&D;compatiblewithWinPE/BartPEbootableCDs? FAQ#043

Yes,Spybot-S&D;hasfullsupportforPEingeneralandPEBuilder.Youcandownloadthenecessarypluginforversion1.4here(onlinelink)orforversion1.5here(onlinelink),orrunitfromyourharddiskafterbootingaPEdisk.

OncerunfromyourbootablePECD,Spybot-S&D;willautomaticallyscanallregistryanddrivesitcanfind(ifyouwantthatfeaturewithoutPE,seethisFAQentry.


http://www.safer-networking.org/files/peplugin.zip

http://www.safer-networking.org/files/peplugin15.zip

HowcanIdisablethenotificationspoppingupwhenadownloadwasblocked(e.g.AvenueA,Inc.,DoubleClick)?

FAQ#044

ThismessageiscreatedbythebaddownloadblockerforIE,atoolofSpybot-S&D.;Thefeatureofthesilentbaddownloadblockerinversion1.5isinadifferentplacethaninolderversions.

PleaseopentheToolsmenuinyourInternetExplorerandchooseSpybot-S&D;-Configuration.Thereyouwillfindadropdownmenu(seescreenshotbelow)whereyoushouldselectBlockallbadpagessilently.Withthatoptionsetthenotificationswillnolongercomeup,butyouwillstillhavetheprotection.

NewconfigurationforIEplugin


WhydoesMSAntiSpywarecomplainthatSpybot-S&D;addsbadsitestothetrustedzone?

FAQ#045

ThatisamistakebyMicrosoft.Microsofthasreleasedknowledgebasearticle902956(onlinelink)thatdescribesthisproblemoftheirs.


http://support.microsoft.com/kb/902956/EN-US/

WhydoesSpybot-S&D;flagchangesintheWindowsSecurityCenter?

FAQ#046

Spybot-Search&DestroydetectsregistrychangesassociatedwithMicrosoftSecurityCenter;theyarelistedas"WindowsSecurityCenter".Thisisneitherafalsepositivenorabug.Itisjustaninformationaboutapotentialthreat-Spybot-S&DonlywantstobringtoyourattentionthatsomeoneorsomethingdisabledoneormorenotificationsintheWindowsSecurityCenter,e.g.thenotificationsthatyourvirusprotectionisnotactiveornotup-to-date.

IfyouchangedthesettingsyourselfyoucansafelytellSpybot-S&Dtoexcludethosedetectionsfromfurtherscans.Inordertodoso,pleaseright-clickeachinturn,thenclickExcludethisdetectionfromfurthersearches.Thatway,shouldanyotherpartofsecuritycentersettingschange,Spybot-S&Dwillstilldetectthose.Thesameistrueifyouhaveanothersecuritysolutioninstalled(likeMcAfeeSecurityCenterorNortonInternetSecurity).TheseprogramsdisableannouncementsofWindowSecurityCenterinordertosignalthingsbythemselves.

ThereasonwhythechangesareflaggedbySpybot-S&Disthattherearealsomalwareprogramsthatdisablethenotificationssotheuserdoesnottakenoteofhissecuritytoolsnotbeingeffective.Somemoreinformationisalsoavailableinourforum(onlinelink).



WhichbrowsersdoesSpybot-S&D;support? FAQ#048

Spybot-S&D;doessupportmanycommonbrowsers.Asforresidentprotection,Spybot-S&D;containstheResidentTeaTimerwhichiscompletelybrowserindependent.ItisaSpybot-S&D;toolperpetuallymonitoringtheprocessescalled/initiated.Inaddition,TeaTimerdetectschangestosomecriticalregistryvalues.

Spybot-S&D;supportsdetectionincookies,history,start&searchpagesandbookmarksofthesebrowserspluscacheforInternetExplorerandOpera(allfollowinglinksareonlinelinks):

BeonexCommunicatorFirefoxpre-0.9,0.9,1.x,2.0andcompatible,includingoldFirebirdvariantsK-MeleonMicrosoftInternetExplorer5.0,5.5,6.0,7.0MozillaSuiteNetscapeCommunicator4.x,6,7Opera4.x,5.x,6.x,7.x,8.x,9.xandcompatibleThunderbird1.xandcompatible(whereapplicable)


http://www.beonex.com/

http://www.mozilla.org/products/firefox/

http://kmeleon.sourceforge.net/

http://www.microsoft.com/windows/IE/

http://www.mozilla.org/products/mozilla1.x/

http://www.opera.com/

http://www.mozilla.org/products/thunderbird/

IsSpybot-S&D;compatiblewithotherresidentprotectiontools? FAQ#049

Usingmorethanoneanti-spywareprogramwitharesidentprotectiontoolmightcauseconflicts.However,Spybot-Search&Destroy'sResidentprotectionisdesignedsuchthatthereshouldnotbeanycompatibilityissues.

OnethingthatcouldappearisthatanotherprogrammdetectsourTeaTimerasbad-becausetheoretically,ithasthesamefunctionasakeyloggerasitrunsinthebackground.Butonlytheoretically-itisarealtimeprotectiontoolforyouandthereisnothingbadaboutit.

AnotherissuecouldbethattheKeyloggerdetectionfilesKeyloggers.sbiandKeyloggers.*.nfoofSpybot-S&D;aredetectedasActivityMonitorkeylogger.ThesedetectedkeyloggersarejusttheSpybot-S&D;detectionrules,whichobviouslyneedtocontainthenamesofthethreats.Pleaseignorethesefalsepositives.

Formoreinformationwecreatedacompatibilityoverview(onlinelink)listingsomesoftwareforwhichtherehavebeenquestionsoncompatibility.

Onelastthingcouldbethatremoveditemswhicharenowstoredintherecoveryareaaszipfilesarebeingdetected.Thezipfilesareneededfortherecovery.IfsomethingdoesnotworkafterfixingaproblemwithSpybot-S&D;youcanrestorethesefiles.Sothereisnothingbadwiththem,either.


http://www.safer-networking.org/en/compatibility/index.html

Whatistheimmunizationfeatureandwhataretheotherpermanentprotectionoptions?

FAQ#050

Beginningwithversion1.2,Spybot-S&D;hasbeenallowingyoutoimmunizeyourcomputeragainstsomespyware.Thishasbeenextendedineveryfurtherrelease,andtweaksbrowsersettingstousetheirmethodsofblockingcookies,malwareinstallations,badwebsitesandmore.SDHelperisanInternetExplorerpluginthataddsasecondlayerforblockingbadstuff.ResidentTeaTimerisexplainedinthisFAQentry.


Whyaresomeproductssettobeignoredbydefault? FAQ#051

CDillaandSideSteparelistedintheignoreproductsbydefault.PleaseseethetopicWhyareCDilla&SideStepcheckedinIgnoreProducts?(onlinelink)inourforum.



WhatcanIdoifSpybot-S&D;freezesduringscan? FAQ#052

ThiscouldbecausedbyseveralreasonslikeanoldversionofSpybot-S&D;,toomuchtemporaryfilesorproblemswiththesystemrestorepoint.

IncaseyouareusingadatedversionofSpybot-S&D;,asafirstsolution,pleasedownloadthelatestversionofSpybot-Search&Destroy,whichshouldfixtheproblem.Youwillfindlinkstoseveraldownloadlocationsonourhomepage(onlinelink).DonotforgettousetheintegratedupdateafterinstallingSpybot-S&D.;

Ifthisdoesnothelp,pleasedeletethecontentsofyourWindowstempfolderandtryitagain.Also,youmightwanttodisabletheCreatesystemrestorepointwhenfixingspyware/usagetracksoptiononthesettingspage.



WhydoIreceivea"SocketError"? FAQ#053

Pleasetakealookatthesecuritysettingsofyourfirewall(ifyouareusingone)andmakesurethatSpybot-S&D;isnotblocked.Thatshouldhelptogetintotheupdates.IfSpybot-S&D;isnotblockeditisalsopossiblethatourserveristemporarilynotavailable.Pleasetryagainafewhourslater.

Ifthisdoesnothelppleasedownloadthemanualupdatershere(onlinelink;hereisalsoadirectdownloadlink).Themanualupdatersareself-installing,youjustneedtoexecutethem.



http://www.spybotupdates.com/updates/files/spybotsd_includes.exe

WhydoIreceivetheerrormessage"Problemsintheincludefile(Trojans.sbi)"?

FAQ#054

Pleasedownloadtheupdatecalled"TCP/IPSettingsplugin"usingtheintegratedupdatefunction,or,ifyoudonotusetheintegratedupdate,youcandownloadamanualinstallerfromourdownloadpage.

Ifevenafterupdating,thefileisnotthere,youcantrythefollowing:

1. CloseSpybot-S&D.;2. Unzip(extract)theplugtcpip.zipfilethatisinyourSpybot-S&D;\Updates

foldertothemainSpybot-S&D;folder.3. RestartSpybot-S&D.;

Formoreinformations,pleasedoalsohavealookatourforum.




WhatisnewatSpybot-S&D;1.5? FAQ#055

Anoverviewofthemostimportantchangessinceversion1.5ofSpybot-S&D;:

Systemsupport

RestoredWin95compatibilityImprovedWinecompatibilityFixedHyperThreadingissuesImproved64bitimmunizationCreatePortable.iniinmainfoldertouseappfolderasdatafolderaswellNewwarningsaboutmissingadminrightsonWindowsVistaSupportformulti-linebookmarks(IE7/Vista)NewImmunizationforFirefox&MozillaImprovedImmunizationforOpera

Reports

AddedversioninfotobugreportIncludeErrors.lognowincludestimestampsImprovedWindowsversiondisplay

Misc

"Singleexcludes"nowincludefilenamestobemoreuniqueImprovedsettingsretrievalfromregistry(mixedinstallations)Fixed.regimportbugsAddedsupportforautomatedremovalofF/PsfromhostlistsChangedupdateUserAgentandReferrerImproved(Vista-compatible)supportforfastuserswitchingUpdaternowinseparateexecutablefileVistamanifestsforassigningrequiredrightstoeachapplicationDeactivatedlistofactiveportsperprocessforVista(incompatible)Fixedsupportforhandleliston64bitsystems

Improveddisabling/enablingBHOsNewspecialerrorreportingforbetaversionsSupportforWindowsErrorReportingforpublicversionsFixedupdate-relatedcrashesonVistaFixedmemoryleaks(replacedIndywithSynapse)Vista-compatibleMSIinstallerforthosewholike/needthatSupportforalphatestsonservicesanddomainslistsAddedhundredsofnewautomatedtestsofinternalfunctionalityforprereleaseQAAddedTeaTimerhideicon(disabled)registryvalueininstaller

Detectionandremovalofthreats

ImprovedPEdetectionallovertheplaceNew64bitdetectionallovertheplaceImprovedfileremovalmethodsAddedoptionalcustomRecoveryDirsettinginDefault.iniAutomaticguessingof"DownloadDir"foldersAddedsupportforrenamingservicesbeforestopping/killing/deletingthemImprovedpluginsupport(example:currentTCP/IPPlugin)SupportforregularexpressionsnearlyallovertheSBIinterfaceMuchimprovedlogicconnectionsbetweenfiles,registryandAPIdetections(otherswouldinventanewTLAforthat*g*)Speed-upsthroughimprovedcachesFileversioncheckingAuthenticodecheckingImprovedarchivescheckingFasterfulltextcheckingImprovedSysInternalsfilelocationalgoImprovedhostsfilelocationalgoAddedsomemoreOpera9detectionschemes

Userinterfacechanges

Fixed"showmoreinformation"panelsImplementedworkaroundsformisarrangedbuttons(includingTeaTimer)Improvedsupportfor/allhivesintoolssection(inactiveinstallation

support)FixedflagshownonshortcutbarafterchangesFixedIEproxyimportinwizardChanged"useproxy"buttontocheckboxImprovedlocalizationonsimpledialogsAddedoptiontoaddaproxyinsideappifrunningonWinPEImprovedlocalizationoflistofupdatesAddedFirefoxicononCookieexcludepageFixedbadkeyboardhandlingonsomeexcludelistsFixedcookieremovalselectionproblemsNewconfirmationdialogforsystemrestorepointsChangeddefaultfonttoTahomaRedcross(trademarked)replacedwithgreencrossMade"Check"optionunavailableduringfixProcesslistnowisabitlesseagerontooltipsImproved"delaystart"dialogsNowdisplayschecksumforeachresultforbettertrackbackofresultsFixed"IgnoreProducts"columnwidthproblemsonVistaImprovedlocalizationofproductdescriptionsAdjustedwizardfornewsituation(externalupdateretc.)FixedToolssnapshotcomparisonhighlightingMadedisplayofregistrychangesinresultslistlessconfusingImprovedSDHelperdialogsandblock/allowchoicesUpdatedateformatoninfopagenowlocalizedDisplayedappversionisnowfourdigits(e.g.1.5.1.12)(De+)SelectallinlistofoldreportsImprovedWarning/ConfirmationdialogIEpluginConfiguration&InformationdialoginIEplugin


FAQ#056

Spybot-S&D;willuninstallfromtheWindowsAdd/RemoveSoftwarecontrolpanelwithoutproblems.

IfyouwanttocompletelygetridofSpybot-S&D;1.4(alsoearlierversions)andtheAdd/Removedoesn'thelp,youcandeletetheinstallationfolder(usuallyC:\ProgramFiles\Spybot-Search&Destroy\),thendownloadthisverysmallfixbyrightclickingandsavingit,thenexecuteit(important!-thiswillremoveallremainsfromtheregistry).

Ifyoujustwanttoupgradetoanewerversion,pleasefollowthesameinstructionslikeaboveandtheninstallthenewversion.

Afterfollowingtheseinstructionspleaserestartyoursystemsothatthechangescantakeplace.

Also,neithertheautomateduninstallnorthemanualuninstalllikedescribedabovewillremovethefollowingdirectories,whichyouwillhavetoremovebyhand:

Windows95or98:C:\Windows\AplicationData\Spybot-Search&Destroy\WindowsME:C:\Windows\AllUsers\ApplicationData\Spybot-Search&Destroy\WindowsNT,2000orXP:C:\DocumentsandSettings\AllUsers\ApplicationData\Spybot-Search&Destroy\WindowsVista:C:\ProgramData\Spybot-Search&Destroy\.

(PleasenotethattheApplicationDataFolderishidden.Soifyoucan'tfindthisfolderpleasecheckyourfolderproperties.)

Explanation:thisfoldercontainsthebackup(thequarantinedfiles)thatSpybot-S&D;creates.IftheUninstallwouldremovethisfolderaswell,thiswouldmeanthatthosebackupswouldbegone.WesawitafewtimesthatnewusersuninstalledSpybot-S&D;inpanicafterthey'veexperiencedasmallproblem,

http://www.safer-networking.org/files/remove-spybotsd-settings.reg

thusremovingthebackupthatwouldhaveundoneanychanges.


CommandlineparametersForlargeenvironmentsorpeoplewhowanttocontrolandautomateeverythingthemselves,hereisalistofcommandlineparametersofboththeinstallerandmainexecutabletomakeyourworkeasier.


Mainexecutable CommandlineparametersofSpybotSD.exe

HereisalistofcommandlineparametersthattheSpybot-S&D;mainexecutable(SpybotSD.exe)supports:

/taskbarhideRunsSpybot-S&D;completelyhidden(nowindow,notaskbaricon),somakeabsolutelysureyouuseitonlyincombinationwith/autoclose(otherwiseitwouldremaininmemorysittingidle).Usefulonlyincombinationwith/autocheck,/autoupdateor/autoimmunize,asitcannotbecontrolledwhencompletelyinvisible./minimizedStartsthewindowminimized./uninstallUninstallsSpybot-S&D.;Thiscommandlineparameterisveryoutdated-unins000.exeshouldbeusedinstead!/blinduserStartswithsupportforblindusers(specialmenus)./autoupdateDoesanupdateafterstartingtheprogram./autocheckStartsscanningimmediately./autofixFixesproblemsafterscan./autocloseClosesprogramafterithasscannedorupdated./autoimmunizeRunstheimmunizationatprogramstart./onlyspywareFixesonlyspyware(red)entrieswith/autofix,leavingallusagetracksastheyare./easymodeStartswitheasierinterfaceforbeginners./createenglishUpdatestheEnglish.sbllanguagefilewiththenewesttexts;usefulonlyfortranslators.

Note:PleasebeawarethattheSpybot-S&D;pathhastobeinquotationmarksandmultipleparametershavetobeseparatedbyaspace.

Example:"C:\ProgramFiles\Spybot-Search&Destroy\SpybotSD.exe"/taskbarhide/autoclose/autocheck/autofix/onlyspyware


Installer Commandlineparameters

HereisalistofcommandlineparametersthattheSpybot-S&D;installersupports:

/sp-Willskipthefirstpageoftheinstallationwizard(Doyouwishtocontinue?...)/silentWilldisplaytheprogressduringinstallation,butnotthewizard./verysilentEventheprogresswillnotbeshown.Errorsetc.wouldstillbeshown./surpressmsgboxesWillusestandardactionsformessageboxes(nooverwritingoffiles,cancellingwherethealternativewouldberetrying...)/log(or/log="filename")Createsalogfileinthetempfolderthatcontainsdetailedinformationaboutactionstakingplaceduringtheinstallation./nocancelDisablestheCancelandClosebutton.Usefulwith/silent./norestartSuppressrebootseveniftheywerenecessaryattheendoftheinstallation./restartexitcode=NIfarestartisneeded,thesetupwouldreturnthespecifiedexitcode./loadinf="filename"(and/saveinf="filename")Canbeusedtouseasavedsetupconfiguration(orsaveone)./lang=languageOverridesthelanguagedialogwithapredefinedlanguage.UseISO2letterlanguagedescribershere./dir="x:\dirname"Installsintothatdirectoryinsteadofthedefaultone./group="foldername"Installsintoaprogramgroupofthatnameinsteadofthedefaultone./noiconsAvoidscreationofanyiconsfortheinstalledsoftware./type=typename

Startsinstallationwithagivetype.Supportedtypesarefull,blindandcompact.

/components="commaseparatedlistofcomponentnames"Installsthegivencomponentsinsteadofthedefaultones.Supportedcomponentsare

main,blind(iconsforblindusers),language(alllanguagefiles),skins,updatedl(fordownloadingupdatesaspartoftheinstallation),updatew95(todownloadprerequisitesonWindows95),SDWinSec(toinstalltheSecurityCenterintegrationonVista),SDShredder(toinstallthestand-aloneshredder),andSDDelFile(toinstallthefileremovalhelper).

/tasks="commaseparatedlistoftasks"Specifiesalistoftasksthatshouldbeexecuted.Taskscurrentlysupportedare:

desktopiconquicklaunchiconlaunchsdhelperlaunchteatimer

/mergetasks="commaseparatedlistoftasks"Sameas/tasks,justwiththeexceptionthatstandardtasksarenotdisabledbydefault.


WhydoIgetanerrormessageduringupdatingthattheupdateisforbidden/badchecksum?

FAQ#020

Someusershavereportedtheyarenotabletodownloadupdates.The'Searchforupdates'revealsupdates,buttheycannotbedownloaded.Oftena'HTTPError403'or'badchecksum'isdisplayed.Thishasasimplereason-thousandsofpeopletryingtodownloadfromthedefaultserver,whichcan'thandlesuchaload.Ifyoutryagain,haveasecondlookatthemenubar.Ithasapull-downitemtoselectamirror.Clickthearrowbesideit,andselectadifferentlocation,whereyou'llmostprobablyhavebetterchancestodownload.

Currentproblemswiththemaininstallerdownloadhavethesamereason-theserversnotbeingabletohandlesuchlargeamountsofdownloads.EventheUniversityisn'tabletodealwithmanythousandsofdownloadsatthesametime.Pleasehavesomepatience;moremirrorsarebeingaddedagain.
