DescriptionSpybot-Search&Destroycandetectandremovespywareofdifferentkindsfromyourcomputer.Spywareisarelativelynewkindofthreatthatcommonanti-virusapplicationsdonotcoveryet.IfyouseenewtoolbarsinyourInternetExplorerthatyoudidn'tintentionallyinstall,ifyourbrowsercrashes,orifyoubrowserstartpagehaschangedwithoutyourknowing,youmostprobablyhavespyware.Butevenifyoudon'tseeanything,youmaybeinfected,becausemoreandmorespywareisemergingthatissilentlytrackingyoursurfingbehaviourtocreateamarketingprofileofyouthatwillbesoldtoadvertisementcompanies.Spybot-S&D;isfree,sothere'snoharmintryingtoseeifsomethingsnoopedintoyourcomputer,too:)
Spybot-S&D;canalsocleanusagetracks,aninterestingfunctionifyoushareyourcomputerwithotherusersanddon'twantthemtoseewhatyouworkedon.Andforprofessionalusers,itallowstofixsomeregistryinconsistenciesandofferssomeextendedreportingfeatures.
LicenseSpybot-S&D;comesundertheDedicationPublicLicense.
Requirements
MicrosoftWindows95,98,ME,NT,2000orXP(32and64bit),2003,Vista.CompatiblewithbootablePEdisks(e.g.BartPE)andWine.Minimumof10MBfreeharddiskspace,morerecommendedforupdatesandbackups.
UsageWerecommendthatyoucontinuebyreadingthetutorialnext.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
I.FreewareFirstofall,thereasonswhySpybot-S&D;isfree:
I.a.DedicationSpybot-S&D;isdedicatedtothemostwonderfulgirlonearth:)
I.b.BinaryWhatdoyougetifyoubuysoftware?Lotsofonesandzeros,nothingmore.Iftheyweredistributedasart,Icouldunderstandpayingforit.Butifthemaingoaloftheirorderistoearnmoney-byfeesorads-Idonotlikeit!
I.c.ConclusionThismeansthatIgrantyouthelicensetouseSpybot-S&D;asmuchasyoulike.Butifyoulikeit,Iasktwothingsofyou:sayaprayerforme(andthemostwonderfulgirlwhileyouareatit;))toyourgod-orwhateveryoubelieve-andwishussomeluck.
II.Limitations
II.a.ReverseEngineeringReverseEngineeringisnotallowedaswithnearlyanysoftware.Ifanyonehasdoubtsinthehonestyofthecode,Iwillgiveinsighttoatrustedorganizationlikeauniversityundercertainlimitations(forexampleonlyonecopy,foralimitedtime,andthathastoberemovedaftertheevaluationtimehasended).
II.b.WarrantyItriedmyverybesttomakethecodeofSpybot-S&D;asstableaspossible,andIgiveyouthewarrantythatIplacednocodetocauseintentionalharmtoyoursystem.However,removingthethreatstargetedbySpybot-S&D;sometimesinvolvescuttingdeepintothesystemsometimes,andIcannotguaranteethatyoursystemwillberunningthesameasbefore.Forexample,spywarehostsmaystopworking.NeithercanIgiveyouanywarrantythatSpybot-S&D;willremoveeveryspyonyoursystem,orthatitwillgiveyounofalsepositives.Foryourownverificationthelocationoftheproblemisshownwithevery
entry,andifyouhaveanyquestionsremainingyoucanvisitthesupportforumformoreinformation.
II.c.LiabilityUndernocircumstancescanyoumakemeliableforanydamage,howevercaused,including,butnotlimitedtodamageyoumightdotoyoursystemusingSpybot-S&D.;
II.d.UseofapplicationinwholeFreeuseislimitedtotheapplicationinwhole.Usageofpartsonly,forexamplethedatabaseortheplug-ins,isnotpermitted.
II.e.CorporateuseAscompaniesarenotindividualpersonsandwouldhaveproblemsfullfillingtheaboveterms,thereisalicenseforcorporateusersthatcanbefoundatsafer-networking.ie(onlinelink).
III.DistributionHerearesomebasicrulesaboutdistributingSpybot-S&D.;
III.a.PrivatedistributionYoumaygiveawaysinglecopiesofthesoftwareaslongasyoudonotmodifythislicenseorotherfilesofthearchive.
III.b.MirroringIfyouwanttomirrorSpybot-S&D;,feelfreetodosoaslongasyoudonotmodifytheoriginalarchive.Ifyouwanttobekeptuptodateaboutmajorupdates,youcansubscribetothemailinglist.OfficialmirrorsneedtofulfilltheMirrorPolicy(onlinelink).
III.c.PublishingYoumaypublishSpybot-S&D;inabookormagazine(orothermedia)bysimplysendingawrittenrequestforpermission,includingadescriptionofyourspecificneeds.IrequestacopyofthemediainwhichSpybot-S&D;ispublishedascompensation.
IV.Privacy
IV.a.Applicationofflineprivacy
EventhoughSpybot-S&D;scansyoursystem,itwillnotsearchspecificallyforanypersonallyidentifiableinformation.Everythingthatisnotdetectedasapossiblethreatwillbeignored.Possiblethreatswillbeshownand,iflogoptionsareswitchedon,writtentoalocallogfile.
IV.b.ApplicationonlineprivacySpybot-S&D;hasonlinefunctionalityin5cases:1.Update:TheUpdatefunctionnowusesanftp-protocoltodownloadaninfofilecontainingupdatedescriptions(thisiscalledspybotsd.ini,anditwillnotbedeleted,soyoucanlookatit)andtodownloadtheupdatefilesyouselect.Noinformationotherthanthoseyourbrowserwouldalsoshowwillbetransmitted.2.News:Onthewebsite(onlinelink)ofSpybot-S&D;youwillfindtheNewssection.HereyoucanreadaboutthemostimportantnewsallaroundSpybot-S&D.;3.BugReport:Thebugreportfunctionsendstheproblemdescriptionyouenterandanautomaticallycreatedreporttooursupportstaff.Youcanmodifytheextentofthereportonthesettingspage,andyoucanpreviewthiscontentswhileyouarewritingthebugreport.Fileslistedintheattachboxwillbesentasattachments.Theheaderwillcontaintheinformation(sendername&address)youhaveenteredinsettings.4.Productinfo&opt-outlinks:thosemayoftenlinktodubiouspages.Youmayopenthematyourownrisk,butyoushouldtakecaretomeetsomesecuritymeasures(likefirewall,latestIEupdates,updatedantivirussoftware)first.5.Otherlinks:DuetothenatureoftheInternetIcannotgiveyouanyguaranteeregardingotherlinksfoundonmywebpages(neithermyown,thesupportforum,orthedonationsite).ButIhaveputmytrustinthemanddonotbelieveanyharmcancomefromthem.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Imageofprogramwizard
Firstrun Tutorial
ThefirsttimeyoustartSpybot-S&D;,itwilldisplayaWizard,asmallwindowhelpingyouthroughthefirststeps.Itgivesyouthepossibilitytoaddorremovetheiconsyouhaveorhavenotcreatedduringinstall,forexample.Letusjustsayyouwantthemandprocedetothenextpage.
IfyouareusingaproxyinInternetExplorer,Spybot-S&D;willshowyouthisproxyandabuttonwillgiveyoutheopportunitytouseitforSpybot-S&D;,too.Ifthetextfieldisblank,youdonotneedtodoit,butinmostcasesthiswillshowaninternetaddress,andyoushouldimportthisproxysetting.
Thenextpagedealswithupdates.Itisveryimportanttokeepup-to-date.Usingthetwobuttonsthispageofferswilldotheupdatesforyou,ifyouwanttodoitatalaterpoint,usetheupdatefeatureintheSpybot-S&D;section.
Thelastpageofthewizardwillaskyoutoreadthehelpfile.Itlookslikeyouarealreadydoingthis:)
Doingascan Tutorial
Afterthewizardhasfinished,youmayfindyourselfontheSettingsorUpdatepage.AsthedefaultsettingsareOKrightnow,andyouhavealreadyupdated,letusignorethemfornowanddothefirstscan.
Imageofuserinterfacewithscanresults
Interpretingtheresults
Ontheleftsideoftheprogramyoucanfindanavigationbarthatcanleadyoutoallfunctionsoftheprogram.Thefirstsectionthere(thetop-mostbutton)islabeledSpybot-S&D;andleadsyoutothemainpage.Rightnow,youwillseeonlyanemptylistandatoolbaratthetop.ThefirstbuttoninthistoolbarisnamedCheckforproblems-thatisthebuttonyouhavegottopresstostartthescanning.Leanbackandwatchthescanprogress.
Interpretingtheresults Tutorial
Atthispoint,youcouldjustjumptothelastpoint,andremovetheresults.InsteadwerecommendthatyoufirsthavealookatwhatallthestuffisthatSpybot-S&D;detected.Thefirstthingyoushouldknowistodistinguishbetweentheredentries,whichrepresentspywareandsimilarthreats,andthegreenentries,whichareusagetracks.
Fortheusagetracks(Ihopeyouhavefollowedthatlinktoreadwhattheyare),removalisnon-critical,butdependsonyourpersonalpreferences.
Ignoringtheusagetracksfornow,youshouldhavealookattheredentrieswhichrepresenttherealthreats.While,ofcourse,youcantrustusthatwearechoosingthetargetsusingstrictcriteria,youcancheckforyourself.Ifyouclickoneachproductandthenonthegreybuttonontherightyoucanreadtheproductinformationintheboxpoppingup.
Decisiononexceptions Tutorial
Allproblemsdisplayedinredareregardedasrealthreatsandshouldbedealtwith.Butwhileyoureadtheproductdescription(youcanfinditbyselectinganiteminthelistandthenclickingonthegreybuttonontherightside),youmaystilldecidetokeepathreat,orjustausagetrack.MaybeyoudonotwantyourlistofmostrecentlyusedWorddocumentsremoved?Atthispointyouhavethreeoptions.
Youcoulddecideonignoringall.InthatcaseyoucouldopentheFilesetspageintheSettingssectionoftheprogram,anddisabletheUsagetracksentries.Orifyouwanttojustkeepalltracksfromaspecificproduct,justright-clickaproductintheresultslist.Finally,ifyouwanttokeepjustonefile,thatispossiblethesameway.
Removingthethreatsfound Tutorial
Sonowyoushouldknowabouteverythingyouhavefound.ItistimetousetheFixselectedproblemsbutton.
Onceyoustartthinkingaboutremovingtheusagetracks,too,youmaythinkthattickingallthegreenentriesishardwork.Thisisforasimplereason-toforceyou,thenewbie-tolookattheresults.Onceyouknowwhatyouaredealingwith,thereisahiddenSelectallbuttonavailableforyouonthesettingspage(onlywhenstartedinadvancedmode).
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Settingthebasicoptions Settings
Allimportantsettingsarelistedinatreeinthissection.PleasenotethatthesesettingsareonlyvisibleifyoustartSpybot-S&Dinadvancedmode-thedefaultmodewillnotshowthem.Thedescriptionthatfollowsissortedbythetreesmaincategories.
Installation
Thissectionletsyouchangethedesktopiconaswellasthestartmenuandquicklaunchitem.
Mainsettings
Thesearesomemiscellaneoussettingsaboutessentialwarningandconfirmationdialogs.Hereyoucanforexamplechangeyourbackuppreferences.
Automation
Spybot-S&Dhastwokindsofautomationsettings–onsystemstartandonprogramstart.HereyoucansetwhethertostarttheprogramwhenyoustartupyourWindows,ortocheckforupdatesautomatically,ortodelaythescanonsystemstartforaspecifieddelayoruntilotherprograms(scanners)haveterminated.
Logfilesettings
Spybot-S&Dcanwritedetailsabouteachscanintotextfiles.Hereyoucanselectwhethertodothis,whetherthedateandtimeshouldbeincludedinthefilename,andwhethertoappendortooverwritethelogfile.
Look&Feel
YoucanswitchafewdetailsaboutthelookofSpybot-S&D.Justtrytheoptionsandseewhatlookyoulikemost.Afterawhile,youmaywantto
disabletheintroducinginformationpanels,forexample.
BugReport
Ifyouareunsureaboutproblems,youmaysendabugreporttoSaferNetworkingLimited.Thissectionisabouthowtheemailingshouldbehandled.Youshouldatleastselecttoincludesysteminformationandscanresultsinthebugreport(youcanpreviewitbeforesending).Also,ifyouwanttoreceivethesameemailasSaferNetworkingLimited,youmayselecttosendacopytoyourself(youneedtochangeSMTPsettingstodothis–seetheBugReporthelp).
Expertsettings
Thesearesomesettingsthenormalusermaynotneed,butthatcouldbeusefultothepoweruser.Forexample,youcansetupexternalapplicationstoviewresultdatahere.
YoucanfindthemainsettingsbychoosingSettingsfromtheSettingssectioninthetoolbartotheleft.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Scheduler Settings
TheSchedulerpageallowsyoutoaddanentrytoautomaticallyrunSpybot-S&DtotheWindowsscheduler.Todothis,youfirsthavetoclicktheAddbutton,thensetthenecessaryproperties(scheduledtimeetc.)throughtheEditbutton.YoucanremoveatasklateronbyusingtheRemovebutton.Customoptionsthatyouwillseearecheckboxestodecideifyouwanttoautomaticallyfixproblemsafterthescheduledscan,andtoclosetheprogramafterscanning/fixinghasfinished.
TheEditbuttonopensthedefaultWindowstaskpropertiesdialog,sothatyoucanchangethetasklikeanyotherWindowsSchedulertask.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Choosingtheinterfacelanguage Settings
IfyoudownloadedSpybot-S&D;fromtheInternet,itwillcomewithalotoflanguagesalreadyincluded,butnotthehelpfiles(toreducethedownloadsize).Youshouldusetheupdatefunctiontodownloadadditionalfilesforyourlanguageafteryouhaveselectedit.
Ifyourlanguageisnotyetshown,youcangototheSettingspageandenabletheoptiontodownloadforeignlanguageupdates.Inthatcase,yournextupdatewillshowyoutheupdatesforallavailablelanguages,eventhosenotyetinstalledonyourmachine.
YoucanfindthelanguagesettingsbychoosingLanguagesfromtheSettingssectioninthetoolbartotheleft.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Choosingwhattoscan(filesets) Settings
Spybot-S&D;usestheconceptofIncludeFilestomakeitmoreflexible.EachIncludeFileisafilecontainingthedescriptionofsomeproblemsthatSpybot-S&D;candetectandfix.
Thesefilesaredividedintocategories,soyoucanselectwhatyouwouldliketotargetinyournextscan.
Thebasiccategoriesare"Spybots"(whichcontainstheincludesforspywareandadware)andUsagetracks.ForeachcategoryyoumayseeIncludeFileswithashortdescriptiononwhattheydoandthenumberoffiles,registryentriesanddirectoriesthatwillbechecked.
YoucanselecttheIncludeFilesyouwishtouseforyournextscanbytogglingthecheckboxnexttothem.
IfyouseeanIncludeFileinitalicletters,thenitisonenotoriginatingfromSafer-NetworkingLimited.AstheIncludeFileformatispublic,anyonemaywriteIncludeFiles.However,asIncludeFilescandoalotofharmtoyoursystemandSafer-NetworkingLimitedisnotliableforaforeignIncludeFile,youwillbeaskedwhetheryouarereallysureyouwanttouseanyfilethatisnotfromSafer-NetworkingLimited.
YouwillfindthefilesetssettingsbychoosingFilesetsfromtheSettingssectioninthetoolbartotheleft.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Choosingwhatnottoscan Settings
Rightnow,therearefivedifferentIgnoresections:
Ignoreproducts
Thissectionlistsallproductsdefinedinternallyandintheexternalincludefiles.Ifyouwanttoexcludeacompleteproduct,orincludeitagain,selectthefilefromthissectionandtogglethecheckboxinfrontoftheproductname.
IgnoreCookies
Cookiesareusagetracks,butyoumaywanttokeepsomeusefulcookies.Thissectionlistsallcookiescurrentlyonyoursystem,allowingyoutoexcludethemfromfurthersearches.
Ignorefileextensions
ThisconcernsthecommonWindowsfileopeningdialog.Itsaveslistsofopened(andsaved)filesbrokendownbytheirextensions.IfyoudonotwanttoremovetheWinWordfiles,forexample,youcouldselect.doctobeexcludedinthissection.
Ignoresingleentries
Ifyoudonotwanttoexcludeacompleteproduct,butonlyasinglefileorregistrysettingofit,youcanselectthatonefromtheresultslist.Thesearelistedhere,whereyoumayremovethemfromtheexcludelistagain.
Ignoresysteminternals
Ifyouhavegotsysteminternalsresultsonthelist,youcanremovethemfromtheIgnorelisthere.
Allthelistsinthesesectionshaveacontextmenuwithextendedselectionoptions.
YouwillfindtheseoptionsbychoosingoneofthefourIgnorefeaturesfromtheSettingssectioninthetoolbartotheleft.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Settingthedownloaddirectories Settings
SomescansdoalsotargettheinstallerfilesofproblemsdetectedbySpybot-S&D.Installersthattheusermustexplicitelydownloadhimselfwillonlybescannedforinthedirectoriesenteredintothislist.
YoucaneitheruseDragandDroptodropsomedirectoriesfromanExplorerwindoworusethecontextmenutoaddorremovedirectoriestoorfromthelist.
YouwillfindthedownloaddirectoriessettingsbychoosingDirectoriesfromtheSettingssectioninthetoolbartotheleft.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Choosingaskin Settings
Spybot-Search&Destroysupportstheconceptofbasicskins,toadjustprogramcolorstopersonalneeds.
Togetnewskins(atfirstthereareonlytwoavailable,theoriginalSpybot-S&D;andthePeace)youcanvisitthefollowinghomepages:http://www.safer-networking.org/en/download/index.htmlhttp://www.allsecpros.com/sbsd.html
ThenchooseyourfavoriteskinsandsimplydownloadthemandextractthemtotheSpybot-S&D;skinsfolder.
TheSkinsectionwillshowyoualistofavailableskins.Selectonetopreviewit.The(verysimple)previewwillbedisplayedintheleftpartofthewindow,withsomeinformationbelowthelistandtheskinlogoatthebottomofthepage.
Ifyouliketheskin,presstheApplyselectedbutton.
YoucanfindtheskinsettingsbychoosingSkinsfromtheSettingssectioninthetoolbartotheleft.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
IgnoreCookies Settings
Cookiesareusagetracks,butyoumaywanttokeepsomeusefulcookies.Thissectionlistsallcookiescurrentlyonyoursystem,allowingyoutoexcludethemfromfurthersearches.(Atthemoment,onlyInternetExplorerandNetscapeNavigatorandMozillacookiesaresupported-Operacookiescanonlybecompletelydeleted)
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Ignorefileextensions SettingsThisisaboutthecommonWindowsfileopendialog.Itsaveslistsofopened(andsaved)filesdividedintoextensions.Ifyoudonotwanttoremovecommontextfiles,forexample,youcouldselect.txttobeexcludedinthissection.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Ignoreproducts SettingsThissectionlistsallproductsdefinedinternallyandintheexternalincludefiles.Ifyouwanttoexcludeacompleteproduct,orincludeitagain,selectthefilefromthissectionandtogglethecheckboxbeforetheproduct.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Ignoresingledetections SettingsIfyoudonotwanttoexcludeacompleteproduct,butonlyasinglefileorregistrysettingofit,youcanselectthatonefromtheresultslist.Thesearelistedhere,whereyoumayremovethemfromtheexcludelistagain.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
IgnoreSystemInternals SettingsIfyouhaveputSystemInternalsresultsontheignorelist,youcanremovethem(fromtheignorelist)here.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Updating Spybot-S&D;
Inordertoavoidlargedownloadsandformoreflexibility,themainpartofscanninginformationislocatedinsidetheincludefiles.
Includefiles,aswellasnewerhelpfiles,newlanguages,updateddescriptionsetc.canbedownloadedusingtheintegratedupdatefunction.
Ofcourse,inordertoupdatetheprogram,youneedanopeninternetconnection.
Afterthat,youcanclicktheSearchforupdatesbutton.Thatopensanewwindow,enablingyoutoexecutetheupdateprogramm"SDUpdate".Afterdoingthat,alistofavailableupdateswillbedownloadedfromaSaferNetworkingLtd.serverandcomparedtothefilesalreadyinstalledonyoursystem.Newfileswillbeshowninthelist,whereyoucanselectthemandpresstheDownloadupdatesbuttonafterwards.Duringdownload,everyfinishedfilewillgetagreencheckmark.
Ifyouwanttoreadaboutupdatesfirst,visitourwebsiteorthesupportforum.
YoucanfindtheupdatefunctionbychoosingUpdatefromtheSpybot-S&D;sectioninthetoolbartotheleft.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Reportingabug Tools
Youshouldusethebugreportonlyasalastresort.First,pleasecheckfornewerversions,readtheFAQandvisitthesupportforum.
Ifallthathasn'thelpedsolveyourproblems,youmaywriteabugreport.BeforedoingthispleasecheckifyouhavegotacurrentversionofSpybot-S&D.;Toproveifyouareuptodateyoucanusetheintegratedupdatefunction(Spybot-S&D;section).AfterthischeckpleasegototheToolssection,thenchoosebugreportandpressNext.Ifthisisthefirsttimeyouarewritingabugreport,youmayneedtoadjustyouremailsettings.ClickthebuttonMailsettingsandchangethemtoyoursettings.Thedialogpoppingupwillallowyoutosetallnecessarydata.IfyouareusingOutlookorOutlookExpress,youmayevenimportyoursettingsandwillonlyhavetoenteryourpassword.
Oncetheemailsettingsarecorrect,youcanwriteyourbugdescriptionintothetextfieldforYourdetaileddescriptionofthebug.Then,pleasepresssystemgeneratedreport.Atthispoint,aspecifiedreportfromthemachinewillbelistedthatwillalsobesenttous.Ifyouwanttoattachafiletothereportpleasedragittotheboxatthebottom.Onceyouhavedonethatandverifiedthateverythingiscorrect,youcanpresstheSendbuttontosendtheemail.
Youwillfindmorebugreportoptionsinthemainsettings.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Optingout Tools
Ifyouhavesubscribedtosomeadvertisersservicebyaccidentinthepast,anddonotknowwheretooptoutagain,youmaybeluckytofindadvertiserlistedhere.Double-clicktheaddresstoeithervisitthewebsiteorsendanoptoutemail(youcandistinguishbetweenthetwobytheiconinfront).
Pleasedonotusethisfunctionasapreventivemeasure,becausethatwouldgiveyounoadvantages,butinsteadgivetheadvertiseryouraddress.
YoucanfindtheOptOutlistbychoosingOptOutfromtheToolssectioninthetoolbartotheleft.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Scanningyoursystem Spybot-S&D;
OnceyouhavestartedSpybot-Search&Destroy,youcanimmediatelystartscanning.
Havingstartedtheprogram,youwillalreadyseethescanscreen.Ifnot,pleaseselectSearch&DestroyintheSpybot-S&D;sectioninthetoolbartotheleft.
Thesearchscreencontainsatoolbarwiththemostimportantoptions.Letusstartascan:pleasepresstheCheckforproblemsbutton.
Youwillseethescanprogressinthestatusbaratthebottomofthewindow,andcanstoptheprogressatanypointbypressingtheStopcheckbuttonthathasjustappeared(itwillvanishagainoncethecheckhasfinished).
Ifthescanhasfoundsomething,thelistwillshowit.Therearetwobasickindsofresults:
Redentriesindicatespywareproblemsthatshouldbefixedtoavoidsecurityand/orprivacyproblems.Thisistheonlykindofproblemthatispreselectedtobefixed.
Greenentriesindicateusagetracks.Itcandonoharmtoremovethese.
Formostoftheproblemsthereismoreinformationavailable.Ontherightsideofthewindowyouwillfindagreybutton.Byclickingitawindowwillopenandshowyousomeinformationabouttheitemselected(ifthereisnoneselected,youcansimplyclickonitandtheinformationwillbedisplayed).
Youcannowselecttheproblemsyouwanttofix,byclickingthecheckboxinfrontofit,orbyselectingallusingthebuttonSelectallproblems(thisbuttonwillonlybeavailableafterenablingtheexpertbuttonsettinginadvancedmode).Moreselectionoptionsareavailableifyoulookintothecontextmenu(byright-clickingaproblem).Thecontextmenuwillalsoallowyoutoexcludesingleproblemsorwholeproductsfromfurtherscans(youmaylaterchangetheexcludesettingsinthesettingssection/Ignore...).Anotheroptionthe
contextmenuoffersistocopyorexporttheresultlistorafullreport.
Onceyouaresureyouhaveselectedwhatyouwanttoberemovedfromyourcomputer,presstheFixselectedproblemsbutton.Youwillseethefixingprogressatthebottomstatusbar.
Ifsomeproblemscannotbefixedrightnow(becausetheyarestillloadedandcan'tbeterminated,forexample),Spybot-S&D;offersanoptiontorunonnextsystemstart,soyoucancheckandfixagain.
Shouldyounoticeatanylaterpointthatyouhaveremovedmorespywarethanyouwanted,youcanalwaysrestoreitfromtheRecoveryintheSpybot-S&D-section.;
Youcanalsofine-tuneyourscanoptionsbyselectingspecialFilesetsandchangingsomeSettings.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Immunize Search&Destroy
Beginningfromversion1.2,Spybot-S&Dallowsyoutoimmunizeyourcomputeragainstsomespyware.Itcurrentlyoffersthreedifferentimmunities:
PermanentInternetExplorerimmunity
ThepermanentimmunityworksonsomeInternetExplorercontroloptionsthatarepartlyvisibleintheInternetExplorerinterface,partlyhiddenintheregistryonly.ItaddsdomainsknowntocontainbadcontentsintotheRestrictedZone,thusblockinginstallationofexecutablecodefromthosepages;italsoaddsblockoptionsforbadexecutablecodebyitsID,anditsetsknowntrackingcookiesnottobeacceptedbyInternetExplorer.
Tocutitshort:itmodifiesInternetExplorer,throughofficialways,toblockalotofthebadstuffknowntoSpybot-S&D.;
PermanentlyrunningbaddownloadblockerforInternetExplorer
ThisisasecondlayerofprotectionforIE.WhilethePermanentImmunityblocksinstallersbytheirActiveXID,thisoneblocksanythingthatshouldcomethroughbydifferentaspects.YoucanviewalogofblockedinstallersintheTools/Residentsection.
PermanentOperaimmunity
ThislistshowsallOperaprofiles,andhowmanyofthepluginsthatSpybot-S&Dknowsasbadarealreadyblockedineachprofile.Tosetthecompleteprotection,justtickthecheckboxinfrontoftheprofileyouwanttoprotect.Toremovetheprotection,untickthecheckbox.
NotmanybrowserpluginsarecurrentlyworkingforOpera,buttheattempttoinstallsomemaycrashOpera,andActiveXsupportforOperaisavailableinthird-partybetasoftware,sousethisfunctionasaprecautionagainstfuturemisuseofOperathroughspyware.
Thisfeaturewill(certainly)onlybedisplayedifyouhaveOperainstalledonyoursystem!
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Recovery Spybot-S&D
TherecoverysectionisavailablebyselectingRecoveryfromtheSpybot-S&Dsectioninthetoolbartotheleft.
Ifyouhavefixedsomespywareproblemsinthepast,thislistwillshowit.Hereyoucanselectoneormoreproblems(seealsothecontextmenuforextendedselectionoptions)andeitherrecoverorfinallypurgethemfromyoursystem.
InadditiontotheRecoveryfeature,WindowsME,XPandVistausershavethepossibilitytoenablethecreationofSystemRestorePointsforeachfix.ThisoptioncanbesetintheMainSettingspartoftheSettingssection.WhengoingbacktoaSystemRestorePoint,theResidentTeaTimerneedstobeshutdown:WithTeaTimerrunning,itwilltakenoteofthechangesandasktoeitherAlloworDenythem.However,intheprocessofrestoringWindowswillrestarttoofasttoallowthechanges.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Productinformation
Inordertofindtheproductinformationintheresultslistpleaseclickonanitemandthenonthegreybuttonontherightside.ThereyouwillfindmoreinformationabouttheproblemsSpybot-S&D;istargeting.
TheinformationshowncontainsURLsonly,butassomeoftheseURLsmaydirectlystartan(ActiveX)download,youcannotopenthembyusingthestandarddouble-click.Instead,right-clicksomewhereintheinfofieldandselecttheURLyouwanttovisitifyouaresureyourbrowserissettosafesettings.
Youcanalsochoosetoexcludeaproductfromfurthersearchesbyright-clickingitandselectingExcludethisproductfromfurthersearches(thisdoesthesameasignoringaproductinthesettingssection).
Inthatcontextmenuyouwillalsofindtheoptiontocopytheresultsorafullreporttoeithertoatextfileortotheclipboard.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Blindusers
Spybot-S&Dhasbeenadjustedtofittheneedofblind(disabled)users.AlreadyduringtheinstallationtheuserhasthechoicetocreateanicontostartSpybot-S&Dinaspecialmode.Itwillalsoswitchtothatmodeifitdetectsthataccessibilitysupportisinstalled.Asathirdoption,theSettingspagecontainsanoptiontoswitchtothisspecialmode.
Inthisspecialblindusermode,thecontextmenus(theonesthatwouldappearifauserright-clicksonalist),thetoolbar(usuallyatthetoporbottomofeachpage)andtheglobalnavigationbarattheleftaremirroredintotwomainmenusubmenusthattheusercanuseforeasiernavigation.Thetwographicallists(theresultslistandtherecoverylist)willalsobeswitchedtotextformat.Asthecheckboxesarenotavailableinthistextformat,theselistswillcontainthetextCHECKEDorUNCHECKEDattheendofeachentry.Thischeckoptioncanbetoggledusingthespacekey.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
SpywareandAdware Dictionary
Whatisspyware?Toputitsimply,spywareissoftwarethattransmitspersonallyidentifiableinformationfromyourcomputertosomeplaceintheinternetwithoutyourexplicitapprovalknowledge.
Spywareistypicallynottheproductyouinstallyourself,butsmalladd-ons,thatyoumayormaynotdisableduringinstall.Inmostcases,theEULAsomewherehasafewlinestellingyouaboutprivacymatters,buttypicallymostusersdonotreadthecompleteEULAandneverknowtheygotspywareontheirsystem.
Alessthreateningkindofmalware(i.e.malicioussoftware)isadware.Adwareissimilartospyware,butdoesnottransmitpersonallyidentifiableinformation,oratleastthecollectorpromisesnottosellit.Instead,aggregatedusageinformationiscollected.
Also,adwareisoftenaside-effectofspyware,asbothmonitoryouforasolepurpose–deliveringadvertisementstoyouthatareespeciallytailoredtoyourhabits.
Anotherkindthatisdetectedunderthespywarecategoryaretrackingcookies.Cookiesareusedallovertheinternetinusefulandlessusefulplaces.Advertisementcompaniesoftensetcookieswheneveryourbrowserloadsabannerfromthem.InthatcaseandifthatcookiecontainsaGUID,thecompanygetsnoticeabouteverysiteyouvisitthatcontainstheirads.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Systeminternals Dictionary
Thewindowsregistrycontainsalotofinformation.ItsconsistencycanbecheckedwithgoodcommercialprogramslikeSymantec™SystemWorks.ButtherearesomesmallthingsImisswiththoseprograms.HereiswhatSpyBot-S&D;searchesfor:
Missinghelpfiles–theregistrycontainsinformationaboutthelocationofsomehelpfiles.Ifthisinformationpointstoincorrectdirectories,Spybot-S&D;willinformyouaboutandallowtofix.
MissingsharedDLLs–theregistrycontainsalistofdynamiclinklibraries,wheretheyarelocatedandhowmanyprogramsareusingthem.SpyBot-S&D;checksifalllocationsarecorrectandallowstochangethemifnot.
Applicationpaths–someapplications(mostlythoseregisteredtoafileextension)areregisteredintheregistry.Iftheyarepointingtoaprogramfilenolongerexisting,Spybot-S&D;canchangetheirpathordeletetheirentry.
WrongUninstallinformation–everyprogramthathasitsownuninstallroutinestoressomeinformationaboutitintheregistry.Ifthisinformationisincorrect,Spybot-S&D;willtellyouabout.Forexample,theuninstallprogrammayhavebeenlocatedinsideatempdirectory(therearelotsofprogramsthatstupid!).
BrokenDesktopLinks–ifoneofthelinksonyourdesktoplinkstoafilethatnolongerexists,Spybot-S&D;willtellyouandallowyoutoeitherpointthelinktoanotherfileordeleteit.
Warning:Pleasebeawarethatchangestotheseitemscancorruptyoursystem!Ifyouarenotsurewhetherasettingisreallyaproblemyou´dbetterleaveitalone!ThiswarningespeciallyappliesifyouareusingMicrosoftOffice™.This
softwaresuitehassomeregistryentriespointingtowrongdirectoriesandsomeevenpointingtonon-existenthelpfiles.Ihavechangedthefirst,butIwouldnotdeletetheotherone,becausetheymaywellpointtofilesthatwillbeinstalledonthat"Installonfirstuse"basis.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Usagetracks Dictionary
Usagetracksareyourfingerprintsinyoursystem.Wheneveryouvisitapagewithyourbrowser,orjustopenanyfile,thatinformationisstoreddeepinsideWindows.Inmostcasesthatisveryuseful–ifyouwanttoopenthatfileagain,youcanselectitfromalistinsteadoftypingthewholefilenameorbrowsingthewholedirectorystructureagain.
Butinsomecasesyoumaywanttohideyouractivity,becausespywareandinternetattackersmayusethatinformation.Spybot-Search&Destroycanremovesomeofthemostimportantandcommontracksonyoursystem.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
ToolsSpybot-Search&Destroyoffersmultipletoolstohelpyoulookingdeeperintoyoursystem.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Viewreport Tools
ThistoolallowsyoutocreateanewreportincludingallorjustaselectionofthereportsthatSpybot-S&Dcancreate.Youcanthensavethereporttoafileforfuturereference.Thetoolalsoallowsyoutoviewoldreportsagain.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Resident Tools
Residentisapermanentlyrunningapplicationtoprotectyoursystem.Currently,itconsistsofabrowserhelperforInternetExplorerthatwillblockdownloadoffilesknownasmalicious(spywareinstallersforexample).ThispageinsideSpybot-S&D;allowsyoutoinstall/uninstallthishelperaswellasviewthereportofwhichpagesithasblocked(thatshouldonlyappearifthefirstlayerofprotection,themainIEimmunity,didnotstoptheculprit).
ThesecondresidenttoolistheTeaTimer
Youcanfindtheresidenttoolsinthetoolssection.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhatistheResidentTeaTimer? TeaTimer
TheResidentTeaTimerisatoolofSpybot-S&D;whichperpetuallymonitorstheprocessescalled/initiated.Itimmediatelydetectsknownmaliciousprocesseswantingtostartandterminatesthemgivingyousomeoptionshowtodealwiththisprocessinthefuture:YoucansetTeaTimerto:
beinformedwhentheprocesstriestostartagainautomaticallykilltheprocessorgenerallyallowtheprocesstorun
Thereisalsoanoptiontodeletethefileassociatedwiththisprocess.
Inaddition,TeaTimerdetects,whensomethingwantstochangesomecriticalregistrykeys.TeaTimercanprotectyouagainstsuchchangesagaingivingyouanoption:YoucaneitherAlloworDenythechange.AsTeaTimerisalwaysrunninginthebackground,ittakessomeresourcesofabout5MB.
WhydoesResidentTeaTimerterminatetheapplicationbeforeasking? TeaTimer
Becausethreatsliketolldialersaretimecritical-theycostfromthefirstsecondtheyhaveconnected.Inordertoprotectyou,thesehavetobeterminatedatthemomenttheyappearbeforetheycanconnectatall.
WhyistheTeaTimercalledTeaTimer? TeaTimer
Asweusedtoforgetourtea,whenweletitbrew,webuiltasmalltoolwithasystemtrayicontoremindus.WecalledthistoolTeaTimer.WhenwestartedtodeveloptheResidenttoolforSpybot-S&D;,wealsoneededasystemtrayiconforthis.Aswedonotlikehavingtoomanyiconsinthesystemtray,wedecidedtoputbothtoolstogetherandkeptthenameTeaTimer.ThenextversionoftheResidenttoolmightalsohavethefunctionsoftheoriginalTeaTimer.
YoucanfindtheResidentTeaTimerinthetoolssection.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
ActiveX Dictionary
ActiveXisaMicrosofttechnologythatallowsInternetapplicationsthataremorepowerfulthansimplescripts.ActiveXapplicationsdoonlyworkinInternetExplorer,sotheuseofActiveXonwebsitesisnotrecommended.DuetothehugeamountofinfluenceActiveXapplicationscanhaveonthesystem(ActiveXapplicationshaveaccesstothesamefilesyouhaveaccessto,meaningallfilesinthecaseofmostprivatecomputers),itisrecommendedtobeverycarefulifdealingwithActiveX.
TherearetwotypesofActiveXapplications-signedandunsigned.ThecodeofunsignedActiveXapplicationshasnotbeencertifiedandshouldneverbetrusted.SignedActiveXapplicationsarecertified,butcanstillcontainmaliciouscode!SignedActiveXapplicationsshouldonlybetrustediftheycomefromtrustedwebsitesandonlyonapromptbase(meaningthatInternetExplorersettingswillaskeverytimeawebsitewantstoloadanActiveXapplication).
ManydialersandhijackersinstallthemselvesusingActiveXapplications.
ActiveX Tools
Spybot-S&D;isabletodisplayalistofinstalledActiveXapplications.ItalsohasasmalldatabaseintegratedthatwilldisplayagreencheckmarkinfrontofActiveXapplicationsknownaslegitimate,andaredsigninfrontifapplicationsknownasillegitimate.
Thislistcanbeexportedintoatextfileasareferenceandforfurtheranalysis.
Featureaddedinversion1.3:entriesthathavechangedsincethelastsnapshot(thefirstsnapshotwascreatedwhenyoustartedSpybot-S&D;forthefirsttime,lateronyoucancreatesnapshotsbyright-clickingthelistandselectingthecorrespondingmenuitem)aredisplayedinboldletters.Thisallowsyoutoseechangestothelistatonce.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
BHO,BrowserHelperObject Dictionary
ABHOisasmallprogramthatextendsMicrosoft'sInternetExplorer.ExamplesofBHOusageincludevisibleadd-ontoolbarsinInternetExplorer,butcanalsobehiddenfunctions.Ad-andspywareaswellasbrowserhijackersoftenuseBHOstodisplayadsorfollowyourtrackacrosstheinternet,becauseaBHOhasaccesstoeachURLyouvisitandcanredirectyouordisplayotherpagesthanyourequested(ads,forexample).
BHOsoftenuseActiveXinstallationprograms.
BHO Tools
Spybot-S&Disabletodisplayalistofinstalledbrowserhelperapplications.Italsohasasmalldatabaseintegratedthatwilldisplayagreencheckmarkinfrontofbrowserhelpersknownaslegitimate,andaredsigninfrontifapplicationsknownasillegitimate.ItalsoallowstheusertoenableordisablesingleBHOs.
Thislistcanbeexportedintoatextfileasareferenceandforfurtheranalysis.
Featureaddedinversion1.3:entriesthathavechangedsincethelastsnapshot(thefirstsnapshotiscreatedwhenyoustartedSpybot-S&D;forthefirsttime,lateronyoucancreatesnapshotsbyright-clickingthelistandselectingthecorrespondingmenuitem)aredisplayedinboldletters.Thisallowsyoutoseechangestothelistatonce.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Browserpages ToolsSpybot-S&D;isabletolistallknownlocationswhereInternetExplorerstartandsearchpagesareanchored.IfyourbrowsergothijackedandyoucannotusethenormalInterentExplorercontrolpaneltoresetyourstartorsearchpage,youcanusethisSpybot-S&D;tooltolocatetheURL(pleasesendittodetections@spybot.infosothatitcanbeaddedtothenextupdate),andchangeit.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Hostsfile Dictionary
Thehostsfilecouldbedescribedasanaddressbook.Whilethenormaluserisaccustomedtoaccessothercomputersontheinternetusingnames(forexamplesecurity.kolla.de),everycomputerisaccessedbyanumericaddressatalowerlevel.Youmayalreadyhaveseenthisnumericaddresses;theylooklike127.0.0.1forexample.
Everytimeyoutrytoaccessanothercomputerbyusinghisname,yourcomputerlooksuphisaddressinanaddressbook.Firstitlooksintoalocaladdressbook(thehostsfile),andonlyifitcannotfindtheaddressthereitlooksinaverybigaddressbookintheinternet.
So,ifyouwanttoblockaninternetwebsite,youcouldsimplyredirectthissitesnametoaplacewherenothingwillbedeliveredfrom.Suchaplacewouldbeyourcomputerforexample.TheaddressIalreadymentioned,127.0.0.1isanaddressthatwillalwayspointtothelocal-your-computer.Byaddinganentrytothehostsfile(yourlocaladdressbook)thatredirectsanadsitetoyourmachine,youwouldtrickyourinternetbrowsertothinkthatadsitewouldbeonyourmachine,andasyourmachinedoesnotdeliverads,itwouldnotgettheadanditwillnotbedisplayed.
Anotherwayofusingthehostsfileisifyouwanttoaccesscomputersthatarenotlistedinanyaddressbookyet.Forexampleifyouhavealocalnetwork,youwouldnotlistyourlocalcomputersinanyinternetaddressbook,ifonlybecausethatwouldbeveryexpensive.Soyoucouldjustenterthemintothelocaladdressbook(yourhostsfile).
Spybot-S&D;usingthehostsfile Tools
Spybot-S&D;canaddapreparedlistofwebsitesknownforbadbehaviour(installingspywareortrackingusers,forexample)toyourhostsfile.Ifyouwanttodothis,werecommendyoualsoreadtheFAQaboutcuresforpossibleslow-downsonWindowsNTbasedsystems(WindowsNT,2000,XPandVista).Andifyoushouldnoticeyoucannotvisitasitethatworkedbefore,you
shouldchecktheHostsfilesectiontoseeifthatsiteisontheblocklist.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
IETweaks Tools
Theseareverysmallchangesrecommendedtomakeyoursystemabitsaferandmoresecure.Lockingthehostsfilewillpreventmosthostshijackers(evenunknown)fromdoingharm;lockingtheIEsettingswillpreventotherusersofyourcomputertochangeyourpreferences.
YoucanalsochangetheInternetExplorertitletoauser-definedtext,orremoveapre-definedtext.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Processlist ToolsThistooldisplaysalistofallcurrentlyrunningprocesses,includingsomeinformationaboutthem.Italsoallowsyoutokillsomeprocesses,butpleasedonotusethisfunctionuntilyouknowwhatyouaredoing!
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Systemstartup Tools
ThistoollistsallprogramsthatarestartedatWindowsstartup.IfthoseitemsareinthedatabasecomingwithSpybot-S&D,itwilldisplaysomemoreinformationaboutthem.Italsoallowsyoutodisable(andenable)items,aswellasdeletethem,changethemorinsertnewitems.
Theentrieswillbedisplayedindifferentcolours:
Green:legitimateprogramYellow:unknown,unneededorunambiguousprogram(e.g.malwareprogramsmightusethesamefilenameaslegitimateprograms)Red:maliciousprogram
OnWindows9xandME,theuserhasfullaccesstothislist.OnWindowsNT/2000/XP/Vista,thelistwilldisplaytheglobalandthecurrentuserentries.Forsomefunctionslikeseeingallentriesorevenchangingsome,theusermayneedadminorpoweruserrights.
Sinceversion1.3entriesthathavechangedsincethelastsnapshot(thefirstsnapshotiscreatedwhenyoustartedSpybot-S&D;forthefirsttime,lateronyoucancreatesnapshotsbyright-clickingthelistandselectingthecorrespondingmenuitem)aredisplayedinboldletters.Thisallowsyoutoseechangestothelistatonce.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Uninstallinfo Tools
ThistoollistsallprogramsthathaveregisteredsomekindofUninstallinformationwithWindows.Youcanuseittoremovetheuninstallinformationofnolongerexistingprogramsaswellastosimplygetanoverview.
Entriesthathavechangedsincethelastsnapshot(thefirstsnapshotiscreatedwhenyoustartedSpybot-S&D;forthefirsttime,lateronyoucancreatesnapshotsbyright-clickingthelistandselectingthecorrespondingmenuitem)aredisplayedinboldletters.Thisallowsyoutoseechangestothelistatonce.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
LSP,LayeredServiceProvider Dictionary
ALayeredServiceProviderisasystemdriverlinkeddeepintothenetworkingservicesofWindows.Ithasaccesstoeverydataenteringandleavingthecomputer,aswellastheabilitytomodifythisdata.AfewsuchLSPsarenecessarytoallowWindowstoconnectyoutoothercomputers,includingtheInternet.ButSpywaremayalsoinstallitselfasanLSP,thushavingaccesstoallthedatayoutransmit.LSParecurrentlyusedbyCommonName,New.Net,NewtonKnowsandwebHancer.
WinsockLSPs Tools
Spybot-S&Disabletodisplayalistofinstallednetworkdriversasareferenceforprofessionals,andallowsthislisttobeexportedforfuturereference.
Sinceversion1.3entriesthathavechangedsincethelastsnapshot(thefirstsnapshotiscreatedwhenyoustartedSpybot-S&Dforthefirsttime,lateronyoucancreatesnapshotsbyright-clickingthelistandselectingthecorrespondingmenuitem)aredisplayedinboldletters.Thisallowsyoutoseechangestothelistatonce.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
AboutTeaTimer
Spybot-Search&Destroyisanon-demandspywareandmalwarescanner.Thatmeansitscansforthreatswheneveryouchoosetodoso.ItalsoofferssomepreventivemeasureslikeitsImmunizefunction.
Resident,ofwhichTeaTimerisapart,isSpybot-S&D'spermanentlyrunningpartnerthatdoeson-accessscanning.Thismeansthatitwillinstantlydetectandcounteracttothreatsandunsolicitedsystemsettingschanges.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Event TeaTimer
Spybot-Search&DestroyhasdetectedachangetoaBrowserHelperObject.
Definition TeaTimer
Spybot-S&D;ResidentwatchesfornewordeletedBrowserHelperObjects(whicharepluginsforInternetExplorer,sometimesexpandingitsfunctionality,butoftenusedformaliciouspurposesaswell).
Userinteractions TeaTimer
DidyoujusttrytoinstallsomeInternetExplorerplugin?Ifitisnotshownasabadone,youshouldproceed.Ifthishappensoutoftheblueskywhilesurfingtheweb,youshouldgetcautious.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Event TeaTimer
Spybot-Search&DestroyhasdetectedachangetoanInternetExplorertoolbar.
Definition TeaTimer
Spybot-S&D;ResidentwatchesfornewordeletedInternetExplorertoolbars.
Userinteractions TeaTimer
DidyoujusttrytoinstallsomeInternetExplorerplugin?Ifitisnotshownasabadone,youshouldproceed.Ifthishappensoutoftheblueskywhilesurfingtheweb,youshouldgetcautious.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Event TeaTimer
Spybot-Search&DestroyhasdetectedachangetosomeActiveXinstallation.
Definition TeaTimer
Spybot-S&D;ResidentwatchesfornewordeletedInternetExplorerInternetinstallations.
Userinteractions TeaTimer
DidyoujusttrytoinstallsomeInternetExplorerplugin?Ifitisnotshownasabadone,youshouldproceed.Ifthishappensoutoftheblueskywhilesurfingtheweb,youshouldgetcautious.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Event TeaTimer
Spybot-Search&DestroyhasdetectedachangetosomecustomInternetExlorermenuentry.
Definition TeaTimer
Spybot-S&D;ResidentwatchesforcustomInternetExplorermenuentries.
Userinteractions TeaTimer
DidyoujusttrytoinstallsomeInternetExplorerplugin?Ifitisnotshownasabadone,youshouldproceed.Ifthishappensoutoftheblueskywhilesurfingtheweb,youshouldgetcautious.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Event TeaTimer
Spybot-Search&Destroyhasencounteredandterminatedaprocessthatislistedaspartofamalicioussoftware.
Definition TeaTimer
Spybot-S&D;Residentwatchesallapplicationsthatarebeingstartedonyourcomputer.Itknowsthesamebadfilesastheon-demandscannerofSpybot-S&D;,andifitencountersanapplicationthatisknownasathreat,itwillautomaticallyterminatethisapplication.
Userinteractions TeaTimer
Aftertheprocesshasbeenterminated,youarepresentedwithafewchoices.YoucanassigntheactionResidentshouldtakethenexttimeitencountersthisthreat(likeautomaticallykillingit,and/ordeletingtheoffendingfile).
FrequentlyAskedQuestions TeaTimer
Q:WhydoesResidentterminatetheapplicationbeforeasking?A:Becausethreatsliketolldialersaretimecritical-theycostfromthefirstsecondtheyhaveconnected.Inordertoprotectyou,thesehavetobeterminatedbeforetheycanconnectatall,atthemomenttheyappear.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Event TeaTimer
Spybot-Search&DestroyhasdetectedachangetoInternetExplorerstartorsearchpagesetting.
Definition TeaTimer
Spybot-S&D;ResidentwatchesallknownInternetExplorerstartandsearchpagesettings,andwarnsyouaboutchangestothem.
Userinteractions TeaTimer
IfyougetawarningaboutanInternetExplorerpagethathaschangedwhenyoudidnotchangeityourself,youshouldusuallydenyit(ifitisnotamicrosoft.compagethatisset-IEtendstochangepagesitselfonafreshcomputer).
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Event TeaTimer
Spybot-Search&DestroyhasdetectedachangetoaSystemStartupentry.
Definition TeaTimer
Spybot-S&DResidentwatchesforchangestothissetting,andallowsyoutoreacttothem.
Userinteractions TeaTimer
Notallstartupentriesarebad-youhavetodecideifyoutrusttheprogramthatasksthechange.Duringauser-initiatedsoftwareinstallationforexample,youwouldusuallyallowthischange.Ifthishappenswhilesurfingtheweborwithoutanyintendedsystemchanges,youshouldbecareful.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
DictionaryThedictionarycontainssomeexplanationsofcommontermswhendealingwithmalware.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Dialer DictionaryAdialerisaverysmallprogram,ofteninstalledusingtheActiveXtechnology.Dialersoftenpromiseaccesstofreeporn,freegamesorfreecracksforcommercialsoftware.Onceinstalled,adialerofferstouseyourdial-updevicetocallintotheservice,usuallycallingaquiteexpensivephonenumber.Somedialersexplainthecostsoftheconnectiontheywillbemaking,sinceitisrequiredbylocallawinsomecountries,butmanydialersjustdisplayabuttonofferingtoconnect,withoutinformingtheuserofwhatishappeningbehindit.Intheworstcase,thedialersetsuptheexpensivenumberasthedefaultInternetconnection,meaningtheuserwillhavetopayhighratesforbeingonline,withoutevenknowingituntilreceivingthenexthighphonebill.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Firewall Dictionary
Afirewallisbasicallysomekindofsoftwareorhardwarethatcontrolsdatatransfers.Thetypicaluseofafirewallwouldbetosecuretheaccessacomputeroranetworkofcomputerstoanothernetwork(whichmayevenbetheinternet).Ahardwarefirewallissimplyaboxthatisputbetweenthelocalandthefarnetworkandthatallowsordeniestransfersbasedonpredefinedrules;asoftwarefirewallisasoftwareinstalledonacomputerandbasicallydoesthesame.Ithastheadvantagethatitcanalsosetrulesbasedonthesoftwarethatisdoingthetransfer,butthedisadvantagethatitdependsonhowwisetheuserusesit.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Browserhijacker Dictionary
AbrowserhijackerisasmallprogramorregistrysettingthatisresponsibleforchangedIEstartandsearchpages.Ifyourbrowserstartswithadifferentstartpage(oneyouhavenotchangedyourself),youmostprobablygothijacked.Intelligenthijackersdonotonlychangethesepages,butalsoaddasmallfilethatwillrestorethehijackedsettingsuponeachsystemstart.HijackersoftenuseActiveXinstallationprogramsand/orsecurityholes.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Javaapplet Dictionary
AJavaappletiscapableofdoingmorethanjustaJavaScript,buthasn'tgotthefullaccesstoyourmachinelikeafullJavaapplication.Anappletstillneedsthebrowsertoberunin,whileafullJavaapplicationcouldrunstand-alone(usingjusttheruntimeengine).
©2000-2008SaferNetworkingLtd.Allrightsreserved.
JavaScript DictionaryAJavascriptisaverysmallprogramthatisrunningonyourcomputerwhenvisitingwebsitesthathavedefinedsuchascript.Javascriptshavelittleaccesstoyourcomputer,butcanmodifyyourbrowser.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Keylogger Dictionary
ThenamekeyloggerwasdefinedbackinoldDOStimes,wherecomputerswerehandledjustbyusingakeyboard.Themostbasickeyloggersbackfromthattimejustlogthekeysyoupress.Thespy,apersonwithphysicalaccesstoyourmachine,couldgetthatlogatalaterpointandseeeverythingyoutyped.
Modernkeyloggersaremuchimproved.Theydonotonlylogthekeysyoupress,butdoalsomakescreenshotstoshowthespywhatWindowsyouareworkingwith,theycaptureinformationaboutyourinternetuse,andmuchmore.Thespydoesnotevenneedphysicalaccesstoyourmachinebecausemanycurrentkeyloggerssendtheirlogsbyemail.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Passwords Dictionary
Yousurelyknowwhatapasswordis.Whenaccessingprivatedataonaprotectedsystem,youneedapassword(sometimesalsocalledpassphrase)andmostoftenausernametotellthesystemyouridentity.
Mostthingsaboutpasswordshavealreadybeensaid,butsomethingscannotberepeatedtoooften.
1. Donottellyourpasswordstoanyone.Ifyouareaskedbyanyonetotellthemyourpassword,sayno.Theresimplyisnoreason.Ifsomeonetellsyouheisanadminandneedstoknowyourpassword,heislying.
2. Whenchoosingyourpassword,donotchoosesomethingthatotherscouldsimplyguess.Donotusethenameofyourspouseorcat,orthecompanynameprintedonyourcomputerormonitor.Whilethebestthingwouldbearandomstringofcharactersandnumbersandevenspecialcharacters,ifyoureallyneedsomethingthatiseasytoremember,takepartsofwordsandcombinethemintosomethingthatyoucanstillspeak,butthatgivesnosense.Attachafewnumberstoittobeonthesaferside.
3. Donotwriteyourpassworddownonastickyattachedtoyourscreen,oranywhereonyourworkspace.Ifyouneedtowriteitdown,putthepaperwithitintoyourwallet,butneveranywherenearthecomputer.
4. Donotsaveafilewithallyourpasswordsonyourcomputer.Ifyoucannotrememberthemall,writethemdown.Ifyoureallywanttosavetheminafile,encryptthatfile.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Trojanhorses Dictionary
EventhoughatrojanhorseissometimesalsocalledTrojan,itismoreaGreek.TheGreeksbuilttheso-called"trojanhorse"inthefightaboutTrojatogetintothetown,sotheyaretherealsnoops;)
Atrojanisaprogramthathasgottenontoyourmachinewithoutyourknowledgeandcontainsmaliciouscode,thatwouldforexampleallowpersonsusinganothercomputertoconnecttoyoursoveranetwork.Typicaltrojansareopentoanyonetryingtoconnect(anypersononyourlocalnetworkoreventheinternet).Specialtrojansaredesignedtomakeyourmachineaccessiblejusttothepersonwhoinfectedyourcomputerwiththetrojan.
Theaccessanoutsidercangainusingatrojanonyourmachinecanbenearlyanything.Fromwatchingallyourbehaviour(likeakeylogger),manipulatingyourcomputertobasicallydoinganythingyoucanalsodousingyourkeyboardandmouse.
Yourcomputercangetinfectedwithatrojanbymultipleways.Apersonwithphysicalaccesstoyourmachinecanplaceitthere,butyoucanalsoaccidentallyinstallityourselfbyopeninganunknownemailattachmentthatbychancecontainsatrojan.
Accordingtosomedefinitions,trojansarealsoprogramsthatsneakintootherprograms,forexampletogainaccess.Astheseprogramsareconsciouslyusedbytheother,theyarenottrojans,butarebackdoors.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Generalquestions
WhyisSpybot-S&D;thatfast?HowcanIcontributetothecause?WherearefeaturesliketheToolsorSettingssection?Whatisblindman.exefor?Arethereanycommandlineparameters?Ihavetwoinstallationsonmyharddisk.CanIscanbothatthesametime?HowcanIgetAdministratorrightsunderWindowsVista?IsSpybot-S&D;compatiblewithWinPE/BartPEbootableCDs?WhichbrowsersdoesSpybot-S&D;support?IsSpybot-S&D;compatiblewithotherresidentprotectiontools?Whatistheimmunizationfeatureandwhataretheotherpermanentprotectionoptions?WhatisnewatSpybot-S&D;1.5?
Updates
WhatfilesdoIneedtoupdate?Whyistheintegratedupdatenotworking?WhydoIreceivethemessage"updateisforbidden"/"badchecksum!!!"?WhydoesSpybot-S&D;freezeuponupdate?WhydoIreceivea"SocketError"?
Detections
WhydoesSpybot-S&D;alsoremoveIEtoolbarsthatseemusefultome?WhydootherspywareprogramsfindspiesinSypbot-S&D;'sdirectory?WhycanInotremovetheSti_Trace.log(orSchedLgU.txt)file?WhydoIreceiveadstitled"MessengerService",althoughSpybot-S&D;cannotfindanything?WhydoesSpybot-S&D;findsomanySpywareinstallers/howisthatDownloaddirectoriessettingused?
Whydootheranti-spywareapplicationsdetectsomanymoretrackingcookies?WhydoesSpybot-S&D;notdetectrunningprocesses?WhydoesMSAntiSpywarecomplainthatSpybot-S&D;addsbadsitestothetrustedzone?WhydoesSpybot-S&D;flagchangesintheWindowsSecurityCenter?
Bugsandproblems
WhatshouldIdoifmyinternetprogramsstoppedworking?WhydoesmynetworkreactveryslowlyafterinsertingtheHostsFile?Whyaretheresomeitemslefttoimmunize?Whyhasthenumberofscanneditemsbeenreduced(andnowsearchesforonlyafewitems)?WhatcanIdoifSpybot-S&D;flashesanddisappearsimmediately?WhycanInolongeraccessmyIEsettings?WhydoesSpybot-S&D;notscannetworkdrives(shares)?HowcanIdisablethenotificationspoppingupwhenadownloadwasblocked(e.g.AvenueA,Inc.,DoubleClick)?Whyaresomeproductssettobeignoredbydefault?WhatcanIdoifSpybot-S&D;freezesduringscan?
TeaTimer
HowdoIedittheBlack&WhitelistinresidentTeaTimer?HowdoIdisabletheTeaTimernotifications?WhatistheResidentTeaTimer?WhydoesResidentTeaTimerterminatetheapplicationbeforeasking?WhyisTeaTimercalledTeaTimer?
ErrorMessages
WhydoIreceivetheerrormessagethatthereisaprobleminHijackers.sbiandIshouldlookintotheIncludeerrors.logfile?WhydoIreceivetheerrormessage"ws2_32.dllmissing,EReadError"?/DoesSpybotnotrununderWindows95?WhydoIreceivetheerrormessage"NoZipFilespecified"whenIupdateorfix?
WhydoIreceivetheerrormessage"framedyn.dllismissing"?WhydoIreceivetheerrormessage"Problemsintheincludefile(Trojans.sbi)"?
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhyisSpybot-S&Dthatfast? FAQ#001
Therearedifferentwaystosearchforspies.Onewouldbetosearchthecompleteregistryandharddiskforsuspiciousentriesandfiles.Thatcantakealotoftime.
Spybot-S&Dtakesadvantageofthefactthatallspieshavetoanchorthemselvesatafewplacesoverthesystemtogetactive.Itstartstosearchatthisplaces,followingtheinformationgatheredtheretocatchthewholespy.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoesSpybot-S&D;alsoremoveIEtoolbarsthatseemusefultome?
FAQ#002
NearlyallIEtoolbarshavesomethingincommon:theywanttomakethewebeasierforyou.Sadly,totailortheirinformationtoyourneeds,theyneedtocollectdataaboutyou;andmostprivacystatementsareunclearabouthowtheydousethisdatabesidesendingyouwhattheythinkiswhatyouwant.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhatshouldIdoifmyinternetprogramsstoppedworking? FAQ#003
Ifyouremoveaspy,theapplicationthathasinstalleditmaynoticethisandrefusetoworkanylonger.Spybot-S&D;isabletoreplaceafewspieswithharmlessdummies;butwherethatisnotpossible,Irecommendeithertosearchforagoodalternativethatcomeswithoutspy-oradware,orusingtherecoveryoptioninSpybot-S&D;torestorethespy.Inthelatercase,youcandoitstepbystep,untilyoufoundthefilesthatareabsolutelynecessaryforthespy,andatleastkeepsomefilesfromyoursystem,likethedatasavedaboutyou.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydootherspywareprogramsfindspiesinSypbot-S&D;'sdirectory?
FAQ#004
Pleaselookatthepathwheresuchaprogramfoundthespyware.AsSpybot-S&Dhasnospywareintegrated,thismustbeafalsealarm.
Thereasonforsuchafalsealarmissimple:Spybot-S&Dsavesbackupsoftheproblemsyouhavefixed;tomakeitpossibletorecoverthemincasesomethingstopsworkingafterthefix.
IfthefilefoundisintheRecoverydirectoryinsidetheSpybot-S&Ddirectory,itissuchabackup.Itisnolongerofanyharmthere,asthefilewillnotbefoundandloadedfromthere.Butonceyouaresureyoudonotneedthebackup,gototheRecoverysectioninsideSpybot-S&Dandpurgethatfiles.
Currentversionscompresstherecoveryfilesintopassword-protectedziparchives,thusavoidingotherspywareapplicationswillgivefalsealarms.Someprogramsmightnotifyyouthattheycannotaccesstheseziparchives-thiscaneasilybeignored.Astherecoveryfilesarenamedafterthethreatsomeprogramsmightalsonaivelydetectthebackupsasthreatsjustbecauseofthefilename.Thiscanalsobeignored.
Inrecentweekstherewasanoticeablyhighnumberofcaseswhereotheranti-virusandanti-spywareprogramswronglydetectedpartsofSpybot-S&D,whichprobablyhastobetracedbacktoinsufficienttestingatthesecompanies.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
HowdoIedittheBlack&WhitelistinresidentTeaTimer? FAQ#005
Pleaseright-clicktheResidenticoninthesystemtraySpybotS&DresidentandselectSettings.Thereyouwillfindfourlistsforremembereddecisions(allowed/deniedprocessesandregistrychanges).Inordertoremoveanentry,justclickonthecrossnexttoit.TeaTimerwillthen"forget"thisdecisionandyouwillbeaskedagainthenexttime.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhycanInotremovetheSti_Trace.log(orSchedLgU.txt)file? FAQ#006
TheSti_Trace.logfileisopenedonmanymachines;mostoftenonWindowsME/2000/XP/Vista.ThereasonisthattheStillImageMonitorrunsallthetime,usingthisfile.YoucanusemsconfigtodisabletheStillImageMonitor,butasitisofnoharmIwouldsuggesttoaddthislogfiletothesingleignorelist.
ThesameisvalidfortheSchedLgU.txt;itisthelogfileofthescheduler.Iftheschedulerisrunning,thisfileiskeptopen.Ifyouarenotusingthescheduler,Isuggestdisablingit,thiswillnotonlyallowyoutobackupthisfile,butalsosavesomeRAM.
(Toaddaproblemtothesingleignorelist,simplyright-clickonitintheresultslist,andchoosetheappropriatemenuitem.)
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoIreceivetheerrormessagethatthereisaprobleminHijackers.sbiandIshouldlookintotheIncludeerrors.logfile?
FAQ#007
Thiserrorusuallyistheresultofupdatesyouhavemissedorinstalledonlypartially.Tosolvetheproblem,pleaseinstallallupdatescheckedbydefaultatleast,ifnotall.IfyoudonotwanttousetheupdatefunctionofSpybot-S&D;,takealookatthedownloadpage(onlinelink)hereanddownloadallmanualupdaters.
Thebackgroundofthisproblemareextensionstothedetectionenginewhichprovidenewwaysofdetectingmalware.TheseupdatesareusuallylabeledPlugin,contrarytotheweeklyDetectionupdate,andmightthereforebeoverlooked.Sinceversion1.4Spybot-S&D;andlaterallowyoutohidethesemessages,butthisisgenerallynotrecommendedsincemissingpluginsmightmeanmissingorreducedchancestofindthenewestmalware.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
HowdoIdisabletheTeaTimernotifications? FAQ#008
ThereasonwhyTeaTimeraskedyouisbecauseitwouldaskyouaboutanysimilarchangesintheregistrywithoutregardingifitisgoodorbad.Therearesomanyregistrykeysthatitisimpossibletoclassifythembydefault.Sotheuserhastodecideifhewantstoallowitornot.TheTeaTimerismakingsnapshotfileswhenyoustartitthefirsttimeandthetooliscomparingthecurrentregistrywiththesnapshotfiles.
IfyouwanttomakenewsnapshotfilespleaseshutdowntheTeaTimerwiththeResidenticonandthenstartitmanuallyfromtheSpybotS&Dprogramfolder.Thereisnopossibilityyettohidethepopupswhichremindyouwhichkeysareblocked.Asaworkaround,youcanonlymakenewsnapshotfiles.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhatfilesdoIneedtoupdate? FAQ#009
Updatescanbedividedintothefollowingcategoriesusually:
1. Detectionupdatesandplugins:theseupdatesareusuallypreselectedwhenyouusetheupdater,itishighlyrecommendedtodownloadthemwheneverthereareupdatesavailable,sincetheseareresponsibleforthedetectionrate.TheseareusuallynamedDetectionrules,Advanceddetectionlibrary,DetectionsupportlibraryorSomeplugin.
2. Localizedupdates:languagefilesandlocalizedproductinformation.ThesefilesarenotnecessaryifyouuseSpybot-S&D;exclusivelyinEnglish.Ifyouuseonlyoneotherlanguage,youjustneedyourlocalones.
3. Betaupdates:ifyouarewillingtohelpusimproveSpybot-S&D;,youmightdownloadtheseaswell.Donotforgettheusualbetadisclaimerthough:theremightbeabunchofnewfeatures,butthereisalsotheriskofnewbugs.
4. Malwaredocumentationandhelpupdates:asthenamealreadyindicates,theseareforthosewholiketoreadupsomeinformation,onmalwareandonSpybot-S&D.;
5. Fullupdates:rare,butwhenanewreleasecomesout,itwillusuallybeavailablethroughtheupdater.
Thesecondandthirdoptionarenotdisplayedbydefault;inversion1.4youcanenablethesecategoriesonthesettingspage,version1.5hastwocheckboxesforthemonthestartpageofthenewupdaterapplication.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Whyistheintegratedupdatenotworking? FAQ#010
Themainreasonforthisproblemisthatyouneedtouseaproxyservertoaccesstheinternet.Inthatcase,theproxyserverisalreadysetupinyourbrowser,whereyoucanlookupitssettingsandenterthemintoSpybot-S&D.;
InMozilla,youcanfindtheProxysettingsifyouopentheEditmenu,chooseSettings...atthebottom,andnavigatetothesectionAdvanced-Proxies.InInternetExplorer,seetheMenuExtras-Internetoptions,gotothetabConnectionsandclicktheSettingsbuttonatthebottom.InOpera,seetheMenuTools-Preferences,gotothetabAdvanced,sectionNetworkandclicktheProxyserversbutton.LookfortheHTTPproxythere.
BackinsideSpybot-S&D;gototheAdvancedMode(viamenuMode),thenchooseSettings→Settings,andscrolldowntotheentryAutomation-Webupdate-Useproxy.Nowchecktheboxbelowit,andadialogwillappearwhereyoucanenteryourproxysettings.
Theformatishost:port(thehostisthename,theportthenumberyoufoundinyourbrowser).Ifyouneedtoaccessyourproxyusingalogin,youcanusetheformatusername:password@host:port.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Whydoreceivetheerrormessage"ws2_32.dllmissing"(andothers)? FAQ#011
Spybot-Search&Destroy1.4wasincompatiblewithWindows95,whileversion1.3orearlierandversion1.5andlaterarecompatible.However,thelackoffollowingupdatesusuallycausesproblems(allfollowinglinksareonlinelinks):
HTMLHelp1.3Ifyoureceivethemessage"Errormessage:HHCTRL.OCXismissing",youareprobablyusinganoldversionofInternetExplorer,thustheneededHTMLhelpcomponentsarenotinstalled.Winsock2Ifyoureceivethemessage"Errormessage:WS2_32.DLLismissing",youneedaWinsockupdateforWindows95.MoreinformationisavailableinMicrosoft'sknowledgebase.ActiveAccessibility1.3Spybot-S&D;triestosupportsolutionsfordisabledpeople,soyouneedtoinstalltheActiveAccessibilityruntimepackageifyoureceivecomplaintsaboutproblemsinoleacc.dll.CommonControlsSpybot-S&D;mightalsoneedthisupdateifthingsarenotprobablydisplayedoryoureceivemessagesaboutothermissingfunctions.ShellFoldersIfyouarerunningoneoftheolderWindows95releasesanddonotevenhaveInternetExplorer4,youneedthisupdateforanewerSHFolder.dll,whichisresponsiblefortheApplicationDatafolderusedbymanyapplicationstostoredata.
WerecommendtheseupdatestoanyWindows95anyway,andwehaveincludedanoptiontodownloadandinstallmissingupdatesintheinstallerofSpybot-S&D;1.5.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoesmynetworkreactveryslowlyafterinsertingtheHostsFile?
FAQ#012
Pleasereadthisarticle(onlinelink).
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoIreceiveadstitled"MessengerService",althoughSpybot-S&D;cannotfindanything?
FAQ#013
ThesearesentusingtheMessengerserviceintegratedintoWindows2000andXP(trythenetsendcommandtoseeforyourself).
TodisabletheMessengerservice,gotoStart→AllPrograms→AdministrativeTools→Services.InServices,clickonServices(Local),thenontherightside,findMessengeranddisableit.
Note:noteveryonewillhaveAdministrativeToolsintheStartmenu.YouneedtomakeitvisibleunderTaskbarandStartMenuProperties(right-clickontaskbar→Properties).ThesafestwaytogettoComponentServicesistoenter%systemroot%\system32\com\comexp.mscintothecommandline.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoesSpybot-S&D;findsomanySpywareinstallers/howisthatDownloaddirectoriessettingused?
FAQ#015
Detectionoffilesthatmightbefoundinvariablelocations,typicallytheinstallerarchivesofmalware,issometimesoptimizedbycombiningtheirlookup,inwhichcasetheyreceivethisgenericname.
TheDownloaddirectoriessettingcanbeusedtoputspecialattentionforsuchfilesonfoldersyouuseforincomingfiles.Spybot-S&D1.5alsoaddsafewguessedlocationstothisinternallytoreducetheriskofforgettingstandarddownloadfolders.
Itisunnecessary,evencounterproductive,toaddwholedrivestothissetting!
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Whyaretheresomeitemslefttoimmunize? FAQ#017
Ifyouarenotimmunizingwithfulladministratorrights,Spybot-S&Dmightnothavepermissiontoimmunizealluseraccounts.
IfyouareusingWindowsVista,youshouldalsoreadthisFAQentryaboutgettingAdministratorrightsunderVista.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoIreceivetheerrormessage"NoZipFilespecified"whenIupdateorfix?
FAQ#018
ThishappensifyouhaveZipMagicfromAladdinSystems(tomyknowledgeitcamefromOntrackbefore)installed.ZipMagicdisplaysallzipfilesasfolders,andevendeniesotherapplicationsaccesstotherealzipfile.
Toallowanotherapplicationdirectaccesstozipfiles,ZipMagichasasettingsomewhereonitsOptionspage.YouneedtoaddSpybotSD.exethere.Instructionsfromkinduserfollow:
1. OpentheZipMagicproperties,2. ClickontheiconApplicationsattheleft.3. ChecktheoptionTheseapplicationsseeZipfilesasfiles,4. PresstheAdd...button,and5. SelecttheSpybotSDexecutableinthedialogappearing(usuallyC:\Programfiles\Spybot-Search&Destroy\SpybotSD.exe).
ThiswilltellZipMagictoallowSpybot-S&D;accesstozipfilesagain.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
HowcanIcontributetothecause? FAQ#019
Asyoumayhaveread,weareworkingfull-timeonthisfreeproject,butwehavegottopayhostingbillsanddevelopmentsoftware.Sowewouldbegladifyoucoulddonateasmallamount(onlinelink)toourcause.Thankyou:-)
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WherearefeaturesliketheToolsorSettingssection? FAQ#021
IfyouhaveafreshinstallationofSpybot-S&D,youmaymisssomefunctionsliketheToolsorSettingssection.TheyhavenotvanishedbutSpybot-S&Dhastwodifferentmodes.FromthemenubaritemModeyoucanchoosebetweenDefaultModewiththebasicfunctionsandAdvancedModewhereyouwillfindtheToolsandtheSettingssection.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Whyhasthenumberofscanneditemsbeenreduced(andnowsearchesforonlyafewitems)?
FAQ#022
PleaserunSpybot-Search&Destroy;andswitchtoAdvancedmodeviathemenubaritemMode,thenselectSettings→FileSetsintheleftbar.
There,pleaseright-clicksomewhereintothelistandchooseSelectallavailablechecks.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhatcanIdoifSpybot-S&D;flashesanddisappearsimmediately? FAQ#023
ThismighthappenifyouenablealloftheProgramautomationsettings.Whileversion1.5shouldnotallowyoutolockyourselfoutthisway,hereareinstructionsonhowtorevertthis,e.g.forolderversions:
1. Youcandeletetheconfigurationfile(whichisnamedConfiguration.ini).WhereitislocateddependsonyourWindowsversion.
ForWindows95/98,thefileislocatedinC:\Windows\ApplicationData\Spybot-Search&Destroy\.ForWindowsME,thefileislocatedinC:\Windows\AllUsers\ApplicationData\Spybot-Search&Destroy\.ForWindowsNT/2000/XP,thefileislocatedinC:\DocumentsandSettings\AllUsers\ApplicationData\Spybot-Search&Destroy\.ForWindowsVista,thefileislocatedinC:\ProgramData\Spybot-Search&Destroy\.
Eitherdeletethatfile,oreditit(forexampleinnotepad),andsetalltheAutomationvaluesinittozero.
2. Youcandownloadasmalltoolthatwilldothosechangesforyou:clickhere(onlinelink).
Ifthisdoesnotfixtheproblem,yoursystemispossiblyinfectedbytheCoolWWWSearch.SmartKiller(v1andv2).Thisisanew,reallyuglyvariantofCoolWWWSearch.Whenrunning,itwillcloseeverybrowserwindowvisitingananti-spyware-site.ItwillevencloseSpybot-S&D;andsomeotheranti-spywareapplicationsaswell.
SoifyourcopyofSpybot-S&D;(ortheanti-spywareapplicationofyourchoice)closesafewsecondsafterstarting,oryourbrowsercloseswheneveryoutrytovisitananti-spywaresite,checkourCWS.SmartKillerremovalutility(onlinelink).
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhycanInolongeraccessmyIEsettings? FAQ#024
InternetExplorertellsyoutocontactyouradministratorwhenyoutrytoaccesstheIEsettings?
ThiscanhappenifyouuseSpybot-S&DinadvancedmodeandyouhaveusedtheImmunizefeaturewithoutreadingallthetext.
1. PleasestartSpybot-S&Dagaininadvancedmode(usuallyfromtheStartmenugroupSpybot-Search&Destroy,untilyouhavealreadychangedthedesktopicontoadvancedmode).
2. SelectToolsintheleftbar,thenIEtweaks.3. ThereyouwillseeagroupRecommendedmiscellaneouslocks.Untickthe
checkboxesinfrontofbothLockIE...options.4. YoumayneedtocloseallExplorerwindows,andmaybeevenrestart
Windowsbeforethesechangestakeplace.
Hint:thislockfunctionhasbeenaddedmostlyformulti-userenvironmentswhereyouwouldnotwantotherusersofyourcomputertochangeyourIEsettings.Ifyouaretheonlyuserofyourcomputer,thereisnorealneedtoenablethem.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Whatisblindman.exefor? FAQ#025
Someofyoumayhavenoticedanewfileblindman.exeinsidetheSpybot-S&D;folder,andhaveaskedyourselfwhatitisfor.Inshortwords:itdoesnothing.
IguessanexplanationisneededwhyafilethatdoesexactlynothingcomeswithSpybot-S&D.;Spybot-S&D;offersatooltocontroltheSystemstartupinitsToolssection.ThisincludestheabilitytodisableorenablestartupentriesfromtheAutostartgroup(foundinyourStartmenuunderPrograms).Thisgroupcontainslinkstotheactualfiles.Windowsstoresthoselinksasfileswiththeextension.lnk.WhenWindowsencountersa*.lnkfileinthatfolderuponstartup,itwillstartthelinkedapplication.Nowtheeasiestwaytodisablethoseentriesistochangetheextension.TheSystemstartuptoolofSpybot-S&D;doessimplychangetheextension.lnkto.disabled.Thiseasilypreventsthelinkedapplicationfrombeingstarted.ButasWindowsdoesnotknowthisextension,thiscouldslowthestartupdown.SoSpybot-S&D;doeslinkthatextensiontoblindman.exe.Windowsnowtriestorunthe.disabledfilewithblindman.exe-andasblindman.exedoesexactlynothing,thereisnoslow-downinbooting.
Somepeoplehavesuspecteditcouldevenbespywareitself.ForthoseIwillprinttheDelphisourcecode(blindman.dpr)here(theincludedresourcefileisblindman.resandcontainsjusttheicon):
programblindman;
{$R*.res}
begin
end.
Anyoneknowingaverysmallbitofprogrammingshouldseethatthisprogramistotallyharmless(actually,theversionshippedwithSpybot-S&D;1.5isabitlargerthantheabove,becauseoneofMicrosoftscertificationrequirementsisthateveryexecutablefileneedtocallGetVersionExatleastonce,andneedsto
crashoninsertedinjections,evenifjusta1millisecondemptydummy).
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoesSpybot-S&D;notscannetworkdrives(shares)? FAQ#026
Scanningnetworksharessoundslikeagoodideaatfirst-thescannerneedstobeinstalledonlyonasinglemachineandonepersoncandothescan.Tosimplyremoveinstallers,thisisnotabadideaatall,soSpybot-S&DallowstoaddnetworksharesaswellinitsDownloaddirectoriessetting.
Butscanningforandremovingfilesonothercomputerscanbedangerousaswell.Mostthreatsarenotonlyfiles,butalsolinkedbyregistryentries-removingjustthefileswouldcausethe'cleaned'Windowstoproducealotoferrors.Butwhilethosemessagesmaybeharmless(andremoteregistrycleaningcouldatleastbeaddedforNT/2000/XP/Vista),thereisanevenworsecase-somethreatsneedtoberemovedbyusingAPIcalls.RemovingLSPhijackersbyjustdeletingtheirfilewilldisablethenetworkaccessofthecleanedmachine,andrepairingLSPsbyfixingtheregistryisnotfail-safeeither.
Thatiswhyananti-spywaretoolneedstoberunoneachmachine.Wearedevelopingaclient/serverscanningsystemthatwillworkinnetworkenvironments.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoIreceiveanerrormessage"framedyn.dllismissing"? FAQ#027
PleasevisitthisMicrosortsupportpage(onlinelink);youcandownloadthefilehere(onlinelink)forexample.Moreinformationisavailableinourforum(onlinelink).
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Arethereanycommandlineparameters? FAQ#030
HereisalistofcommandlineparametersthattheSpybot-S&Dmainexecutable(SpybotSD.exe)supports:
/taskbarhideRunsSpybot-S&Dcompletelyhidden(nowindow,notaskbaricon),somakeabsolutelysureyouuseitonlyincombinationwith/autoclose(otherwiseitwouldremaininmemorysittingidle).Usefulonlyincombinationwith/autocheck,/autoupdateor/autoimmunize,asitcannotbecontrolledwhencompletelyinvisible./minimizedStartsthewindowminimized./uninstallUninstallsSpybot-S&D.Thiscommandlineparameterisveryoutdated-unins000.exeshouldbeusedinstead!/blinduserStartswithsupportforblindusers(specialmenus)./autoupdateDoesanupdateafterstartingtheprogram./autocheckStartsscanningimmediately./autofixFixesproblemsafterscan./autocloseClosesprogramafterithasscannedorupdated./autoimmunizeRunstheimmunizationatprogramstart./onlyspywareFixesonlyspyware(red)entrieswith/autofix,leavingallusagetracksastheyare./easymodeStartswitheasierinterfaceforbeginners./createenglishUpdatestheEnglish.sbllanguagefilewiththenewesttexts;usefulonlyfortranslators.
AndhereisalistofcommandlineparametersthattheSpybot-S&Dinstaller(spybotsd15.exe)supports:
/sp-Willskipthefirstpageoftheinstallationwizard(Doyouwishtocontinue?...)/silentWilldisplaytheprogressduringinstallation,butnotthewizard./verysilentEventheprogresswillnotbeshown.Errorsetc.wouldstillbeshown./surpressmsgboxesWillusestandardactionsformessageboxes(nooverwritingoffiles,cancellingwherethealternativewouldberetrying...)/log(or/log="filename")Createsalogfileinthetempfolderthatcontainsdetailedinformationaboutactionstakingplaceduringtheinstallation./nocancelDisablestheCancelandClosebutton.Usefulwith/silent./norestartSuppressrebootseveniftheywerenecessaryattheendoftheinstallation./restartexitcode=NIfarestartisneeded,thesetupwouldreturnthespecifiedexitcode./loadinf="filename"(and/saveinf="filename")Canbeusedtouseasavedsetupconfiguration(orsaveone)./lang=languageOverridesthelanguagedialogwithapredefinedlanguage.UseISO2letterlanguagedescribershere./dir="x:\dirname"Installsintothatdirectoryinsteadofthedefaultone./group="foldername"Installsintoaprogramgroupofthatnameinsteadofthedefaultone./noiconsAvoidscreationofanyiconsfortheinstalledsoftware./type=typenameStartsinstallationwithagivetype.Supportedtypesare
full,blindandcompact.
/components="commaseparatedlistofcomponentnames"
Installsthegivencomponentsinsteadofthedefaultones.Supportedcomponentsare
main,blind(iconsforblindusers),language(alllanguagefiles),skins,updatedl(fordownloadingupdatesaspartoftheinstallation),updatew95(todownloadprerequisitesonWindows95),SDWinSec(toinstalltheSecurityCenterintegrationonVista),SDShredder(toinstallthestand-aloneshredder),andSDDelFile(toinstallthefileremovalhelper).
/tasks="commaseparatedlistoftasks"Specifiesalistoftasksthatshouldbeexecuted.Taskscurrentlysupportedare:
desktopiconquicklaunchiconlaunchsdhelperlaunchteatimer
/mergetasks="commaseparatedlistoftasks"Sameas/tasks,justwiththeexceptionthatstandardtasksarenotdisabledbydefault.
Note:PleasebeawarethattheSpybot-S&Dpathhastobeinquotationmarksandmultipleparametershavetobeseparatedbyaspace.
Example:"C:\ProgramFiles\Spybot-Search&Destroy\SpybotSD.exe"/taskbarhide/autoclose/autocheck/autofix/onlyspyware
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoesSpybot-S&D;freezeuponupdate? FAQ#032
Spybot-S&D;canbefreezedupiftheserversarereactingveryslowly.Thisoftenhappensthedaynewupdatesarereleased,whentoomanypeopletrytodownloadthematthesametime-itisjustdelayedthoughandveryslowinreacting.Thereareafewpossiblesolutionsforthisproblem:
1. Waitaminute,itshouldbeactiveagain.2. Selectadifferentdownloadlocation:AfterSearchforupdate,youcan
selectanothermirrorinthetoolbar.Todothat,clickthesmallarrownexttothecurrentlyselectedmirrorname.
3. Pleasetryagainlater.
InformationaboutupdatingisalsoavailableinoursectionHowto(onlinelink;includesascreenshot);takealookatpoint5ofthisdescriptionthatshowsyouhowtoselectadifferentdownloadlocation.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhatistheResidentTeaTimer? FAQ#033
TheResidentTeaTimerisatoolofSpybot-S&D;whichperpetuallymonitorstheprocessescalled/initiated.Itimmediatelydetectsknownmaliciousprocesseswantingtostartandterminatesthemgivingyousomeoptions,howtodealwiththisprocessinthefuture.YoucansetTeaTimerto:
beinformed,whentheprocesstriestostartagainautomaticallykilltheprocessorgenerallyallowtheprocesstorun
Thereisalsoanoptiontodeletethefileassociatedwiththisprocess.
Inaddition,TeaTimerdetectswhensomethingwantstochangesomecriticalregistrykeys.TeaTimercanprotectyouagainstsuchchangesagaingivingyouanoption:YoucaneitherAlloworDenythechange.
AsTeaTimerisalwaysrunninginthebackground,ittakessomeresourcesofabout5MB.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoesResidentTeaTimerterminatetheapplicationbeforeasking?
FAQ#034
Becausethreatsliketolldialersaretimecritical-theycostfromthefirstsecondtheyhaveconnected.Inordertoprotectyou,thesehavetobeterminatedbeforetheycanconnectatall,atthemomenttheyappear.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhyisTeaTimercalledTeaTimer? FAQ#035
Asweusedtoforgetourteawhenweletitbrew,webuiltasmalltoolwithasystemtrayicontoremindus.WecalledthistoolTeaTimer.
WhenwestartedtodeveloptheResidenttoolforSpybot-S&D,wealsoneededasystemtrayiconforthis.Aswedonotlikehavingtoomanyiconsinthesystemtray,wedecidedtoputbothtoolstogetherandkeptthenameTeaTimer.
AfutureversionoftheResidenttoolmighthavethefunctionsoftheoriginalTeaTimeragain.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Whydootheranti-spywareapplicationsdetectsomanymoretrackingcookies?
FAQ#037
Someanti-spywareapplicationshavestartedtodetectnearlyeverythird-partycookietheyfindasatrackingcookie.Inmanycases,thatismoreorlesscorrect,sincemanycontainaGUID(GenericUniqueIdentifier).
Butinsteadofbloatingourdetectiondatabasewiththousandsofcookiesoutthere,wepreferrecommendingtochangeyourbrowsersettingsabittoblockoutallthesethirdpartycookiesbeforetheyevencomeintoyoursystem(allfollowinglinksareonlinelinks):
InternetExplorer:Open"InternetOptions..."fromthe"Tools"menu.Choosethe"Privacy"tab,andraisetheSettingstoatleastMedium;orusethe"Advanced..."buttontoenabled"Overrideautomaticcookiehandling"andset"Third-partyCookies"to"Block".Screenshot1Screenshot2Firefox1.x:Open"Options"fromthe"Tools"menu.Clickthe"Privacy"icon,andopenthe"Cookies"category.Under"Allowsitestosetcookies",justsetthe"fortheoriginatingwebsiteonly"option.ScreenshotFirefox2.0:Type"about:config"intoFirefox'saddressbar,thentype"network.cookie.cookiebehavior"inthe"Filter"box.Thatwillleaveonesettingslinevisible;double-clickit,type"1"inthe"Enterintegervalue"box,thenclickOK.Mozilla/Netscape:Open"Preferences..."fromthe"Edit"menu.Openthecategory"Privacy&Security"andclickonitsfirstentry"Cookies".Inthegroup"CookieAcceptancePolicy",select"Allowcookiesfortheoriginatingwebsiteonly".ScreenshotOpera:Open"Preferences"fromthe"Tools"menu.Clickon"Privacy"inthelistontheleft,thenopenthepull-downlistabout"Thirdpartycookies"ontherightandsetitto"Refuseallcookies".ScreenshotOpera9:Open"Preferences"fromthe"Tools"menu,goto"Advanced"
→"Cookies"andselect"AcceptcookiesonlyfromthesiteIvisit.".
©2000-2008SaferNetworkingLtd.Allrightsreserved.
DoIneedthisFAQ? FAQ#039
BeforeyoureadthisFAQorothersupportdocuments,wewouldrecommendthatyouusetheupdatefunctionandseeifyouhavethemostcurrentupdatesforSpybot-S&D;(weremovedsomeFAQentriesforversionsfromlastyearorearliertokeepthisFAQeasiertolookthrough).
Ifyouhave,wehopetobeabletohelpyoueitherhere,onthesupportforumorbyemail.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoesSpybot-S&D;notdetectrunningprocesses? FAQ#040
Butitdoes!Thisisoftenmisunderstoodaswedonotdisplayanextralistofrunningprocessesafterthescan.Butwedonotseethatasnecessary-everyrunningprocessisidenticaltoafileontheharddisk,becauseaprocessismoreorlessthatfileloadedintomemory.
ButwhenyouuseSpybot-S&D;tofixproblems,itwillautomaticallyterminatethebadprocessesdetectedbeforedoinganythingelse.AndifyouareusingourTeaTimer,TeaTimerwilldetectmalwareprocessesassoonastheyarestartedandterminatethem.
Ourlogsofcoursedoincludeafulllistofprocesses,andsinceversion1.4Spybot-S&D;evenlistsopennetworkconnectionsperprocess(exceptforonVista),allowingyoutoeasilyseewhichprocessesareconnectingtotheoutsideandwhereto.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Ihavetwoinstallationsonmyharddisk.CanIscanbothatthesametime?
FAQ#041
Yes,ifyouhaveWindows2000,XP,2003orVista,Spybot-S&D;doesallowyoutoscaninactiveWindowsversionsaswell,includingtheregistryofotherinstallations!
Toscanyoursystemincludinginstallationsonotherpartitions,right-clickthelink/iconyouusetostartSpybot-S&D;,andadd/allhivestothecommandline(separatedbyaspacefromtherest).IfyounowstartSpybot-S&D;throughthislink,itwillautomaticallydetectotherinstallations,andscantheirsregistriesandfilesaswell.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
HowcanIgetAdministratorrightsunderWindowsVista? FAQ#042
OnWindowsVista,Spybot-S&D;mighttellyouthatforsomeactions,youarenotbeingallowedtooperatethem,sincetheywouldrequireadministrationelevation.Youcansolvethisproblemasfollows:
1. Right-clicktheSpybot-Search&Destroy;entryinyourstartmenu,insteadofjustleft-clickingtostartit.
2. ChooseRunasadministratorfromthecontextmenu.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
IsSpybot-S&D;compatiblewithWinPE/BartPEbootableCDs? FAQ#043
Yes,Spybot-S&D;hasfullsupportforPEingeneralandPEBuilder.Youcandownloadthenecessarypluginforversion1.4here(onlinelink)orforversion1.5here(onlinelink),orrunitfromyourharddiskafterbootingaPEdisk.
OncerunfromyourbootablePECD,Spybot-S&D;willautomaticallyscanallregistryanddrivesitcanfind(ifyouwantthatfeaturewithoutPE,seethisFAQentry.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
HowcanIdisablethenotificationspoppingupwhenadownloadwasblocked(e.g.AvenueA,Inc.,DoubleClick)?
FAQ#044
ThismessageiscreatedbythebaddownloadblockerforIE,atoolofSpybot-S&D.;Thefeatureofthesilentbaddownloadblockerinversion1.5isinadifferentplacethaninolderversions.
PleaseopentheToolsmenuinyourInternetExplorerandchooseSpybot-S&D;-Configuration.Thereyouwillfindadropdownmenu(seescreenshotbelow)whereyoushouldselectBlockallbadpagessilently.Withthatoptionsetthenotificationswillnolongercomeup,butyouwillstillhavetheprotection.
NewconfigurationforIEplugin
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoesMSAntiSpywarecomplainthatSpybot-S&D;addsbadsitestothetrustedzone?
FAQ#045
ThatisamistakebyMicrosoft.Microsofthasreleasedknowledgebasearticle902956(onlinelink)thatdescribesthisproblemoftheirs.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoesSpybot-S&D;flagchangesintheWindowsSecurityCenter?
FAQ#046
Spybot-Search&DestroydetectsregistrychangesassociatedwithMicrosoftSecurityCenter;theyarelistedas"WindowsSecurityCenter".Thisisneitherafalsepositivenorabug.Itisjustaninformationaboutapotentialthreat-Spybot-S&DonlywantstobringtoyourattentionthatsomeoneorsomethingdisabledoneormorenotificationsintheWindowsSecurityCenter,e.g.thenotificationsthatyourvirusprotectionisnotactiveornotup-to-date.
IfyouchangedthesettingsyourselfyoucansafelytellSpybot-S&Dtoexcludethosedetectionsfromfurtherscans.Inordertodoso,pleaseright-clickeachinturn,thenclickExcludethisdetectionfromfurthersearches.Thatway,shouldanyotherpartofsecuritycentersettingschange,Spybot-S&Dwillstilldetectthose.Thesameistrueifyouhaveanothersecuritysolutioninstalled(likeMcAfeeSecurityCenterorNortonInternetSecurity).TheseprogramsdisableannouncementsofWindowSecurityCenterinordertosignalthingsbythemselves.
ThereasonwhythechangesareflaggedbySpybot-S&Disthattherearealsomalwareprogramsthatdisablethenotificationssotheuserdoesnottakenoteofhissecuritytoolsnotbeingeffective.Somemoreinformationisalsoavailableinourforum(onlinelink).
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhichbrowsersdoesSpybot-S&D;support? FAQ#048
Spybot-S&D;doessupportmanycommonbrowsers.Asforresidentprotection,Spybot-S&D;containstheResidentTeaTimerwhichiscompletelybrowserindependent.ItisaSpybot-S&D;toolperpetuallymonitoringtheprocessescalled/initiated.Inaddition,TeaTimerdetectschangestosomecriticalregistryvalues.
Spybot-S&D;supportsdetectionincookies,history,start&searchpagesandbookmarksofthesebrowserspluscacheforInternetExplorerandOpera(allfollowinglinksareonlinelinks):
BeonexCommunicatorFirefoxpre-0.9,0.9,1.x,2.0andcompatible,includingoldFirebirdvariantsK-MeleonMicrosoftInternetExplorer5.0,5.5,6.0,7.0MozillaSuiteNetscapeCommunicator4.x,6,7Opera4.x,5.x,6.x,7.x,8.x,9.xandcompatibleThunderbird1.xandcompatible(whereapplicable)
©2000-2008SaferNetworkingLtd.Allrightsreserved.
IsSpybot-S&D;compatiblewithotherresidentprotectiontools? FAQ#049
Usingmorethanoneanti-spywareprogramwitharesidentprotectiontoolmightcauseconflicts.However,Spybot-Search&Destroy'sResidentprotectionisdesignedsuchthatthereshouldnotbeanycompatibilityissues.
OnethingthatcouldappearisthatanotherprogrammdetectsourTeaTimerasbad-becausetheoretically,ithasthesamefunctionasakeyloggerasitrunsinthebackground.Butonlytheoretically-itisarealtimeprotectiontoolforyouandthereisnothingbadaboutit.
AnotherissuecouldbethattheKeyloggerdetectionfilesKeyloggers.sbiandKeyloggers.*.nfoofSpybot-S&D;aredetectedasActivityMonitorkeylogger.ThesedetectedkeyloggersarejusttheSpybot-S&D;detectionrules,whichobviouslyneedtocontainthenamesofthethreats.Pleaseignorethesefalsepositives.
Formoreinformationwecreatedacompatibilityoverview(onlinelink)listingsomesoftwareforwhichtherehavebeenquestionsoncompatibility.
Onelastthingcouldbethatremoveditemswhicharenowstoredintherecoveryareaaszipfilesarebeingdetected.Thezipfilesareneededfortherecovery.IfsomethingdoesnotworkafterfixingaproblemwithSpybot-S&D;youcanrestorethesefiles.Sothereisnothingbadwiththem,either.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Whatistheimmunizationfeatureandwhataretheotherpermanentprotectionoptions?
FAQ#050
Beginningwithversion1.2,Spybot-S&D;hasbeenallowingyoutoimmunizeyourcomputeragainstsomespyware.Thishasbeenextendedineveryfurtherrelease,andtweaksbrowsersettingstousetheirmethodsofblockingcookies,malwareinstallations,badwebsitesandmore.SDHelperisanInternetExplorerpluginthataddsasecondlayerforblockingbadstuff.ResidentTeaTimerisexplainedinthisFAQentry.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Whyaresomeproductssettobeignoredbydefault? FAQ#051
CDillaandSideSteparelistedintheignoreproductsbydefault.PleaseseethetopicWhyareCDilla&SideStepcheckedinIgnoreProducts?(onlinelink)inourforum.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhatcanIdoifSpybot-S&D;freezesduringscan? FAQ#052
ThiscouldbecausedbyseveralreasonslikeanoldversionofSpybot-S&D;,toomuchtemporaryfilesorproblemswiththesystemrestorepoint.
IncaseyouareusingadatedversionofSpybot-S&D;,asafirstsolution,pleasedownloadthelatestversionofSpybot-Search&Destroy,whichshouldfixtheproblem.Youwillfindlinkstoseveraldownloadlocationsonourhomepage(onlinelink).DonotforgettousetheintegratedupdateafterinstallingSpybot-S&D.;
Ifthisdoesnothelp,pleasedeletethecontentsofyourWindowstempfolderandtryitagain.Also,youmightwanttodisabletheCreatesystemrestorepointwhenfixingspyware/usagetracksoptiononthesettingspage.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoIreceivea"SocketError"? FAQ#053
Pleasetakealookatthesecuritysettingsofyourfirewall(ifyouareusingone)andmakesurethatSpybot-S&D;isnotblocked.Thatshouldhelptogetintotheupdates.IfSpybot-S&D;isnotblockeditisalsopossiblethatourserveristemporarilynotavailable.Pleasetryagainafewhourslater.
Ifthisdoesnothelppleasedownloadthemanualupdatershere(onlinelink;hereisalsoadirectdownloadlink).Themanualupdatersareself-installing,youjustneedtoexecutethem.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoIreceivetheerrormessage"Problemsintheincludefile(Trojans.sbi)"?
FAQ#054
Pleasedownloadtheupdatecalled"TCP/IPSettingsplugin"usingtheintegratedupdatefunction,or,ifyoudonotusetheintegratedupdate,youcandownloadamanualinstallerfromourdownloadpage.
Ifevenafterupdating,thefileisnotthere,youcantrythefollowing:
1. CloseSpybot-S&D.;2. Unzip(extract)theplugtcpip.zipfilethatisinyourSpybot-S&D;\Updates
foldertothemainSpybot-S&D;folder.3. RestartSpybot-S&D.;
Formoreinformations,pleasedoalsohavealookatourforum.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhatisnewatSpybot-S&D;1.5? FAQ#055
Anoverviewofthemostimportantchangessinceversion1.5ofSpybot-S&D;:
Systemsupport
RestoredWin95compatibilityImprovedWinecompatibilityFixedHyperThreadingissuesImproved64bitimmunizationCreatePortable.iniinmainfoldertouseappfolderasdatafolderaswellNewwarningsaboutmissingadminrightsonWindowsVistaSupportformulti-linebookmarks(IE7/Vista)NewImmunizationforFirefox&MozillaImprovedImmunizationforOpera
Reports
AddedversioninfotobugreportIncludeErrors.lognowincludestimestampsImprovedWindowsversiondisplay
Misc
"Singleexcludes"nowincludefilenamestobemoreuniqueImprovedsettingsretrievalfromregistry(mixedinstallations)Fixed.regimportbugsAddedsupportforautomatedremovalofF/PsfromhostlistsChangedupdateUserAgentandReferrerImproved(Vista-compatible)supportforfastuserswitchingUpdaternowinseparateexecutablefileVistamanifestsforassigningrequiredrightstoeachapplicationDeactivatedlistofactiveportsperprocessforVista(incompatible)Fixedsupportforhandleliston64bitsystems
Improveddisabling/enablingBHOsNewspecialerrorreportingforbetaversionsSupportforWindowsErrorReportingforpublicversionsFixedupdate-relatedcrashesonVistaFixedmemoryleaks(replacedIndywithSynapse)Vista-compatibleMSIinstallerforthosewholike/needthatSupportforalphatestsonservicesanddomainslistsAddedhundredsofnewautomatedtestsofinternalfunctionalityforprereleaseQAAddedTeaTimerhideicon(disabled)registryvalueininstaller
Detectionandremovalofthreats
ImprovedPEdetectionallovertheplaceNew64bitdetectionallovertheplaceImprovedfileremovalmethodsAddedoptionalcustomRecoveryDirsettinginDefault.iniAutomaticguessingof"DownloadDir"foldersAddedsupportforrenamingservicesbeforestopping/killing/deletingthemImprovedpluginsupport(example:currentTCP/IPPlugin)SupportforregularexpressionsnearlyallovertheSBIinterfaceMuchimprovedlogicconnectionsbetweenfiles,registryandAPIdetections(otherswouldinventanewTLAforthat*g*)Speed-upsthroughimprovedcachesFileversioncheckingAuthenticodecheckingImprovedarchivescheckingFasterfulltextcheckingImprovedSysInternalsfilelocationalgoImprovedhostsfilelocationalgoAddedsomemoreOpera9detectionschemes
Userinterfacechanges
Fixed"showmoreinformation"panelsImplementedworkaroundsformisarrangedbuttons(includingTeaTimer)Improvedsupportfor/allhivesintoolssection(inactiveinstallation
support)FixedflagshownonshortcutbarafterchangesFixedIEproxyimportinwizardChanged"useproxy"buttontocheckboxImprovedlocalizationonsimpledialogsAddedoptiontoaddaproxyinsideappifrunningonWinPEImprovedlocalizationoflistofupdatesAddedFirefoxicononCookieexcludepageFixedbadkeyboardhandlingonsomeexcludelistsFixedcookieremovalselectionproblemsNewconfirmationdialogforsystemrestorepointsChangeddefaultfonttoTahomaRedcross(trademarked)replacedwithgreencrossMade"Check"optionunavailableduringfixProcesslistnowisabitlesseagerontooltipsImproved"delaystart"dialogsNowdisplayschecksumforeachresultforbettertrackbackofresultsFixed"IgnoreProducts"columnwidthproblemsonVistaImprovedlocalizationofproductdescriptionsAdjustedwizardfornewsituation(externalupdateretc.)FixedToolssnapshotcomparisonhighlightingMadedisplayofregistrychangesinresultslistlessconfusingImprovedSDHelperdialogsandblock/allowchoicesUpdatedateformatoninfopagenowlocalizedDisplayedappversionisnowfourdigits(e.g.1.5.1.12)(De+)SelectallinlistofoldreportsImprovedWarning/ConfirmationdialogIEpluginConfiguration&InformationdialoginIEplugin
©2000-2008SaferNetworkingLtd.Allrightsreserved.
FAQ#056
Spybot-S&D;willuninstallfromtheWindowsAdd/RemoveSoftwarecontrolpanelwithoutproblems.
IfyouwanttocompletelygetridofSpybot-S&D;1.4(alsoearlierversions)andtheAdd/Removedoesn'thelp,youcandeletetheinstallationfolder(usuallyC:\ProgramFiles\Spybot-Search&Destroy\),thendownloadthisverysmallfixbyrightclickingandsavingit,thenexecuteit(important!-thiswillremoveallremainsfromtheregistry).
Ifyoujustwanttoupgradetoanewerversion,pleasefollowthesameinstructionslikeaboveandtheninstallthenewversion.
Afterfollowingtheseinstructionspleaserestartyoursystemsothatthechangescantakeplace.
Also,neithertheautomateduninstallnorthemanualuninstalllikedescribedabovewillremovethefollowingdirectories,whichyouwillhavetoremovebyhand:
Windows95or98:C:\Windows\AplicationData\Spybot-Search&Destroy\WindowsME:C:\Windows\AllUsers\ApplicationData\Spybot-Search&Destroy\WindowsNT,2000orXP:C:\DocumentsandSettings\AllUsers\ApplicationData\Spybot-Search&Destroy\WindowsVista:C:\ProgramData\Spybot-Search&Destroy\.
(PleasenotethattheApplicationDataFolderishidden.Soifyoucan'tfindthisfolderpleasecheckyourfolderproperties.)
Explanation:thisfoldercontainsthebackup(thequarantinedfiles)thatSpybot-S&D;creates.IftheUninstallwouldremovethisfolderaswell,thiswouldmeanthatthosebackupswouldbegone.WesawitafewtimesthatnewusersuninstalledSpybot-S&D;inpanicafterthey'veexperiencedasmallproblem,
thusremovingthebackupthatwouldhaveundoneanychanges.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
CommandlineparametersForlargeenvironmentsorpeoplewhowanttocontrolandautomateeverythingthemselves,hereisalistofcommandlineparametersofboththeinstallerandmainexecutabletomakeyourworkeasier.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Mainexecutable CommandlineparametersofSpybotSD.exe
HereisalistofcommandlineparametersthattheSpybot-S&D;mainexecutable(SpybotSD.exe)supports:
/taskbarhideRunsSpybot-S&D;completelyhidden(nowindow,notaskbaricon),somakeabsolutelysureyouuseitonlyincombinationwith/autoclose(otherwiseitwouldremaininmemorysittingidle).Usefulonlyincombinationwith/autocheck,/autoupdateor/autoimmunize,asitcannotbecontrolledwhencompletelyinvisible./minimizedStartsthewindowminimized./uninstallUninstallsSpybot-S&D.;Thiscommandlineparameterisveryoutdated-unins000.exeshouldbeusedinstead!/blinduserStartswithsupportforblindusers(specialmenus)./autoupdateDoesanupdateafterstartingtheprogram./autocheckStartsscanningimmediately./autofixFixesproblemsafterscan./autocloseClosesprogramafterithasscannedorupdated./autoimmunizeRunstheimmunizationatprogramstart./onlyspywareFixesonlyspyware(red)entrieswith/autofix,leavingallusagetracksastheyare./easymodeStartswitheasierinterfaceforbeginners./createenglishUpdatestheEnglish.sbllanguagefilewiththenewesttexts;usefulonlyfortranslators.
Note:PleasebeawarethattheSpybot-S&D;pathhastobeinquotationmarksandmultipleparametershavetobeseparatedbyaspace.
Example:"C:\ProgramFiles\Spybot-Search&Destroy\SpybotSD.exe"/taskbarhide/autoclose/autocheck/autofix/onlyspyware
©2000-2008SaferNetworkingLtd.Allrightsreserved.
Installer Commandlineparameters
HereisalistofcommandlineparametersthattheSpybot-S&D;installersupports:
/sp-Willskipthefirstpageoftheinstallationwizard(Doyouwishtocontinue?...)/silentWilldisplaytheprogressduringinstallation,butnotthewizard./verysilentEventheprogresswillnotbeshown.Errorsetc.wouldstillbeshown./surpressmsgboxesWillusestandardactionsformessageboxes(nooverwritingoffiles,cancellingwherethealternativewouldberetrying...)/log(or/log="filename")Createsalogfileinthetempfolderthatcontainsdetailedinformationaboutactionstakingplaceduringtheinstallation./nocancelDisablestheCancelandClosebutton.Usefulwith/silent./norestartSuppressrebootseveniftheywerenecessaryattheendoftheinstallation./restartexitcode=NIfarestartisneeded,thesetupwouldreturnthespecifiedexitcode./loadinf="filename"(and/saveinf="filename")Canbeusedtouseasavedsetupconfiguration(orsaveone)./lang=languageOverridesthelanguagedialogwithapredefinedlanguage.UseISO2letterlanguagedescribershere./dir="x:\dirname"Installsintothatdirectoryinsteadofthedefaultone./group="foldername"Installsintoaprogramgroupofthatnameinsteadofthedefaultone./noiconsAvoidscreationofanyiconsfortheinstalledsoftware./type=typename
Startsinstallationwithagivetype.Supportedtypesarefull,blindandcompact.
/components="commaseparatedlistofcomponentnames"Installsthegivencomponentsinsteadofthedefaultones.Supportedcomponentsare
main,blind(iconsforblindusers),language(alllanguagefiles),skins,updatedl(fordownloadingupdatesaspartoftheinstallation),updatew95(todownloadprerequisitesonWindows95),SDWinSec(toinstalltheSecurityCenterintegrationonVista),SDShredder(toinstallthestand-aloneshredder),andSDDelFile(toinstallthefileremovalhelper).
/tasks="commaseparatedlistoftasks"Specifiesalistoftasksthatshouldbeexecuted.Taskscurrentlysupportedare:
desktopiconquicklaunchiconlaunchsdhelperlaunchteatimer
/mergetasks="commaseparatedlistoftasks"Sameas/tasks,justwiththeexceptionthatstandardtasksarenotdisabledbydefault.
©2000-2008SaferNetworkingLtd.Allrightsreserved.
WhydoIgetanerrormessageduringupdatingthattheupdateisforbidden/badchecksum?
FAQ#020
Someusershavereportedtheyarenotabletodownloadupdates.The'Searchforupdates'revealsupdates,buttheycannotbedownloaded.Oftena'HTTPError403'or'badchecksum'isdisplayed.Thishasasimplereason-thousandsofpeopletryingtodownloadfromthedefaultserver,whichcan'thandlesuchaload.Ifyoutryagain,haveasecondlookatthemenubar.Ithasapull-downitemtoselectamirror.Clickthearrowbesideit,andselectadifferentlocation,whereyou'llmostprobablyhavebetterchancestodownload.
Currentproblemswiththemaininstallerdownloadhavethesamereason-theserversnotbeingabletohandlesuchlargeamountsofdownloads.EventheUniversityisn'tabletodealwithmanythousandsofdownloadsatthesametime.Pleasehavesomepatience;moremirrorsarebeingaddedagain.
©2000-2007SaferNetworkingLtd.Allrightsreserved.