Getting Started

Webroot Spy Sweeper Scan™ lets you protect your privacy and your computer from a variety of spyware, from those that monitor all of your computer's activities (system monitors), to those that can steal or destroy data (Trojan horses). It also detects programs that pop up advertising on your computer (adware) and cookies that may contain personal information (tracking cookies).

Spy Sweeper "sweeps" your computer looking for evidence of spyware, reports its findings, and lets you decide whether to quarantine the item or keep it. The quarantine function disables the item until you decide to delete it completely or restore it.

Below is a list of topics to help you get started using Spy Sweeper:

  • About This Help
  • Technical Support
  • New in Spy Sweeper 5.0
  • Understanding Spyware
  • Installing Spy Sweeper
  • Starting Spy Sweeper
  • Updating the Spy Sweeper Definitions and Program
  • Understanding Spy Sweeper Alerts
  • Shutting Down Spy Sweeper


About This Help

This help describes how to set up and use Spy Sweeper to protect your privacy and your computer from spyware. It assumes that you have a basic understanding of how to use the Windows operating system.


Conventions

This help uses several typographical conventions to help explain how to use Spy Sweeper.

Convention
Definition
Bold
Words in bold show items to select or click, such as menu items or buttons.
Note
This symbol means the following information is a note that gives you important information that may affect how you use Spy Sweeper.
Caution
This symbol means the following information is a caution that warns you about actions that may affect your ability to use some programs on your computer.
This symbol means that the following information is a procedure.


Technical Support

Technical support is available from the Webroot Web site. Submit a trouble ticket to our service representatives:

www.webroot.com/support

If clicking the link above does not open your browser and take you to the Webroot Support page, copy the text of the link and paste it into your browser.

We make every effort to respond to your request on the same day you send it in, but please allow up to 48 hours.


New in Spy Sweeper 5.0

Spy Sweeper 5.0 has the following new features and functions:

  • Completely redesigned user interface, including a new Home panel for quick access to functions and Spy Sweeper setting status.
  • Improved spy installation shield to block spyware from ever installing on your computer. For more information see, Setting Up the Windows System Shields.
  • New protection against keyloggers, which are system monitors that monitor all of your keystrokes. For more information see, Setting Up the Windows System Shields.


Understanding Spyware

Online threats come in many forms. Typically, spyware gets installed on your computer without your knowledge or consent. It may be part of a program that you installed or it may install itself as you visit various Web sites. The following information is not meant to be a complete discussion of all online threats. We hope that it will acquaint you with some of the threats that Spy Sweeper can address for you.

Spyware is any application that makes potentially unwanted changes to your computer, while collecting information about your computer activities. This information may then be sent to a third party for malicious purposes, without your knowledge or consent. Spyware arrives bundled with freeware or shareware, through e-mail, by someone with access to your computer, or by another means without your consent. Unlike traditional personalization or session cookies, spyware is difficult to detect, and difficult (if not impossible) for the average user to remove.

You can set up Spy Sweeper to detect and remove spyware. However, in some cases, the program that installed the spyware may not work without the spyware installed. You should test your programs before deleting items permanently.


Installing Spy Sweeper

You install Spy Sweeper from a file you download from the Webroot® Web site.

Note icon Note: If you are updating from a previous version of Spy Sweeper, do not uninstall the old version first. Installing the new version over the old one retains the quarantine information from previous sweeps and automatically retains your Spy Sweeper settings.

You can install Spy Sweeper one of two ways:

    • Typical—Use this option to quickly install Spy Sweeper using the configuration settings that Webroot recommends. (See page 3.)
    • Custom—Use this option to select various configuration settings yourself. (See page 7.)

Step Introduction icon To do a Typical Spy Sweeper installation:

  1. Close all other programs that you have open on your computer.
  2. Follow the instructions on the Web site to download the file.
  3. Using Windows Explorer, navigate to where you downloaded the file.
    • If you downloaded the file to your Windows Desktop, close all open programs and you will see an icon on your desktop for the file you downloaded.
    • If you downloaded the file to a different location, use Windows Explorer to navigate to the file.
  4. Double-click the file you downloaded to start the installation.
    • The Welcome to the Spy Sweeper Setup Wizard window displays.
  5. Click Next to install Spy Sweeper.
    • The License Agreement window displays.

  6. Read the license agreement, select the I Accept the Agreement option if you agree with the content, and click Next.
    • The Select Your Install Type window displays.

  7. Select Typical and click Next.
    • The Spy Sweeper Scan Registration window displays.

  8. Enter your e-mail address and click Next.
    • If you want to receive product notifications, technical support alerts, and information about saving on your online security, select the check box.
    • The Permission to Send Sweep Results window displays.

  9. If you want to send your sweep results anonymously to Webroot, click Next.
    • This option will store the number of traces found, date and time of the sweep, and threats detected from your first sweep only. Spy Sweeper will send this sweep information to Webroot when you are connected to the Internet and take an action in Spy Sweeper that requires it to communicate with the Webroot server. This helps Webroot better understand which threats are most common and monitor trends.
    • The Ready to Install window displays, showing the installation location and recommended options.

  10. Click Install.
    • The installation may ask you to restart your computer. If it does, Spy Sweeper will start when you restart Windows.
    • If the installation does not ask you to restart your computer, the Completing the Spy Sweeper Setup Wizard window displays.

  11. Select the options you want and click Finish.

    12. Click to see a description of each option.

    Option
    Description
    Run Spy Sweeper Now
    This starts Spy Sweeper when you finish the installation, so you can review the default settings and run a sweep.
    View Release Notes
    This option opens the Release Notes (readme.txt) file in Notepad. This lets you review the most current information about this release. Close the file when you are finished.

    • If you selected the option to run Spy Sweeper now, the Spy Sweeper splash screen displays, followed by the main Spy Sweeper window.

Step Introduction icon To do a Custom Spy Sweeper installation:

  1. Close all other programs that you have open on your computer.
  2. Follow the instructions on the Web site to download the file.
  3. Using Windows Explorer, navigate to where you downloaded the file.
    • If you downloaded the file to your Windows Desktop, close all open programs and you will see an icon on your desktop for the file you downloaded.
    • If you downloaded the file to a different location, use Windows Explorer to navigate to the file.
  4. Double-click the file you downloaded to start the installation.
    • The Welcome to the Spy Sweeper Setup Wizard window displays.
  5. Click Next to install Spy Sweeper.
    • The License Agreement window displays.

  6. Read the license agreement, select the I Accept the Agreement option if you agree with the content, and click Next.
    • The Select Your Install Type window displays.

  7. Select Custom and click Next.
    • The Select a Destination Location window displays.

  8. Select where you want to install Spy Sweeper and click Next.
    • For most users, we recommend letting Spy Sweeper install to the default location that displays. To install to another location, click Browse.
    • The Select Additional Tasks window displays.

  9. Select or deselect the options you want and click Next.

    10. Click to see a description of each field.

    Option
    Description
    Start Spy Sweeper at Windows Startup
    This option ensures that Spy Sweeper starts whenever you start Windows, so it is always protecting your computer. We recommend using this option.
    Add a Shortcut on the Desktop
    This option adds a Spy Sweeper shortcut to your desktop. You can then double-click the shortcut icon to start Spy Sweeper.
    Add "Sweep" Option to Windows Explorer Context Menu
    This option lets you run a sweep on a specific file or folder from Windows Explorer. This adds a Run a Sweep option to the menu you see when you right-click a file or folder, letting you run a sweep on the selected file or folder.
    View Spy News When Available
    This option has Spy Sweeper check for new Spy News each time it checks for program updates.
    Enable Windows Messenger Shield
    (Applies only to Windows NT, 2000, and XP.) This option turns off and actively watches the Microsoft Messenger Service in Windows. This service is not an instant messaging program and does not affect your use of instant messaging. This service is often used for sending spam (unwanted e-mail) and creating pop-up advertisements. Turning off the service stops these types of spam and pop-ups.
    If your computer is in your home, you can turn off this service without any problem.
    If you work in a corporate environment, contact your system administrator to find out if your company uses the service to communicate with company employees. If you are not sure, leave the service turned on until you find out.

    • The Spy Sweeper Scan Registration window displays.

  10. Enter your e-mail address and click Next.
    • If you want to receive product notifications, technical support alerts, and information about saving on your online security, select the check box.
    • The Permission to Send Sweep Results window displays.

  11. If you want to send your sweep results anonymously to Webroot, click Next.
    • This option will store the number of traces found, date and time of the sweep, and threats detected from your first sweep only. Spy Sweeper will send this sweep information to Webroot when you are connected to the Internet and take an action in Spy Sweeper that requires it to communicate with the Webroot server. This helps Webroot better understand which threats are most common and monitor trends.
    • The Ready to Install window displays, showing the installation location and your selected options.
    • If you need to make changes, click Back until you return to the window you want to change.

  12. Click Install.
    • The installation may ask you to restart your computer. If it does, Spy Sweeper will start when you restart Windows.
    • If the installation does not ask you to restart your computer, the Completing the Spy Sweeper Setup Wizard window displays.

  13. Select the options you want and click Finish.

    14. Click to see a description of each option.

    Option
    Description
    Run Spy Sweeper Now
    This starts Spy Sweeper when you finish the installation, so you can review the default settings and run a sweep.
    View Release Notes
    This option opens the Release Notes (readme.txt) file in Notepad. This lets you review the most current information about this release. Close the file when you are finished.

    • If you selected the option to run Spy Sweeper now, the Spy Sweeper splash screen displays, followed by the main Spy Sweeper window.


Starting Spy Sweeper

You can start Spy Sweeper and display the main window a number of ways, depending on the options you selected when you installed it.

Step Introduction icon Start Spy Sweeper and display the main window using one of the following methods:

  • If Spy Sweeper is open in your system tray (you should see the Spy Sweeper icon [image] in the lower-right corner of your screen), do one of the following to display the Spy Sweeper main window:
    • Double-click the Spy Sweeper icon.
    • Right-click the Spy Sweeper icon and select Restore from the pop-up menu.
      • The Spy Sweeper main window displays. This is where you can change your Spy Sweeper settings and run sweeps. For more information, see Understanding the Spy Sweeper Window, Running Sweeps, and Setting Up Program Options and Continuous Monitoring.
      • Click Close [image] to close the Spy Sweeper window, but keep Spy Sweeper open in your system tray and protecting your computer. A message displays letting you know that Spy Sweeper will continue to protect your computer. Click OK.
  • If you did not select the Run Spy Sweeper Now option during installation or you shut down Spy Sweeper completely, double-click the Spy Sweeper icon [image] on your computer desktop or click Start, point to Programs, point to Webroot, point to Spy Sweeper, and click Spy Sweeper.
    • This starts Spy Sweeper and displays the main window.

Note icon Note: If you want Spy Sweeper to start automatically when you start Windows and run in your system tray, click Options in the icon panel, click the Program tab, and select the Load Spy Sweeper at Windows Startup option. We recommend using this option.


Understanding the Spy Sweeper Window

The Spy Sweeper window lets you change your sweep settings, create customized settings, and run a sweep. Figure 1 shows the main window and describes its parts.

Figure 1: Spy Sweeper main window (Home panel shown)

General Spy Sweeper window areas
1
Icon panel—Click an icon to see the available settings and actions.
2
Main panel—Displays the options available for the selected icon. This panel is where you change the Spy Sweeper settings and run a sweep.
Home panel areas
3
Sweep Status
—Sweep status OK. The last sweep was within the last 7 days.
—Sweep due. The last sweep was between 8 and 14 days ago.
—Sweep out of date. The last sweep was more than 14 days ago.
—Threats found. Spy Sweeper found threats during a sweep, you should subscribe to remove the threats.
4
Next Sweep—If you have set up a scheduled sweep, displays the date of your next scheduled sweep. Click the Next Sweep link to set up or change a scheduled sweep.
5
Shield Status
—Full Protection. All critical and recommended shields are turned on.
—Partial Protection. All critical shields are on, but some recommended shields are not.
—Vulnerable. One or more critical shields are not turned on.
6
Subscription Inactive gives you a link to subscribe to Spy Sweeper, so that you can remove spyware.

Figure 2 shows the settings available when you click the Options icon, then click the Sweep tab. Some icons display tabs, as shown here, that give you access to additional options.

Figure 2: Spy Sweeper Options (Sweep tab)


Understanding How Spy Sweeper Works with Multiple User Accounts

If you have multiple people using your computer, each person can have a user account. This means that each person logs in to the computer using a unique user name and password. Typically, one user is set up as the computer administrator, with what are often called administrative privileges. Other users, typically, do not have administrative privileges and are sometimes called limited users. This distinction between user accounts does not apply to Windows 98 or Me.

When you install Spy Sweeper, it is available to all user accounts on your computer. The computer administrator can use all functions available in Spy Sweeper. Limited users can use most functions, with a few exceptions, as described in Table 1. Limited users inherit the settings set by the computer administrator for these functions.

Table 1: Functions not available to limited users
Function
Description
Shields
Limited users cannot change any shield settings.
Program Option: Add "Sweep" Option to Windows Explorer Context Menu
Limited users cannot change this option.
Program Option: Load Spy Sweeper at Windows Startup
Limited users cannot change this option.
Sweep Option: Sweep All User Accounts
Option is not listed for limited users.
Quarantine panel
Limited users can view the Quarantine panel, but cannot restore or delete items that have been quarantined.
IE Hijack Shield, Edit IE Hijack Shield Settings (Advanced Settings)
  • User—Limited users can use this drop-down list to change these settings. Only the current user account is affected. These settings effectively override the system settings below.
  • System—Only the computer administrator can use this drop-down list to change these settings. Changes here affect all user accounts, unless a limited user has customized the setting.

In addition, you can only see the scheduled sweeps set up from the user account you are currently logged in to. You must be logged in to the account that created the scheduled sweep for a scheduled sweep to run. Spy Sweeper does not need to be open in the system tray.


Updating the Spy Sweeper Definitions and Program

Webroot updates the Spy Sweeper spyware definitions and program to keep up with changes in spyware. You can update the spyware definitions for 30 days after you install the Webroot Spy Sweeper Scan version. To update the Spy Sweeper program, you must be an active Spy Sweeper subscriber. Click Subscribe to remove detected spyware and be protected.

You should check for updates to the definitions at least once a week to ensure that you are using the latest version. Spy Sweeper can notify you whenever updates are available, as described in the steps below. You can also check for updates anytime.

To see when you last updated the definitions, click Options in the icon panel, then click the Update tab.

Note icon Note: You must connect to the Internet to update Spy Sweeper.

Step Introduction icon To update the Spy Sweeper definitions:

  1. Start Spy Sweeper, if it is not already open, and display the Home panel.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Options.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
    • The Options panel displays.
  3. Click the Update tab.
    • The Update tab displays.
    • If you want Spy Sweeper to automatically notify you of updates, select the Automatically Check for Spy Sweeper Updates option.
    • If you want Spy Sweeper to also automatically download new definitions, select the Automatically Download Definitions if Available option.
  4. Click Update Spy Sweeper.
    • Spy Sweeper opens your Web browser and takes you to the Webroot Web site. The Web site tells you whether your version of the program is current or if an update is available.
    • If new definitions are available, Spy Sweeper downloads and installs them from the Webroot Web site. A progress bar shows the status of the download.


Understanding Spy Sweeper Alerts

Spy Sweeper alerts you about certain activities related to protecting your computer and about Spy Sweeper's status. These alerts display in one of three ways:

  • An alert window—These alerts require immediate action and normally relate to something that is trying to install itself or make a change to a program on your computer.
  • An alert pop-up near the system tray (lower-right corner of your screen)—These alerts do not require you to take action immediately. Click the link in the pop-up or display the Spy Sweeper window and click Alerts in the icon panel to see the details. Some pop-ups are informational only and do not have a link or more information in the Alerts panel.
  • On the Alerts panel in the Spy Sweeper window—These alerts also do not require you to take action immediately.

You can select whether nonurgent alerts automatically open the Spy Sweeper window to the Alerts panel or display as a pop-up near the system tray.

Step Introduction icon To select the alert option you want:

  1. Start Spy Sweeper, if it is not already open, and display the Home panel.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Shields.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
    • The Shields Summary tab displays.
  3. Select the alert option you want.

    4. Click to see a description of each option.

    Option
    Description
    Show Notification above System Tray
    This option shows a small, pop-up window above the system tray (lower-right corner of your screen) whenever Spy Sweeper needs to alert you to an activity that does not require immediate action. If the pop-up has a link, you can click it to open the Alerts panel in the Spy Sweeper window and see more details.
    Open Spy Sweeper to Show Alert Details
    This option opens the Spy Sweeper Alerts panel for all alerts that display additional information in the Alerts panel. Some alerts are only informational pop-ups, which will still display only as a pop-up above the system tray.


Shutting Down Spy Sweeper

When you are viewing the Spy Sweeper window, as shown in Understanding the Spy Sweeper Window, you can click Close [image] when you are finished setting up Spy Sweeper. Clicking Close [image] closes the window, but keeps the Spy Sweeper program open in the system tray (lower-right corner of your screen) to protect your computer.

If you have set up any scheduled sweeps or have set Spy Sweeper shields (continuous monitoring), you should keep it open in the system tray. You know it is open if you see the icon [image] in the system tray in the lower-right corner of your screen.

If you want to completely stop Spy Sweeper, you can shut down the program. You need to shut down Spy Sweeper before you install a new version of Spy Sweeper.

Step Introduction icon To shut down Spy Sweeper:

  1. Right-click the Spy Sweeper icon [image] in your system tray and select Shut Down from the pop-up menu.
    • The system tray is in the lower-right corner of your screen.
    • Spy Sweeper warns you that your computer will not be protected if you shut down Spy Sweeper.
  2. Click Shut Down to shut down Spy Sweeper.
    • To start Spy Sweeper, so that your shields and scheduled sweeps will run, see Starting Spy Sweeper.


Running Sweeps

Spy Sweeper lets you do the following related to running sweeps:

  • Set sweep options
  • Run sweeps
  • Schedule sweeps to run automatically
  • Handle quarantined items
  • Set up automatic handling of found items


Setting Sweep Options

You can set a variety of options that control how Spy Sweeper sweeps your computer looking for spyware. You should review the options before running a sweep to ensure that you are thoroughly protecting your computer from spyware.

You can also protect your Spy Sweeper options by setting up a password. For more information, see Protecting Settings with a Password.

Step Introduction icon To set sweep options:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Options.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
    • The Options panel displays.
  3. Click the Sweep tab.
    • The Sweep tab displays.
  4. Select the options you want to use for your next sweep.

    5. Click to see a description of each option.

    Option
    Description
    Where to Sweep
    Only Folders Where Threats Are Known to Reside
    When you use this option, Spy Sweeper only looks in the folders where spyware files are typically found. Using this option performs a less thorough sweep. You should periodically sweep all folders.
    Selected Drives and Folders
    Select this option to have Spy Sweeper look in all folders on the drives you select to sweep. This type of sweep will take longer to run, but using this option performs a more thorough sweep.
    Select the drives and folders you want Spy Sweeper to sweep. The drives list includes all local drives (hard drives, CD, or DVD drives) installed on your computer.
    Typically, most spyware installs on the C: drive, but you should sweep all hard drives periodically.
    Items to Sweep
    Windows Registry
    Select this option to have Spy Sweeper sweep your computer's registry for spyware. Typically, you want to sweep the registry each time you run a sweep. Spyware commonly creates entries in your computer's registry.
    Memory Objects
    Select this option to have Spy Sweeper sweep your computer's random access memory (RAM) for spyware. Typically, you want to sweep memory each time you run a sweep. Spyware commonly loads into memory.
    Cookies
    Select this option to have Spy Sweeper include known tracking cookies (that are in the spyware definitions) in the sweep. You can then decide if there are cookies you want to keep. You may want to keep cookies that contain user names and passwords that let you log in to a Web site automatically or that contain preferences you set for a Web site.
    You may want to remove tracking cookies. Some Web sites now issue tracking cookies, which allow multiple Web sites to store and access cookies that may contain personal information (including surfing habits, user names and passwords, and areas of interest), then share the information they contain with other Web sites.
    Compressed Files
    Select this option to have Spy Sweeper sweep compressed files such as .zip, .rar, .lzh, and ..cab files. Spyware can hide itself inside these types of files. You may want to use this option after you have found spyware, and you want to be sure that you have removed it.
    Note: Using this option may significantly increase the time required for a sweep the first time you use the option. After the first sweep with this option, Spy Sweeper will skip compressed files that have not changed, thereby saving time.
    System Restore Folder
    (Applies only to Windows Me and XP.) Select this option to have Spy Sweeper sweep the folder where Windows stores System Restore files. If a restore point contains spyware, Spy Sweeper will find it and let you remove the spyware from the restore point. You will be able to use that restore point, if necessary, in the future, and you will not restore the spyware.
    Other Options
    Sweep All User Accounts
    Select this option to have Spy Sweeper sweep all registry entries, even those related to another user account or login ID on your computer. Spyware commonly creates entries in your registry. Using this option makes sure all registry entries are swept.
    If you deselect this option, Spy Sweeper only sweeps the user account you logged in with.
    This option is only available to computer administrators. For more information, see Understanding How Spy Sweeper Works with Multiple User Accounts.
    Enable Direct Disk Sweeping
    Normally, you should leave this option selected, as it makes sweeps run faster. Deselect this option only if you find that Spy Sweeper does not complete a sweep. Some computers need to turn off this method of sweeping for sweeps to run completely.
    Sweep for Rootkits
    Select this option to have Spy Sweeper include rootkits in its sweep. Rootkits are software tools that an attacker uses to maintain access to your computer for malicious purposes. Use this option if you are particularly concerned about your computer's security or continue to see unwanted advertising after running a full system sweep.
    Note: Using this option will cause the sweep to take about twice as long as a full system sweep without this option selected.

  5. If you want to use other programs on your computer while running a sweep, move the CPU Conservation vs. Sweep Speed slider to the left.
    • Moving the slider to the left slows the sweep, but gives you more processing power for your other programs. For the fastest sweeps, leave the slider all the way on the right.
    • Drag the slider with your mouse to move it.


Protecting Settings with a Password

You can protect your Spy Sweeper settings with a password. After you enable password protection, Spy Sweeper will require the password to access Options, Shields, Alerts, and Quarantine and to shut down Spy Sweeper.

Spy Sweeper "remembers" your password as long as you are actively using the program. After five minutes of inactivity or after you minimize the program, it will ask for the password again.

Be sure you remember or write down your password.

Step Introduction icon To protect settings with a password:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Options.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
    • The Options panel displays.
  3. Click the Program tab.
    • The Program tab displays.
  4. Select the Enable Password Protection option.
    • The Enable Password Protection window displays.
  5. Enter the password you want to use in both text boxes.
    • Consider making the password difficult to guess by combining letters and numbers.
  6. Click OK.


Running a Sweep

You can run a sweep on your computer at any time. A sweep is a three-step process:

  1. Search for Spyware—Spy Sweeper searches your computer for known spyware, based on the spyware definitions.
  2. Quarantine Threats—You select what to do with found items. Spy Sweeper puts suspect items it finds into the Quarantine where they cannot run or harm your computer. You can do three things with quarantined items:
    • Leave in Quarantine (Recommended)—The safest thing to do with found items. You can restore or delete them later.
    • Restore—You may need some found items to use legitimate programs. Restore an item only if you know you need it.
    • Delete—Delete items only if you know you do not need them.
  3. Sweep Complete—Spy Sweeper summarizes the action it took for each found item.

You can view quarantined items after a sweep from within Spy Sweeper. For more information, see Handling Quarantined Items.

Note icon Note: To quarantine and remove detected spyware, you must be an active Spy Sweeper subscriber. Click Subscribe to remove detected spyware and be protected.

You can sweep entire disk drives from Spy Sweeper or sweep a single file or folder from Windows Explorer. To run a sweep from Windows Explorer, you must enable the option for this feature. For more information, see Setting Spy Sweeper Program Options.

You can also set up Spy Sweeper to run sweeps automatically. For more information, see Scheduling Sweeps.

Step Introduction icon To run a sweep:

  1. Close all programs that are open.
    • Spy Sweeper may not be able to remove spyware associated with a particular program if that program is open. For best results, close all programs that are listed in the taskbar at the bottom of your screen. You do not need to close programs shown in the system tray in the lower-right corner of your screen. These programs are only open in the background.

      • To sweep one or more disk drives
      To sweep a specific folder
      1. Start Spy Sweeper, if it is not already open, and display the main window.
        • For more information, see Starting Spy Sweeper.
      2. Click Start Sweep.
        • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
        • The Sweeping panel displays.
      1. Start Spy Sweeper if it is not already open.
        • You do not need to display the Spy Sweeper window. It just needs to be open in the system tray. For more information, see Starting Spy Sweeper.
      2. From Windows Explorer, right-click the file, folder, or drive you want to sweep.
      3. From the pop-up menu, select Run a Sweep.
        • The Sweeping panel displays.

    • Spy Sweeper runs the sweep based on the options you selected. For more information about setting options, see Setting Sweep Options.
    • To pause the sweep, click Pause Sweep. An Information window displays, letting you know that the sweep is paused. When you want to resume the sweep where it left off, click OK.
    • To stop the sweep, click Cancel Sweep.
    • The number of items found, progress bar, current sweep location, and a list of items found display on the left side of the panel. The following fields display on the right side of the panel.

      • Click to see a description of each field.

      Field
      Description
      Search For
      Known Threats
      Displays the number of threats that Spy Sweeper is looking for, based on the current spyware definitions. You should update your Spy Sweeper definitions regularly to ensure that you are using the most current version. For more information, see Updating the Spy Sweeper Definitions and Program.
      Items Inspected
      Memory
      Displays the number of pieces of programs that Spy Sweeper swept in your computer's memory. Some of these pieces may be part of spyware.
      Registry
      Displays the number of items in the Windows registry that Spy Sweeper swept. Some registry entries may be associated with spyware.
      Cookies
      Displays the number of cookies that Spy Sweeper swept. Some cookies contain personal information (including surfing habits, user names and passwords, and areas of interest).
      Files/Folders
      Displays the number of files and folders on the selected drives that Spy Sweeper swept.
      Found
      Items
      Displays the number of definitions matched during the sweep.
      Traces
      Displays the number of traces of spyware that Spy Sweeper found. Traces are places where Spy Sweeper finds spyware.
      Sweep Time
      Elapsed
      How long the sweep has been running.

  2. When the sweep is finished, click Continue.
    • If Spy Sweeper did not find any spyware, you are finished and can click Back to Home to return to the Home panel.
    • If Spy Sweeper found spyware, the Quarantine panel displays with a list of the found items.

      • Click to see a description of each field.

      Field
      Description
      List of items found
      Displays the list of suspect items that Spy Sweeper found. Select an item in the list to view the Item Details on the right side of the panel. Leave the check box next each item selected to leave the item in the Quarantine.
      Items you have already set to Always Ignore or Always Quarantine are not listed here. Spy Sweeper automatically handled those items based on your settings. To set an item to Always Ignore or Always Quarantine now, right-click the item and select the option you want. For more information, see Handling Found Items Automatically.
      Click the plus sign (+) next to an item to see the full path to the traces found.
      Item Details
      Name
      Displays the name of the currently selected item.
      Category
      Displays the type of the currently selected item. See the Glossary for definitions of the types.
      Risk Rating
      Red bars show the risk level of the selected item. The more bars shown, the higher the risk as follows:
      • —Low
      • —Moderate
      • —High
      • —Very high
      • —Critical
      Traces Found
      Number of traces found related to this item.
      Description
      Displays a description of the item. For more information, click View More Details Online.
      Note: You must be connected to the Internet to see the additional information.

Note icon Note: To quarantine and remove detected spyware, you must be an active Spy Sweeper subscriber. Click Subscribe to remove detected spyware and be protected.


Scheduling Sweeps

You can set up Spy Sweeper to run sweeps automatically based on a schedule that you set. You can set up the schedule in any way that works for you. Here are examples of what you can do (assuming that you have Spy Sweeper set to load at startup):

  • Set Spy Sweeper to run a once a month on the first of the month.
  • Set Spy Sweeper to run a sweep every day at 3 a.m. This works well if your computer is on all night, and you are not working at 3 a.m.
  • Set Spy Sweeper to run on a specific day at a specific time, say Monday at 2 p.m., when you have a weekly staff meeting.

Spy Sweeper comes with one scheduled sweep already set up for you. That sweep will do the following:

  • Run every Monday at 2:00 a.m.
  • Sweep all folders
  • Sweep all drives on your computer

You can keep this scheduled sweep, change it, delete it, or schedule other sweeps, to meet your needs.

Your scheduled sweeps will run as long as you are logged in to the user account from which you created the scheduled sweep. Spy Sweeper does not need to be open in the system tray (lower-right corner of your screen) for the scheduled sweeps to run.

If you have multiple people using your computer and each person has a user account, each user can schedule sweeps. You can only see the scheduled sweeps set up from the user account you are currently logged in with. You must be logged in to an account for the scheduled sweep to run, but Spy Sweeper does not need to be open in the system tray.

Step Introduction icon To schedule sweeps:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Options.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
    • The Options panel displays.
  3. Click the Schedule tab.
    • The Schedule tab displays.
  4. Click Add a Scheduled Sweep.
    • The Schedule Wizard window displays.
  5. Select the sweep option you want and click Next.

    6. Click to see a description of each option.

    Option
    Description
    Standard Sweep
    Select this option to have Spy Sweeper use the sweep options that you set by clicking Options in the icon panel, then the Sweep tab. When you change those options, your scheduled sweep will use the changed options.
    If you select this option, skip to step 8.
    Custom Sweep
    Select this option to set custom sweep options that are separate from the sweep options you set up in the Sweep tab. This option lets you set different options for you scheduled sweep. You can set up multiple scheduled sweeps, each with different sweep options.

  6. Select where you want to sweep and click Next.

    7. Click to see a description of each option.

    Option
    Description
    Only Folders Where Threats Are Known to Reside
    When you use this option, Spy Sweeper only searches in the folders where spyware is typically found. Using this option performs a less thorough sweep. You should periodically sweep all folders.
    Selected Drives and Folders
    Select this option to have Spy Sweeper search all the drives and folders you select. This type of sweep will take longer to run, but using this option performs a more thorough sweep.
    Select the drives and folders you want to sweep. We recommend sweeping all drives regularly.

  7. Select what you want to sweep and click Next.

    8. Click to see a description of each option.

    Option
    Description
    Items to Sweep
    Windows Registry
    Select this option to have Spy Sweeper sweep your computer's registry for spyware. Typically, you want to sweep the registry each time you run a sweep. Spyware commonly creates entries in your computer's registry.
    Memory Objects
    Select this option to have Spy Sweeper sweep your computer's random access memory (RAM) for spyware. Typically, you want to sweep memory each time you run a sweep. Spyware commonly loads into memory.
    Cookies
    Select this option to have Spy Sweeper include known tracking cookies (that are in the spyware definitions) in the sweep. You can then decide if there are cookies you want to keep. You may want to keep cookies that contain user names and passwords that let you log in to a Web site automatically or preferences you set for Web site.
    You may want to remove tracking cookies. Some Web sites now issue tracking cookies, which allow multiple Web sites to store and access cookies that may contain personal information (including surfing habits, user names and passwords, and areas of interest), then share the information they contain with other Web sites.
    Compressed Files
    Select this option to have Spy Sweeper sweep compressed files such as .zip, .rar, .lzh, and ..cab files. Spyware can hide itself inside these types of files. You may want to use this option after you have found spyware, and you want to be sure that you have removed it.
    Note: Using this option may significantly increase the time required for a sweep the first time you use the option. After the first sweep with this option, Spy Sweeper will skip compressed files that have not changed, thereby saving time.
    System Restore Folder
    (Applies only to Windows Me and XP.) Select this option to have Spy Sweeper sweep the folder where Windows stores System Restore files. If a restore point contains spyware, Spy Sweeper will find it and let you remove the spyware from the restore point. You will be able to use that restore point, if necessary, in the future, and you will not restore the spyware.
    Other Options
    Sweep All User Accounts
    Select this option to have Spy Sweeper sweep all registry entries, even those related to another user account or login ID on your computer. Spyware commonly creates entries in your registry. Using this option makes sure all registry entries are swept.
    If you deselect this option, Spy Sweeper only sweeps the user account you logged in with.
    This option is only available to computer administrators. For more information, see Understanding How Spy Sweeper Works with Multiple User Accounts.
    Enable Direct Disk Sweeping
    Normally, you should leave this option selected, as it makes sweeps run faster. Deselect this option only if you find that Spy Sweeper does not complete a sweep. Some computers need to turn off this method of sweeping for sweeps to run completely.
    Sweep for Rootkits
    Select this option to have Spy Sweeper include rootkits in its sweep. Rootkits are software tools that an attacker uses to maintain access to your computer for malicious purposes. Use this option if you are particularly concerned about your computer's security or continue to see unwanted advertising after running a full system sweep.
    Note: Using this option will cause the sweep to take about twice as long as a full system sweep without this option selected.

  8. Select how often and when you want to sweep for spyware and click Next.
  9. If you want to change your selections, click Back until you see the options you want to change.
  10. Click Finish.
    • As long as you are logged in to the user account from which you created the scheduled sweep, Spy Sweeper will run sweeps based on your schedule.
    • To change a scheduled sweep, select it and click Change Selected.
    • To delete a scheduled sweep, select it and click Delete Selected.
    • To run one of the scheduled sweeps now, select the sweep from the list and click Run Selected.


Handling Quarantined Items

The Webroot Spy Sweeper Scan version does not quarantine spyware it finds. To be able to quarantine, and later permanently delete or restore spyware, you must be an active Spy Sweeper subscriber. Click Subscribe to remove detected spyware and be protected.


Deleting Quarantined Items Permanently

The Webroot Spy Sweeper Scan version does not quarantine spyware it finds. To be able to quarantine, and later permanently delete or restore spyware, you must be an active Spy Sweeper subscriber. Click Subscribe to remove detected spyware and be protected.


Restoring Quarantined Items

The Webroot Spy Sweeper Scan version does not quarantine spyware it finds. To be able to quarantine, and later permanently delete or restore spyware, you must be an active Spy Sweeper subscriber. Click Subscribe to remove detected spyware and be protected.


Handling Found Items Automatically

Note icon Note: For found items to actually be quarantined, you must be an active Spy Sweeper subscriber. Click Subscribe to quarantine and remove detected spyware and be protected.

Using the Always Apply function reduces the number of items you have to evaluate during sweeps. By default (the automatic setting), Spy Sweeper sets all found items to Always Ask. This means that Spy Sweeper lists found items in the Quarantine and asks you what to do with them during a sweep.

If you find spyware on your computer that you need to keep to make another program run properly or that you always want to quarantine, you can tell Spy Sweeper to always ignore or always quarantine that item. Spy Sweeper will still detect the item and include it in its count of found items and traces, but it will not include it in the list of items to quarantine.

You can do two things automatically handle found items:

  • Always Quarantine
    • If you repeatedly see the same unwanted items during sweeps, tell Spy Sweeper to always quarantine them. Spy Sweeper will always quarantine these items, and they will not be listed on the Quarantine panel during a sweep.
    • This setting also tells the Spy Sweeper shields not to alert you to shield-related activities associated with that particular item. Spy Sweeper will always block activities related to any item set to Always Quarantine. This means you will receive fewer shield-related alerts and warnings. For more information about shields, see Setting Up Continuous Monitoring (Shields).
  • Always Ignore
    • If you know you need some items to use legitimate programs, tell Spy Sweeper to always ignore them. Spy Sweeper will always ignore these items, and they will not be listed on the Quarantine panel during a sweep.
    • This setting also tells the Spy Sweeper shields not to alert you to shield-related activities associated with that particular item. Spy Sweeper will permit activities related to any spyware in this list. This means you will receive fewer shield-related alerts and warnings. For more information about shields, see Setting Up Continuous Monitoring (Shields).

Step Introduction icon To handle found items automatically:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Options.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
    • The Options panel displays.
  3. Click the Always Apply tab.
    • The Always Apply tab displays with a list of all items Spy Sweeper has found on your computer.
    • Use the Show Items Marked drop-down list to select what displays in the list:
      • Show All Items—Displays all items found in any sweep, unless you have cleared the item from the list.
      • Always Ask—Displays only found items that are set to Always Ask, the default setting.
      • Always Ignore—Displays only found items that you have set to Always Ignore.
      • Always Quarantine—Displays only found items that you have set to Always Quarantine.
    • Click a column heading to sort the list based on that heading.
  4. Select each item in the list that you want to always quarantine.
    • To select more than one item, hold down the Ctrl key and click each item you want to include.
  5. To learn more about any item listed, click the View link.
    • You must be connected to the Internet to see the additional information.
    • Spy Sweeper opens your Web browser, goes to the Webroot Web site, and displays information about the selected item. This information can help you decide if you want to ignore or quarantine the item.
  6. Click Always Quarantine.
  7. Select the items you want to ignore and click Always Ignore.
  8. If you want to remove items that you are not setting to Always Quarantine or Always Ignore from the list here, select the items and click Clear from List.
    • Clearing items does not remove any type of spyware. It just makes the list on the Always Apply tab shorter for you to manage. If Spy Sweeper finds the same item again, it will be added to the list.


Setting Up Program Options and Continuous Monitoring

You can customize Spy Sweeper to meet your needs in the following ways:

  • Set program options
  • Set up continuous monitoring of specific spyware-related activities (shields)

In addition, you can do the following:

  • View spy news


Setting Spy Sweeper Program Options

You can set several options to customize how Spy Sweeper works from the Program tab.

Step Introduction icon You can also update the Spy Sweeper program and spyware definitions. For more information, see Updating the Spy Sweeper Definitions and Program To set Spy Sweeper program options:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Options.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
    • The Options panel displays.
  3. Click the Program tab.
    • The Program tab displays.
  4. Select the options you want to use.

    5. Click to see a description of each option.

    Option
    Description
    Display
    Add "Sweep" Option to Windows Explorer Context Menu
    This option lets you run a sweep on a specific file or folder from Windows Explorer. This adds a Run a Sweep option to the menu you see when you right-click a file or folder, letting you run a sweep on the selected file or folder.
    If the option is unavailable (dimmed), you may not have access to this function. For more information, see Understanding How Spy Sweeper Works with Multiple User Accounts.
    Display Splash Screen on Spy Sweeper Startup
    This option turns on the Spy Sweeper splash screen that displays when you first start Spy Sweeper.
    Show Tooltips
    This option turns on explanatory text that displays when you hold your mouse pointer over options and buttons in Spy Sweeper.
    Other Options
    Start Spy Sweeper at Windows Startup
    This option ensures that Spy Sweeper starts whenever you start Windows, so it is always protecting your computer. We recommend using this option.
    If the option is unavailable (dimmed), you may not have access to this function. For more information, see Understanding How Spy Sweeper Works with Multiple User Accounts.
    Enable Password Protection
    This option lets you protect your settings with a password. The option asks you to create a password. After you create the password, use must use the password to access the Options, Shields, Alerts, and Quarantine panels and to shut down Spy Sweeper. For more information, see Protecting Settings with a Password.


Setting Up Continuous Monitoring (Shields)

You can set up Spy Sweeper to continuously monitor the following types of spyware-related activities on your computer:

  • Internet Explorer changes
  • Windows system changes
  • Hosts file changes (for advanced computer users)
  • Startup programs changes (for advanced computer users)

Spy Sweeper calls these functions Shields. When Spy Sweeper detects activity related to any of the shields, it displays an alert.

The Shields Summary tab (displays after you click Shields in the icon panel), as shown in Figure 3 , shows you a summary of all shields and their status.

Figure 3: Shields Summary tab

1
Shield Status
—Full Protection. All critical and recommended shields are turned on.
—Partial Protection. All critical shields are on, but some recommended shields are not.
—Vulnerable. One or more critical shields are not turned on.
2
—Shield is turned on.
3
—Recommended shield is turned off. Click the shield name to go to the tab where you can turn the shield on. We recommend keeping all recommended shields turned on.
4
—Critical shield is off. Click the shield name to go to the tab where you can turn the shield on. We strongly recommend keeping all critical shields turned on.

Table 2 lists the critical and recommended shields. We recommend that you leave these shields turned on:

Table 2: Critical and recommended shields
Critical shields
Recommended shields
Internet Explorer tab
Internet Explorer tab
IE Hijack
IE Favorites
Windows System tab
IE Security
Memory
Browser Helper Object (BHO)
Spy Installation
Windows System tab
Spy Communication
ActiveX
Keylogger
Alternate Data Stream Execution
Windows Messenger Service
Hosts File
Startup Items

If the shields are unavailable (dimmed), you may not have access to this function. For more information, see Understanding How Spy Sweeper Works with Multiple User Accounts.


Setting Up the Internet Explorer Shields

You can set up Spy Sweeper to continuously monitor several Internet Explorer (IE) settings. These are settings that some spyware changes if you are not protected.

When Spy Sweeper detects attempts to change your Internet Explorer favorites, security settings, browser add-ons, and other settings, it displays an alert.

If the shields are unavailable (dimmed), you may not have access to this function. For more information, see Understanding How Spy Sweeper Works with Multiple User Accounts.

Step Introduction icon To set up the Internet Explorer Shields:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Shields.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
    • The Shields Summary tab displays, showing a summary of the available shields and their status. For information about the icons in the Shields Summary tab, see Setting Up Continuous Monitoring (Shields).
  3. Click the Internet Explorer tab.
    • The Internet Explorer tab displays.
  4. Select the options you want to use.

    5. Click to see a description of each option.

    Option
    Description
    IE Tracking Cookies Shield
    This option actively watches for known tracking cookies (that are in the spyware definitions) as you visit Web sites and removes them. Tracking cookies are cookies that can track your Web activities. These may include cookies that contain user names, passwords, or similar information that you enter on some Web sites.
    IE Favorites Shield
    This option actively protects your Internet Explorer favorites. Whenever a Web site tries to change your favorites, Spy Sweeper lets you know and gives you the option to accept or reject the change. Some Web sites add entries to your favorites without letting you know. This option ensures that you are aware whenever changes are made.
    Even if Spy Sweeper is not open when your favorites change, Spy Sweeper will detect the changes and ask you about them when you next start Spy Sweeper.
    IE Security Shield
    This option actively protects your Internet Explorer security settings (select Tools > Internet Options and click the Security tab). Whenever a program tries to change these settings, Spy Sweeper lets you know and gives you the option to accept or reject the change. Some programs change these options without letting you know. This option ensures that you are aware whenever changes are made.
    Browser Helper Object (BHO) Shield
    This option actively watches your computer for the installation of Browser Helper Objects (BHOs). Whenever a BHO tries to install itself, Spy Sweeper lets you know and gives you the option to accept or reject the change.
    BHOs are add-on programs that work with your browser. Some spyware adds BHOs without your knowledge. This shield ensures that programs do not add a BHO without you being aware of it.
    Edit BHOs Used by Internet Explorer
    Editing BHOs is for advanced users. Deselecting BHOs from the list could cause your browser to not work properly or cause your computer to be unstable. Edit with extreme caution. For more information, see Editing BHOs Used by Internet Explorer.
    IE Hijack Shield
    This option actively protects various Internet Explorer functions, such as the search page, error pages, and other default pages that Internet Explorer displays. Whenever a program tries to change these pages, Spy Sweeper lets you know and gives you the option to accept or reject the change. Some programs change ("hijack") these pages without letting you know. This option ensures that you are aware whenever changes are made.
    Even if Spy Sweeper is not open when these pages change, Spy Sweeper will detect the changes and ask you about them when you next start Spy Sweeper.
    Edit IE Hijack Shield Settings
    Click to edit the individual IE Hijack Shield settings, including the default home and search pages for IE. For more information, see Editing the IE Hijack Shield Settings.


Editing BHOs Used by Internet Explorer

You can edit the BHOs that start when you start Internet Explorer. BHOs are add-on programs that work with your browser. Some spyware adds BHOs without your knowledge.

Caution icon Caution: Editing browser add-on items is for advanced users. Editing items in the list could cause your browser to not work properly or cause your computer to be unstable. Edit with extreme caution.

Step Introduction icon To edit BHOs used by Internet Explorer:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Shields.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
    • The Shields panel displays, showing a summary of the available shields and their status.
  3. Click the Internet Explorer tab.
    • The Internet Explorer tab displays.
  4. Click Edit BHOs Used by Internet Explorer.
    • The Edit Browser Helper Objects window displays, with a list of the installed BHOs. Items with a check mark next to them start whenever Internet Explore starts.
    • To see more information about an item, select it and click More Details. Not all programs provide additional details.
  5. Deselect any BHOs you do not want to start whenever Internet Explorer starts.
  6. Click OK.


Editing the IE Hijack Shield Settings

You can edit the individual IE Hijack Shield settings, including the default home and search pages for Internet Explorer.

Step Introduction icon To edit the IE Hijack Shield settings:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Shields.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
  3. Click the Internet Explorer tab.
    • The Internet Explorer tab displays.
  4. Select the options you want to use.

    5. Click to see a description of each option.

    IE Home Page Shield
    This option actively protects the Web site you set as your home page in Internet Explorer. Some programs change the home page that you set. The home page is the Web site that displays automatically when you start Internet Explorer or when you click the Home button.
    In the Use This Page field, enter the Web address of the Web site you want in the format: http://www.webroot.com.
    Alert Me Before Restoring This Setting
    Select this option if you want Spy Sweeper to tell you when it automatically changes the home page back to the site listed above. To avoid seeing alerts about changes to your home page, do not select this option.
    IE Search Page Shield
    This option actively protects the Web site you set as your search page in Internet Explorer. Some programs change the search page that you set. The search page is the Web site that displays automatically when you click the Search button in Internet Explorer.
    In the Use This Page field, enter the Web address of the Web site you want in the format: http://www.webroot.com.
    Alert Me Before Restoring This Setting
    Select this option if you want Spy Sweeper to tell you when it automatically changes the search page back to the site listed above. To avoid seeing alerts about changes to your home page, do not select this option.
    Advanced Settings
    These options are advanced configuration options used only in error conditions and/or when a system is severely infected. You can use these options to repair your Internet Explorer settings when a browser hijacker embeds itself deeply in your browser. Webroot customer support is available to assist.
    • User—Limited users can use this drop-down list to change these settings. Only the current user account is affected. These settings effectively override the system settings below. For more information about the account types, see Understanding How Spy Sweeper Works with Multiple User Accounts.
    • System—Only the computer administrator can use this drop-down list to change these settings. Changes here affect all user accounts, unless a limited user has customized the setting.
    Enter the Web address of the Web site in the format: http://www.webroot.com or the path to the file you want in the text field.
    Alert Me Before Restoring This Setting
    Select this option if you want Spy Sweeper to tell you when it automatically changes the pages listed in the Advanced Settings drop-down list back to the site or path listed in the text field. To avoid seeing alerts about changes to your home page, do not select this option.

  5. If you want to reset all of the Internet Explorer page settings back to the defaults used when Internet Explorer was first installed, click Reset IE Page Settings to Defaults.
  6. Click OK.


Setting Up the Windows System Shields

You can set up Spy Sweeper to continuously monitor several Windows system settings. These are settings that some spyware changes if you are not protected.

If the shields are unavailable (dimmed), you may not have access to this function. For more information, see Understanding How Spy Sweeper Works with Multiple User Accounts.

Step Introduction icon To set up the Windows System Shields:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Shields.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
    • The Shields panel displays, showing a summary of the available shields and their status.
  3. Click the Windows System tab.
    • The Windows System tab displays.
  4. Select the options you want to use.

    5. Click to see a description of each option.

    Option
    Description
    ActiveX Shield
    This option actively watches for programs that install ActiveX technology on your computer. Whenever a program tries to install ActiveX technology, Spy Sweeper lets you know and gives you the option to continue the installation or to stop it.
    ActiveX technology is a group of functions developed by Microsoft that let programs share information. Many legitimate programs use ActiveX, but some spyware also uses ActiveX to install itself.
    Prompt Only for Known Spyware Items
    Select this option to have Spy Sweeper watch for only known spyware (that is in the spyware definitions) that tries to install ActiveX technology. Turning this option on will reduce the number of alerts you receive, but could permit new spyware (that is not yet in the Spy Sweeper definitions) to install.
    Alternate Data Stream (ADS) Execution Shield
    (Applies only to Windows NT, 2000, and XP.) This option actively watches for programs that try to start from an alternative data stream (ADS). Turning on this shield lets Spy Sweeper alert you if a program tries to start from an ADS.
    ADS is a highly technical way to hide images, data, or code in a file and can be used to hide malicious code. The hidden content is impossible to detect using regularly-available tools, such as Windows Explorer.
    Windows Messenger Service Shield
    (Applies only to Windows NT, 2000, and XP.) This option turns off and actively watches the Microsoft Messenger Service. This service is not an instant messaging program and does not affect your use of instant messaging. This service is often used for sending spam (unwanted e-mail) and creating pop-up ads. Turning off the service stops these types of spam and pop-ups.
    If your computer is in your home, you can turn off this service without any problem. If you work in a corporate environment, contact your system administrator to find out if your company uses the service to communicate with company employees. If you are not sure, leave the service turned on until you find out.
    Critical Shields
    Memory Shield
    This option sweeps your computer's random access memory (RAM) frequently looking for spyware. It only sweeps memory when Spy Sweeper is open in the system tray in the lower-right corner of your screen.
    Spy Installation Shield
    This option actively watches for known spyware (that is in the spyware definitions) that tries to install itself on your computer. Whenever known spyware tries to install itself, Spy Sweeper lets you know and gives you the option to block or allow the installation.
    If you block the installation, Spy Sweeper places the file that tried to install itself in Quarantine. You can then remove or restore the file. For more information, see Handling Quarantined Items.
    Automatically Quarantine Items Found by This Shield
    This option automatically stops the installation of known spyware (that is in the spyware definitions) and places the file that tried to install itself in Quarantine, without alerting you.
    Spy Communication Shield
    This option actively watches for communication from your computer to known Web sites that are related to spyware. Spy Sweeper includes a list of known sites with its definitions.
    If Spy Sweeper detects an attempt to communicate with a site on the list, it will display a pop-up alert in the system tray (lower-right corner of your screen) telling you that access to the site was blocked.
    Keylogger Shield
    A keylogger is a type of system monitors that has the ability to monitor all keystrokes on your computer, which can capture your credit card numbers, passwords, and other personal information. This shield looks for any programs that are tracking your keystrokes and blocks the program from doing so.


Setting Up the Hosts File Shields

Note icon Note: This section describes highly technical features associated with how your computer finds the actual address of a Web site. The features described here will not damage your computer or remove anything you need if you enable them, but the underlying technology is complex if you are not aware of how IP addressing works.

You can set up Spy Sweeper to continuously monitor two functions related to the Hosts file. The Hosts file is a Windows file that helps direct your computer to a Web site using Internet Protocol (IP) addresses. Your Web browser, for example Internet Explorer, uses the IP address to actually connect you to a Web site.

When you go to a Web site, like www.webroot.com, your computer first looks in the Hosts file to see if it already knows where to go. If the domain (webroot.com) is listed, your computer goes directly to the IP address listed in the Hosts file. If the domain is not in the Hosts file, your computer looks up the information from the Internet (a slightly slower process).

The Hosts file has two primary uses, one good and one bad:

  • Good—You can block a lot of tracking cookies and other monitoring by using the Hosts file to route certain domains, such as advertising sites, to a dead end.
  • Bad—Some spyware will route certain domains to false addresses, for example, by making a commonly used search site open to a porn site. We call this hijacking.

Using Spy Sweeper to manage the Hosts file, you can block a lot of unwanted adware activity, while preventing your Web browsing from being hijacked.

When Spy Sweeper detects activity related to the Hosts File Shield, it displays an alert.

If the shields are unavailable (dimmed), you may not have access to this function. For more information, see Understanding How Spy Sweeper Works with Multiple User Accounts.

Step Introduction icon To set up the Hosts File Shields:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Shields.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
    • The Shields panel displays, showing a summary of the available shields and their status.
  3. Click the Hosts File tab.
    • The Hosts File tab displays.
  4. Select the options you want to use.

    5. Click to see a description of each option.

    Option
    Description
    Common Ad Sites Shield
    This option adds known advertising sites to your Hosts file and sets the IP address for those sites to the IP address for your computer. This blocks banner and other advertising from these sites. When you go to a Web site that has advertising from one of the blocked sites, you may see a small graphic that indicates a broken link to a graphic (typically a red x in a box). This just shows where the blocked ad would display. Spy Sweeper updates these sites when you update your definitions.
    Hosts File Shield
    This option actively watches the Hosts file for any changes. Some programs will add or change the IP address for a Web site in the Hosts file. When you try to go to the added or changed Web site, you will really go to a different Web site, such as an advertising site. This shield ensures that programs do not change an IP address without you being aware of it.
    Edit Hosts File
    Click to edit the Hosts file. For more information, see Editing the Hosts File.


Editing the Hosts File

Note icon Note: This section describes highly technical features associated with how your computer finds the actual address of a Web site. The features described here will not damage your computer or remove anything you need if you enable them, but the underlying technology is complex if you are not aware of how IP addressing works.

Editing the Hosts file lets you remove entries from the file. If you suspect that spyware has changed the IP address of a Web site in your Hosts file, you can remove that entry.

Some spyware will add or change the IP address for a Web site in the Hosts file. When you try to go to the added or changed Web site, you will really go to a different Web site, such as an advertising site. If Spy Sweeper suspects that Web site's address has been changed (hijacked), it displays a warning icon next to the entry.

If the shields are unavailable (dimmed), you may not have access to this function. For more information, see Understanding How Spy Sweeper Works with Multiple User Accounts.

Step Introduction icon To edit the Hosts file:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Shields.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
    • The Shields panel displays, showing a summary of the available shields and their status.
  3. Click the Hosts File tab.
    • The Hosts File tab displays.
  4. Click Edit Hosts File.
    • The Edit Hosts File window displays, showing entries that you, your IT department or spyware have added to your Hosts file. If you have the Common Ad Sites Shield turned on, it does not display the blocked ad sites.
    • Spy Sweeper compares the IP address of each entry in the Hosts file to the correct address on a domain name system (DNS) server. Any address that does not match and is not set to the local machine address (127.0.0.1) is flagged as possibly hijacked [image].
  5. Select the entries you want to remove.
  6. Click Delete Selected.
    • Spy Sweeper deletes the selected entries from your Hosts file.
  7. Click Close.


Setting Up the Startup Programs Shields

You can set up Spy Sweeper to continuously monitor the list of programs that start every time you start Windows. Some spyware adds programs to this startup list if you are not protected, which causes spyware to start every time you start Windows.

When Spy Sweeper detects activity related to the Startup Shield, it displays an alert.

Spy Sweeper also lets you edit the startup items.

If the shields are unavailable (dimmed), you may not have access to this function. For more information, see Understanding How Spy Sweeper Works with Multiple User Accounts.

Caution icon Caution: Editing startup items is for advanced users. Some items listed may be required by Windows or other programs. Deselecting items from the list could cause your computer to not start properly or cause some programs not to work. Edit with extreme caution.

Step Introduction icon To set up the Windows Startup Programs Shields:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Shields.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
    • The Shields panel displays, showing a summary of the available shields and their status.
  3. Click the Startup Programs tab.
    • The Startup Programs tab displays.
  4. Select the options you want to use.

    5. Click to see a description of each option.

    Option
    Description
    Startup Items Shield
    This option actively watches for attempts to add either suspected spyware or any item to your startup list. Select an option below to set when you want Spy Sweeper to alert you.
    Alert Only for Suspected Spyware Changes to Startup Items
    This option actively watches for attempts to add suspected spyware to your startup list. Some spyware will add itself to your startup list, so that the spyware will always run on your computer. This shield ensures that suspected spyware does not add itself to your startup list without you being aware of it.
    Alert for All Startup Item Changes
    This option actively watches your startup list for all changes. Some spyware will add itself to your startup list, so that the spyware will always run on your computer. This shield ensures that spyware does not add something to the startup list without you being aware of it.
    Ignore Other Webroot Products
    This option tells Spy Sweeper to ignore changes made to your startup list when you install other Webroot products.
    Edit Startup Items
    Click to edit startup items. For more information, see Editing Startup Items.
    Editing startup items is for advanced users. Some items listed may be required by Windows or other programs. Deselecting items from the list could cause your computer to not start properly or cause some programs not to work. Edit with extreme caution.


Editing Startup Items

You can edit the startup items from Spy Sweeper. Startup items are programs that start whenever Windows starts.

Caution icon Caution: Editing startup items is for advanced users. Some items listed may be required by Windows or other programs. Deselecting items from the list could cause your computer to not start properly or cause some programs not to work. Edit with extreme caution.

Step Introduction icon To edit startup items:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Shields.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
  3. Click the Startup Programs tab.
    • The Startup Programs tab displays.
  4. Click Edit Startup Items.
    • The Edit Startup Items window displays with a list of the items that start when Windows starts, along with the path and name of the program's executable file. Items with a check mark next to them start whenever Windows starts.
    • To see more information about an item, select it and click More Details. Not all programs provide additional details.
  5. Deselect any item in the list that you do not want to start whenever Windows starts.
  6. Click OK.


Viewing Spy News

The Spy News provides you with tips, tricks, and information about spyware.

Step Introduction icon To view Spy News:

  1. Start Spy Sweeper, if it is not already open, and display the main window.
    • For more information, see Starting Spy Sweeper.
  2. In the icon panel, click Home.
    • For information about the Spy Sweeper window, see Understanding the Spy Sweeper Window.
  3. Click the View Spy Sweeper News link.
    • Spy Sweeper opens your Internet browser and displays the latest news.


Software Evaluation Agreement

PLEASE READ THIS AGREEMENT CAREFULLY

SOFTWARE EVALUATION AGREEMENT

WEBROOT SOFTWARE, INC. ("WEBROOT") IS WILLING TO LICENSE THE ENCLOSED SOFTWARE (THE "SOFTWARE") ONLY ON THE CONDITION THAT YOU ACCEPT ALL OF THE TERMS IN THIS SOFTWARE EVALUATION AGREEMENT (THIS "AGREEMENT").

BY CLICKING ON THE "ACCEPT" BUTTON BELOW, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS AGREEMENT, UNDERSTAND IT, AND AGREE TO BE BOUND BY IT. IF YOU DO NOT AGREE TO THE TERMS BELOW, WEBROOT IS UNWILLING TO LICENSE THE SOFTWARE TO YOU, AND YOU SHOULD CLICK ON THE "DO NOT ACCEPT" BUTTON BELOW TO DISCONTINUE THE INSTALLATION PROCESS.

1. LICENSE. Subject to the terms and conditions of this Agreement, Webroot hereby grants You a limited, non-exclusive, personal license to use the Software in accordance with the documentation provided with the Software for the sole purpose of testing and evaluating the Software in order to assist You in Your decision to purchase a license for the commercial version of the Software.

2. RESTRICTIONS. You may not: (a) reproduce, modify, adapt, alter, translate, or create derivative works from the Software; (b) merge the Software with other software; (c) sublicense, lease, rent, loan, or otherwise transfer the Software to any third party; (d) use the Software in any service bureau or time-sharing arrangement; (e) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code for the Software; or (f) otherwise use or copy the Software except as expressly allowed under Section 1.

3. OWNERSHIP. The Software and all worldwide intellectual property rights therein and related thereto, are the exclusive property of Webroot and its licensors. Except for the limited rights expressly granted under Section 1, You have no right, title, or interest (whether by implication, estoppel, or otherwise) in or to the Software or any intellectual property rights therein or related thereto.

4. TERM/TERMINATION. This Agreement becomes effective when You agree to this Agreement by using or accessing the Software (the "Effective Date") and will continue until terminated. This Agreement will terminate immediately if you breach any term or condition of this Agreement. In addition, either party may terminate this Agreement with or without cause upon notice to the other party. Upon termination of this Agreement, You agree to destroy the Software and all copies thereof.

5. POTENTIALLY UNWANTED SOFTWARE. The Software will search Your computer for "spyware," "adware" and other programs, files and content that Webroot identifies as fitting within a defined category (collectively, "Potentially Unwanted Software") and will display a list of Potentially Unwanted Software located on Your computer. The Software provided by Webroot under this Agreement, however, contains limited functionality and may not remove the Potentially Unwanted Software found on Your computer. You must purchase a license to the commercial version of Software to access the full functionality of the Software. While Webroot uses reasonable efforts to properly identify Potentially Unwanted Software on Your computer and to regularly update its database of Potentially Unwanted Software, Webroot cannot guarantee that its database is complete or accurate. During the 30-day period following the Effective Date (the "Trial Period"), Webroot, at its discretion, may allow the Software to receive updates to Webroot's database of Potentially Unwanted Software ("Content Updates"). You must purchase a license to the commercial version of the Software, however, to receive Content Updates after the Trial Period expires.

6. NO SUPPORT. Webroot will have no obligation under this Agreement to correct any bugs, defects or errors in the Software or to otherwise support or maintain the Software.

7. WARRANTY DISCLAIMER. THE SOFTWARE IS PROVIDED TO YOU "AS IS" AND WEBROOT AND ITS LICENSORS EXPRESSLY DISCLAIM ANY AND ALL WARRANTIES AND REPRESENTATIONS OF ANY KIND WITH REGARD TO ANY SUBJECT MATTER OF THIS AGREEMENT, INCLUDING WITHOUT LIMITATION, ANY WARRANTY OF NON-INFRINGEMENT, TITLE, FITNESS FOR A PARTICULAR PURPOSE, FUNCTIONALITY OR MERCHANTABILITY, WHETHER EXPRESS, IMPLIED OR STATUTORY. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY WEBROOT, ITS EMPLOYEES, DISTRIBUTORS, DEALERS, OR AGENTS SHALL INCREASE THE SCOPE OF THE ABOVE WARRANTIES OR CREATE ANY NEW WARRANTIES.

8. LIMITATION OF REMEDIES. REGARDLESS OF WHETHER ANY REMEDY SET FORTH IN THIS AGREEMENT FAILS OF ITS ESSENTIAL PURPOSE OR OTHERWISE, IN NO EVENT WILL WEBROOT, ITS DISTRIBUTORS OR ITS SUPPLIERS BE LIABLE TO YOU OR TO ANY THIRD PARTY FOR ANY LOST PROFITS, LOST DATA, INTERRUPTION OF BUSINESS, OR OTHER SPECIAL, INDIRECT, INCIDENTAL OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE, EVEN IF WEBROOT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LOSS OR DAMAGES AND WHETHER OR NOT SUCH LOSS OR DAMAGES ARE FORESEEABLE. IN NO EVENT WILL THE TOTAL LIABILITY OF WEBROOT UNDER THIS AGREEMENT EXCEED TWENTY (US) DOLLARS.

9. GENERAL. This Agreement will be governed by the laws of the State of Colorado in the United States of America, without regard to or application of any conflicts of law rules or principles. The federal and state courts in Denver or Boulder County, Colorado will have exclusive jurisdiction over any disputes, claims or controversies arising out of or relating to this Agreement, and You hereby irrevocably waive any objection to the jurisdiction of such courts over any such dispute, claim or controversy. If any provision of this Agreement is unenforceable, such provision will be changed and interpreted to accomplish the objectives of such provision to the greatest extent possible under applicable law and the remaining provisions will continue in full force and effect. This Agreement is the complete and exclusive statement of the agreement between the parties which supersedes any proposal or prior agreement, oral or written, and any other communications between the parties in relation to the subject matter of this Agreement.

THE SOFTWARE IS PROTECTED BY UNITED STATES COPYRIGHT LAW AND INTERNATIONAL TREATY. c COPYRIGHT 2006, WEBROOT SOFTWARE, INC. ALL RIGHTS RESERVED.


Glossary

ActiveX
ActiveX technology is a group of functions developed by Microsoft that let programs share information. Many legitimate programs use ActiveX, but some spyware also uses ActiveX to install itself.
adware
Adware is advertising-supported software that displays advertisements. Adware is usually available via free downloads from the Internet. Adware is often bundled with or embedded within freeware programs like filesharing applications, search utilities, information-providing programs (such as clocks, messengers, alerts, weather, and so on), and software such as screensavers, cartoon cursors, backgrounds, sounds, etc. Deleting adware may result in the deletion of the bundled freeware application.
Worst case scenario: Although seemingly harmless, some adware programs may track your Web surfing habits and cause slowing of your Web browser as well as system performance issues.
Alternate Data Stream (ADS)
An Alternate Data Stream is a highly technical way to hide images, data, or code in a file and can be used to hide malicious code. The hidden content is impossible to detect using regularly-available tools, such as Windows Explorer.
Browser Helper Object (BHO)
Browser Helper Objects are add-on programs that work with your browser. Some spyware adds BHOs without your knowledge.
dialer
Dialers have the ability to disconnect your computer from your local Internet provider and reconnect you to the Internet using an expensive toll or international phone number. They do not spy on you, but they may accrue significant long distance phone charges. They have the ability to run in the background, hiding their presence.
Worst case scenario: Dialers may accrue significant long distance phone charges.
definitions
A definition is the set of fingerprints that characterize a piece of spyware. Webroot regularly updates the definitions of known spyware that Spy Sweeper uses.
keylogger
A keylogger is a type of system monitor that may record all keystrokes on your computer. Therefore, a keylogger may record and log your e-mail conversations, chat room conversations, instant messages, and any other typed material. They have the ability to run in the background, hiding their presence. Keyloggers may be installed by someone with administrative access to your computer or they may be installed via other threats, such as music downloads and Trojan downloaders.
Worst case scenario: A third party may be able to view your personal conversations and may gain access to private information such as your usernames, passwords, credit card numbers, or your Social Security number.
rootkit or potentially rootkit masked files
Rootkits are software tools that an attacker uses to maintain access to your computer for malicious purposes.
spyware
Spyware is any application that makes potentially unwanted changes to your computer while collecting information about your computing activities. This information may be sent subsequently to a third party for malicious purposes without your knowledge or consent. Spyware may arrive bundled with freeware or shareware, through e-mail or instant messenger, may propagate itself using dialog boxes, various social engineering methods, scripting errors, or by someone with access to your computer. Spyware is difficult to detect, and difficult (if not impossible) for the average user to remove.
system monitors
System monitors may monitor all of your computer activity. They range in capabilities and may record some or all of the following: keystrokes, e-mails, chat room conversations, instant messages, Web sites visited, programs run, time spent, and even usernames and passwords. The information is gathered via remote access or sent by e-mail, and may then be stored for later retrieval.
Worst case scenario: A third party may be able to view your personal conversations and may gain access to private information such as your usernames, passwords, credit card numbers, or your Social Security number.
traces
Traces are places where Spy Sweeper finds spyware fingerprints. Traces can be a file, cookie, or registry entry. Each definition is made up of multiple traces.
tracking cookies
Cookies are pieces of information that are generated by a Web server and stored on your computer for future access. Cookies were originally implemented to allow you to customize your Web experience. However, some Web sites now issue tracking cookies, which allow multiple Web sites to store and access cookies that may contain personally identifiable information (surfing habits, usernames and passwords, areas of interest, etc.), and then simultaneously share the information with other Web sites. Tracking cookies are installed and accessed without your knowledge or consent.
Worst case scenario: This sharing of information allows marketing firms to create a user profile based on your personal information and sell it to other firms.
Trojan horses
A Trojan horse is a program that allows a hacker to make changes to your computer. Unlike a virus, a Trojan does not replicate itself. It is generally disguised as a harmless software program and distributed as an e-mail attachment. Once you open the attachment, the Trojan may install itself on your computer without your knowledge or consent. It has the ability to manage files on your computer, including creating, deleting, renaming, viewing, or transferring files to or from your computer. It may utilize a program manager that allows a hacker to install, execute, open, or close software programs. Trojans have the ability to run in the background, hiding their presence.