Welcome to Spybot - Search & Destroy

SpyBot - Search & Destroy
Freeware, ©'2000-2002 Patrick Michael Kolla

SpyBot - Search & Destroy searches your hard disk for different kinds of internet threats - including spy- and adware, keyloggers and your usage tracks (for example your browsers page history). Spybot-S&D can also fix some system problems.

Spybot-S&D also offers some tools, like the Secure Shredder.

License
Why freeware? There's a simple answer to that. What do you get if you buy a program? Lots of ones and zeros, that's all. If they were distributed as art, I could understand to pay for it.
But if the main goal of their order is to earn money - by fees or ads - I don't like it!
And that's why this program comes for free. But if you like it and it helped you, I ask you of one thing: say a prayer for me to your god - or whatever you believe in - and wish me some luck.

Needed Soft- and Hardware
You obviously need some sort of 32bit Windows, like Windows 95, 98, ME, NT, 2000 or XP. About 2 Megabytes of free hard disk space are also needed.

Usage
Start the program by double-clicking the file SpybotSD.exe in the directory you extracted the archive. If this is your first use of Spybot-Search&Destroy, you will be asked whether to create a desktop icon and/or a start menu item.

After that, you are inside the program!

If you need more information, read on about scanning.


Product information

Bot info

In this section you can find more information about the problems Spybot-S&D is targeting. If you came from the results list, the problem you want may already be selected, otherwise you can use the pulldown list the select one.

The information shown contains only URLs, but as some of these URLs may directly start an (ActiveX) download, you can't open them by using the standard double-click. Instead, right-click somewhere in the info field and select the URL you want to visit if you are sure your browser is set to safe settings.

You can also select the exclude a product from further searches using the checkbox at the top (this does the same as checking a product in the Excludes section).

You can find the Product (Bot) information by choosing Product info from the Info & License section in the toolbar to the left.


About spyware

What is spyware? In easy terms, spyware is software that transmits personally identifiable information from your computer to some place in the internet without your special knowledge.

Spyware is typically not the product you install itself, but small add-ons, that you may or may not disable during install. In most cases, the EULA somewhere has a few lines telling you about privacy matters, but typically most users don‚t read the complete EULA and never know they got spyware on their system.

A less threatening sort is adware. Adware is similar to spyware, but does not transmit personally identifiable information, or at least the collector promises not to sell it. Instead, aggregated usage information is collected.

Adware is also often a side-effect of spyware, as both monitor you for a sole purpose – delivering you advertisement that is especially tailored to your habits.

Another kind that is detected under the spyware category are tracking cookies. Cookies are used all over the internet in useful and less useful places. Advertisement companies often set cookies whenever your browser loads a banner from them. In that case and if that cookie contains a GUID, the company gets notice about every site you visit that contains their ads.


About system internals

The windows registry contains lots of information. It‚s consistency can be checked with good commercial programs like Symantec™ System Works. But there are some small things I miss with those programs. Here‚s what SpyBot-S&D searches for:

  • Missing help files – the registry contains information about the location of some help files. If those information points to incorrect directories, SpyBot-S&D will tell and allow to fix.

  • Missing shared DLLs – the registry contains a list of dynamic link libraries, where they are located and how many programs use them. SpyBot-S&D checks if all locations are correct and allows to change them if not.

  • Application paths – some applications (mostly those registered to a file extension) are registered in the registry. If they are pointing to a no longer existent program file, SpyBot-S&D can change their path or delete their entry.

  • Wrong Uninstall information – every program that has it‚s own uninstall routine stores some information about it in the registry. If those information is incorrect, e.g. because the uninstall program was located inside a temp directory (there are lots of programs that stupid!), SpyBot-S&D will tell (and allow a change in future versions).

  • Broken Desktop Links – if one of the links on your desktop links to a file that is no longer existent, Spybot-S&D will tell you and allow you to either point the link to another file or delete it.

Warning: Please be aware that changes to this items can corrupt your system! If you are not sure whether a setting is really a problem, better leave it!
Especially Microsoft Office™ has some registry entries pointing the wrong directories and some even pointing to non-existent help files. I‚ve changed the first, but I wouldn‚t delete the second kind of, because they may well point to files that will be installed on that ‘Install on first use‚ base.


About usage tracks

Usage tracks are your fingerprints in your system. Whenever you visit a page with your browser, or just open any file, that information is stored deep inside Windows. In most cases that is very useful – if you want to open that file again, you can select it from a list instead of typing the whole filename or browsing the whole directory structure again.

But in some cases you may want to hide your activity, because spyware and internet attackers may use that information. Spybot-Search&Destroy can remove some of the most important and common tracks on your system.


Setting the basic options

All important settings are listed in a tree in this section. The description that follows is sorted by the trees main categories.

Installation

This section lets you add/remove the desktop icon and/or start menu item.

Spybot-S&D settings

This options should be self-explanatory

Automation

Spybot-S&D has two kind of automation settings – on system start and on program start. Here you can set whether to start the program when you start up your Windows, or to check for updates automatically, or to delay the scan on system start for a specified delay or until other programs (scanners) have terminated.

Log file settings

Spybot-S&D can write details about each scan into text files. Here you can select whether to do this, whether the date and time should be included in the filename, and whether to append or to overwrite the log file.

Look & Feel

You can switch a few details about the look of Spybot-S&D. Just try the options and see what look you like most.

Bug Report

If you are unsure about problems, you may send a bug report to PepiMK Software. This section is about how the mailing should be handled. You should at least select to include system information and scan results in the bug report (you can preview it before sending). Also, if you want to receive the same mail as PepiMK Software, you may select to send a copy to yourself (you need to change SMTP settings to do this – see the Bug Report help).

You can find the main settings by choosing Settings from the Settings section in the toolbar to the left.


Choosing the interface language

Spybot-S&D uses external files for language resources, so anyone may write a language file for his language. Please contact PepiMK Software for support if you want to do so – you won‚t earn any money from it, but eternal fame ;)

By default, all available languages are shown in the list. But if you want to remove (or add again later) a language from display, you can use the context menu of the list to do that.

You can find the language settings by choosing Languages from the Settings section in the toolbar to the left.


Choosing what to scan (file sets)

Spybot-S&D uses the concept of include files to make it more flexible. Each include file is a file containing the description of some problems that Spybot-S&D can detect and fix.

This files are divided into categories, so you can select what you want to target during your scan.

The basic categories are spy- and adware, system problems and usage tracks. For each category you may see include files with a short description on what they do, and the number of files, registry entries and directories that will be checked.

You can select which include files to use for your next scan by toggling the checkbox next to them.

If you see a include file in italic letters, then it is one not originating from PepiMK Software. As the include file format is public, anyone may write include files. But include files can do a lot of harm to your system, and PepiMK Software can‚t guarantee for a foreign include file, so you will be asked whether you are really sure to use the file if it is not from PepiMK Software.

You can find the file sets settings by choosing File sets from the Settings section in the toolbar to the left.


Choosing what not to scan (excludes)

There are four different exclude sections at the moment:

Product excludes

This section lists all products defined internally and in the external include files. If you want to exclude a complete product, or include it again, select the file from this section and toggle the checkbox before the product.

Cookie excludes

Cookies are usage tracks, but you may want to keep some useful cookies. This section lists all cookies currently on your system, allowing you to exclude them from further searches.
(At the moment, only Internet Explorer and Netscape Navigator cookies are supported – Opera cookies can only be deleted completely)

Extension excludes

This is about the common Windows file open dialog. It saves lists of opened (and saved) files divided into extensions. If you don‚t want to remove the WinWord files, for example, you could select .doc to be excluded in this section.

Single excludes

If you do not want to exclude a complete product, but only a single file or registry setting of it, you can select that one from the results list. These are listed here, where you may remove them from the exclude list again.

All the lists in these sections have a context menu with extended selection options.

You can find the exclude settings by choosing a category from the Excludes section in the toolbar to the left.


Setting the download directories

Some scans target also the installer files of problems detected by Spybot-S&D. Installers that the user must explicitly start downloading will only be scanned for in the directories entered into this list.

You can either use Drag‚n‚Drop to drop some directories from an Explorer window, or use the context menu to add or remove directories to or from the list.

You can find the download directories settings by choosing Directories from the Settings section in the toolbar to the left.


Choosing a skin

Spybot-Search&Destroy supports the concept of basic skins, to adjust program colors to personal needs.

The Skin section will show you a list of available skins. Select one to preview it. The (very simple) preview will be displayed in the left part of the window, with some information below the list and the skin logo at the bottom of the page.

If you like the skin, press the Apply button.

You can find the skin settings by choosing Skins from the Settings section in the toolbar to the left.


Scanning your system

Once you have started Spybot-Search&Destroy, you can immediately start scanning.

After you have started the program, you will already see the scan screen. If not, please select Search & Destroy in the Spybot-S&D section in the toolbar to the left.

The search screen contains a toolbar with the most important options (you can move this toolbar between the top and bottom position if you want). Let's start a scan: please press the Check all button.

You will see the scan progress in the status bar at the bottom of the window (the right-most section displayed the estimated time left), and can stop the progress at any point by pressing the Stop check button that has just appeared (it will vanish again once the check has finished).

If the scan has found something, the list will show it. There are three basic kinds of results:

  • Red entries indicate spyware problems that should be fixed to avoid security and/or privacy problems. This is the only kind of problem that is preselected to be fixed.

  • Black entries are system internals. If you do not know what they mean, I would suggest to either keep your fingers from it or visit the support forum.

  • Green entries indicate usage tracks. It can do no harm to remove these.

For most problems more information is available. If you select a problem in the list, the button Description of this product should be available in most cases. Press it to read about what kind of threat you have found.

You can now select the problems you want to fix, by clicking the checkbox before it, or by selecting all using the button Select all problems. More selection options are available if you look into the context menu (by right-clicking a problem). The context menu will also allow you to exclude single problems or whole products from further scans (you may later change the exclude settings from the Excludes section).

Once you are sure you have selected what you want to be removed from your computer, press the Fix selected problems button. You will see the fixing progress at the bottom status bar.

If problems can not be fixed now (because they are still loaded and can‚t be terminated, for example), Spybot-S&D offers to run on next system start, so you can check and fix again.

Should you notice at any later point that you have removed more spyware than you wanted, you can always restore it from the Recovery section.

You can also fine-tune your scan options by selecting special filesets and changing some settings.


Recovery

The recovery section is available by selecting Recovery from the Spybot-S&D section in the toolbar to the left.

This section also has a movable toolbar similar to the one in the Search & Destroy section.

If you have fixed some spyware problems in the past, this list will show it. Here you can select one or more problems (see also the context menu for extended selection options) and either recover them, or purge them permanently from your system.


Updating

To avoid large downloads and for more flexibility, most scan information is inside the include files.

Include files, but also newer help files, new languages, updated descriptions etc. can be downloaded using the integrated update function.

Of course to update the program, you need an open internet connection.

After that, you can click the Search for updates button. That will download a list of available updates from a PepiMK Software server and compare them to the files already installed on your system.
New files will be shown in the list, where you can select them and press the Download updates button afterwards. During download, every finished file will get a green check mark.

If you want to read about updates first, press the Read news online button or visit the support forum.

You can find the update function by choosing Update from the Online section in the toolbar to the left.


Reporting a bug

You should use the bug report only as a last resort. First, please check for newer versions, read the FAQ and visit the support forum.

If all that hasn‚t helped solve your problems, you may write a bug report. If you write a bug report the first time, you may need to set your mail settings. Select the button Mail settings, and change them to yours. The dialog poping up will allow you to set all necessary data. If you use Outlook or Outlook Express, you may even import your settings, and will only have to enter your password.

Once the mail settings are correct, press Next button. A new section will pop up, allowing you to write your bug description, preview the automatically created report, and add files to be appended to the mail. Once you have done that and verified everything is correct, you can press the Send button to send the mail.

You can find more bug report options in the main settings.

You can find the bug report function by choosing Bug Report from the Online section in the toolbar to the left.


Opting out

If you have subscribed to some advertisers service by accident in the past, and don‚t know where to opt out again, you may have luck and the advertiser is listed in here. Double-click the address to either visit the website or send an opt out mail (you can distinguish between the two by the icon in front).

You can find the Opt Out list by choosing Opt Out from the Online section in the toolbar to the left.


Secure shredder tool

The secure shredder is a tool to get finally rid of files, without any further possibilities of recovery.

Shredding is simple – drop some files from the explorer into the list (or add some using the context menu of the list), select the number of shreds, and click Chop it away.

Usage tracks that are in files will be shredded using this tool, too, using 5 passes.

The first 5 shreds are using pre-defined bit pattern that should make even hardware recovery impossible. Any further pass will use a random bit pattern that is changing every few Bytes.
Please notice: one pass is not enough to shred a file, as the heads of your hard disk won‚t hit the same track 100,00% of the time. There are small differences of a few µm that will allow pros to reconstruct even overwritten data. That is why multiple shreds are necessary, and why different patterns should be used.

Warning: This tool is designed to remove files so they can not be recovered again! If you use it, be aware of that!

Disclaimer: I tried my best to finally shred every given to this tool. But I can't guarantee that files will be unrecoverably extinguished.

You can find the secure shredder tool by choosing Secure Shredder from the Tools section in the toolbar to the left.


Dump trash tool

Some older versions of Spybot-S&D sadly created registry keys they should only be checking for existence. If you have used Spybot-S&D 0.9 to 0.94, you should run this tool.

First press the Check for keys button. This may take a long while, and will list all of the keys that have been accidentally created. You can then remove them by selecting Remove keys. Only empty (unused) keys will be listed, so you do not have to fear that a key accidentally created in the past, but in use now will be listed and removed.

There is no need to run this tool more than once if you don‚t intend to run any older Spybot-S&D again (which you shouldn‚t).

You can find the dump trash tool by choosing Dump trash from the Tools section in the toolbar to the left.


ActiveX

ActiveX is a Microsoft technologie that allows Internet applications that are more powerful than simple scripts. ActiveX applications do work only in Internet Explorer, so the use of ActiveX on websites is not recommended. Due to the huge amount of influence ActiveX apps can have on the system (ActiveX apps have access to the same files you have access to, meaning all files in the case of most private computers), it is recommended to be very careful if dealing with ActiveX.

There are two types of ActiveX apps - signed and unsigned. The code of unsigned ActiveX apps hasn't been certified and should never be trusted. Signed ActiveX apps are certified, but can still contain malicious code! Signed ActiveX apps should be trusted only if coming from trusted websites and only on a prompt base (meaning that IE settings will ask every time a website wants to load an ActiveX app).

Many dialers and hijackers install themselves using ActiveX applications.


Browser Helper Object

Also called BHO. A BHO is a small program that extends Microsofts Internet Explorer. Examples for a BHO are for example additional toolbars shown in IE, but also hidden functions. Ad- and spyware as well as browser hijacker often use BHOs to display ads or follow your moves across the internet, because a BHO has access to each URL you visit and can redirect you or display other pages than you requested (ads, for example).
BHOs often use ActiveX installation programs.


Browser hijacker

A browser hijacker is a small program or registry setting that is responsible for changed IE start and search pages. If your browser starts with a different start page (one you haven't changed yourself), you most probably got hijacked. Intelligent hijackers do not only change these pages, but also add a small file that will restore the hijacked settings upon each system start. Hijackers often use ActiveX installation programs and/or security holes.


Firewall

A firewall is basically some kind of software or hardware that controls data transfers. The typical use of a firewall would be to secure the access a computer or a network of computers to another network (which may even be the internet). A hardware firewall is simply a box that is put between the local and the far network and that allows or denies transfers based on predefined rules; a software firewall is a software installed on a computer and basically does the same. It has the advantage that it can also set rules based on the software that is doing the transfer, but the disadvantage that it depends on how wise the user uses it.


Hosts file

The hosts file could be described as an address book. While the normal user is used to access other computers on the internet using names (for example security.kolla.de), every computer is accessed by a numeric address at a lower level. You may already have seen this numeric addresses; they look like 127.0.0.1 for example.

Every time you try to access another computer by using his name, your computer looks up his address in an address book. First it looks into a local address book (the hosts file), and only if it can't find the address there it looks in a very big address book in the internet.

So if you want to block an internet website, you could simply redirect this sites name to a place where nothing will be delivered from. Such a place would be your computer for example. The address I already mentioned, 127.0.0.1 is an address that will always point to the local - your - computer. By adding an entry to the hosts file (your local address book) that redirects an ad site to your machine, you would trick your internet browser to think that ad site would be on your machine, and as your machine doesn't deliver ads, it wouldn'get the ad and it will not be displayed.

Another way of using the hosts file is if you want to access computers that are not listed in any address book yet. For example if you have a local network, you wouldn't list your local computers in any internet address book, if only because that would be very expensive. So you could just enter them into the local address book (your hosts file).


Keylogger

The name keylogger was defined back in old DOS times, where computers where handled just by using a keyboard. The most basic keyloggers back from that time just log the keys you press. The spy, a person with physical access to your machine, could get that log at a later point and see everything you typed.

Modern keyloggers are much improved. They do not only log the keys you press, but make also screenshots to show the spy what Windows you are working with, the capture information about your internet use, and much more. The spy doesn't even need physical access to your machine because many current keyloggers send their logs by mail.


Passwords

You surely know what a password is. When accessing private data on a protected system, you need a password (sometimes also called passphrase) and most often an username to tell the system your identity.

Most things about passwords have already been said, but some things can't be repeated to often.

1. Do not tell your passwords anyone. If you are asked by anyone to tell them your password, say no. There is simply no reason. If sometime tells you he is an admin and needs to know your password, he lies.

2. When choosing your password, don't choose something that others could simply guess. Don't use the name of your spouse or cat, or the company name printed on your computer or monitor. While the best thing would be a random string of characters and numbers and even special characters, if you really need something that is easy to remember, take parts of words and combine them into something that you can still speak, but that gives no sense. Attach a few numbers to it to be on the saver side.

3. Don't write your password down on a sticky attached to your screen, or anywhere on your workspace. If you need to write it down, put the paper with it into your wallet, but never anywhere the computer.

4. Don't save a file with all your passwords on your computer. If you can't remember them all, write them down. If you really want to save them in a file, encrypt that file.


Trojan horse

Even though a trojan horse is sometimes also called Trojan, it's more a Greek. The Greeks build the so-called 'trojan horse' in the fight about Troja to get into the town, so they are the real snoops ;)

A trojan is a program that has gotten onto your machine without your knowledge and contains malicious code, that would for example allows persons using another computer to connect to yours over a network. Typical trojans are open to anyone trying to connect (any person on your local network or even the internet). Special trojans are designed to make you machine accessible just to the person who infected your computer with the trojan.

The access an outsider can gain using a trojan on your machine can be nearly anything. From watching all your behaviour (like a keylogger) to manipulating your computer to basically doing anything you can also do using your keyboard and mouse.

Your computer can get infected with a trojan by multiple ways. A person with physical access to your machine can place it there, but you can also accidently install it yourself by opening an unknown email attachment that by chance contains a trojan.

According to some definitions, trojans are also programs that sneak into other programs, for example to gain access. As these programs are used consiously by the other, they are no trojans, but instead backdoors.