Welcome to Spybot - Search & Destroy

SpyBot - Search & Destroy
Freeware, ©'2000-2003 Patrick Michael Kolla

Spybot - Search & Destroy can detect and remove spyware of different kinds from your computer. Spyware is a relatively new kind of threat that common anti-virus applications do not yet cover. If you see new toolbars in your Internet Explorer that you didn't intentionally install, if your browser crashes, or if you browser start page has changed without your knowing, you most probably have spyware. But even if you don't see anything, you may be infected, because more and more spyware is emerging that is silently tracking your surfing behaviour to create a marketing profile of you that will be sold to advertisement companies. Spybot-S&D is free, so there's no harm in trying to see if something snooped into your computer, too :)

Spybot-S&D can also clean usage tracks, an interesting function if you share your computer with other users and don't want them to see what you worked on. And for professional users, it allows to fix some registry inconsistencies and extended reports.

License

Spybot-S&D comes under the Dedication Public License.

Requirements

  • Microsoft Windows 95, 98, ME, NT, 2000 or XP
  • Minimum of 5 MB free hard disk space, more recommended for updates and backups

Usage

We recommend that you continue reading about tutorial next.


License

Dedication Public License License

I. Freeware
First of all, the reasons why Spybot-S&D is free:

I.a. Dedication
Spybot-S&D is dedicated to the most wonderful girl on earth :)

I.b. Binary
What do you get if you buy software? Lots of ones and zeros, nothing more. If they were distributed as art, I could understand paying it. But if the main goal of their order is to earn money - by fees or ads - I don't like it!

I.c. Conclusion
This means that I grant you the license to use Spybot-S&D as much as you like. But if you like it, I ask two things of you: say a prayer for me (and the most wonderful girl while you're at it ;) ) to your god - or whatever you believe - and wish us some luck.

II. Limitations

II.a. Reverse Engineering
Reverse Engineering is not allowed as with nearly any software. If anyone has doubts in the honesty of the code, I will give insight to a trusted organization like a university under certain limitations (for example only one copy, for a limited time, and that has to be removed after the evaluation time has ended).

II.b. Warranty
I tried my very best to make the code of Spybot-S&D as stable as possible, and I give you the warranty that I placed no code to cause intentional harm to your system.
However, removing the threats targeted by Spybot-S&D sometimes involves cutting deep into the system sometimes, and I cannot guarantee that your system will be running the same as before. For example, spyware hosts may stop working. I can also give you no warranty that Spybot-S&D will remove every spy on your system, or that it will give you no false positives. For your own verification the location of the problem is shown with every entry, and if you have any questions remaining you can visit the support forum for more information.

II.c. Liability
Under no circumstances can you make me liable for any damages you might do to your system using Spybot-S&D.

II.d. Use of application in whole
Free use is limited to the application in whole. Usage of parts only, for example the database or the plug-ins, is not permitted.

III. Distribution
Here are some basic rules about distributing Spybot-S&D.

III.a. Private distribution
You may give away single copies of the software as long as you don't modify this license or other files of the archive.

III.b. Mirroring
If you want to mirror Spybot-S&D, feel free to do so as long as you don't modify the original archive. If you want to be kept up to date about major updates, you can subscribe to the mailing list.
Official mirrors need to fulfill the Mirror Policy I created (link will be inserted here).

III.c. Publishing
You may publish Spybot-S&D in a book or magazine (or other media) by simply sending a written request for permission, including a description of your specific needs. I request a copy of the media in which SpyBot-S&D is published as compensation.

IV. Privacy

IV.a. Application offline privacy
Even though Spybot-S&D scans your system, it will not search specifically for any personally identifiable information. Everything that is not detected as a possible threat will be ignored. Possible threats will be shown and, if log options are switched on, written to a local log file.

IV.b. Application online privacy
Spybot-S&D has online functionality in 5 cases:
1. Update: The Update function uses only HTTP requests (like your web browser does) to download an info file containing update descriptions (this is called called spybotsd.ini, and it won't be deleted, so you can look at it) and to download the update files you select. No information other than those your browser would also show will be transmitted.
2. News: The News function opens an IE window integrated into Spybot-S&D. This is the same as if you would load the News page on my main homepage in Internet Explorer.
3. Bug Report: The bug report function sends the problem description you enter and an automatically created report to our support staff. You can modify the extent of the report on the settings page, and you can preview this sole contents while you are writing the bug report.
Files listed in the attach box will be sent as attachments. The header will contain the information (sender name & address) you've entered in settings.
4. Product info & opt-out links: those may often link to dubious pages. You may open them on your own risk, but you should take care to meet some security measures (like firewall, latest IE updates, updated antivirus software) first.
5. Other links: Due to the nature of the Internet I cannot give you any guarantee regarding other links found on my web pages (neither my own, the support forum, or the donation site). But I have put my trust into them and do not believe any harm can come from them.


Tutorial

First run Tutorial
The first time you start Spybot-S&D, it will display a Wizard, a small window helping you through the first steps. It gives you the possibility to add or remove the icons you have or haven't created during install, for example. Lets just say you want them and procede to the next page.

If you are using a proxy in Internet Explorer, Spybot-S&D will show you this proxy and a button will give you the opportunity to use it for Spybot-S&D, too. If the text field is blank, you don't need to do it, but in most cases this will show an internet address, and you should import this proxy setting.

The next page deals with updates. It is very important to keep up-to-date. Using the two buttons this page offers will do the updates for you, if you want to do it at a later point, use the Online/Update section.

The last page of the wizard will ask you to read the help file. It looks like you are already doing this :)

Doing a scan Tutorial
After the tutorial has finished, you may find yourself on the Settings or Update page. As the default settings are ok right now, and you've already updated, lets ignore them for now and do the first scan.

The left side of the program has a navigation bar that can lead you to all functions of the program. The first section there (the top-most button) is labeled Spybot-S&D and leads you to the main page. Right now, you will see only an empty list and a toolbar at the bottom. The first button in this toolbar is named Check for problems - that is the button you've got to press to start the scanning. Lean back and watch the scan progress.

Interpreting the results Tutorial
At this point, you could just jump to the last point, and remove the results. Instead we recommend that you first have a look at what all the stuff is that Spybot-S&D detected. The first thing you should know is to distinguish between the red entries, which represent spyware and similar threats, and the green entries, which are usage tracks.

For the usage tracks (I hope you have followed that link to read what they are), removal is non-critical, but depends on your personal preferences.

Ignoring the usage tracks for now, you should have a look at the red entries which represent the real threats. While you of course can trust us that we have chosen the targets using strict criteria, you can check for yourself if you click on each product and read the product information that will be shown in a pop-up window.

Decision on exceptions Tutorial
All problems displayed in red are regarded as real threats and should be dealt with. But while you read the product description, you may still decide to keep a threat, or just a usage track. Maybe you don't want your list of most recently used Word documents removed? At this point you have three options.

  • You could decide on ignoring all usage tracks. In that case you could open the File sets page on the Settings section of the program, and disable the Usage tracks entries.
  • Or if you want to just keep all tracks from a specific product, just right-click a product in the results list.
  • Finally, if you want to keep just one file, that is possible the same way.

Removing the threats found Tutorial
So now you should know about everything you've found. It's time to use the Fix selected problems button.

Once you start thinking about removing the usage tracks, too, you may think that ticking all the green entries is hard work. This is for a simple reason - to force you, the newbie - to look at the results. Once you know what you are dealing with, there is a hidden Select all button available for you on the settings page (only when started in advanced mode).


Product information

Product information Info & License

In this section you can find more information about the problems Spybot-S&D is targeting. If you came from the results list, the problem you want may already be selected, otherwise you can use the pulldown list the select one.

The information shown contains only URLs, but as some of these URLs may directly start an (ActiveX) download, you can't open them by using the standard double-click. Instead, right-click somewhere in the info field and select the URL you want to visit if you are sure your browser is set to safe settings.

You can also select the exclude a product from further searches using the checkbox at the top (this does the same as checking a product in the Excludes section).

You can find the Product (Bot) information by choosing Product info from the Info & License section in the toolbar to the left.


About spyware

Spyware Dictionary

What is spyware? In easy terms, spyware is software that transmits personally identifiable information from your computer to some place in the internet without your special knowledge.

Spyware is typically not the product you install itself, but small add-ons, that you may or may not disable during install. In most cases, the EULA somewhere has a few lines telling you about privacy matters, but typically most users don‚t read the complete EULA and never know they got spyware on their system.

A less threatening sort is adware. Adware is similar to spyware, but does not transmit personally identifiable information, or at least the collector promises not to sell it. Instead, aggregated usage information is collected.

Adware is also often a side-effect of spyware, as both monitor you for a sole purpose – delivering you advertisement that is especially tailored to your habits.

Another kind that is detected under the spyware category are tracking cookies. Cookies are used all over the internet in useful and less useful places. Advertisement companies often set cookies whenever your browser loads a banner from them. In that case and if that cookie contains a GUID, the company gets notice about every site you visit that contains their ads.


About system internals

System internals Dictionary

The windows registry contains lots of information. It‚s consistency can be checked with good commercial programs like Symantec™ System Works. But there are some small things I miss with those programs. Here's what SpyBot-S&D searches for:

  • Missing help files – the registry contains information about the location of some help files. If those information points to incorrect directories, SpyBot-S&D will tell and allow to fix.

  • Missing shared DLLs – the registry contains a list of dynamic link libraries, where they are located and how many programs use them. SpyBot-S&D checks if all locations are correct and allows to change them if not.

  • Application paths – some applications (mostly those registered to a file extension) are registered in the registry. If they are pointing to a no longer existent program file, SpyBot-S&D can change their path or delete their entry.

  • Wrong Uninstall information – every program that has it's own uninstall routine stores some information about it in the registry. If those information is incorrect, e.g. because the uninstall program was located inside a temp directory (there are lots of programs that stupid!), SpyBot-S&D will tell (and allow a change in future versions).

  • Broken Desktop Links – if one of the links on your desktop links to a file that is no longer existent, Spybot-S&D will tell you and allow you to either point the link to another file or delete it.

Warning: Please be aware that changes to this items can corrupt your system! If you are not sure whether a setting is really a problem, better leave it alone!
Especially Microsoft Office™ has some registry entries pointing the wrong directories and some even pointing to non-existent help files. I've changed the first, but I wouldn't delete the second kind of, because they may well point to files that will be installed on that "Install on first use" base.


About usage tracks

Usage tracks Dictionary

Usage tracks are your fingerprints in your system. Whenever you visit a page with your browser, or just open any file, that information is stored deep inside Windows. In most cases that is very useful – if you want to open that file again, you can select it from a list instead of typing the whole filename or browsing the whole directory structure again.

But in some cases you may want to hide your activity, because spyware and internet attackers may use that information. Spybot-Search&Destroy can remove some of the most important and common tracks on your system.


Setting the basic options

Setting the basic options Settings

All important settings are listed in a tree in this section. Please note that these settings are only visible if you start Spybot-S&D in advanced mode - the easy mode will not show them.
The description that follows is sorted by the trees main categories.

Installation

This section lets you change the desktop icon as well as the start menu and quicklaunch item.

Main settings

These are some miscellaneous settings about essential warning and confirmation dialogs the program will show as for changing your backup preferences

Automation

Spybot-S&D has two kind of automation settings – on system start and on program start. Here you can set whether to start the program when you start up your Windows, or to check for updates automatically, or to delay the scan on system start for a specified delay or until other programs (scanners) have terminated.

Log file settings

Spybot-S&D can write details about each scan into text files. Here you can select whether to do this, whether the date and time should be included in the filename, and whether to append or to overwrite the log file.

Look & Feel

You can switch a few details about the look of Spybot-S&D. Just try the options and see what look you like most. After a while, you may want to disable the introducing information panels, for example.

Bug Report

If you are unsure about problems, you may send a bug report to PepiMK Software. This section is about how the mailing should be handled. You should at least select to include system information and scan results in the bug report (you can preview it before sending). Also, if you want to receive the same mail as PepiMK Software, you may select to send a copy to yourself (you need to change SMTP settings to do this – see the Bug Report help).

Expert settings

These are some settings the normal user may not need, but that could be useful to the power user. For example, you can set up external applications to view result data here.

You can find the main settings by choosing Settings from the Settings section in the toolbar to the left.


Choosing the interface language

Choosing the interface language Settings

If you have downloaded Spybot-S&D from the Internet, it will come with a lot of languages already included, but not the help files (to reduce the download size). You should use the update function to download additional files for your language after you have selected it.

If your language isn't yet shown, can can go to the Settings page and enable the option to download foreign language updates. In that case, your next update will show you the updates for all available languages, even those not yet installed on your machine.

You can find the language settings by choosing Languages from the Settings section in the toolbar to the left.


Choosing what to scan (file sets)

Choosing what to scan (file sets) Settings

Spybot-S&D uses the concept of include files to make it more flexible. Each include file is a file containing the description of some problems that Spybot-S&D can detect and fix.

This files are divided into categories, so you can select what you want to target during your scan.

The basic categories are spy- and adware, system problems and usage tracks. For each category you may see include files with a short description on what they do, and the number of files, registry entries and directories that will be checked.

You can select which include files to use for your next scan by toggling the checkbox next to them.

If you see a include file in italic letters, then it is one not originating from PepiMK Software. As the include file format is public, anyone may write include files. But include files can do a lot of harm to your system, and PepiMK Software can‚t guarantee for a foreign include file, so you will be asked whether you are really sure to use the file if it is not from PepiMK Software.

You can find the file sets settings by choosing File sets from the Settings section in the toolbar to the left.


Choosing what not to scan (excludes)

There are four different exclude sections at the moment:

Product excludes

This section lists all products defined internally and in the external include files. If you want to exclude a complete product, or include it again, select the file from this section and toggle the checkbox before the product.

Cookie excludes

Cookies are usage tracks, but you may want to keep some useful cookies. This section lists all cookies currently on your system, allowing you to exclude them from further searches.
(At the moment, only Internet Explorer and Netscape Navigator and Mozilla cookies are supported – Opera cookies can only be deleted completely)

Extension excludes

This is about the common Windows file open dialog. It saves lists of opened (and saved) files divided into extensions. If you don‚t want to remove the WinWord files, for example, you could select .doc to be excluded in this section.

Single excludes

If you do not want to exclude a complete product, but only a single file or registry setting of it, you can select that one from the results list. These are listed here, where you may remove them from the exclude list again.

All the lists in these sections have a context menu with extended selection options.

You can find the exclude settings by choosing a category from the Excludes section in the toolbar to the left.


Setting the download directories

Setting the download directories Settings

Some scans target also the installer files of problems detected by Spybot-S&D. Installers that the user must explicitly start downloading will only be scanned for in the directories entered into this list.

You can either use Drag'n'Drop to drop some directories from an Explorer window, or use the context menu to add or remove directories to or from the list.

You can find the download directories settings by choosing Directories from the Settings section in the toolbar to the left.


Choosing a skin

Choosing a skin Settings

Spybot-Search&Destroy supports the concept of basic skins, to adjust program colors to personal needs.

The Skin section will show you a list of available skins. Select one to preview it. The (very simple) preview will be displayed in the left part of the window, with some information below the list and the skin logo at the bottom of the page.

If you like the skin, press the Apply button.

You can find the skin settings by choosing Skins from the Settings section in the toolbar to the left.


Scanning your system

Scanning your system Spybot-S&D

Once you have started Spybot-Search&Destroy, you can immediately start scanning.

After you have started the program, you will already see the scan screen. If not, please select Search & Destroy in the Spybot-S&D section in the toolbar to the left.

The search screen contains a toolbar with the most important options (you can move this toolbar between the top and bottom position if you want). Let's start a scan: please press the Check all button.

You will see the scan progress in the status bar at the bottom of the window (the right-most section displayed the estimated time left), and can stop the progress at any point by pressing the Stop check button that has just appeared (it will vanish again once the check has finished).

If the scan has found something, the list will show it. There are three basic kinds of results:

  • Red entries indicate spyware problems that should be fixed to avoid security and/or privacy problems. This is the only kind of problem that is preselected to be fixed.

  • Black entries are system internals. If you do not know what they mean, I would suggest to either keep your fingers from it or visit the support forum.

  • Green entries indicate usage tracks. It can do no harm to remove these.

For most problems more information is available. If you select a problem in the list, the button Description of this product should be available in most cases. Press it to read about what kind of threat you have found.

You can now select the problems you want to fix, by clicking the checkbox before it, or by selecting all using the button Select all problems (this button will only be able in advanced mode by enabling the expert button setting). More selection options are available if you look into the context menu (by right-clicking a problem). The context menu will also allow you to exclude single problems or whole products from further scans (you may later change the exclude settings from the Excludes section).

Once you are sure you have selected what you want to be removed from your computer, press the Fix selected problems button. You will see the fixing progress at the bottom status bar.

If problems can not be fixed now (because they are still loaded and can't be terminated, for example), Spybot-S&D offers to run on next system start, so you can check and fix again.

Should you notice at any later point that you have removed more spyware than you wanted, you can always restore it from the Recovery section.

You can also fine-tune your scan options by selecting special filesets and changing some settings.


Recovery

Recovery Spybot-S&D

The recovery section is available by selecting Recovery from the Spybot-S&D section in the toolbar to the left.

This section also has a movable toolbar similar to the one in the Search & Destroy section.

If you have fixed some spyware problems in the past, this list will show it. Here you can select one or more problems (see also the context menu for extended selection options) and either recover them, or purge them permanently from your system.


Immunize

Immunize Search & Destroy

Beginning from version 1.2, Spybot-S&D allows you to immunize your computer against some spyware. It currently offers three different immunities:

Permanent Internet Explorer immunity

Similar to JavaCools SpywareBlaster, this allows you to tweak some internal Internet Explorer settings to block the installation of known spyware (and similar threats) installers. Spybot-S&D is able to set all entries for those that are in its database to be blocked. If you want to distinguish, you should install SpywareBlaster.

Permanently running bad download blocker for Internet Explorer

This is a second layer of protection for IE. While the Permanent Immunity blocks installers by their ActiveX ID, this one blocks anything that should come through by different aspects.
You can view a log of blocked installers in the Tools / Resident section.

Recommended miscellaneous protections

These are very small changes recommended to make your system a bit safer and more secure. Locking the hosts file will prevent most hosts hijackers (even unknown) from doing harm; locking the IE settings will prevent other users of your computer to change your preferences.


Updating

Updating Online

To avoid large downloads and for more flexibility, most scan information is inside the include files.

Include files, but also newer help files, new languages, updated descriptions etc. can be downloaded using the integrated update function.

Of course to update the program, you need an open internet connection.

After that, you can click the Search for updates button. That will download a list of available updates from a PepiMK Software server and compare them to the files already installed on your system.
New files will be shown in the list, where you can select them and press the Download updates button afterwards. During download, every finished file will get a green check mark.

If you want to read about updates first, press the Read news online button or visit the support forum.

You can find the update function by choosing Update from the Online section in the toolbar to the left.


Reporting a bug

Reporting a bug Online

You should use the bug report only as a last resort. First, please check for newer versions, read the FAQ and visit the support forum.

If all that hasn‚t helped solve your problems, you may write a bug report. If you write a bug report the first time, you may need to set your mail settings. Select the button Mail settings, and change them to yours. The dialog poping up will allow you to set all necessary data. If you use Outlook or Outlook Express, you may even import your settings, and will only have to enter your password.

Once the mail settings are correct, press Next button. A new section will pop up, allowing you to write your bug description, preview the automatically created report, and add files to be appended to the mail. Once you have done that and verified everything is correct, you can press the Send button to send the mail.

You can find more bug report options in the main settings.

You can find the bug report function by choosing Bug Report from the Online section in the toolbar to the left.


Opting out

Opting out Online

If you have subscribed to some advertisers service by accident in the past, and don't know where to opt out again, you may have luck and the advertiser is listed in here. Double-click the address to either visit the website or send an opt out mail (you can distinguish between the two by the icon in front).

Please do not use this function as a preventive measure, because that would give you no advantages, but the advertiser your address.

You can find the Opt Out list by choosing Opt Out from the Online section in the toolbar to the left.


Secure shredder tool

Secure shredder tool Dictionary

The secure shredder is a tool to get finally rid of files, without any further possibilities of recovery.

Shredding is simple – drop some files from the explorer into the list (or add some using the context menu of the list), select the number of shreds, and click Chop it away.

Usage tracks that are in files will be shredded using this tool, too, using 5 passes.

The first 5 shreds are using pre-defined bit pattern that should make even hardware recovery impossible. Any further pass will use a random bit pattern that is changing every few Bytes.
Please notice: one pass is not enough to shred a file, as the heads of your hard disk won't hit the same track 100,00% of the time. There are small differences of a few µm that will allow pros to reconstruct even overwritten data. That is why multiple shreds are necessary, and why different patterns should be used.

Warning: This tool is designed to remove files so they can not be recovered again! If you use it, be aware of that!
You do not need to use this tool to remove spyware or usage tracks. Spybot-S&D will take care of shredding them on its own.

Disclaimer: I tried my best to finally shred every given to this tool. But I can't guarantee that files will be unrecoverably extinguished.

You can find the secure shredder tool by choosing Secure Shredder from the Tools section in the toolbar to the left.


Resident

Resident Tools

Resident is a permanently running application to protect your system. Currently, it consists of a browser helper for Internet Explorer that will block download of files known as malicious (spyware installers for example).
This page inside Spybot-S&D allows you to install/uninstall this helper as well as few the report which pages it has blocked (that should only appear if the first layer of protection, the main IE immunity, didn't stop the culprit).


ActiveX

ActiveX Dictionary

ActiveX is a Microsoft technology that allows Internet applications that are more powerful than simple scripts. ActiveX applications do work only in Internet Explorer, so the use of ActiveX on websites is not recommended. Due to the huge amount of influence ActiveX apps can have on the system (ActiveX apps have access to the same files you have access to, meaning all files in the case of most private computers), it is recommended to be very careful if dealing with ActiveX.

There are two types of ActiveX apps - signed and unsigned. The code of unsigned ActiveX apps hasn't been certified and should never be trusted. Signed ActiveX apps are certified, but can still contain malicious code! Signed ActiveX apps should be trusted only if coming from trusted websites and only on a prompt base (meaning that IE settings will ask every time a website wants to load an ActiveX app).

Many dialers and hijackers install themselves using ActiveX applications.

ActiveX Tools

Spybot-S&D is able to display a list of installed ActiveX applications. It also has a small database integrated that will display a green checkmark in front of ActiveX applications known as legit, and a red sign in front if applications known as illegit.

This list can be exported into a text file as a reference and for further analysis.


Browser Helper Object

BHO, Browser Helper Object Dictionary

Also called BHO. A BHO is a small program that extends Microsoft's Internet Explorer. Examples of BHO usage include visible add-on toolbars in IE, but can also be hidden functions. Ad- and spyware as well as browser hijackers often use BHOs to display ads or follow your moves across the internet, because a BHO has access to each URL you visit and can redirect you or display other pages than you requested (ads, for example).
BHOs often use ActiveX installation programs.

BHO Tools

Spybot-S&D is able to display a list of installed browser helper applications. It also has a small database integrated that will display a green checkmark in front of browser helpers known as legit, and a red sign in front if applications known as illegit. It also allows the user to enable or disable single BHOs.

This list can be exported into a text file as a reference and for further analysis.


Browser pages

Browser pages Tools

Spybot-S&D is able to list all known locations where Internet Explorer start and search pages are anchored. If your browser got hijacked and you can't use the normal IE control panel to reset your start or search page, you can use this Spybot-S&D tool to locate the URL (please send it to detections@spybot.info so that it can be added to the next update), and change it.


Hosts file

Hosts file Dictionary

The hosts file could be described as an address book. While the normal user is used to access other computers on the internet using names (for example security.kolla.de), every computer is accessed by a numeric address at a lower level. You may already have seen this numeric addresses; they look like 127.0.0.1 for example.

Every time you try to access another computer by using his name, your computer looks up his address in an address book. First it looks into a local address book (the hosts file), and only if it can't find the address there it looks in a very big address book in the internet.

So if you want to block an internet website, you could simply redirect this sites name to a place where nothing will be delivered from. Such a place would be your computer for example. The address I already mentioned, 127.0.0.1 is an address that will always point to the local - your - computer. By adding an entry to the hosts file (your local address book) that redirects an ad site to your machine, you would trick your internet browser to think that ad site would be on your machine, and as your machine doesn't deliver ads, it wouldn'get the ad and it will not be displayed.

Another way of using the hosts file is if you want to access computers that are not listed in any address book yet. For example if you have a local network, you wouldn't list your local computers in any internet address book, if only because that would be very expensive. So you could just enter them into the local address book (your hosts file).

Spybot-S&D using the hosts file Tools

Spybot-S& can add a prepared list of websites known for bad behaviour (installing spyware or tracking users, for example) to your hosts file. If you want to do this, we recommend you also read the FAQ about cures for possible slow-downs on Windows NT based systems (Windows NT, 2000 and XP). And if you should notice you cannot visit a site that worked before, you should check the Hosts file section to see if that site is on the block list.


Process list

Process list Tools

This tool displays a list of all currently running processes, including some information about them. It also allows you to kill some processes, but please do not use this function until you know what you are doing!


System startup

System startup Tools

This tool lists all programs that are started at Windows startup. If those items are in the database coming with Spybot-S&D, it will display some more information about them. It also allows you to disable (and enable) items, as well as delete them, change them or new items.

On Windows 9x and ME, the user has full access to this list. On Windows NT/2000/XP, the list will display the global and the current user entries. For some functions like seeing all entries or even changing some, the user may need admin or power user rights.


LSP

LSP, Layered Service Provider Dictionary

A Layered Service Provider is a system driver linked deep into the networking services of Windows. It has access to every data entering and leaving the computer, as was as the ability to modify this data. A few such LSPs are necessary to allow Windows to connect you to other computers, including the Internet. But Spyware may also install itself as an LSP, thus having access to all the data you transmit. LSP are currently used by CommonName, New.Net, NewtonKnows and webHancer.

Winsock LSPs Tools

Spybot-S&D is able to display a list of installed network drivers as a reference for professionals, and allows this list to be exported for future reference.


View report

View report Tools

This tool allows you to create a new report including all or just a selection of the reports that Spybot-S&D can create. You can then save the report to a file for future reference.
The tool also allows you to view old reports again.


Browser hijacker

Browser hijacker Dictionary

A browser hijacker is a small program or registry setting that is responsible for changed IE start and search pages. If your browser starts with a different start page (one you haven't changed yourself), you most probably got hijacked. Intelligent hijackers do not only change these pages, but also add a small file that will restore the hijacked settings upon each system start. Hijackers often use ActiveX installation programs and/or security holes.


Dialer

Dialer Dictionary

A dialer is a very small program, often installed using the ActiveX technology. Dialers often promise access to free porn, free games or free cracks for commercial software. Once installed, a dialer offers to use your dial-up device to call in to the service, usually calling a quite expensive toll number. Some dialers explain the costs of the connection they will be making, like it is required by local law in some countries, but many dialers just display a button offering to connect, without informing the user of what is happening behind it. In the worst case, the dialer sets up the expensive number as the default Internet connection, meaning the user will have to pay high rates for being online, without even knowing it until receiving the next bill.


Firewall

Firewall Dictionary

A firewall is basically some kind of software or hardware that controls data transfers. The typical use of a firewall would be to secure the access a computer or a network of computers to another network (which may even be the internet). A hardware firewall is simply a box that is put between the local and the far network and that allows or denies transfers based on predefined rules; a software firewall is a software installed on a computer and basically does the same. It has the advantage that it can also set rules based on the software that is doing the transfer, but the disadvantage that it depends on how wise the user uses it.


Java applet

Java applet Dictionary

A Java applet is capable of doing more than just a JavaScript, but hasn't got the full access to your machine like a full Java application. An applet still needs the browser to be run in, while a full Java application could run stand-alone (using just the runtime engine).


Java Script

Java Script Dictionary

A Java script is a very small program that is running on your computer when visiting websites that have defined such a script. Java scripts have little access to your computer, but can modify your browser.


Keylogger

Keylogger Dictionary

The name keylogger was defined back in old DOS times, where computers where handled just by using a keyboard. The most basic keyloggers back from that time just log the keys you press. The spy, a person with physical access to your machine, could get that log at a later point and see everything you typed.

Modern keyloggers are much improved. They do not only log the keys you press, but make also screenshots to show the spy what Windows you are working with, the capture information about your internet use, and much more. The spy doesn't even need physical access to your machine because many current keyloggers send their logs by mail.


Passwords

Passwords Dictionary

You surely know what a password is. When accessing private data on a protected system, you need a password (sometimes also called passphrase) and most often an username to tell the system your identity.

Most things about passwords have already been said, but some things can't be repeated to often.

1. Do not tell your passwords anyone. If you are asked by anyone to tell them your password, say no. There is simply no reason. If sometime tells you he is an admin and needs to know your password, he lies.

2. When choosing your password, don't choose something that others could simply guess. Don't use the name of your spouse or cat, or the company name printed on your computer or monitor. While the best thing would be a random string of characters and numbers and even special characters, if you really need something that is easy to remember, take parts of words and combine them into something that you can still speak, but that gives no sense. Attach a few numbers to it to be on the saver side.

3. Don't write your password down on a sticky attached to your screen, or anywhere on your workspace. If you need to write it down, put the paper with it into your wallet, but never anywhere the computer.

4. Don't save a file with all your passwords on your computer. If you can't remember them all, write them down. If you really want to save them in a file, encrypt that file.


Trojan horse

Trojan horses Dictionary

Even though a trojan horse is sometimes also called Trojan, it's more a Greek. The Greeks build the so-called 'trojan horse' in the fight about Troja to get into the town, so they are the real snoops ;)

A trojan is a program that has gotten onto your machine without your knowledge and contains malicious code, that would for example allows persons using another computer to connect to yours over a network. Typical trojans are open to anyone trying to connect (any person on your local network or even the internet). Special trojans are designed to make you machine accessible just to the person who infected your computer with the trojan.

The access an outsider can gain using a trojan on your machine can be nearly anything. From watching all your behaviour (like a keylogger) to manipulating your computer to basically doing anything you can also do using your keyboard and mouse.

Your computer can get infected with a trojan by multiple ways. A person with physical access to your machine can place it there, but you can also accidently install it yourself by opening an unknown email attachment that by chance contains a trojan.

According to some definitions, trojans are also programs that sneak into other programs, for example to gain access. As these programs are used consiously by the other, they are no trojans, but instead backdoors.


Frequently asked questions

Frequently asked questions Dictionary
  • What can I do if Spybot-S&D is running forever, never stopping the scan?
  • I downloaded the skins, but they are not showing!
  • Why does Spybot-S&D find so many Spyware installers / how is that Download directories setting used?
  • Spybot-S&D finds Prolivation after each scan!
  • I receive ads titled 'Messenger Service', but Spybot-S&D can't find anything!
  • After inserting the hosts my network rects very slowly!
  • Are there any problems using Spybot-S&D 1.1 under Windows 95?
  • The integrated update is not working. Are there any solutions for this?
  • What files do I need to update?
  • Why does Spybot-S&D not detect and remove the Alexa key for the What's related function of IE like other anti spyware utilities?
  • During each scan I get the error message that there is a problem in Malware.sbi and I should look into the Include errors.log file.
  • I can't remove the Sti_Trace.log (or SchedLgU.txt) file; I always get an I/O Error 32 (Version 0.93) or the error sign before the list item.
  • InCtrl5 (or another monitoring utility) shows me that very many registry keys are created. Can you explain this?
  • Other spyware programs find spies in Sypbot-S&D's directory!
  • Some of my internet programs stopped to work. What should I do?
  • Why does Spybot-S&D also removes IE toolbars that look useful to me?
  • Why is Spybot-S&D that fast?


Why is Spybot-S&D that fast?

Why is Spybot-S&D that fast? FAQ #001
There are different ways to search for spies. One would be to search the complete registry and harddisk for suspicious entries and files. That can take a lot of time.

Spybot-S&D takes advantage of the fact that all spies have to anchor themselves at a few places over the system to get active. It starts to search at this places, following the information gathered there to catch the whole spy.


Why does Spybot-S&D also removes IE toolbars that look useful to me?

Why does Spybot-S&D also removes IE toolbars that look useful to me? FAQ #002
Nearly all IE toolbars have something in common: they want to make the web easier for you. Sadly, to tailor their information to your needs, they need to collect data about you; and most privacy statements are unclear about how they do use this data beside sending you what they think is what you want.


Some of my internet programs stopped to work. What should I do?

Some of my internet programs stopped to work. What should I do? FAQ #003
If you remove a spy, the application that has installed it may notice this and refuse to work any longer. Spybot-S&D is able to replace a few spies with harmless dummies; but where that is not possible, I recommend to either search for a good alternative that comes without spy- or adware, or using the recovery option in Spybot-S&D to restore the spy. In the later case, you can do it step by step, until you found the files that are absolutely necessary for the spy, and at least keep some files from your system, like the data saved about you.


Other spyware programs find spies in Sypbot-S&D's directory!

Other spyware programs find spies in Sypbot-S&D's directory! FAQ #004
Please look at the path where such a program found the spyware. As Spybot-S&D has no spyware integrated, this must be a false alarm.

The reason for such a false alarm is simple: Spybot-S&D saves backups of the problems you have fixed; to make it possible to recover them in case something stops working after the fix.

If the file found is in the Recovery directory inside the Spybot-S&D directory, it is such a backup. It is no longer of any harm there, as the file won't be found and loaded from there. But once you are sure you don't need the backup, go to the Recovery section inside Spybot-S&D and purge that files.

You may also upgrade to Spybot-S&D version 0.95 or newer; these versions compress the recovery files into zip archives, thus avoiding other spyware applications will give false alarms.


InCtrl5 (or another monitoring utility) shows me that very many registry keys are created. Can you explain this?

InCtrl5 (or another monitoring utility) shows me that very many registry keys are created. Can you explain this? FAQ #005

There is a bug somewhere from version 0.7x up to 0.95ß3, which should be fixed in 0.95ß5 (see the forum for this). The creation of many keys was a simple 'accident', created by an internal undocumented change in a component I was using. Here's a short explanation for all who want to know more:

The problem is the windows function to open a registry key. For this a flag is to be set or unset. If this flag is set, the registry key will get created; if not the open procedure returns that the key does not exist. In previous versions of the component, the flag was unset by default, and I used the open procedure to check wether the key existed or not (giving me some speed improvement over checking for its existance first). Now that the component has changed (the flag set instead of unset by default), most of those keys I just checked were created.

This bug should be fixed if you are using 0.95ß5 or later.

There are also a lot of registry keys created for the language modules, about 250 values per language. This is intended, but I do plan for future versions to load the languages directly from their files (implemented since 1.x).


I can't remove the Sti_Trace.log (or SchedLgU.txt) file

I can't remove the Sti_Trace.log (or SchedLgU.txt) file; I always get an I/O Error 32 (Version 0.93) or the error sign before the list item. FAQ #006

The Sti_Trace.log file is opened on many machines; most often on Windows 2k/XP/ME. The reason is that the Still Image Monitor runs all the time, using this file. You can use msconfig to disable the Still Image Monitor, but as it is of no harm I would suggest to add this log file to the single ignore list.

The same is valid for the SchedLgU.txt; it is the log file of the scheduler. If the scheduler is running, this file is kept open. If you are not using the scheduler, I suggest disabling it, this will not only allow you to back up this file, but also save some RAM.

(To add a problem to the single ingore list, simply right-click on it in the results list, and choose the appropriate menu item.)


During each scan I get the error message that there is a problem in Malware.sbi

During each scan I get the error message that there is a problem in Malware.sbi and I should look into the Include errors.log file. FAQ #007
This error should not longer occur with Spybot-S&D 1.1!

The problem is that the TempFile plugin didn't install correctly. Please locate a zip file called plugin-tempfile.zip inside your Spybot-S&D directory. It contains a file TempFile.dll that needs to be put inside a subdirectory called Plugins (you may need to create the subdirectory first).

Just unzipping the file into the same directory as it is and calling update.bat should also do the work (this should work automatically, but obviously it didn't).


Why does Spybot-S&D not detect and remove the Alexa key for the What's related function of IE?

Why does Spybot-S&D not detect and remove the Alexa key for the What's related function of IE like other anti spyware utilities? FAQ #008
This key is often simply called Alexa, but that is wrong for two reasons:
1. simply calling it Alexa would mix it up with the Alexa Toolbar, and
2. it is not a key created by Alexa. It is a Microsoft Internet Explorer key that points to a Microsoft DLL and a local Microsoft HTML file. The later redirects to a online MS page, and only that page redirects to the Alexa search engine.

In my opinion a better way than to delete the key would be to make another or even multiple search engines available. You can read about the basics for that in this discussion (online link) at the support forum.


What files do I need to update?

What files do I need to update? FAQ #009
Basically there are three kinds of updates. I will start from the back:

  • 1. the PGP signatures. If you don't have PGP installed, you don't need these files, as there are only an optional feature for PGP users.
  • 2. the localized updates: language files and localized product information. These files are also not necessary if you use the english language, and if you use any other language, you only need your local ones.
  • 3. all other files are either plugin updates (like the tempfile plugin) or include files. Both kinds are needed.

Regarding updates of kind 1 and 2: the next release of Spybot-S&D will have an option to hide these files by default so you won't be bothered by them any more.

If you don't want them to appear every time now, you can right-click them and add them to the exclude list in the popup menu.


The integrated update is not working. Are there any solutions for this?

The integrated update is not working. Are there any solutions for this? FAQ #010
The main reason for this problem is that you need to use a proxy server to access the internet. In that case, the proxy server is already set up in your browser, where you can look up it's settings and enter them into Spybot-S&D.

In Mozilla, you can find the Proxy settings if you open the Edit menu, choose Settings... at the bottom, and navigate to the section Advanced - Proxies.
In Internet Explorer, see the Menu Extras - Internet options, go to the tab Connections and click the Settings button at the bottom.

Back inside Spybot-S&D you need to go to the settings page, and scroll down to the entry Automation - Web update - Use proxy. Now check the box below it, and a dialog will appear where you can enter your proxy settings.
The format is host:port (the host is the name, the port the number you found in your browser). If you need to access your proxy using a login, you can use the format username:password@host:port.


Are there any problems using Spybot-S&D 1.1 under Windows 95?

Are there any problems using Spybot-S&D 1.1 under Windows 95? FAQ #011
There are two possible reasons why Spybot-S&D 1.1 wouldn't run using Windows 95.

The first possible reason (Error message: HHCTRL.OCX is missing) is that you are using an old version of Internet Explorer, thus the needed HTML help components are not installed. Those are available from Microsoft (online link).

The second reason (Error message: WS2_32.DLL is missing) is that you need the Winsock update for Windows 95. That one is also available from Microsoft (online link).

Win 95 Winsock2 setup (online link)
More information (online link)

Both are updates you should make anyway!


After inserting the hosts my network reacts very slowly!

After inserting the hosts my network reacts very slowly! FAQ #012
Please read this article (online link) and this article (online link).


I receive ads titled 'Messenger Service', but Spybot-S&D can't find anything!

I receive ads titled 'Messenger Service', but Spybot-S&D can't find anything! FAQ #013
These are sent using the Messenger service integrated into Windows 2000 and XP (try the 'net send' command to see for yourself).
To disable the Messenger service, go to Start --> All Programs --> Administrative Tools --> Component Services. In Component Services, click on Services (Local), then on the right side, find Messenger and disable it.
Note: not everyone will have Administrative Tools in the Start menu. You need to make it visible under Taskbar and Start Menu Properties (right-click on taskbar --> Properties). The surest way to get to Component Services is to enter %systemroot%\system32\com\comexp.msc into the command line.


Spybot-S&D finds Prolivation after each scan!

Spybot-S&D finds Prolivation after each scan! FAQ #014
If you experience this problem, you have downloaded only a partial update.
The Prolivation detection came with the usual Includes update, but there are also two other updates Application updater and Main application that are necessary. Please make sure you always download all available updates! As soon as you've downloaded all of them, this will be fixed .


Why does Spybot-S&D find so many Spyware installers?

Why does Spybot-S&D find so many Spyware installers / how is that Download directories setting used? FAQ #015
The Spyware installer detection is the only one that is based only on filenames, without other criteria. The reason for this are two:
1. files not yet installed don't have any registry references to them, and
2. these detection is intended mainly for dialers - files that often differ in contents (different text, different images, different toll numbers) while keeping the same name (within one dialer 'family').

The Download directories setting should be set only to your download folders, where you can easily identify the files you downloaded. Files in other places will be searched for automatically, there is no need to enter them in the setting. In fact, adding your whole harddisk to this setting will most likely result in false positives.
If files like wbemtest.exe in your Windows/System folder are detected as a spyware installer, that is such a false positive.


I downloaded the skins, but they are not showing!

I downloaded the skins, but they are not showing! FAQ #016
If you have downloaded all skin updates, but only one is shown inside the program, you most probably did a small mistake.

When the skins are shown in the update list, there is named named "Skins: 1st needed". In the description you will see that this one should be downloaded before all the other ones, because it prepares the program to accept skins. If you downloaded them all at once, this preparation wouldn't have taken place, and the skins were downloaded, but not installed. Now to install them, you need to do a little bit of manual labour. Open an Explorer window and go to the Spybot-S&D folder (typically in C:\Program files\Spybot - Search & Destroy 1.1). It will have some sub-folders, along them Skins and Updates.
The Updates folder will contain some skins.*.zip files that you should extract into the Skins folder. After that, start Spybot-S&D again and it will show you the skins :)


What can I do if Spybot-S&D is running forever, never stopping the scan?

What can I do if Spybot-S&D is running forever, never stopping the scan? FAQ #017
With the installation of 1.1 rel 4, there was a very small chance that all automation options have been enabled during the installation. This would cause a loop that would restart the scan again and again. If you experience such problems, please switch to the "Settings" page in Spybot-S&D (the page with the treeview), and disable all settings in the category "Automation".