Spybot - Search & Destroy

These instructions have been moved to the ITS Knowledge Base [http://helpdesk.pomona.edu].
You will be redirected in a moment.

What is Spybot - Search & Destroy?

Spybot - Search & Destroy is a free, downloadable tool to remove spyware from your computer. It can scan your computer for spyware that is already there and remove it automatically, it can prevent you from getting new spyware, and has advanced tools for when the scanner isn't enough.

How do I install it?

1. Please visit the Pomona anti-spyware page to download a current version. The latest non-beta version as of this writing is v1.4. You can also visit Spybot's homepage at http://www.safer-networking.org.
2. When you run the installer, you will be asked to select a language for the application to run in. Select a language and click OK. Then click Next to start the installation.
3. Read and click I accept the agreement and click Next to continue.
   
4. Choose a location to install the program to. If you are unsure, the default is ok. Click Next when you have selected a location.
   
5. On the next screen, you can uncheck the boxes if you do not need support for additional languages or changing the way the program looks.
   
6. You can change the location of Spybot in the Start Menu, or just click Next to accept the default.
   
7. These options allow you to place a shortcut to Spybot on your desktop and in the quick launch bar (next to the Start menu). You can also enable or disable program settings. ITS recommends using the Internet Explorer protection feature. TeaTimer is a more advanced method of protection that we recommend only for people who feel they have intermediate to advanced computer skills. Check or uncheck the boxes to add or remove features. The Internet Explorer protection and TeaTimer can be added later if you change your mind.
   
8. You can check over the settings you've selected, and then click Install. On the next screen, make sure the box to run SpybotSD.exe is checked and click Finish to continue.
   

How do I use it?

If you have not used the program before

The first time you run the program, there will be a series of popup windows. The first one is to notify you that it may be illegal to remove some spyware that comes bundled with other programs - for example, if you use Kazaa, you need to leave the other programs it installs there. If you don't want this to pop up and remind you every time you run the program, check the box and click OK.

If you have also installed Ad-Aware on your system, a compatibility message may appear notifying you that Ad-Aware sometimes finds spyware in Spybot's backups that can be safely ignored. Click OK to continue.

Spybot will now ask if you want to make a backup of your registry. If you have a brand new computer, this is unnecessary, but otherwise it is a good idea. Click the Create registry backup button, and after the backup has been created click the Next button at the bottom.

Spybot will now try to update definition files so it can find the latest spyware out there, similar to virus scanning updates. Click the Search for updates button, and then click the Download available updates button.

You will now be asked to immunize your computer. ITS recommends this feature to protect you from getting spyware infections in the future, and more information is available in the Immunization section.

You should now be ready to use the program! Click Start using the program to go to the main screen of the program.

If you have used the program before, update!

Please check that you have the most up to date program version available. The latest non-beta version as of this writing is v1.4. To check what version you have currently, open the program and click on Help, and then About. You should be able to see what version you have and when the last update was.

If you need a new version of the program, such as an upgrade from 1.2 or 1.3, please be aware that the internal updater will NOT update versions, only definitions. Please visit the Pomona anti-spyware page to download a current version if necessary. You can also visit Spybot's homepage at http://www.safer-networking.org.

Once you have the current version, open the program and click on the Updates button, and then click the Search for Updates button at the top. If Spybot finds updates, click the button on top to Download available Updates.

If there are no updates available, you should get a pop-up window telling you so.

General Instructions

Once you have updated the program, you should scan for spyware by clicking the Check for problems button.

This will begin an automated scan. You will not need to do anything until the scan finishes, but running other programs at the same time can make the scan go slower. DO NOT RUN SPYBOT AND AD-AWARE SCANS AT THE SAME TIME. Running a virus scan at the same time will make both go very slowly. The scan can take differing amounts of time depending upon your hardware and system configuration. (NOTE: If the scan takes under 10 seconds and declares your system to be problem-free, some form of spyware is preventing Spybot from running. Try using HijackThis first.) There should be a status bar and count at the bottom which can help you estimate the amount of time it will take. If the scan does not find any problems, you will see a green check mark and no further action is needed. Otherwise, you will see a screen similar to the one below.

If you would like more information about a particular piece of software, you can click on the name and then click the arrow bar at the right of the screen. Additional information is available for many programs, such as ways you might have gotten the software.

Usually Spybot will check the box next to any threats it finds to mark it for removal, but occasionally it does not. In this case, you should check the product information as described above to determine whether you should remove it or not. For example, BackWeb is identified as spyware but is necessary to run Yahoo!'s DSL software.

Once you have selected items to remove, click the Fix selected problems button at the top of the screen. A window will appear notifying you that a System Restore point is being created. This can be used to restore your settings if the spyware removal makes your computer or programs stop working correctly. Once the restore point has been created, the spyware will be removed. Sometimes you will see a message notifying you that some files could not be removed because they are currently in use.

In this case, Spybot will ask to run on your next system start up. This means that the next time you start your computer, Spybot will run a full scan before your computer goes all the way into Windows so that it can remove files before they can be used. If you receive this message repeatedly for the same files, you may want to try booting your computer into safe mode and running a scan from there.

Immunization

Immunization is a nice feature of Spybot that blocks you from downloading certain types of spyware when enabled. Note this does not block everything and you should still scan your computer regularly. To enable this feature, click the Immunize button on the left from the main screen. You may receive a message that you should immunize.

To immunize your computer, click the Immunize button at the top of the screen. When it has finished, your screen should look like the one below.

You will need to reimmunize your system after you download program updates in order to take advantage of new protections.

Recovery

If you remove spyware from your computer and later discover that it is needed to run other software, you can attempt to put the program back on your computer in the Recovery section. Click Recovery on the left and then find the program(s) you need in the list. Check the box next to the program(s) and click Recover selected programs at the top of the screen.

What can I do in advanced mode?

Advanced mode provides additional functions for manual prevention and removal of spyware or other unwanted files. However, using many of these functions can cause your computer to stop working correctly, and you probably should not use advanced mode features unless you are comfortable adjusting some of the inner workings of your operating system. An ITS consultant would be happy to help you use these features if you think it is necessary. Some features include the ability to edit or delete:

• startup items in the registry
• running processes
• hosts file entries
• layered service providers (LSPs)
• browser helper objects (BHOs)
• ActiveX controls
• missing registry items
• uninstaller files
• additional settings for Internet Explorer

What is TeaTimer?

TeaTimer is an optional feature of Spybot which lets you manually decide whether certain processes should be allowed to run and whether startup registry entries should be allowed to change. TeaTimer is only recommended for advanced users.