Using Spybot Search & Destroy to Remove Spyware

Spybot Search & Destroy is a free tool from Safer Networking Limited used for identifying and removing spyware, adware, and various other non-virus malware from Microsoft Windows systems. These programs are often installed by Trojan horses, as part of some freeware and shareware applications, or as "drive-by installations" from various websites. The programs invade your privacy and interfere with your work by transmitting your personal information to their creators, opening unwanted pop-up windows, and modifying your Internet Explorer settings. Removing these applications by hand is a difficult process, but Spybot S&D can remove many of these programs automatically and safely.

1. Obtaining Spybot and Starting Installation

Before you install Spybot Search & Destroy 1.3, you should use the Add/Remove Programs control panel to remove any previous versions. Once you've done that, you can obtain Spybot Search & Destroy in either of two ways:

• Install with Scout

  If you've installed Scout, you can just start Scout, click on the "Spybot - Search and Destroy 1.3" button, and Scout will download and install it for you automatically. For information on getting Scout, see "Scout: Getting Network Software for Computers Running Windows (WNG 231)" at http://www.ait.iastate.edu/pubs/wng231/.

• Download from the Web

  Spybot is available from the author's website at http:/www.safer-networking.org/. Click Download, then scroll down to the title "Spybot - Search & Destroy 1.3" and click one of the buttons labeled "Download Here". (Depending on which mirror you choose, the button may be in different places and may be tricky to find, especially if you don't read German.) Save the file to the Desktop, then start the installation by double-clicking on the spybotsd13.exe icon on your Desktop. Now skip to "Continuing the Installation".

• Use the Solution Center Diskette Set

  A set of diskettes containing Spybot S&D 1.3 is available at the Solution Center, 195 Durham Center. Insert disk 1 into your floppy drive, then select Start -> Run and enter A:\SETUP. When you're asked to, remove the diskette from the drive and insert additional diskettes, pressing <Enter> after each one.

2. Continuing the Installation

To install, follow these steps:

1. Select the language to use during the installation and click OK.
2. The "Setup–Spybot–Search & Destroy" window will appear. Click Next.
3. Read the license agreement. If you agree, click I accept the agreement and click Next.
4. Click Next to accept the standard program directory.
5. Click Next to accept a full installation.
6. Click Next to create a "Spybot–Search & Destroy" folder in the Start Menu.
7. The Select Additional Tasks window will appear. By default, Spybot will put an icon on the Desktop and in the Quick Launch area of the taskbar, and will install SDHelper, a tool for adding protection to Internet Explorer. Turn on "Use system settings protection" to add TeaTimer, a tool to prevent unauthorized changes to system settings.
8. Click Next, then Install, then Finish. Spybot S&D will automatically start after the installation.
9. The "Legal Stuff" window will appear. Read the text, turn on "Don't show this message again" and click OK to continue.
10. If AdAware is installed or has ever been installed on the system a "Compatibility Warnings" window will appear. Read the text, turn on "Do not display compatibility warnings again" and click OK.
11. You'll be given the opportunity to make a backup of the Windows registry. This is a good thing, but will take some time and disk space, so you can skip it and click Next if you're short of either. Otherwise, click Create registry backup. This may take several minutes. When the backup is finished, click Next (which will reappear in the window) to continue.
12. If you have an Internet connection, click Search for updates.
13. If the button "Download all available updates" appears, click Download all available updates. When the updates have been downloaded, click Next.
14. Click Immunize this system. When Spybot reports how many bad products have been blocked, click Next.

15. A dialog box will appear giving you three choices:

    Read tutorial
    Read help file
    Start using the program
    

    If you've never used Spybot Search & Destroy before, we recommend that you read the tutorial. If you've used a previous version, you should read the help file to see what's changed. If you're brave, go straight into using the program and jump in these directions to step 2 of "Using Spybot Search & Destroy" but don't say we didn't warn you.

3. Using Spybot Search & Destroy

16. Choose Start -> Programs -> Spybot–Search & Destroy -> Spybot–Search & Destroy.
17. Unless you've just installed SS&D and did the search for updates, you should click Search for updates to see if new definitions have been created. If they have, check the boxes to download each of the files and click Download updates.
18. In the menu on the left, click on Search & Destroy, then click Check for problems. SS&D will search your computer for problem files and programs and list them in its window. Depending on the speed of your computer, this could take a while.
19. When the problem check is finished, a list of problems will be displayed. These fall into three categories:
    Red entries: Spyware should be removed. The boxes for these entries will already be checked.
    Black entries: System internals that should only be fixed if you can identify the problem. This usually requires consulting the software publisher's website or technical support line.
    Green entries: Usage tracks (primarily browser cookies) that track where you've been on the web and what files you've opened recently in different applications. As a general rule, you can check and delete these without doing any harm to your computer.
    
20. Mark the check boxes for the problems you want fixed, then click Fix selected problems. Click Yes when asked if you want to continue, then click OK when the "Confirmation" window appears.
21. All of the spyware products installed on your computer should now have been removed. To protect your computer from future problems, click Immunize in the menu at the left.
22. A dialog box showing the count of additional protections possible will appear. Click OK.
23. In the right pane of the window, click Immunize.
24. Optional: In the menu at the bottom of the window under "Permanently running bad download blocker for Internet Explorer," select Ask for blocking confirmation.

Note: The download blocker may interfere with the use of some webpages. You may need to remove it to use some sites. To do so, start Spybot Search & Destroy, click on Immunize in the left-hand menu, and click Undo.

To keep your system working well, you should scan your system with Spybot S&D periodically. There is no charge for Spybot S&D, but please consider making a voluntary donation via the author's website at http://www.safer-networking.org/ or by clicking Donations in the lefthand menu in Spybot S&D itself. See the Download page for more details.

4. More Assistance

For more assistance, contact the Solution Center by phone at 515.296.6000, on the web at http://www.ait.iastate.edu/help/, by email at solution@iastate.edu, or in person at 195 Durham Center.