Install & Configure Spybot

2005-06-21T08:43:33Z

On May 31, 2005 Safer-networking released an updated version of Spybot. If you already have Spybot installed, please Remove Spybot-Search & Destroy first. Do not over-install version 1.4 over a previous version.

If your computer doesn't have Spybot installed, you can follow these steps. These steps are written for computers with Windows XP Professional.

Use Add/Remove Control Panel to Remove Spyware

Prior to installing and running Spybot, you may take the extra step of looking for known spyware software. You can then use their own un-installers to remove them from the computer. Again, one of the reasons this software is called "spyware" is because it get installed without your explicit knowledge. These programs will let you un-install them ... usually. The follow-up step is then to use a program like Spybot to cleanup their leftover tracks and prevent them from coming back.

1. Click on the Start button and then choose Control Panel.

2. Open the Add/Remove Programs control panel.

3. Write down the list of nonstandard products installed. Look for software like ...

  Anything with 'New.Net' (New.net Domains 6.38)
  Anything with 'Search' (My Web Search, My Web Search (Smiley Central), Search Assistant)
  Anything with 'HotBar' ('Web Tools by Hotbar)
  Various with 'Gator' or Gator.com applications - Date Manager, Precision Time or Gator eWallet' 
  Anything with 'WildTangent' (WildTangent Web driver)
  Anything with 'Viewpoint' (Viewpoint Manager, Viewpoint Media Player)
  Other items: Tools for Internet Explorer, nhupdater, updater, starter, wupdt, wapdate, wupdate, ILookup.

4. If you have other software that you are unsure of, go to http://www.google.com and look for uninstall instructions. Just use "remove" plus their names. If the programs is considered spyware, you should see that in the results.

5. Once you have the list of programs that may be uninstalled, we recommend that you scroll to the bottom of the Add/Remove Programs list and start from there.

6. Click once on the program to be uninstalled and then click on the Add/Remove button and follow the instructions for the software. If asked to restart, you may choose to wait. Continue to remove as many products as you can. Restart when you have removed as many programs as you could.

Download the Software

To download the Spybot installer exe, perform these steps.

1. Open Internet Explorer.

2. If you have Windows XP SP2 installed, from the the Tools menu, click Pop-up Blocker, and then click Turn Off Pop-up Blocker.

3. Enter the following address or click this link to download the software from c|net Download.com. http://www.download.com/3000-8022-10122137.html

NOTE: If the above link fails, you may also visit the "mirror" list at the Safer-Networking.org website. This site has a rotating list of four download sites. You may have difficulty downloading from some of these sites. This is why we list the c|net Download.com site as a first choice. http://www.safer-networking.org/en/mirrors/index.html

4. Click on the Download Now button. Click Save.

5. Click the Desktop button. Click Save again. (This will copy the Installer to the desktop).

Note: This file is approximately 4.8 MB in size.

6. Once the download completes, if you are asked, click Close.

7. If you have have Windows XP SP2, from the the Tools menu, click Pop-up Blocker, and then click Turn On Pop-up Blocker.

8. Close Internet Explorer.

Install Spybot

1. Close all running programs. (ex: Word, Outlook, Excel, etc.).

2. From the desktop, double-click on the "spybotsd14.exe" file.

3. If you receive an Open File - Security Warning message, click Run.

4. In the Select Setup Language windows, English should be selected. Click OK.

5. On the Welcome Screen, click Next

6. Click "I accept the agreement" and then click Next.

7. Click Next again to install the program in its default location.

8. Un-check the "Additional languages" and "Skins to change appearance" choices.

9. If you are connected to the Internet, Check the "Download updates immediately" choice.

10. Click Next.

11. At the Select Start Menu Folder window, click Next. (The "Don't create a Start Menu folder" should be un-checked.)

12. At the Select Additional Tasks window, you may UN-check the "Create Desktop icons" and "Create a Quick Launch icon" if you don't want these shortcuts.

13. Leave the "Use Internet Explorer protection (SDHelper)" choice CHECKED.

14. Leave the "Use system settings protection (TeaTimer)" choice unchecked.

15. Click Next. Click Install.

16. If updates were found, you will receive a second Install button. Click Install.

17. When Spybot has finished installing, click Close.

18. On the Completing the Spybot - Search & Destroy Wizard screen, the "Run SpybotSD.exe" choice should be selected. Click Finish to launch Spybot.

Configure Spybot on First Run

1. When Spybot starts for the first time, you will see a Legal stuff window. If you don't, it may be minimized on the Taskbar. If it is, click the Spybot - Search & Destroy icon on the Taskbar to bring it up.

2. Place a check in the "Don't show this message again." box and click OK.

3. You are now at Step 3 of 7 in the Spybot-S&D Wizard and are being prompted to backup the Registry. Click Next to skip this step. (Note: Step 4 is skipped by the Wizard.)

4. At Step 5 of 7 in the Spybot-S&D Wizard, click the Search for Updates button.

5. If updates are found, click the "Download all available updates" button. Wait for the downloads to complete. They should have a green check beside their name in the Update window. In the Wizard window, click Next. If no updates were found, click Next.

6. At Step 6 of 7 in the Spybot-S&D Wizard, click the "Immunize this system" button. When finished you will see the number of bad products blocked. Then click Next.

7. At Step 7 of 7 in the Spybot-S&D Wizard, click the "Start using the program" button.

8. From the Mode menu, choose Advanced mode. In the warning message, click Yes.

NOTE: On the left, in addition to the Spybot-S&D tab, there are now 3 more tabs: Settings, Tools, Info & License.

9. Click the Settings tab. Click the Settings button.

10. On the right side, scroll down to the "Main Settings" section. Be sure that BOTH the "Create system restore point when fixing .... (Win XP Only)" choices are UNCHECKED.

11. Scroll down to the "Automation" section. Then in the "Program Start" section, click the "Immunize on program start if program has been updated" choice.

12. Scroll down to the "Web Update" section.

13. Click the "Search the web for new versions at each program start" choice. In the warning message, click Yes.

14. Also in the "Web Update" section, click the "Download updated include files if available online" choice.

15. On the left side of the screen, click the Ignore products button. Click on All Products tab.

KEY STEP: Spybot can be set to ignore items during a check. You may want to do this for a certain programs that you have. Normally, you DO NOT want items checked. However, there are at least three entries that are checked by the default Spybot install: CDilla, New.net, and Sidestep. We want these unchecked. The easiest way to do this process is to "Deselect all".

16. Right Click on the Product column heading and select Deselect all. On the left, click the Tools tab.

17. Click the Resident button. On the right side, confirm that the Resident "SDHelper" ... choice is checked.

18. Click the IE tweaks button. On the right side, confirm that the "Lock Hosts file read-only as protection against hijackers" is checked.

19. Click the Spybot-S&D tab.

Using Spybot

To check for problems, Spybot should already be opened.

NOTE: To switch between "Default" and "Advanced" mode, use the Mode menu. For most purposes, the Default mode will suffice.

1. On the left side, click "Search & Destroy" and then click "Check for Problems" at the top of the window.

NOTE: The search process will take around 2 to 10 minutes, depending on the speed of your machine. Look in the lower-left corner of the window. You will see that it is Running a bot-check with the number of bots (spyware) being counted. Let the scan proceed until it finishes!

2. When finished, you'll either get the message "Congratulations No immediate threats were found" or a list of the possible spyware the program found. The list of threats may be expanded to see their details by clicking the plus ( + ) sign next to their names.

3. Place a check in all the found threats.

4. Click on the "Fix selected problems" button at the top of the window.

5. You'll see a message "You are about to remove the checked entries. Do you want to continue?", click Yes.

NOTE: When the problems are fixed, the files have been removed, each file "fix" will be verified with a green check mark. In some cases, during or after the fixing process, you may see a message that some problems couldn't be fixed. The reason is that files cannot be removed if they're running in the computer's memory.

6. If the problems could be fixed without a restart, click OK. Go to step 7. If you receive a message that some programs must be fixed on system start, to remove them, click Yes, then restart your computer.

7. Spybot will run automatically on the restart. This re-check can take longer that the original scan, so please be patient. Follow steps 2 - 6 again.

8. That's it. You may exit Spybot.

You should run Spybot on a regular basis. Please follow the steps in the next section to have this scan occur automatically.

Configuring Spybot to check Automatically

NOTE: These steps will tell Spybot to check on a weekly basis.

1. Spybot should be open. From the Mode menu, Advanced mode should be checked. If not, then select Advanced mode and in the warning message, click Yes.

2. Click the Maximize button on the Spybot window or grab the corner of the window and drag to make it larger so that no scroll bar appears.

3. On the left, click the Settings tab.

4. Click the Scheduler button. At the top of the screen, click the Add button.

5. Wait for the Scheduler Settings to appear. This may take from 5 - 30 seconds.

6. Check the "Fix problems after scheduled scan" choice. You may check the "Close program after finishing schedule" if desired.

7. Click the Edit button at the top of the window.

8. Click the Task tab. In the bottom left, be sure that the Enabled... check box is checked.

9. In the "Run as:" or "Enter the user name" field, enter whatever username you used to login to the computer. Note: This may already be filled in. If your computer is part of a Domain, enter the Domain followed by a backslash and your username. Ex: WIN\vcv1

10. Click the Set password button. Enter your password twice. Click OK. Click Apply.

11.Click the Schedule tab. Click New.

12. Under the Schedule Task drop-down list, choose Weekly.

13. Edit the Start Time field to run the task when you desire. Ex: change 9:00 AM to 12:00 PM.

14. Click Apply.

15. Select a Day to run the task. If not scanning on Monday, UN-check Mon. Place a check by the day of the week of your choice. The computer will need to be ON for the scan to occur.

16. Click Apply.

17. Click OK to close the Scheduled Task window. Exit Spybot.

18. To test if it will run at this time, Click on the Start button and then choose Control Panel. Open the Scheduled Tasks control panel. Right Click on Spybot - Search & Destroy - Scheduled Task and choose Run.

19. Spybot should load, check for updates, and begin to run a check. If it does, click Stop Check.

NOTE: If the task doesn't run, double click on the scheduled task in the Scheduled Tasks control panel and verify the settings, especially the username and password.

20. Spybot will open. You will see a "User Abort! Scan was not completed successfully." message. This may be ignored. The test of the Scheduled Task did succeed.

21. Exit Spybot.

NOTE: In Windows XP, Spybot keeps logs of its checks and fixes here: C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs

NOTE: Spybot is now configured. You may stop here. The remaining steps of the How To may be used when removing spyware or for troubleshooting Spybot.

Starting Spybot on System Start

NOTE: If you feel that you are infected with spyware, use these steps to force Spybot to run before any other programs load. This will help it remove any spyware.

1. Spybot should be open. From the Mode menu choose Advanced mode. In the warning message, click Yes.

2. On the left, click the Settings tab.

3. Click the Settings button.

4. On the right side, scroll down to the "Automation" section. Then in the "System Start" section, click the "Run program once at next system startup".

5. Exit Spybot. Restart the computer. Spybot should open. Click on the "Fix selected problems" button at the top of the window. If problems are found, click on the "Fix selected problems" button at the top of the window.

6. When complete, close Spybot. The computer should finish starting normally. If problems were found, restart the computer one more time.

Spybot can't fix New.Net errors

NOTE: Spybot may not be able to clean certain Registry entries for New.Net, even after a restart. To remove these entries, you will need to edit the Registry.

1. Close all open programs.

2. Click Start, and then click Run.

3. In the Open box, delete any existing text. Then enter regedit and click OK.

NOTE: Steps 4 - 6 assume that the errors look similar to the above graphic. If your errors are located in a different registry key, you should open and delete these keys.

4. Click the + (plus) sign next to HKEY_USERS to expand that branch of the tree (group of settings).

5. Click the + (plus) sign next to .DEFAULT to expand it.

6. Click the + (plus) sign next to Software to expand it.

7. Right Click on the new.net folder and choose Delete. Click Yes.

8. Click the - (minus) sign next to .DEFAULT to collapse it.

9. Click the + (plus) sign next to S-1-5-18 to expand it. Click the + (plus) sign next to Software to expand it.

10. If the new.net folder is still there, Right Click on the new.net folder and choose Delete. Click Yes.

11. Click the - (minus) sign next to S-1-5-18 to collapse it.

12. Click the - (minus) sign next to HKEY_USERS to collapse it.

13. From the File menu choose Exit. Restart the computer.

14. Run Spybot again. The New.Net problems should not be found.

Spybot's On-line FAQ

More information on Spybot may be found here:

  http://www.safer-networking.org/index.php?page=faq

  http://www.safer-networking.org/index.php?page=spybotsd

What can I do if Spybot-S&D flashes and disappears immediately?

As a workaround, you need to reset the settings. There are two ways to do this:

1. You can delete the configuration file (which is named Configuration.ini). You will find it in C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\. Either delete that file, or edit it (for example in notepad), and set all the Automation values in it to zero.

2. You can download a small tool that will do those changes for you:

  http://spybot.eon.net.au/files/resetsettings.zip

3. If this does not fix the problem, your system is possibly infected by the CoolWWWSearch.SmartKiller (v1 and v2). This is an ugly variant of CoolWWWSearch. When running, it will close every browser window visiting an anti-spyware-site. It will even close Spybot-S&D and some other anti-spyware applications as well. So if your copy of Spybot-S&D (or the anti-spyware application of your choice) closes a few seconds after starting, or your browser closes whenever you try to visit an anti-spyware site, check our CWS.SmartKiller removal utility.

  http://www.safer-networking.org/files/delcwssk.zip

Watching: Install & Configure Spybot

Install & Configure Spybot