Spybot Search & Destroy
~ POST UNDER CONSTRUCTION...WILL BE UPDATED SOON!
One of the most popular spyware scanners, also, imho, one of the decent ones. Spybot S&D has a lot of features that most people either do not know about or do not bother to use but I urge you to get to know the program a bit more because there are some really neat and useful functions hidden under its menus.
Here is the process that I'd suggest that you follow with each standard installation:
1. Download the program if it is not locally stored, then install it.
2. Launch the program, at the main menu, click 'Search for Updates' button to initiate the program's internal update process.
3. If any updates are available, right-click on any one of them and click 'Select All'.
4. Pick a download location that is close to You for faster download, then start the update process.
*5. Once done, close out of the program and visit Spybot's home page and download the latest definition update file and install it. This allows the 'Ignored Products' to be listed under Advanced Mode > Settings screen which otherwise might not be visible by running the automated update process alone.
6. After the manually update, Click on Mode and select Advanced Mode. Click Yes at the confirmation screen.
7. Click Settings, then Ignored Products option and scan through the 'All Products' list to make sure there are no boxes (products) are selected, uncheck the ones found. As of this writing a total of 3 entries (2 C-Dilla and 1 SideStep) should be checked on the list. Uncheck if you find any others as well.
8. Under Tools section, click Resident option and make sure to activate (check) the 'Resident SD Helper' option which is very similar to SpywareBlaster's malicious ActiveX blocking feature.
9. Under the Spybot-S&D section on the side bar, click on Immunize button to create a preventative layer against spyware.
Also view the ActiveX, BHOs, Hosts File and Winsock LSPs sections as these location could display malware related entries when a system gets infected.
Identified malware related entries will normally be marked with a Red X and known or presumably legit entries would have a green checkmark. Since unknown entries could be tagged with a green checkmark, I suggest you examine each entry very careful in the event of an infection.
Default Hosts File would only have 'locahost' entry with an IP of 127.0.0.1 which is a software based IP address that is used to dignose the installed TCP/IP protocol(s) to see if they are functioning properly.
Winsock LSPs, if damaged by an infection could break network connection altogether.
Final Note: It'd be worth creating a report file by using the Tools > View Report feature.
If an infection takes place, comparing the report logs of the before infection and after infection could help you spot malware entries that spyware scanners might have missed.
~TL
Windows Launch Points
