Spybot - Search & Destroy

Spybot Search & Destroy (S&D) is a popular proprietary spyware and adware removal program compatible with Microsoft Windows 95 and later. It scans the computer hard disk and/or RAM for malicious software.

Spybot-S&D was written by the German software engineer Patrick Michael Kolla, and is distributed by Kolla's Irish company Safer Networking Limited. Development began in 2000 when Kolla, still a student, wrote a small program to deal with the Aureate/Radiate and Conducent TimeSink programs, two of the earliest examples of adware.


Licensing

Spybot - Search & Destroy is currently released as freeware. Corporate users are required to purchase a yearly license.


Spybot features

Along with spyware and adware detection and disinfection capabilities, Spybot-S&D can repair (Registry), Winsock LSPs, ActiveX objects, browser hijackers and BHOs, PUPS, computer cookies, trackeware, heavy duty, homepage hijackers, keyloggers, LSP, tracks, trojans, spybots, revision, and other kinds of malware. It can also to some extent protect a user's privacy by deleting usage tracks like tracking cookies. Spybot-S&D also includes an "Immunize" feature to block the installation of spyware before it occurs e.g. by modifying the hosts file. Another tool included in Spybot-S&D is a file shredder, for the secure deletion of files. Spybot-S&D is not intended to replace anti-virus programs, but it does detect some common trojans.

Spybot-S&D also recently added an anti-rootkit function.[2]

The TeaTimer module can be optionally enabled, providing a level of active, real-time protection from undesirable registry changes and the like. This comes in the form of pop-ups which alert the user to registry changes, and ask for approval before allowing the change. Registry changes only tend to be made when programs are installed/uninstalled/updated, so random changes can indicate the presence of malicious software.

Some programs ship with attached spyware or adware and refuse to run when the undesired co-programs are removed; newer versions of Spybot replace the spyware binaries with inert dummies (designed to fool programs which require the spyware's presence).

In order to efficiently detect recently created programs, detection updates are released weekly along with other improvements such as added languages and better heuristics algorithms. These updates are downloaded from within the software from a variety of mirrors and are then automatically installed.

Spybot-S&D is available for all versions of Windows from Windows 95 and up, and offers more than two dozen different languages and several skins to users. Instructions are available on the website to enable users to design their own skins.

Technical support is currently supplied by means of Internet forums[3] and support e-mails (with a usual response time of no more than 24 hours).


Websites getting blocked

Some recent viruses will prevent you from being able to access the safer-networking site, even pinging is impossible. It completely blocks all internet traffic to this and other spyware programs' sites[citation needed]. A good example of this would be the Antivirus Plus malware.


Reviews and awards

In previous years Spybot-S&D has been applauded for its ease of installation, free updates, and excellent features. It won numerous awards, including the World Class 2003 Awards, the PC Magazine Editor's Choice and PC User Top Buy #1. Additionally, Spybot was recommended by ZDNet, the Wall Street Journal, The Guardian, MSNBC, CNN and other reviewers.

Although PC Magazine initially rated it highly in 2003, their rating has declined steadily since, to "poor" in 2008:

PC Magazine Editors' Ratings (out of 5 possible)[4]

* 2003 4/5 EDITORS' CHOICE AWARD
* v1.2 2004 4/5
* v1.3 2005 3/5
* v1.4 2005 2.5/5
* v1.5 2008 1.5/5

In January 2008, PC Magazine, after giving Spybot Search & Destroy 1.5 a score of just 1.5 out of 5,[5] elected it as one of the worst tech products of the first quarter of 2008 and called its malware cleaning-up skills mediocre.[6] As explained in feedback to PC Magazine's review from a reader,[7] that review was however based on a flawed test using an old version of Spybot with malware definition files that were almost seven months older than those available at the time of the test. Spybot has also advised against automatic cleaning, instead asking users to follow instructions in their website forum in order to clean their systems manually.

However, as of 2009-01-15, 2-Spyware.com gives Spybot the only gold rating for free spyware removers.


Versions

Version 1.5 has improved Wine compatibility, and restores compatibility with Windows 95[9] which was faulty in 1.4.


Scanning Speed

The scanning speed of version 1.6 is purportedly several times faster than of version 1.5.


Malicious clones

A number of people, knowing the program's great legitimacy, have made Spybot 'clones' with similar user interfaces and similar sounding program names. Some clones have been made by spyware manufacturers to make programs that pose as anti-spyware programs, but actually install spyware themselves. These programs are known as rogue antispyware.

Searching the words "spybot", or "search & destroy", "spybot antispyware" or any other related search on Google will often result in a paid advertisement for "SpywareBot". This program is a known rogue antispyware program, which fraudulently uses the "search and destroy" logo and a name similar to Spybot to fool users into downloading their product instead of the original Spybot Search & Destroy.


Incompatibility and conflicts

Removal by commercial security products

Several of the largest commercial security products require users to uninstall Spybot when they are being installed or when they run.[13]

Norton Internet Security

The makers of Spybot-S&D have come into conflict over claims of incompatibility with Norton Internet Security.[14] Symantec recommends uninstalling Spybot-S&D before installing Norton Internet Security. According to Safer Networking, no satisfactory explanation has been provided to them for this decision. Antivirus professional Mary Landesman suggests a possible explanation may stem from a graphical glitch in TeaTimer module's confirmation dialog. An official explanation from Safer Networking[15] states that this error stemmed from a bug in the program used to build their code. The result of the bug was that users had difficulty enabling Norton Internet Security to make necessary changes to critical registry areas, such as allowing itself to launch on startup. Aside from this, Mary Landesman, like Safer Networking, concludes that the two programs have no issue with one another. The bug exists only in the 1.4 version of Spybot-Search & Destroy and has been fixed as of the 1.5 release.[16]

Kaspersky Internet Security

In certain instances Kaspersky Antivirus and Kaspersky Internet Security version 2009, forces users to uninstall Spybot during installation process, although there is no serious incompatibility yet known. The discussion was concluded in the Kaspersky forum, which said not to install Spybot at all. Kaspersky seems to be reluctant to fix the issue although they have received several complaints.

Source