Introduction and Startup

Previous Next

Introduction and Startup
Introduction and Startup
For an introduction to Webroot® Spy Sweeper®, see the following topics:
•
About this help
•
Spy Sweeper overview
•
Start-up and shut-down operations


About this help

Introduction and Startup > About this help
About this help
This online help describes how to use the features available for the following Spy Sweeper versions:
Version
Description
Spy Sweeper
Provides protection from spyware and other potentially unwanted programs. This version includes a one-year subscription to the evolving database of threat definitions from Webroot.
Spy Sweeper with AntiVirus
Provides the same protection from spyware and other potentially unwanted programs as the regular version of Spy Sweeper, along with sophisticated Sophos® Anti-Virus protection. This version includes a one-year subscription to the evolving database of threat definitions from Webroot.
This symbol indicates notes that apply only to Spy Sweeper with AntiVirus.
Spy Sweeper
Trial Version
Provides protection from spyware and other potentially unwanted programs on a trial basis. When the trial expires, Spy Sweeper notifies you and lets you purchase a full version with a one-year subscription from the Webroot Web site (www.webroot.com).
This symbol indicates notes that apply only to trial versions.
Spy Sweeper
Scan-Only Trial Version
Performs a complimentary scan (sweep) of your computer and locates any spyware or other potentially unwanted programs. This is a limited version that demonstrates where you might have potential risks. This version does not quarantine or remove potential risks. After performing a scan, Spy Sweeper notifies you and lets you purchase a full version with a one-year subscription from the Webroot Web site (www.webroot.com).
This symbol indicates notes that apply only to trial versions.
This online help assumes you have a basic understanding of the Windows operating system. If you need assistance with Spy Sweeper, see Webroot Support for contact information.


Spy Sweeper overview

Introduction and Startup > Spy Sweeper overview
Spy Sweeper overview
Webroot Spy Sweeper is a comprehensive solution for protecting your privacy and your computer from online security risks, including spyware, adware, and other potentially unwanted programs. To learn more about Spy Sweeper, read the following topics:
•
How online threats can damage your computer
•
How Spy Sweeper protects your computer


How online threats can damage your computer

Introduction and Startup > Spy Sweeper overview > How online threats can damage your computer
How online threats can damage your computer
Online security threats come in many forms — the most common types come from spyware and viruses, which could install themselves without your knowledge as you visit Web sites or download software. Spyware programs are specifically designed to infiltrate your computer for commercial gain (stealing personal information or displaying annoying advertisements), while viruses are typically designed to damage your computer.
Types of spyware programs include system monitors that capture your e-mails and keystrokes, Trojan horses that can steal or destroy data, adware that pops up advertising, and tracking cookies that store information about your online preferences and habits. While some of these programs may be harmless, others can steal your personal information and send it to a third party for malicious purposes. In some cases, these programs can damage your computer enough to slow down processing times or cause system crashes. Spyware and other unwanted programs may be part of a program that you installed or they may install themselves as you visit Web sites. They could also arrive bundled with freeware or shareware, through e-mail, or by someone with access to your computer. These programs are difficult to detect, and difficult (if not impossible) to remove. Spyware can hide in multiple locations and can reinstall if you don’t remove it properly with specialized antispyware software like Spy Sweeper.
A virus is computer code that often duplicates itself and causes a specific event to occur. The event may be harmless, such as displaying a message on a specific date, or may be malicious, such as deleting data or duplicating data to fill a hard drive. Viruses can arrive as file attachments to e-mail, as embedded files on a CD, and as clickable graphics in an e-mail. Once on your hard drive, viruses are difficult to detect and remove, unless you have specialized antivirus software.
*
Spy Sweeper with AntiVirus: To protect against virus attacks, you must have the Spy Sweeper with AntiVirus version.


How Spy Sweeper protects your computer

Introduction and Startup > Spy Sweeper overview > How Spy Sweeper protects your computer
How Spy Sweeper protects your computer
Spy Sweeper offers continuous protection from potential threats by providing the following features:
•
Sweeps and quarantine
•
Shields
•
Subscription (threat definition) updates


Sweeps and quarantine

Introduction and Startup > Spy Sweeper overview > How Spy Sweeper protects your computer > Sweeps and quarantine
Sweeps and quarantine
You can schedule sweeps to run at convenient times, typically while you are away from your computer (the computer must be turned on) or you can run sweeps on demand. The process for locating and removing items found during a sweep include:
1.
Sweep. Spy Sweeper searches for known threats, looking for any items that match definitions in the Webroot threat database. You can specify where Spy Sweeper searches (for example, search specific folders or file types) and the types of threats to include or ignore (for example, bypass tracking cookies).
2.
Quarantine. After a sweep, Spy Sweeper removes items that match threat definitions from their current locations and sends them to a holding area, called the Quarantine, where they are rendered inoperable and cannot harm the computer. You can control whether certain items are always quarantined or whether certain items like tracking cookies are always ignored.
*
Spy Sweeper with AntiVirus: If Spy Sweeper with AntiVirus detects a virus, it removes the infected portions of a file during a cleaning process, then restores the cleaned file to your computer.
3.
Delete. After items are quarantined, you can delete them permanently or restore them to their original locations. You might need to restore an item if you discover that a certain piece of software will not work without it. You should always leave an item in the Quarantine and test your computer operations first, before deleting items permanently.


Shields

Introduction and Startup > Spy Sweeper overview > How Spy Sweeper protects your computer > Shields
Shields
For added protection, Spy Sweeper includes a shielding function that continuously monitors activity as you work (for example, when you connect to the Internet or when you open an e-mail attachment). Shields can monitor functions related to your Web browser settings, network communications between your computer and Web sites, Windows system settings, Windows Startup programs, and e-mail.
If Spy Sweeper detects spyware or any other potential threat attempting to download, it displays an alert message. For most types of detected items, the alert message asks if you want to proceed anyway or stop the download. You can also specify that Spy Sweeper always allow certain types of items to download.


Subscription (threat definition) updates

Introduction and Startup > Spy Sweeper overview > How Spy Sweeper protects your computer > Subscription (threat definition) updates
Subscription (threat definition) updates
The Webroot Threat Research team is constantly updating Spy Sweeper definitions to protect your computer from ever-changing spyware and other potential threats. Spy Sweeper can automatically download these definitions to your computer so you are always protected against the most current online threats.
With your purchase of Spy Sweeper or Spy Sweeper with AntiVirus, you receive a one-year subscription to all threat definition updates and also to newly released program versions. When your subscription is within 30 days of expiration, Spy Sweeper will notify you in the Alerts panel. You can extend your subscription (or upgrade the program) at any time from the Webroot Web site. For more information, see Updating Spy Sweeper.


Start-up and shut-down operations

Introduction and Startup > Start-up and shut-down operations
Start-up and shut-down operations
Spy Sweeper runs automatically when Windows starts (providing you did not turn off the Load Spy Sweeper at Windows startup option during a custom installation). Look for the Spy Sweeper icon in the Windows system tray in the lower-right corner of your screen. This icon indicates that Spy Sweeper is running and actively protecting your computer.
*
Note: If you turned off the Load Spy Sweeper at Windows startup option during a custom installation or in the Options/Program tab, you must manually start Spy Sweeper by double-clicking the Spy Sweeper icon on your computer desktop or selecting it through the Windows Start Menu (select All Programs > Webroot > Spy Sweeper > [image] Spy Sweeper). This also opens the Spy Sweeper Main window and Home panel.
While Spy Sweeper is running, it protects your computer by:
•
Sweeping for potential threats on a schedule or on demand. See Sweeps and the Quarantine.
•
Shielding against potential threats at all times. See Shields.


Opening Spy Sweeper

Introduction and Startup > Start-up and shut-down operations > Opening Spy Sweeper
Opening Spy Sweeper
To modify how Spy Sweeper checks for potential threats and to change other settings, open the Spy Sweeper Main window by doing one of the following:
•
Double-click the Spy Sweeper icon on your Windows desktop or click the Windows Start menu and select All Programs > Webroot > Spy Sweeper > [image] Spy Sweeper.
•
Double-click the Spy Sweeper icon in the system tray (lower-right corner of your screen). You can also right-click the icon to display the task bar menu, then click on an option in the middle of the menu to open the corresponding panel in the Spy Sweeper Main window.


Main window and Home panel

Introduction and Startup > Start-up and shut-down operations > Opening Spy Sweeper > Main window and Home panel
Main window and Home panel
The Spy Sweeper main window is divided into two areas: the Icon panel at the left allows you to select options, while the Main panel on the right displays the corresponding settings available for the selected icon.
The following table describes the areas of the main window.
General Spy Sweeper window areas
Icon panel
Allows you to select areas of the program for reviewing overall status (Home icon), running sweeps (Sweep icon), setting shields (Shields icon), viewing quarantined items (Quarantine icon), setting program options (Options icon), and viewing alert details (Alerts icon). When you select an icon, its corresponding functions and information open in the Main panel. The Icon panel also provides a Help icon, which opens the online instructions for using the program (you can also click the [image] icon).
Main panel
Displays the tasks and information related to the selected icon. It allows you to change Spy Sweeper settings, run a sweep, manage the Quarantine, and view alerts.
When the Home panel is displayed, the main panel shows overall Spy Sweeper status and functions, as described in the following table.
Home panel areas
Sweep panel
Last full sweep:
—Last sweep is up to date (within the last 7 days).
—Sweep is due. The last sweep was between 8 and 14 days ago.
—Sweep is out of date. The last sweep was more than 14 days ago.
Click the Edit link (upper right) to change your sweep options (see Setting sweep options).
Next sweep: If you have defined a sweep schedule, this displays the date of your next sweep. Click the Next sweep link to define or change a scheduled sweep (see Configuring Custom Sweep options).
Start button: Click the arrow on the button to select a different sweep type. Click the button to start a sweep now (see Running sweeps immediately).
Shields panel
—Full Protection. All critical and recommended shields are turned on.
—Partial Protection. All critical shields are on, but some recommended shields are not.
—Vulnerable. One or more critical shields are not turned on.
Click the Edit link (upper right) to change your shield settings (see Setting shields).
Updates panel
Last check for updates:
—The definitions are up to date. The last check for updates was within the last 7 days.
—Definitions might be out of date. The last check was between 8 and 14 days ago.
—Definitions are out of date. The last check for updates was more than 14 days ago.
Click the Edit link (upper right) to change your update settings (see Updating Spy Sweeper).
Antivirus Protection panel
Sweep for Viruses
—In your Custom Sweep settings, the Sweep for viruses option is selected.
—In your Custom Sweep settings, the Sweep for viruses option is not selected (see Configuring Custom Sweep options).
—You do not have Spy Sweeper with AntiVirus installed, which means that Spy Sweeper is not providing any antivirus protection.
Virus Shields
—In the Shields tab, the Protect against viruses option is selected.
—In the Shields tab, the Protect against viruses option is not selected (see Antivirus and behavioral protection).
—You do not have Spy Sweeper with AntiVirus installed, which means that Spy Sweeper is not providing any antivirus protection.
Subscription Status panel
Shows the date your subscription ends. If you see a Check Status link, click the link to ensure that you see up-to-date subscription information. You can also click the About Spy Sweeper link for program version information and definitions status.
Alerts and News panel
Alerts
If Spy Sweeper has any alerts for you, it displays the number of alerts in parentheses. Click the Alerts link to review them (see Viewing alerts and news).
Spy News™
Click the Spy News™ link to review Webroot threat news in your Web browser (see Viewing alerts and news).


Tabs

Introduction and Startup > Start-up and shut-down operations > Opening Spy Sweeper > Tabs
Tabs
Some panels display tabs that give you access to additional options. The following example shows the settings available when you click the Options icon, then click the Schedule tab.


Closing the Spy Sweeper main window

Introduction and Startup > Start-up and shut-down operations > Closing the Spy Sweeper main window
Closing the Spy Sweeper main window
When you are finished using the Spy Sweeper Main window, click Close [image] in the upper right corner of the main screen. This action closes the window, but keeps the Spy Sweeper program running. Look for the Spy Sweeper icon in the Windows system tray at the lower-right corner of your screen; this icon means that Spy Sweeper is actively protecting your computer. We recommend that you always keep Spy Sweeper running.


Shutting down Spy Sweeper operations

Introduction and Startup > Start-up and shut-down operations > Shutting down Spy Sweeper operations
Shutting down Spy Sweeper operations
To completely stop Spy Sweeper operations, you can shut down the program. A shut-down action is only necessary if you plan to install a new version of Spy Sweeper. Otherwise, you should keep the program running so that shields can actively block potential threats.
To shut down Spy Sweeper:
1.
Right-click the Spy Sweeper icon in your system tray.
A pop-up window opens.
2.
Click Shut Down.


Using multiple accounts

Introduction and Startup > Start-up and shut-down operations > Using multiple accounts
Using multiple accounts
If your computer is configured for multiple user accounts (each person logs in with a unique name and password), the Spy Sweeper program is available to all those accounts. Users with administrative privileges have full access to all areas of Spy Sweeper, while other users have limited access.
The following table describes Spy Sweeper functions not available to limited users (those without administrative privileges).
Function
Description
Shields
Limited users cannot change shield settings, with the exception of the IE Hijack Shield options:
•
User—Limited users can use this drop-down list to change these settings. Only the current user account is affected. These settings effectively override the system settings below.
•
System—Only the computer administrator can use this drop-down list to change these settings. Changes here affect all user accounts, unless a limited user has customized the setting.
See Editing the IE Hijack Shield settings.
Program Options
Limited users cannot change settings for these options:
•
Add “Sweep” option to Windows Explorer context menu
•
Load Spy Sweeper at Windows startup
See Setting Spy Sweeper program options.
Quarantine panel
Limited users can view the Quarantine panel, but cannot restore or delete items that have been quarantined.
See Managing the Quarantine.
Scheduled Sweeps
All users can run sweeps. However, for scheduled sweeps to run, you must be logged in to the account where you created the schedule. In addition, you can only see the scheduled sweeps configured from your own account.
See Running sweeps on a schedule.


Sweeps and the Quarantine

Sweeps and the Quarantine
Sweeps and the Quarantine
To sweep your computer for potential threats and manage detected items in the Quarantine, see the following topics:
•
Setting sweep options
•
Running a sweep
•
Managing the Quarantine
•
Managing detected items automatically


Setting sweep options

Sweeps and the Quarantine > Setting sweep options
Setting sweep options
Before running a sweep, you should review what options are currently set for each sweep type. Sweep types include:
•
Full. Performs a complete sweep of all internal drives and drives directly attached to your computer. We recommend running a Full Sweep at least once a week. It takes longer than a Quick Sweep, but it is more thorough. Options for Full Sweeps cannot be changed.
•
Quick. Performs a limited sweep of only the locations where spyware and other unwanted programs are commonly found. This type of sweep is less thorough than a Full Sweep, but it maximizes use of your computer’s processing power to make the sweep as fast as possible. Options for Quick Sweeps cannot be changed.
•
Custom. Lets you customize the sweep to focus on specific areas. Spy Sweeper saves these settings for future Custom Sweeps.
For more information about sweep options, see the following topics:
•
Reviewing options for Full and Quick Sweeps
•
Configuring Custom Sweep options


Reviewing options for Full and Quick Sweeps

Sweeps and the Quarantine > Setting sweep options > Reviewing options for Full and Quick Sweeps
Reviewing options for Full and Quick Sweeps
Spy Sweeper includes pre-set options for a Full Sweep and a Quick Sweep. You cannot change these options. To run a sweep with modified settings, you must run a Custom Sweep (see Configuring Custom Sweep options).
To review option settings for Full and Quick Sweeps:
1.
In the Icon panel, click Options.
2.
Make sure the Sweep tab is currently active (selected).
3.
Under Sweep Type, select either Full Sweep or Quick Sweep.
A green check mark appears next to each option that is currently enabled for the selected sweep type. The following table describes each option.
Sweep Options
Options
Description
Sweep All Attached Drives
Sweeps all drives attached to your computer (such as a CD-RW drive), as well as the internal drives.
Virus Sweep
Applies only to Spy Sweeper with AntiVirus.
Enables virus-sweeping in the following areas: Memory Objects, Compressed Files, System Restore Folder, and All User Accounts (providing those options are also turned on, as described below). When selected, the Antivirus Protection panel on the Spy Sweeper Main window shows that Sweep for Viruses is enabled [image].
Windows Registry
Sweeps the computer’s registry, where spyware and other potentially unwanted programs commonly create entries.
Memory Objects
Sweeps the computer’s random access memory (RAM), where spyware and other potentially unwanted programs commonly load into memory.
Cookies
Sweeps for known tracking cookies that are included in the Spy Sweeper definitions. Some Web sites store and access cookies that may contain personal information (including surfing habits, user names and passwords, and areas of interest), then share that information with other Web sites. However, some cookies can be helpful, because they contain user names and passwords that let you log in to a Web site automatically or contain preferences you set for a Web site. You can determine which ones you want to keep from the Quarantine.
Compressed Files
Sweeps compressed files such as .zip, .rar, .lzh, and .cab files, where potentially unwanted programs can hide.
The first time Spy Sweeper scans compressed files, the sweep time takes considerably longer than it would without sweeping compressed files. But after the first sweep with this option, it will skip compressed files that have not changed, thereby saving time. You may want to use this option after you have found potentially unwanted programs and want to be sure they have been removed.
If you download a compressed file in the future, you can run a sweep on just that file from Windows Explorer to save time. For more information, see the instructions for setting the Add “Sweep” option to Windows Explorer context menu.
System Restore Folder
Applies only to Windows XP.
Sweeps the folder where Windows saves system restore files. If a restore point contains a potentially unwanted program, Spy Sweeper finds it and lets you remove it. After removing the unwanted program, you can still use that restore point in the future.
All User Accounts
Sweeps registry entries for all user accounts or login IDs on your computer. If there are numerous user accounts, the sweep time will be slower than it would with the option turned off. If you deselect this option, Spy Sweeper only sweeps the registry entries for the current user account (which you used to log in).
Direct Disk Sweeping
Searches for strains of spyware that hide themselves from the Windows operating system. Normally, you should leave this option selected, as it makes sweeps run faster. Deselect this option only if you find that Spy Sweeper does not complete a sweep. Some computers need to turn off this method for sweeps to run completely.
Rootkits
Sweeps for rootkits. A rootkit or rootkit masked file is a software tool that an attacker can use to maintain access to your computer for malicious purposes.
When this option is selected, the time required for the sweep will double. Use this option only if you are particularly concerned about your computer’s security or continue to see unwanted advertising after running a full system sweep. Otherwise, turn off this option for quicker sweeps.
Verify Executable Programs
Isolates and examines suspect processes running in memory. If the process matches a Spy Sweeper definition, Spy Sweeper stops the process from running.
Behavioral Detection
Applies only to Spy Sweeper with AntiVirus.
Enables additional protection (available from Sophos® AntiVirus) by analyzing programs for behavior typical of malware before its code can execute. This option can locate many emerging threats, but on very rare occasions, a legitimate program could be classified as malicious because it shows malware-like behavior.


Configuring Custom Sweep options

Sweeps and the Quarantine > Setting sweep options > Configuring Custom Sweep options
Configuring Custom Sweep options
You can create your own settings that instruct Spy Sweeper on where to sweep and what to sweep the next time you run a Custom Sweep.
To configure options for a Custom Sweep:
1.
In the Icon panel, click Options.
2.
Make sure the Sweep tab is selected.
3.
Under Sweep Type, select Custom Sweep.
4.
Click the Change Settings link.
The Custom Sweep window opens, with a panel in the middle that provides four buttons for selecting custom options. You can select any button, in any order.
5.
In the Where to Sweep panel, you can exclude certain drives, directories, or folders from the sweep by deselecting them (click the check box to remove the green check mark [image] next to each folder or file). Typically, most spyware and other threats install on the C: drive, but you should sweep all drives periodically.
*
Spy Sweeper with AntiVirus: Spy Sweeper with AntiVirus can sweep all internal drives for viruses; you should sweep all drives regularly. Viruses can be found in all types of files and in any location.
6.
In the What to Sweep panel, you can select options as described in the following table. (Items with a check mark [image] are enabled. Click in the box to deselect or select options.)
What to Sweep (Custom options)
Options
Description
Sweep for viruses
Applies only to Spy Sweeper with AntiVirus.
Enables virus sweeping in the following areas: Memory Objects, Compressed Files, System Restore Folder, and All User Accounts (providing those options are also turned on, as described below).
Automatically quarantine viruses found
Applies only to Spy Sweeper with AntiVirus.
Places files in the Quarantine that contain a virus and does list them on the Quarantine panel during the sweep process.
If Spy Sweeper with AntiVirus is able to clean the file (remove the virus safely), it keeps the cleaned file in its original location and places a copy of the corrupted file in the Quarantine. The cleaned file is safe to use; the file in the Quarantine is not safe to use.
Windows registry
Sweeps the computer’s registry, where spyware and other potentially unwanted programs commonly create entries.
Memory objects
Sweeps the computer’s random access memory (RAM), where spyware and other potentially unwanted programs commonly load into memory.
Cookies
Sweeps for known tracking cookies that are included in the Spy Sweeper definitions. Some Web sites store and access cookies that may contain personal information (including surfing habits, user names and passwords, and areas of interest), then share that information with other Web sites. However, some cookies can be helpful, because they contain user names and passwords that let you log in to a Web site automatically or contain preferences you set for a Web site. You can determine which ones you want to keep from the Quarantine.
Sweep all user accounts
Sweeps registry entries for all user accounts or login IDs on your computer. If this option is turned off, Spy Sweeper only sweeps the registry entries for the user account you logged in with.
Compressed files
Sweeps compressed files such as .zip, .rar, .lzh, and .cab files, where potentially unwanted programs can hide. You may want to use this option after you have found potentially unwanted programs, and you want to be sure that you have removed them.
Enabling this option increases sweep time significantly. (After the first sweep with this option, Spy Sweeper will skip compressed files that have not changed, thereby saving time.)
If you download a compressed file in the future, you can run a sweep on just that file from Windows Explorer to save time. For more information, see the instructions for setting the Add “Sweep” option to Windows Explorer context menu.
System Restore folder
Applies only to Windows XP.
Sweeps the folder where Windows saves system restore files. If a restore point contains a potentially unwanted program, Spy Sweeper finds it and lets you remove it. After removing the unwanted program, you can still use that restore point in the future.
7.
In the Skip File Types panel, you can specify the file types for Spy Sweeper to ignore during a sweep. Enter the file extension and click Add to Skip List. For multiple entries, use a comma or semicolon to separate entries (for example: .mp3,.wma).
*
Note: Do not skip .dll, .exe, or .com file types, because spyware and other potentially unwanted programs typically hide in them. Be very careful when determining file types to skip. Threats can hide anywhere.
8.
In the Advanced Options panel, you can select additional sweep options, as described in the following table.
Advanced Options (Custom Options)
Option
Description
Enable Direct Disk Sweeping
Makes sweeps run faster. Normally, you should leave this option selected. Deselect this option only if you find that Spy Sweeper does not complete a sweep. Some computers need to turn off this method for sweeps to run completely.
Sweep for rootkits
Sweeps for rootkits. A rootkit or rootkit masked file is a software tool that an attacker can use to maintain access to your computer for malicious purposes.
When this option is selected, the time required for the sweep will double. Use this option only if you are particularly concerned about your computer’s security or continue to see unwanted advertising after running a full system sweep. Otherwise, turn off this option for quicker sweeps.
Verify executable programs in a protected memory space
Isolates and examines suspect processes running in memory. If the process matches a Spy Sweeper definition, Spy Sweeper stops the process from running.
Enable behavioral detection
Applies only to Spy Sweeper with AntiVirus.
Enables additional protection from potential threats by searching for behavior typical of malware programs. This option can locate many emerging threats, but on very rare occasions, a legitimate program could be classified as malicious because it shows malware-like behavior.
Automatically quarantine behavioral detections
Applies only to Spy Sweeper with AntiVirus.
Places any items found with the Behavioral Detection feature in the Quarantine.
Sweep Speed vs. Processor Usage
Allows you to provide more processing power to other programs as sweeps are running. To do this, move the slider (click with your mouse and drag) toward “Conserve processing power” at the left. This setting slows the sweep process, but provides more processing power for other programs. For the fastest sweeps, leave the slider all the way on the right.
9.
When you are finished selecting options, click OK. Your Custom Sweep settings are automatically saved and are used any time you select Custom Sweep as your sweep type.
10.
If desired, click Sweep Now and refer to Running sweeps immediately.


Running a sweep

Sweeps and the Quarantine > Running a sweep
Running a sweep
During a sweep, Spy Sweeper performs a three-step process:
1.
Sweep. Spy Sweeper searches your computer for known threats, looking for any items that match definitions in the Webroot database and that meet the criteria specified in the Option settings. (Make sure the threat definitions are always up-to-date, as described in Updating threat definitions.)
2.
Quarantine. Spy Sweeper lists all items that matched definitions and lets you determine whether to send the items to the Quarantine, where they are rendered inoperable and cannot harm your computer, or to keep the items in their current locations.
3.
Summary. Spy Sweeper summarizes actions taken for each found item.
You have two options for when to run a sweep:
•
Running sweeps immediately
•
Running sweeps on a schedule


Running sweeps immediately

Sweeps and the Quarantine > Running a sweep > Running sweeps immediately
Running sweeps immediately
You can run an immediate sweep from the Spy Sweeper Main screen or from Windows Explorer. Running a sweep from Windows Explorer is a convenient method for quickly scanning a specific file or folder.
See the instructions for:
•
Starting the sweep
•
Reviewing and quarantining items
•
Viewing the sweep summary
*
Note: Spy Sweeper may not be able to remove spyware associated with a particular program if that program is open. Before running a sweep, close all programs that are listed in the taskbar at the bottom of your screen. You do not need to close programs shown in the system tray in the lower-right corner of your screen; these programs are only open in the background.


Starting the sweep

Sweeps and the Quarantine > Running a sweep > Running sweeps immediately > Starting the sweep
Starting the sweep
Before you begin, close all programs that are open. Then follow the instructions to start a sweep from the Spy Sweeper Main screen or from Windows Explorer.
To start a sweep from the Main screen, click here for instructions:
1.
From the Spy Sweeper Main screen (Sweep panel), click the down arrow on the button to select one of these sweep types:
•
Start Full Sweep
•
Start Quick Sweep
•
Start Custom Sweep
2.
Click the button to start the sweep.
To start a sweep from Explorer, click here for instructions:
1.
Make sure you have enabled the Add “Sweep” option to Windows Explorer context menu.
You do not need to display the Spy Sweeper window; it just needs to be open in the system tray.
2.
Open Windows Explorer.
3.
Right-click the file, folder, or drive you want to sweep.
4.
From the pop-up menu, select Sweep with Spy Sweeper.
When you start the sweep (either from the Main screen or from Explorer), the Sweeping panel opens and Spy Sweeper shows its progress, including the number of items found, progress bar, current sweep location, and a list of detected items.
*
Note: If you want to pause the sweep, click Pause Sweep. When you want to resume the sweep, click Resume.
If you want to stop the sweep entirely, click Stop Sweep
On the right side of the Sweeping panel, the fields show more details about what Spy Sweeper is searching for and what it has found.
Click to see descriptions of the Sweeping panel fields.
Sweep Details
Field
Description
Search for
Total Definitions
Current Spy Sweeper definitions being used to locate potentially unwanted programs. You should update your Spy Sweeper definitions regularly to ensure that you are using the most current version (see Updating threat definitions).
Items Inspected
Memory
Program pieces that Spy Sweeper swept in your computer’s memory. Some of these pieces may be part of a potentially unwanted program.
Registry
Items in the Windows registry that Spy Sweeper searched. Some registry entries may be associated with potentially unwanted programs.
Cookies
The tracking cookies that Spy Sweeper searched. Some cookies contain personal information (including surfing habits, user names and passwords, and areas of interest).
Files/Folders
Files and folders on the selected drives that Spy Sweeper searched.
Detected
Items
The definitions matched during the sweep.
Traces
The traces of spyware or other potentially unwanted programs.
If Spy Sweeper did not detect any potential threats, it opens the Summary panel and shows details about the sweep. You can click Back to Home to return to the Home panel.
If Spy Sweeper did detect potential threats, it opens the Quarantine panel and shows details about the items it found (see Reviewing and quarantining items).


Reviewing and quarantining items

Sweeps and the Quarantine > Running a sweep > Running sweeps immediately > Reviewing and quarantining items
Reviewing and quarantining items
The Quarantine panel provides details about detected items.
Quarantine Details
Field
Description
Found
List of potential threats that Spy Sweeper found. All items are automatically selected and ready to be moved to the Quarantine.
If you performed sweeps previously and already set some items to Always Ignore or Always Quarantine, those items will not be listed in this panel (see Managing detected items automatically).
If you have Spy Sweeper with AntiVirus and you turned on the Automatically quarantine viruses found option, Spy Sweeper does not list files with detected viruses in this panel. Instead, it automatically places them in the Quarantine.
Item Details
Name
Name of the item currently selected in the list.
Category
Type of item currently selected in the list, such as “Spy Cookie.” The Glossary includes definitions for many of the categories.
Risk Rating
Red bars show the risk level of the selected item. The more bars shown, the higher the risk, as follows:
•
—Low
•
—Moderate
•
—High
•
—Very high
•
—Critical
Traces Found
Number of traces found related to this item.
Description
Description of the item. For more information, click View More Details Online.
You must be connected to the Internet to see the additional information.
From the Quarantine panel, you can select items to move to the Quarantine, which is a holding area where potential threats cannot harm your computer. Moving items to the Quarantine does not permanently delete them; you must manually delete items from the Quarantine. You can also specify that certain items stay in their current locations and remain active.
Spy Sweeper automatically pre-selects all items in preparation for moving them to the Quarantine, except those listed as a rootkit or rootkit masked file. Items with a green check mark [image] next to them will be moved to the Quarantine once you click Quarantine Selected.
*
Trial Versions: If you have the Scan-Only trial version, you cannot quarantine and remove items that Spy Sweeper finds. Click Subscribe to buy a subscription so you can remove found items.
To select items and move them to the Quarantine:
1.
Review all items listed in the Quarantine panel:
•
To see more details about an item, click on the item name in the list. Details appear on the right. If you need more information, click View More Details Online to connect to the Webroot Threat Research Center (you must be connected to the Internet).
•
To see the location (full path) to the traces found, click the arrow [image] next to an item.
2.
Determine which items you want to remove or keep. If there are any items that you want to keep, click on the box to remove the green check mark. You can also use the Deselect All or the Select All links at the bottom of the panel.
*
Note: If you know you will always want to ignore or quarantine an item for future sweeps, you can right-click an item and select Always Ignore or Always Quarantine. For more information, see Managing detected items automatically.
If you want to quarantine a rootkit, make sure you click on the box to add a green check mark. If you are uncertain whether the items listed as rootkits should be quarantined, contact technical support for assistance (see Requesting Technical Support).
3.
Click Quarantine Selected to move all selected items (with a green check mark [image]) to the Quarantine.
Spy Sweeper first encrypts each trace, removes it from its original location (so it will no longer run), then copies it to the Quarantine. Spy Sweeper does not permanently delete items during this process.
*
Spy Sweeper with AntiVirus: If Spy Sweeper with AntiVirus is able to clean the file (remove the virus safely), it keeps the cleaned file in its original location and sends a copy of the corrupted file to the Quarantine. The cleaned file is safe to use; the file in the Quarantine is not safe to use.
The quarantine process can take several minutes or longer depending on the number of traces and the speed of your computer. Once items are quarantined, you have the following options:
•
Leave in Quarantine (recommended). This is the safest action for found items, since it allows you to test your computer without the item in its original location and determine if all your programs still work properly after it’s moved. However, if the Quarantine gets too full, Spy Sweeper alerts you and you must remove some items. For more information, see Managing the Quarantine.
•
Restore. If you discover that some of your legitimate programs won’t work properly when a piece of spyware was placed in the Quarantine, you can restore that item from the Quarantine to its original location on the computer. For more information, see Restoring quarantined items.
*
Spy Sweeper with AntiVirus: Never restore an item containing a virus.
•
Delete. You can permanently delete an item if you’re sure it’s unwanted spyware or another type of threat. For more information, see Deleting quarantined items permanently.
Some detected items require that you download and use an additional tool to completely remove them from their original locations. If this is the case, the Additional Tools Required panel opens during the quarantine process. (You must be connected to the Internet to download additional tools.)
To download and use an additional tool, click here for instructions:
1.
From the Additional Tools Required panel, click the Download link to download the tool to your computer.
Spy Sweeper opens your Web browser and opens the Webroot Web site.
2.
Follow the instructions on the Web site to download the file that contains the tool.
Make a note of where you downloaded the file on your computer.
3.
Follow the instructions on the Web page to install and use the tool.
4.
From the Additional Tools Required panel, click Finish.
The Home panel opens.


Viewing the sweep summary

Sweeps and the Quarantine > Running a sweep > Running sweeps immediately > Viewing the sweep summary
Viewing the sweep summary
When Spy Sweeper is finished managing items, the Summary panel opens and provides a status of the sweep and quarantine process. The Action Taken column shows what action Spy Sweeper took for each found item.
Click to see a description of each field.
Action Taken
Description
Quarantined
Spy Sweeper moved all traces of the item to the Quarantine. For more information, see Managing the Quarantine.
Ignored
Spy Sweeper did nothing to the found item, because you deselected it in the previous panel.
Always Quarantine
Spy Sweeper automatically quarantined the item, because you have it set to Always Quarantine. For more information, see Managing detected items automatically.
Always Ignore
Spy Sweeper automatically bypassed the item, because you have it set to Always Ignore. For more information, see Managing detected items automatically.
Partially Quarantined
Spy Sweeper quarantined some traces of the item, but not all, because you deselected some traces in the previous panel.
If desired, you can view the detailed sweep session log by clicking the View Session Log link. To view the detailed log later, click the Options icon, then the Sweep tab, then click the View Session Log link.


Running sweeps on a schedule

Sweeps and the Quarantine > Running a sweep > Running sweeps on a schedule
Running sweeps on a schedule
You can schedule sweeps to run automatically based on a schedule that works for you. For example, you can schedule Spy Sweeper to run a Full Sweep once a week on a Friday at noon (you must leave your computer on).
*
Trial Versions: If you have the Scan-Only trial version, Spy Sweeper provides one scheduled sweep already created for you. That sweep will run every Monday at 2:00 am and will sweep all drives and folders on your computer. If desired, you can keep this scheduled sweep, change it, delete it, or schedule other sweeps.
*
Note: If your computer is configured for multiple user accounts (each person logs in with a unique name and password, as described in Using multiple accounts), each user can schedule their own sweeps. For your own scheduled sweep to run and to view the results, you must be logged into the user account where you created the schedule.
Spy Sweeper does not need to be open in the system tray for a scheduled sweep to run.
To schedule sweeps:
1.
In the Icon panel, click Options.
2.
Click the Schedule tab.
3.
Click Add a Scheduled Sweep.
The Schedule Wizard window opens.
4.
Select the type of sweep you want to schedule and click Next:
•
Full Sweep. If you select this type of sweep, a Schedule Wizard panel opens for entering the desired frequency and times (continue with step 5 below).
•
Quick Sweep. If you select this type of sweep, a Schedule Wizard panel opens for entering the desired frequency and times (continue with step 5 below).
•
Custom Sweep. If you select this type of sweep, there are several panels for entering custom options. Click Next after entering information for each panel; click Back if you want to return to a previous panel and change the options. (You can create multiple custom sweep schedules, each with different sweep settings.)
Click to see additional instructions for scheduling a Custom Sweep:
Custom Sweep Panels
Description
Where to Sweep
If desired, you can exclude certain drives, directories, or folders from the sweep by deselecting them (click the check box to remove the green check mark next to each folder or file).
Typically, spyware and other threats install on the C: drive, but you should sweep all drives periodically.
What to Sweep
Select the areas where you want to sweep for threats. For information, see the What to Sweep (Custom options) table.
Skip File Types
If there are any file types that you would like to skip during the sweep, enter the file extension and click Add to Skip List. For multiple entries, use a comma or semicolon to separate entries.
Do not skip .dll, .exe, or .com file types; spyware typically hides in these types of files.
Advanced Options
Select the advanced options that you want to set. For more information, see the Advanced Options (Custom Options) table.
5.
Select the frequency and time of day you want the sweep to run, then click Finish.
The Schedule tab panel opens and shows your scheduled sweep. If desired, you can repeat the previous steps to add another scheduled sweep.
To change a scheduled sweep, select it and click Change Selected. To delete a scheduled sweep, select it and click Delete Selected.
If desired, you can run one of the scheduled sweeps now by selecting the sweep and clicking Run Selected. If Spy Sweeper detects potential threats, see Reviewing and quarantining items.


Managing the Quarantine

Sweeps and the Quarantine > Managing the Quarantine
Managing the Quarantine
Once items are moved to the Quarantine (see step 3 under Reviewing and quarantining items), you must then decide how to handle each one. You have the following options:
•
Keeping quarantined items
•
Deleting quarantined items permanently
•
Restoring quarantined items
*
Trial Versions: If you have the Scan-Only trial version, you cannot quarantine and remove items that Spy Sweeper finds. Click Subscribe to buy a subscription so you can remove found items.


Keeping quarantined items

Sweeps and the Quarantine > Managing the Quarantine > Keeping quarantined items
Keeping quarantined items
You can keep items in the Quarantine, where they are rendered inoperable and cannot harm your computer. This is the safest action to take. It allows you to test your computer to make sure that all legitimate programs still function properly without a piece of spyware. If necessary, you can restore an item from the Quarantine.
If the Quarantine reaches certain size limits or when your computer’s hard drive is low on space, Spy Sweeper displays an alert in a pop-up from the system tray (lower-right corner of your screen), in the Alerts panel, or as a Spy Sweeper message window. If you see the Spy Sweeper message window, the alert is critical and space on your hard drive is very low. You should take action to make more space available. The alert message gives you three options:
•
Delete Old Items. Click to delete all items in the Quarantine that are more than seven days old. If deleting these items does not make enough space available, Spy Sweeper displays another message recommending that you go to the Quarantine and delete more items (see Deleting quarantined items permanently).
•
Manage Quarantine. Click to open Spy Sweeper with the Quarantine panel displayed, where you can selectively delete items from the Quarantine (see Deleting quarantined items permanently).
•
Remind Me Later. Click to have Spy Sweeper remind you tomorrow. If you take this action, you may want to delete other files to make more hard drive space available.


Deleting quarantined items permanently

Sweeps and the Quarantine > Managing the Quarantine > Deleting quarantined items permanently
Deleting quarantined items permanently
If your legitimate programs run properly after quarantining a potential threat, you can permanently delete the item. You will not be able to restore the item after deleting it from the Quarantine.
To permanently delete quarantined items:
1.
In the Icon panel, click Quarantine.
The Quarantine panel opens with information about items that you have quarantined, but have not permanently deleted. For more information, see the Quarantine Details table.
2.
Select each item that you want to permanently delete.
A check mark next to the item shows that it is selected and will be deleted.
3.
Click Delete Selected Items.
*
Note: If the Delete Selected Items button is unavailable (dimmed), you may not have access to this function. For more information, see Using multiple accounts.
Spy Sweeper deletes the selected items and displays information about the deletion at the bottom of the panel.


Restoring quarantined items

Sweeps and the Quarantine > Managing the Quarantine > Restoring quarantined items
Restoring quarantined items
You may need to restore a quarantined item if you discover that a program on your computer is not working correctly without it. Sometimes, a piece of spyware is an integral part of a legitimate program and is required to run that program.
In some cases, components with copy protection may not restore from Quarantine properly. You must reinstall these programs from the original media or installation file.
*
Spy Sweeper with AntiVirus: Do not restore a file with a detected virus. If Spy Sweeper with AntiVirus was able to clean the file (remove the virus safely), it keeps the cleaned file in its original location and places a copy of the corrupted file in the Quarantine. The cleaned file is safe to use; the file in the Quarantine is not safe to use.
To restore quarantined items:
1.
In the Icon panel, click Quarantine.
The Quarantine panel opens with a list of the items that you have quarantined, but have not permanently deleted. For more information, see the Quarantine Details table.
2.
Select each item that you want to restore.
A check mark next to the item shows that it is selected and will be restored.
3.
Click Restore Selected Items.Note:
*
Note: If the Restore Selected Items button is unavailable (dimmed), you may not have access to this function (see Using multiple accounts).
Spy Sweeper restores the selected items to their original locations and shows the restore status at the bottom of the panel. If a selected item is part of an e-mail attachment, Spy Sweeper saves it to the location specified in the Always save to: option of the E-mail Attachments Shield or prompts you to select the location to restore the attachment (if you selected the Ask me where to save every file option).


Managing detected items automatically

Sweeps and the Quarantine > Managing detected items automatically
Managing detected items automatically
*
Trial Versions: If you have the Scan-Only trial version, you cannot quarantine and remove items that Spy Sweeper finds. Click Subscribe to buy a subscription so you can remove found items.
Spy Sweeper allows you to set the following actions for detected items:
•
Always Quarantine. If you repeatedly see the same unwanted items during sweeps, you can instruct Spy Sweeper to always quarantine them and not list them in the Quarantine panel during a sweep. For example, you might want to quarantine certain tracking cookies that get downloaded whenever you visit a particular web site so you don’t need to always quarantine the cookie manually after every sweep.
•
Always Ignore. If you know some items are required for legitimate programs, you can instruct Spy Sweeper to ignore them and not list them in the Quarantine panel during a sweep. For example, a legitimate program might need a piece of spyware that should not be removed. In this case, you can instruct Spy Sweeper to always bypass that spyware program during sweeps so it does not get moved.
*
Note: These settings also affect shields (see Shields). When you set Always Quarantine or Always Ignore for a particular item, Spy Sweeper will not alert you to shield-related activities associated with that particular item. For example, if you specify Always Quarantine for a particular item, Spy Sweeper shields will always block activities related to it. If you specify Always Ignore for a particular item, Spy Sweeper will always permit activities related to it.
You can manage detected items automatically by using the Always Apply function. By default (the automatic setting), Spy Sweeper sets all found items to Always Ask, which means that Spy Sweeper always lists the items it detects and requires you to take action on each one (or just leave them in the Quarantine). If you set certain items to be always ignored or always quarantined, Spy Sweeper still detects the items during the sweep and includes them in its count of found items and traces, but it will not include the items in the Quarantine list, which reduces the number of items you must evaluate after sweeps.
*
Spy Sweeper with AntiVirus: Detected viruses are not displayed on the Always Apply tab.
To manage detected items automatically:
1.
In the Icon panel, click Options.
2.
Click the Always Apply tab.
The Always Apply tab opens with a list of all items Spy Sweeper has found on your computer during past sweeps.
If desired, you can filter which items appear in the list by choosing one of the following options from the drop-down list:
•
Show All Items. Displays all items found in any sweep, unless you have cleared the item from the list.
•
Always Ask. Displays only found items that are set to Always Ask, which is the default (automatic) setting.
•
Always Ignore. Displays only found items that you have set to Always Ignore.
•
Always Quarantine. Displays only found items that you have set to Always Quarantine.
To sort the list based on the heading, click a column head.
If you want to further reduce the number of items shown in the list, select ones that you don’t plan to handle with Always Quarantine or Always Ignore and click Clear from List. Clearing items does not delete them; it just makes the list on the Always Apply tab shorter for you to manage. If Spy Sweeper finds the same item again, it will be added to the list.
3.
To learn more about any item listed, click the View link. (You must be connected to the Internet to see the additional information.)
Spy Sweeper opens the Webroot Web site in your browser and displays information about the selected item to help you decide whether to ignore or quarantine the item.
4.
Select each item that you want to either quarantine or ignore every time. To select more than one item, hold down the Ctrl key and click each item you want to include.
5.
Click either Always Quarantine or Always Ignore.
If you later want Spy Sweeper to always ask about an item, you can return to the Always Ask panel, select the item again, and click Always Ask.


Shields

Shields
Shields
To configure Spy Sweeper shields to continuously monitor suspicious activities and block potentially unwanted programs from downloading to your computer, see the following topics:
•
Reviewing shield status
•
Setting shield options
•
Setting shields


Reviewing shield status

Shields > Reviewing shield status
Reviewing shield status
While Spy Sweeper is running, it actively monitors for potential threats that try to download on your computer. If it detects a suspicious item, Spy Sweeper displays an alert. For most types of items, Spy Sweeper also asks if you want to continue downloading it or if you want to block it.
*
Spy Sweeper with AntiVirus: Shields also protect against viruses attempting to download to your computer.
Spy Sweeper provides the following types of shields:
Shield type
Description
Web Browser
Protects your default home page, list of favorites, and other settings related to your Web browser. These shields can also block tracking cookies or Browser Helper Objects that try to install on your computer.
Network
Monitors network communication between your computer and other Web sites. These shields block some ads that may display in your browser and that attempt to reroute you to other, unexpected Web sites.
Windows System
Monitors activity relating to Windows system settings, which some spyware programs can change if your computer is not protected.
Startup Programs
Monitors the list of programs that start every time you start Windows. Some spyware programs add themselves to the startup list if you are not protected, which causes the spyware program to start every time you start Windows.
E-mail Attachments
Monitors file attachments in both incoming and outgoing e-mails. If Spy Sweeper detects that a file or its contents match a threat definition, it places the attachment in Quarantine, where you can decide whether to save the attachment to your computer or delete it.
To see a summary of all shields and their status, click Shields in the Icon panel to display the Shields Summary tab, as shown in the following example.
The icons in the Shields Summary panel indicate the following:
Icon
Description
—Full Protection
In the Shield Status, a green check mark indicates that all critical and recommended shields are turned on.
—Partial Protection
In the Shield Status, a yellow exclamation mark indicates that all critical shields are on, but some recommended shields are off.
In the panels below, this icon appears next to the shield that is turned off. You can click the shield name to go to the tab where you can turn the shield back on.
—Vulnerable
In the Shield Status, a red X indicates that one or more critical shields are not turned on.
In the panels below, this icon appears next to the shield that is turned off. You can click the shield name to go to the tab where you can turn the shield on. We strongly recommend keeping all critical shields turned on.
—Spyware shield
This icon appears next to shields that block spyware and potentially unwanted programs. If it is grayed out, the shield is off.
—Virus shield
Spy Sweeper with AntiVirus only.
This icon appears next to shields that block viruses. If it is grayed out, the shield is off.


Setting shield options

Shields > Setting shield options
Setting shield options
You can set several options related to shields:
•
Antivirus and behavioral protection
•
Alert displays
•
Always Apply option


Antivirus and behavioral protection

Shields > Setting shield options > Antivirus and behavioral protection
Antivirus and behavioral protection
*
Spy Sweeper with AntiVirus: These options are available only in the Spy Sweeper with AntiVirus version.
When Antivirus Protection is turned on, it provides added protection for the following options:
•
Browser Helper Object (BHO)
•
ActiveX
•
Alternate Data Stream Execution
•
System Services
•
Execution
•
File System
•
Startup Items
•
E-mail Attachments
To change the Antivirus Protection or Behavioral Protection settings:
1.
In the Icon panel, click Options.
2.
Click the Shields tab.
3.
Select or deselect the options you want. A green check mark [image] indicates the option is turned on.
Shield type
Description
Antivirus Protection
Protect against viruses
Enables the Antivirus Protection Shield.
Behavioral Detection
Enable behavioral detection
Enables additional protection from potential threats by searching for suspicious behavior typical of malware programs. This option can locate many emerging threats, but on very rare occasions, a legitimate program could be classified as malicious because it shows malware-like behavior.
Automatically quarantine behavioral detections
Places any of the items found with Behavioral Detection in the Quarantine.


Alert displays

Shields > Setting shield options > Alert displays
Alert displays
When Spy Sweeper detects activity related to any of the shield settings, it displays an alert in one of three ways:
•
An alert window. These alerts require immediate action. They normally relate to a program trying to install itself or make a change on your computer.
In some cases, the alert window provides you with the option of blocking the detected item or allowing it. It also allows you to select Always take the selected action..., so that if Spy Sweeper frequently detects this item, it will always handle it based on your selection here.
•
An alert pop-up near the system tray (lower-right corner of your screen). These alerts do not require you to take action immediately.
Click the link in the pop-up or display the Spy Sweeper window and click Alerts in the Icon panel to see the details. Some pop-ups are informational only and do not have a link for more information in the Alerts panel.
•
On the Alerts panel in the Spy Sweeper Main window (see the example in Monitoring alerts). These alerts also do not require you to take action immediately.
For alerts that do not require immediate attention, you can determine how they open in Spy Sweeper: either in a window in the Alerts panel or as a pop-up near the system tray.
To select the alert method:
1.
From the Icon panel, click Options.
2.
Click the Shields tab.
3.
Under Shield Alerts Method, select either:
•
Show notification above system tray: Shows a small, pop-up window above the system tray (lower-right corner of your screen) whenever Spy Sweeper needs to alert you to an activity that does not require immediate action. If the pop-up has a link, you can click it for more details.
•
Open Spy Sweeper to show alert details: Opens the Spy Sweeper Alerts panel for most types of alerts that require additional information. Some alerts are informational pop-ups, which open only as a pop-up above the system tray.


Always Apply option

Shields > Setting shield options > Always Apply option
Always Apply option
In the Always Apply tab, you can specify that certain items are automatically handled when detected by sweeps or shields:
•
Always Quarantine. If you specify that a certain item should always be quarantined, Spy Sweeper will not alert you and will automatically block activities related to it.
•
Always Ignore. If you specify that a certain item should always be allowed (ignored by Spy Sweeper), Spy Sweeper will not alert you and will automatically permit activities related to it.
By default (the automatic setting), Spy Sweeper sets all found items to Always Ask, which means that Spy Sweeper always alerts you about the item and requires you to take action on it. To change this setting for a particular item, see Managing detected items automatically.


Setting shields

Shields > Setting shields
Setting shields
You can set shields to continuously monitor and block common activities and infections on your computer. Spy Sweeper provides the following types of shields:
•
Web Browser Shields
•
Network Shields
•
Windows System Shields
•
Startup Programs Shield
•
E-mail Attachments Shield


Web Browser Shields

Shields > Setting shields > Web Browser Shields
Web Browser Shields
You can modify the shields that protect your default home page, list of favorites, and other settings related to your Web browser.
To change Web Browser Shield settings:
1.
In the Icon panel, click Shields.
The Shields Summary tab opens, showing a summary of the available shields and their status. (If any shields are dimmed, you do not have access to them; see Using multiple accounts.)
2.
Click the Web Browser tab.
3.
Select the options you want to use.
Web Browser Shields
Option
Description
Tracking Cookies
Watches for known tracking cookies (matching those in the Spy Sweeper definitions) and removes them. Tracking cookies are cookies that can track your Web activities. These may include cookies that contain user names, passwords, or similar information that you enter on some Web sites.
IE Favorites
Protects your Internet Explorer favorites. Whenever a Web site tries to change your favorites, Spy Sweeper alerts you and lets you accept or reject the change. Some Web sites add entries to your favorites without informing you; this shield ensures that you are aware of attempted changes.
Even if Spy Sweeper is not open when your favorites change, Spy Sweeper detects the changes and alerts you the next time you start Spy Sweeper.
IE Security
Protects your Internet Explorer security settings (select Tools > Internet Options and click the Security tab). Whenever a program tries to change these settings, Spy Sweeper alerts you and lets you accept or reject the change. Some programs change these options without informing you; this shield ensures that you are aware of attempted changes.
Browser Helper Object (BHO)
Watches for the installation of Browser Helper Objects (BHOs). Whenever a BHO tries to install itself, Spy Sweeper alerts you and lets you accept or reject the change. BHOs are add-on programs that work with your browser. Some spyware programs add BHOs without your knowledge; this shield ensures that programs do not add a BHO without your consent.
If you have Spy Sweeper with AntiVirus, the virus BHO Shield also alerts you whenever a BHO tries to install itself and gives you the option to accept or reject the change.
BHO Shield Options button:
Click to change the BHOs that start with Internet Explorer. See Editing BHOs used by Internet Explorer.
Editing BHOs is for advanced users. Deselecting BHOs could cause your browser to not work properly or cause your computer to be unstable.
IE Hijack
Protects various Internet Explorer functions, such as the search page, error pages, and other default (automatic) pages that Internet Explorer opens. Whenever a program tries to change these pages, Spy Sweeper alerts you and lets you accept or reject the change. Some programs change (“hijack”) these pages without informing you; this option ensures that you are aware of attempted changes.
Even if Spy Sweeper is not open when these pages change, it detects the changes and alerts you the next time you start Spy Sweeper.
IE Hijack Shield Options button:
Click to edit the list of Hijack Shields. See Editing the IE Hijack Shield settings.


Editing BHOs used by Internet Explorer

Shields > Setting shields > Web Browser Shields > Editing BHOs used by Internet Explorer
Editing BHOs used by Internet Explorer
You can edit the BHOs that run when you start Internet Explorer. BHOs are add-on programs that work with your browser. Some spyware and other potentially unwanted programs add BHOs without your knowledge.
*
Caution: Editing browser add-on items is for advanced users. Editing items in the list could cause your browser to not work properly or cause your computer to be unstable. Edit with extreme caution.
1.
From the Shields/Web Browser tab, click BHO Shield Options.
The Edit Browser Helper Objects window opens, with a list of the installed BHOs. Items with a check mark start whenever Internet Explorer starts. To see more information about an item, select it and click More Details. Not all programs provide additional details.
2.
Deselect any BHOs you do not want to start whenever Internet Explorer starts.
3.
Click OK.


Editing the IE Hijack Shield settings

Shields > Setting shields > Web Browser Shields > Editing the IE Hijack Shield settings
Editing the IE Hijack Shield settings
You can edit the individual IE Hijack Shield settings, including the default (automatic) home and search pages for Internet Explorer.
1.
From the Shields/Web Browser tab, click IE Hijack Shield Options.
A window opens for editing the settings.
2.
Select the options you want to use.
IE Hijack Shield Settings
Option
Description
IE Home Page Shield
Protects the Web site set as your home page (the site that opens automatically when you start Internet Explorer or when you click the Home button). Some spyware programs change your home page.
Use This Page
Enter the desired Web site address. The address must be in the following format: http://www.webroot.com.
Alert me before restoring this setting
Select to display an informational alert when Spy Sweeper automatically changes the home page back to the site listed above. To avoid seeing alerts about changes to your home page, do not select this option.
IE Search Page Shield
Protects the Web site set as your search page (the site that opens automatically when you click the Search button in Internet Explorer). Some spyware programs change your search page.
Use This Page
Enter the desired Web site address for performing Web searches. The address must be in the following format: http://www.webroot.com.
Alert me before restoring this setting
Select to display an informational alert when Spy Sweeper automatically changes the search page back to the site listed above. To avoid seeing alerts about changes to your search page, do not select this option.
Advanced Settings
Provides advanced configuration options used only in error conditions and/or when a system is severely infected. Use these options to repair your Internet Explorer settings when a browser hijacker embeds itself deeply in your browser. Webroot customer support is available to assist.
User
Use this drop-down list to change settings to the current user account. These settings effectively override the system settings below. Enter the Web site addresses in the following format: http://www.webroot.com. You can also enter the path to a file.
System
Use this drop-down list to change settings for all user accounts, unless a limited user has customized the setting. (Only the computer administrator can change this setting; see Using multiple accounts.) Enter the Web site addresses in the following format: http://www.webroot.com. You can also enter the path to a file.
Alert me before restoring this setting
Select to display an informational alert when Spy Sweeper automatically changes the pages listed in the Advanced Settings drop-down list back to the site or path listed in the text field. To avoid seeing these alerts, do not select this option.
3.
If you want to reset all of the Internet Explorer page settings back to the defaults (automatic options) used when Internet Explorer was first installed, click Reset IE Page Settings to Defaults.
4.
Click OK.


Network Shields

Shields > Setting shields > Network Shields
Network Shields
You can modify the shields that monitor network communication between your computer and other Web sites. These communication settings are vulnerable to the effects of spyware and viruses and can be changed without your permission. Network Shields block some ads that may open in your browser. They also stop Web sites from sending you to other, unexpected Web sites.
To change Network Shield settings:
1.
In the Icon panel, click Shields.
The Shields panel opens, showing a summary of the available shields and their status. (If any shields are dimmed, you do not have access to them; see Using multiple accounts.)
2.
Click the Network tab.
3.
Select the options you want to use.
Network Shields
Option
Description
Common Ad Sites
Blocks banner and other advertising from common advertising sites. When you go to a Web site that has advertising from one of the blocked sites, you may see a small graphic that indicates a broken link to a graphic (typically a red X in a box). This just shows where the blocked ad would display. Spy Sweeper updates these sites when you update your definitions.
Hosts File
Monitors the Hosts file for any changes. Some programs will add or change the IP address for a Web site in the Hosts file. When you try to go to the added or changed Web site, you will really go to a different Web site, such as an advertising site. This shield ensures that programs do not change an IP address without your knowledge.
Hosts File Shield Options button:
Click to edit the Hosts file. For more information, see Editing the Hosts File.
Internet Communication
Monitors communication from your computer to known Web sites that are related to potentially unwanted programs. Spy Sweeper includes a list of known sites with its definitions.
If Spy Sweeper detects an attempt to communicate with a site on the list, it displays a pop-up alert in the system tray (lower-right corner of your screen) telling you that access to the site was blocked.


Editing the Hosts File

Shields > Setting shields > Network Shields > Editing the Hosts File
Editing the Hosts File
*
Caution: This section describes highly technical features associated with how your computer locates the actual address of a Web site. The features described here will not damage your computer or remove anything you need if you enable them, but the underlying technology is complex if you are not aware of how IP addressing works.
You can configure Spy Sweeper to continuously monitor several functions related to the Hosts file. The Hosts file is a Windows file that helps direct your computer to a Web site using Internet Protocol (IP) addresses. Your Web browser uses the IP address to actually connect to a site.
When you go to a Web site, your computer first looks in the Hosts file to see if it already knows where to go. If the domain (for example, webroot.com) is listed, your computer goes directly to the IP address listed in the Hosts file. If the domain is not in the Hosts file, your computer looks up the information from the Internet (a slightly slower process).
You can use the Hosts file to your advantage by routing certain domains, such as advertising sites, to a dead end. This will block tracking cookies and other monitoring programs. However, some spyware and adware will route (or “hijack”) certain domains to false addresses (for example, by making a commonly used search site open to a porn site).
Using Spy Sweeper to manage the Hosts file, you can block a lot of unwanted adware activity, while preventing your Web browsing from being hijacked. When Spy Sweeper detects activity related to the Hosts File Shield, it displays an alert.
To edit the Hosts file:
1.
From the Shields/Network tab, click Hosts File Shield Options.
The Edit Hosts File window opens, showing entries that you, your IT department, or potentially unwanted programs have added to your Hosts file. If you have the Common Ad Sites Shield turned on, it does not display the blocked ad sites.
Spy Sweeper compares the IP address of each entry in the Hosts file to the correct address on a domain name system (DNS) server. Any address that does not match and is not set to the local machine address (127.0.0.1) is flagged as possibly hijacked [image].
2.
Select the entries you want to remove.
3.
Click Delete Selected.
Spy Sweeper deletes the selected entries from your Hosts file.
4.
Click Close.


Windows System Shields

Shields > Setting shields > Windows System Shields
Windows System Shields
You can modify the shields that monitor Windows system settings, which some spyware can change if not protected.
To change Windows System Shield settings:
1.
In the Icon panel, click Shields.
The Shields panel opens, showing a summary of the available shields and their status. (If any shields are dimmed, you do not have access to them; see Using multiple accounts.)
2.
Click the Windows System tab.
3.
Select the options you want to use.
Windows System Shields
Option
Description
ActiveX
Watches for programs that install ActiveX technology on your computer. Whenever a program tries to install ActiveX technology, Spy Sweeper alerts you and lets you continue the installation or stop it.
ActiveX technology is a group of functions developed by Microsoft that lets programs share information. Many legitimate programs use ActiveX, but some potentially unwanted programs also use ActiveX to install themselves.
If you have Spy Sweeper with AntiVirus, this option also blocks any viruses that try to install ActiveX technology.
ActiveX Shield Options button:
Click to edit the ActiveX Shield option.
Prompt only for detection of known items:
This option watches for only known items from the Spy Sweeper definitions that try to install ActiveX technology. Leaving this option turned on will reduce alert notifications, but could permit a new threat to install that is not yet included in the Spy Sweeper definitions.
Alternate Data Stream Execution
Watches for programs that try to start from an Alternate Data Stream (ADS). Turning on this shield lets Spy Sweeper alert you if a program tries to start from an ADS.
ADS is a highly technical way to hide images, data, or code in a file and can be used to hide malicious code. The hidden content is impossible to detect using regularly available tools, such as Windows Explorer.
If you have Spy Sweeper with AntiVirus, this option also actively watches for viruses that try to start from an alternate data stream.
Windows Messenger Service
Applies only to Windows 2000 and XP. Not available for Vista.
Turns off and actively watches the Microsoft Messenger Service. This service is not an instant messaging program and does not affect your use of instant messaging. This service is often used for sending spam (unwanted e-mail) and creating pop-up ads. Turning off the service stops these types of spam and pop-ups.
If your computer is in your home, you can turn off this service without any problem. If you work in a corporate environment, contact your system administrator to find out if your company uses the service to communicate with company employees. If you are not sure, leave the service turned on until you find out.
Keylogger
Alerts you if any keylogger programs are detected. A keylogger is a type of system monitor that has the ability to monitor all keystrokes on your computer, which can capture your credit card numbers, passwords, and other personal information. If this shield detects a keylogger and displays an alert, you should update your definitions (see Updating threat definitions), run a sweep (see Running sweeps immediately), and determine if you want to remove or keep the keylogger.
System Services
Monitors the system registry and protects against unwanted services and drivers from installing.
If you have Spy Sweeper with AntiVirus, this option also blocks any viruses that try to install in the system registry.
System Services Shield Options button:
Click to edit System Services Shield options.
Highest Security:
Select this option to display an alert related to any item detected by the System Services Shield.
High Security:
Select this option to allow a signed service, but display an alert when an unsigned service or a potential malware application is detected.
Moderate Security:
Select this option to prompt only when potential malware is detected.
Execution
Watches for known items from the Spy Sweeper definitions that try to install themselves. Whenever a potentially unwanted program tries to install itself, Spy Sweeper alerts you and allows you to block or allow the installation.
This option also actively watches for potentially unwanted programs that try to start when you start a program and when you save to the disk drive. Whenever Spy Sweeper detects a potentially unwanted program in either of these situations, Spy Sweeper alerts you and allows you to block or allow the action. If you block the action, Spy Sweeper places the file that tried to install, start, or save itself in Quarantine. You can then remove or restore the file. For more information, see Managing the Quarantine.
If you have Spy Sweeper with AntiVirus, this option also watches for known viruses that try to install themselves.
Execution Shield Options button:
Click to edit Execution Shield options.
Automatically quarantine potentially unwanted programs detected by this shield: Automatically stops the installation, startup, or saving of known items from the Spy Sweeper definitions and places the file that tried to install, start, or save itself in Quarantine, without alerting you.
Automatically quarantine viruses detected by these shields: If you have Spy Sweeper with AntiVirus, this option automatically stops the installation, startup, or saving of known viruses that are in the Spy Sweeper definitions and places the file that tried to install, start, or save itself in Quarantine, without alerting you.
Scan for viruses when starting applications: If you have Spy Sweeper with AntiVirus, this option watches for viruses that try to start when you start a program on your computer, alerts you, and allows you to block or allow the startup. Select this option if you want stronger protection against viruses. If programs take longer to start than you want, deselect this option.
Verify executable programs in protected memory space before starting: Isolates and examines suspect processes when you start a program and looks for potentially unwanted programs. The process isolation gives Spy Sweeper a better chance to see what the process does. If the process matches a Spy Sweeper definition, Spy Sweeper alerts you and allows you to block or allow the startup. Select this option if you want stronger protection against potentially unwanted programs. If programs take longer to start than you want, deselect this option.
File System
Watches for programs during write and read operations.
If you have Spy Sweeper with AntiVirus, this option also blocks any viruses that try to install during write and read operations.
File System Shield Options button:
Click to edit File System Shield options.
Scan on Write: Monitors files or programs that attempt to install (write) to your computer.
Scan on Read: Monitors programs as your computer attempts to read them. You can specify that only the list of file types (extensions) are included in the scan or that all file types are included. If you want to add a file type to the list, enter it in the field and click Add to Extensions to Scan. You can also delete items from the list by clicking on the file extension and clicking Delete Selected. To return the list to its original contents, select Reset List to Default.
Automatically quarantine potentially unwanted programs detected by this shield: Automatically stops the installation, startup, or saving of known items from the Spy Sweeper definitions and places those items in Quarantine, without alerting you.
Automatically quarantine viruses detected by this shield: If you have Spy Sweeper with AntiVirus, this option automatically stops the installation, startup, or saving of known viruses that are in the Spy Sweeper definitions and places those viruses in Quarantine, without alerting you.


Startup Programs Shield

Shields > Setting shields > Startup Programs Shield
Startup Programs Shield
You can set a shield to monitor the list of programs that start every time you start Windows. Some spyware add themselves to this startup list if you are not protected, which causes the spyware program to start every time you start Windows. Spy Sweeper also lets you edit the startup items.
*
Caution: Editing startup items is for advanced users. Some items listed may be required by Windows or other programs. Deselecting items from the list could cause your computer to not start properly or cause some programs not to work. Edit with extreme caution.
To change the Startup Programs Shield settings:
1.
In the Icon panel, click Shields.
The Shields panel opens, showing a summary of the available shields and their status.
2.
Click the Startup Programs tab.
3.
Select the options you want to use.
Startup Programs Shield
Option
Description
Startup Items
Watches for attempts to add any item to your startup list. Select an option below to set when you want Spy Sweeper to alert you.
If you have Spy Sweeper with AntiVirus, this option also actively watches for attempts to add viruses to your startup list.
Startup Programs Shield Options... button:
Click to edit Startup Items Shield options.
Alert me only for suspected spyware and virus changes to startup items: Watches for attempts to add potentially unwanted programs, such as spyware, adware, and suspect programs, to your startup list. Some spyware will add themselves to your startup list, so that it will always run on your computer. This shield ensures that spyware programs do not add themselves to your startup list without you being aware of it.
If you have Spy Sweeper with AntiVirus, this option also watches for viruses.
Alert me for all startup item changes: Watches your startup list for all changes. Some potentially unwanted programs will add themselves to your startup list, so that it will always run on your computer. This shield ensures that you are always alerted when a program tries to add an item to your startup list.
Checked items automatically start when Windows starts: The items in this list start on your computer when Windows starts. To see more information about an item, select it and click More Details (however, not all programs provide additional details). If you do not want an item to start with Windows, deselect its checkbox.
Some items listed may be required by Windows or other programs and may cause your computer to not start properly if removed. Edit with caution.


E-mail Attachments Shield

Shields > Setting shields > E-mail Attachments Shield
E-mail Attachments Shield
You can set a shield to monitor file attachments for both incoming and outgoing e-mails. If Spy Sweeper detects that an attachment or its contents match a threat definition, it replaces the content of the attachment with an alert message that describes what it found. Spy Sweeper will move the original attachment to the Quarantine, where you can decide whether to save it to your computer or delete it. You can also specify that Spy Sweeper always restores quarantined e-mail attachments to a specific directory.
*
Note: The E-mail Attachments Shield does not support e-mail clients that use Secure Socket Layers (SSL).
To change the E-mail Attachments Shield settings:
1.
In the Icon panel, click Shields.
The Shields panel opens, showing a summary of the available shields and their status.
2.
Click the E-mail Attachments tab.
3.
Select the options you want to use.
E-mail Attachments Shield
Option
Description
E-mail Attachments
Monitors e-mail attachments for incoming e-mail (through POP3 protocol) and outgoing e-mail (through SMTP protocol). If it detects a suspicious attachment, it replaces the content of the original file with an alert message describing the potential threat, and then places the original file in Quarantine.
Note: Some firewall configurations might prevent the E-Mail Attachments Shield from monitoring e-mail. For more information, see Communication errors with the E-mail Attachments Shield.
If you have Spy Sweeper with AntiVirus, this option also blocks any e-mail attachments where a virus has been detected.
E-mail Attachments Shield Options... button:
Click to edit E-mail Attachments Shield options.
Restoring Attachments:
Select Ask me where to save every file if you want to be prompted for every quarantined attachment that you want restored or select Always save to: to create a default location for restored e-mail attachments. You can enter a file location in the field or click Select Location to browse directories from Windows Explorer.
E-mail Port Settings:
Enter the POP3 port number for incoming mail and the SMTP port number for outgoing mail. Spy Sweeper automatically displays port numbers that most computers use for e-mail communications. If necessary, change the port numbers or contact your ISP (Internet Service Provider) for the port numbers.
Communication errors with the E-mail Attachments Shield
When the E-Mail Attachments Shield is turned on, Spy Sweeper intercepts all traffic on the POP3 and SMTP ports used for e-mail communications so it can scan attachments for spyware and viruses. By default (the automatic setting), Spy Sweeper monitors port 110 (POP3) for incoming mail and port 25 (SMTP) for outgoing mail, but you can change the port numbers in the E-mail Attachments Shield settings, if necessary.
Some firewall configurations might prevent Spy Sweeper from intercepting e-mail traffic. If this is the case, the following alert appears every time an e-mail is sent or received:
If this alert appears because a firewall application is blocking Spy Sweeper, you need to configure your firewall application to allow Spy Sweeper to monitor the port traffic. For more information about resolving communication issues between your firewall application and Spy Sweeper, you can contact Webroot Technical Support or click the following link (you must be connected to the Internet):
Firewall Configuration Information
If the alert appears only once or just periodically, the problem may be due to an inactive network configuration or a non-responsive SMTP or POP server at the ISP (Internet Service Provider). This is a temporary situation; the E-Mail Attachments Shield should be able to function normally once communication is restored. If the message appears frequently when these types of communication errors occur, you can select “Do not show this message again,” so the alert only appears in the session log (see Viewing the session log).


Options and Alerts

Options and Alerts
Options and Alerts
To get updates, change program settings, and monitor logs and alerts, see the following topics:
•
Updating Spy Sweeper
•
Setting Spy Sweeper program options
•
Viewing the session log
•
Viewing alerts and news


Updating Spy Sweeper

Options and Alerts > Updating Spy Sweeper
Updating Spy Sweeper
You have the following options for updating Spy Sweeper:
•
Updating threat definitions
•
Updating the Spy Sweeper program version
•
Renewing your subscription


Updating threat definitions

Options and Alerts > Updating Spy Sweeper > Updating threat definitions
Updating threat definitions
Because online threats are constantly evolving, make sure that Spy Sweeper is using the most recent threat definitions before running sweeps. These definitions identify spyware and other potentially unwanted programs, which Spy Sweeper uses as a basis for detecting suspicious items during sweeps. Webroot frequently updates these definitions and makes them available for you to download (manually or automatically) from the Webroot Web site.
*
Spy Sweeper with AntiVirus: Updates include both spyware and virus definitions.
For the highest level of protection, Spy Sweeper is already configured to check for new threat definitions and will download them automatically when available. (You must be connected to the Internet.) Spy Sweeper will check for updates daily, but you can change the frequency to hourly.
If you don’t want definitions automatically downloaded, you can turn off automatic downloads and manually download them instead. Spy Sweeper can notify you when updates are ready. You should check for updates to the definitions at least once a week. To see when you last updated them, open the Spy Sweeper Main window (Home panel) and read the Updates section.
*
Trial Versions: If you have a trial version, you can download updates within your trial period.
To check or change settings for automatic updates, click here for instructions:
1.
In the Icon panel, click Options.
2.
Click the Update tab.
3.
Under Auto-Update, make sure both of these options are selected:
•
Automatically check for Spy Sweeper updates. If you deselect this option, Webroot cannot notify you of either threat definition updates or program updates, nor can it automatically send updates to you (the next option is automatically disabled).
•
Automatically download Spy Sweeper definitions if available. If you deselect this option, you must download updates manually. If desired, you can also change the frequency from Daily to Hourly.
Updates will automatically download as long as you are connected to the Internet.
To update the Spy Sweeper definitions manually, click here for instructions:
1.
Make sure you are connected to the Internet.
2.
In the Icon panel, click Options.
3.
Click the Update tab.
4.
Under Auto-Update, deselect the Automatically download Spy Sweeper definitions if available option. (You should leave the Automatically check for Spy Sweeper updates option enabled, so Spy Sweeper can notify you when new definitions are ready.)
5.
Under Update Now, click Update Spy Sweeper.
Spy Sweeper opens your Web browser and displays the Webroot Web site. The Web site indicates whether your version of the program is current or if an update is available. If new definitions are available, Spy Sweeper downloads and installs them from the Webroot Web site. A progress bar shows the status of the download.


Updating the Spy Sweeper program version

Options and Alerts > Updating Spy Sweeper > Updating the Spy Sweeper program version
Updating the Spy Sweeper program version
While your subscription is valid, you can install updates to the Spy Sweeper program when they are available. (You must be connected to the Internet.)
*
Note: Do not uninstall the previous version of Spy Sweeper. Installing the new version over the old one retains the quarantine information from previous sweeps and lets you retain program settings.
To update the Spy Sweeper program version:
1.
In the Icon panel, click Options.
2.
Click the Update tab.
3.
Click Update Spy Sweeper.
Spy Sweeper opens your Web browser and displays the Webroot Web site. The Web site indicates whether your version of the program is current or if an update is available.
Keep the Automatically check for Spy Sweeper updates option enabled. If you deselect this option, you will not be notified of either threat definition updates or Spy Sweeper program updates.


Renewing your subscription

Options and Alerts > Updating Spy Sweeper > Renewing your subscription
Renewing your subscription
When your subscription is within 30 days of expiration, you will see a red banner and a Renew button at the top of the Spy Sweeper main window. Click Renew to renew your subscription. You can also renew your subscription any time from the Webroot Web site (www.webroot.com) by clicking the Renew your Spy Sweeper subscription link. The renewal adds time to your existing subscription, so you never lose any subscription time that you have paid for.
If you are not sure when your subscription ends, check the Subscription Status section of the Home panel. If you see a Check Status link, click that link to see up-to-date subscription information.


Setting Spy Sweeper program options

Options and Alerts > Setting Spy Sweeper program options
Setting Spy Sweeper program options
You can set program options that allow you to control the behavior of Spy Sweeper, such as whether tool tips are displayed and whether you can run sweeps from Explorer.
To set Spy Sweeper program options:
1.
In the Icon panel, click Options.
2.
Click the Program tab.
3.
Select the options you want to use. (Items with a green check mark [image] are enabled. Click in the box to deselect or select options.)
Program Options
Display
Display splash screen on Spy Sweeper startup
Displays the Spy Sweeper splash screen whenever Spy Sweeper first starts.
Show tooltips
Turns on explanatory text (a tooltip) that appears when you hold your mouse pointer over options and buttons in Spy Sweeper.
Add “Sweep” option to Windows Explorer context menu
Adds the Sweep with Spy Sweeper menu option to Windows Explorer. When you right-click a file or folder from Explorer, you can select this option to run a sweep at the selected location. For more information, see Starting the sweep.
If this option is unavailable (dimmed), you may not have access to it (see Using multiple accounts).
Perform “Check Status”
on startup
Automatically performs a license check when Spy Sweeper starts to provide up-to-date subscription information.
Proxy Settings
Proxy Settings ...
Allows you to enter a domain and port number for a proxy server, if you use one to connect to the Internet. Click the Proxy Settings ... button. Another window opens that allows you to select:
•
Use Internet Explorer proxy settings
•
Use custom proxy settings
If you select Use custom proxy settings, enter the fully qualified domain name of the server (for example, proxy.company.com) and the port number. Click OK when you have changed the setting.
Other Options
Load Spy Sweeper at Windows startup
Starts Spy Sweeper whenever you start Windows, so it is always protecting your computer. We recommend keeping this option enabled. If you deselect this option, but have a scheduled sweep set to When I Log On, Spy Sweeper still loads with Windows.
If this option is unavailable (dimmed), you may not have access to it (see Using multiple accounts).
Enable password protection
Lets you create a password to protect access to the following Spy Sweeper areas: Options, Shields, Alerts, Quarantine, and shut down. Spy Sweeper remembers your password as long as you are actively using the program. After five minutes of inactivity or after you minimize the program, it will ask for the password again.
To enable a password, click this option. A window appears where you can enter the password and confirm it. Be sure to remember your password when using the Spy Sweeper program.
Report Potential Threat
Report Potential Threat
Lets you help the Webroot Threat Research team identify new spyware and viruses. If you encounter something that you suspect is a potential threat, click Report Potential Threat. See Reporting potential threats for more information.


Viewing the session log

Options and Alerts > Viewing the session log
Viewing the session log
The session log shows all Spy Sweeper activity for sweeps, shields, updates, and any errors that may have occurred.
To view the session log:
1.
In the Icon panel, click Options.
2.
Click the View Session Log link at the bottom of the panel.
A Session Log panel opens and shows all activity related to Spy Sweeper operations. By default (the automatic setting), Spy Sweeper shows the last 20 log sessions, but you can modify that amount by changing the value in the Maximum number of sessions saved field at the top, right of the panel.
If you want to save log activity to a file, click Save to File and enter a log name.
You can clear old log activity by clicking Clear Session Log.


Viewing alerts and news

Options and Alerts > Viewing alerts and news
Viewing alerts and news
The Alerts and News panel provides access to current news and provides a method for Spy Sweeper to alert you about threats and status.
Viewing Spy News
In the Alerts and News panel, the Spy News link provides access to tips, tricks, and information about potentially unwanted programs, such as spyware and other potential threats. Click the Spy News link from the Home panel. Spy Sweeper opens your Web browser and displays the latest news.
Monitoring alerts
Spy Sweeper displays alerts to warn you about suspicious items detected on your computer and to inform you about status, such as a missed sweep schedule. There are two types of alerts:
•
Threat-related alerts. When a potential threat is detected, such as spyware trying to download, Spy Sweeper opens an alert window that requires you to take action (block the item or continue with the download).
•
Status alerts. For alerts that do not require immediate action, such as a missed scheduled sweep, Spy Sweeper displays status information in either a pop-up near the system tray (lower-right corner of your screen) or on the Alerts panel in the Spy Sweeper window. For more information about changing how status alerts are displayed, see Alert displays.
To read alert details, click the link in the system tray pop-up (some pop-ups are informational only and do not have a link for more details). You can also click Alerts in the Icon panel or under Alerts and News in the Spy Sweeper main window.


Webroot Support

Webroot Support
Webroot Support
You can contact Webroot through our Web site for:
•
Requesting Technical Support
•
Accessing the Knowledge Base
•
Reporting potential threats


Requesting Technical Support

Webroot Support > Requesting Technical Support
Requesting Technical Support
Technical support is available from the Webroot Web site. Submit a trouble ticket to our service representatives at:
www.webroot.com/support
*
Note: If clicking the link above does not open your browser and take you to the Webroot Support page, copy the text of the link and paste it into your browser.
We make every effort to respond to your request on the same day you send it, but please allow up to 48 hours.


Accessing the Knowledge Base

Webroot Support > Accessing the Knowledge Base
Accessing the Knowledge Base
The Webroot Knowledge Base contains many articles that describe common issues and resolutions. These articles are constantly updated, expanded, and refined by Webroot support professionals to ensure that you have access to the very latest information.
To access this database, visit the Support Center at:
support.webroot.com
*
Note: If clicking the link above does not open your browser and take you to the Support Center, copy the text of the link and paste it into your browser.


Reporting potential threats

Webroot Support > Reporting potential threats
Reporting potential threats
If you believe that Spy Sweeper is not finding something on your computer that you suspect is spyware, adware, a virus, or some other potentially unwanted program, you can report it to the Webroot Threat Research Center. Webroot follows up on all reports to determine if the item should be added to threat definitions.
*
Trial Versions: If you have a trial version, you cannot report potential threats.
To report spyware or viruses:
1.
Make sure you are connected to the Internet.
2.
In the Icon panel, click Options.
3.
Click the Program tab.
4.
Click Report Potential Threat.
The Report Potential Threat window opens.
5.
Enter a description of the issue in the Comments field, to help Webroot identify the potential threat. You can also enter your e-mail address, so that Webroot can contact you about the problem.
Spy Sweeper will automatically include a log report, which contains information about the items found on your computer. If you want to view the report that will be sent, click View Report.
6.
Click Send Report.


Glossary

Glossary
Glossary
ActiveX
ActiveX technology is a group of functions developed by Microsoft that let programs share information. Many legitimate programs use ActiveX, but some spyware also uses ActiveX to install itself.
adware
Adware is a type of software that may display advertisements on your system. Some adware may also hijack Web searches, meaning it may reroute your Web searches through its own Web page. It may change your default home page to a specific Web site. Adware generally propagates itself using dialog boxes, various social engineering methods, or through scripting errors. Adware and BHOs are often bundled with various free software programs, such as clocks, messengers, alerts, and software such as screensavers, cartoon cursors, backgrounds, sounds, etc. Removing adware bundled with free software programs may cause the software to stop operating. These adware programs may also cause slowing of your Web browser and system performance issues.
Alternate Data Stream (ADS)
An Alternate Data Stream is a highly technical way to hide images, data, or code in a file and can be used to hide malicious code. The hidden content is impossible to detect using regularly-available tools, such as Windows Explorer.
Behavioral Detection
Additional protection against programs that may not match a threat definition, but exhibit behavior typical of malware. These programs are stopped from executing before they can cause damage. The Behavioral Detection option can locate many emerging threats, but on very rare occasions, a legitimate program could be classified as malicious because it shows malware-like behavior. This detection method is only available from Spy Sweeper with AntiVirus.
Browser Helper Objects (BHOs)
Browser Helper Objects are add-on programs that work with your browser. Some spyware programs add BHOs without your knowledge.
cleaning
A process in which Spy Sweeper with AntiVirus removes infected portions of a file where a virus has been detected. If it can remove the virus successfully, Spy Sweeper with AntiVirus restores the cleaned file to your computer in its original location and places a copy of the corrupted file in the Quarantine. The cleaned file is safe to use; the file in the Quarantine is not safe to use.
Custom Sweep
A tailored sweep that lets you target specific areas on your computer. Spy Sweeper saves your custom sweep settings and uses them as the basis for any custom sweep that you configure.
definitions
A definition is a set of fingerprints that characterize a potentially unwanted program, such as spyware or adware, or that identifies types of viruses. Webroot regularly updates these definitions to provide better protection against the latest versions of potentially unwanted programs discovered by Spy Sweeper.
dialer
Dialers may disconnect your computer from your Internet Service Provider (ISP) and reconnect you to the Internet using an expensive toll or international phone number. Dialers can accrue significant phone charges and can run in the background, hiding their presence. They generally propagates itself using dialog boxes, various social engineering methods, through scripting errors, or may be delivered with a Trojan horse. The Federal Trade Commission recommends that you dispute the charges with your telephone company and report the incident.
Full Sweep
A thorough sweep of all internal drives and drives directly attached to your computer.
keylogger
A keylogger is a type of system monitor that has the ability to record all keystrokes on your computer. Therefore, a keylogger may monitor keystrokes, e-mails, chat room dialogue, instant message dialogue, Web sites visited, usernames, passwords, programs run, and any other typed material. They may have the ability to run in the background, hiding their presence. Keyloggers and system monitors may be used for legitimate purposes but can also be installed by a user to record sensitive information for malicious purposes.
Someone with administrative access to your computer, such as a system administrator or someone who shares your computer, typically installs commercial system monitors. This program may be installed on the machine without your knowledge or consent, and may allow an unauthorized, third party to view potentially sensitive information.
Worst case scenario: A third party may be able to view your personal conversations and may gain access to private information such as your usernames, passwords, credit card numbers, or your Social Security number.
malware
Malicious software that is designed to destroy or harm your computer system, such as a virus.
potentially unwanted program
A potentially unwanted program is a program that may change the security or privacy state of your computer and online activities. These programs can (but do not necessarily) collect information about your online activities and send it to a third party without your knowledge or consent. A potentially unwanted program may arrive bundled with freeware or shareware, various social engineering methods, or by someone with access to your computer. Users may decide to remove these programs by using a desktop security product.
proxy server
A computer system or router that acts as a relay between a client and server. Proxy servers are used to help prevent an attacker from invading the private network and are often used in building a firewall.
Quarantine
A holding area for spyware, viruses, and other potentially unwanted programs found during a sweep. The quarantine process does not delete items from your computer. Rather, it keeps the items in a safe place until you decide whether to delete them permanently or restore them.
Quick Sweep
A fast sweep of only locations where potentially unwanted programs are commonly found. This type of sweep maximizes use of your computer’s processing power, to make the sweep as fast as possible.
random access memory (RAM)
The main memory that acts as the computer’s workspace for running programs. Spyware and other unwanted programs can steal the computer’s memory resources, which can lead to system crashes, slower performance, or instability.
registry
A database of hardware and software settings about your computer’s configuration, such as the types of programs that are installed. Spyware can create entries in the Windows registry, which can ultimately slow down your computer and cause problems in your system.
restore point
A copy of the computer’s contents that allows you to restore your computer to a previous state.
rootkit or rootkit masked file
Rootkits use file obfuscation techniques to allow spyware and other malicious software to avoid detection and removal. Rootkits typically hide logins, processes, files and logs, and may include software to capture information from desktops or a network. A rootkit’s abilities to hide the presence of an intruder and the intruder's actions explain the increase in use of this method.
signed service
A certificate from an authorized certificate verification service (such as from VeriSign), which ensures that an application, service, or driver is from a trusted source and has not been tampered with.
spyware
Spyware is a program that may either monitor your online activities or possibly install programs without your consent. Information about online activities may be subsequently sent to a third party for malicious purposes without your knowledge. Spyware may arrive bundled with freeware or shareware, through e-mail or instant messenger, may propagate itself using dialog boxes, various social engineering methods, scripting errors, or by someone with access to your computer. Spyware is difficult to detect, and difficult (if not impossible) for the average user to remove without the use of a top-quality antispyware program.
system monitors
System monitors, typically non-commercial, may monitor and capture your computer activity, including recording all keystrokes, e-mails, chat room dialogue, instant message dialogue, Web sites visited, usernames, passwords, and programs run. This type of program may be capable of taking screen shots of your desktop at scheduled intervals and storing the information on your computer in an encrypted log file for later retrieval. These log files may be sent to a pre-defined e-mail address. A system monitor can run in the background, hiding its presence. These programs typically install via other threats, such as music downloads and Trojan downloaders. These system monitors may allow an unauthorized, third party to view potentially sensitive information, such as passwords, e-mail, and chat room conversation.
traces
Traces are the individual elements that make up the definition database. The more traces found and put into the definitions, the more complete the removal of the potential threats.
tracking cookies
Cookies are pieces of information that are generated by a Web server and stored on your computer for future access. When visiting some Web sites, a cookie may be placed on your system to track your personal preferences and Web surfing habits through uniquely identifiable information (browsing habits, usernames and passwords, areas of interest, etc.), and simultaneously share the information with other Web sites.
Trojan horses
A Trojan horse may manage files on your computer, including creating, deleting, renaming, viewing, or transferring files to or from your computer. It can utilize a program manager that allows a hacker to install, execute, open, or close programs. The hacker can gain remote control of your cursor and keyboard and can even send mass e-mails from your infected computer. It can run in the background, hiding its presence. A Trojan is usually disguised as a harmless software program and may also be distributed as an e-mail attachment. Opening the program or attachment may cause an auto-installation process that loads the downloader onto your computer and download third party programs on your computer, resulting in the installation of unwanted programs without your knowledge or consent, and jeopardizing your privacy. Trojans may open a port on your computer that may enable a hacker to gain remote control of your computer.
viruses
A virus is a self-replicating program that can infest computer code, documents, or applications. While some viruses are purposefully malignant, others are more of a nuisance, replicating uncontrollably and inhibiting system performance.


Glossary-470321.html

adware
Adware is a type of software that may display advertisements on your system. Some adware may also hijack Web searches, meaning it may reroute your Web searches through its own Web page. It may change your default home page to a specific Web site. Adware generally propagates itself using dialog boxes, various social engineering methods, or through scripting errors. Adware and BHOs are often bundled with various free software programs, such as clocks, messengers, alerts, and software such as screensavers, cartoon cursors, backgrounds, sounds, etc. Removing adware bundled with free software programs may cause the software to stop operating. These adware programs may also cause slowing of your Web browser and system performance issues.


Glossary-470326.html

definitions
A definition is a set of fingerprints that characterize a potentially unwanted program, such as spyware or adware, or that identifies types of viruses. Webroot regularly updates these definitions to provide better protection against the latest versions of potentially unwanted programs discovered by Spy Sweeper.


Glossary-470359.html

spyware
Spyware is a program that may either monitor your online activities or possibly install programs without your consent. Information about online activities may be subsequently sent to a third party for malicious purposes without your knowledge. Spyware may arrive bundled with freeware or shareware, through e-mail or instant messenger, may propagate itself using dialog boxes, various social engineering methods, scripting errors, or by someone with access to your computer. Spyware is difficult to detect, and difficult (if not impossible) for the average user to remove without the use of a top-quality antispyware program.


Glossary-470364.html

system monitors
System monitors, typically non-commercial, may monitor and capture your computer activity, including recording all keystrokes, e-mails, chat room dialogue, instant message dialogue, Web sites visited, usernames, passwords, and programs run. This type of program may be capable of taking screen shots of your desktop at scheduled intervals and storing the information on your computer in an encrypted log file for later retrieval. These log files may be sent to a pre-defined e-mail address. A system monitor can run in the background, hiding its presence. These programs typically install via other threats, such as music downloads and Trojan downloaders. These system monitors may allow an unauthorized, third party to view potentially sensitive information, such as passwords, e-mail, and chat room conversation.


Glossary-470378.html

tracking cookies
Cookies are pieces of information that are generated by a Web server and stored on your computer for future access. When visiting some Web sites, a cookie may be placed on your system to track your personal preferences and Web surfing habits through uniquely identifiable information (browsing habits, usernames and passwords, areas of interest, etc.), and simultaneously share the information with other Web sites.


Glossary-470383.html

Trojan horses
A Trojan horse may manage files on your computer, including creating, deleting, renaming, viewing, or transferring files to or from your computer. It can utilize a program manager that allows a hacker to install, execute, open, or close programs. The hacker can gain remote control of your cursor and keyboard and can even send mass e-mails from your infected computer. It can run in the background, hiding its presence. A Trojan is usually disguised as a harmless software program and may also be distributed as an e-mail attachment. Opening the program or attachment may cause an auto-installation process that loads the downloader onto your computer and download third party programs on your computer, resulting in the installation of unwanted programs without your knowledge or consent, and jeopardizing your privacy. Trojans may open a port on your computer that may enable a hacker to gain remote control of your computer.


Glossary-471295.html

keylogger
A keylogger is a type of system monitor that has the ability to record all keystrokes on your computer. Therefore, a keylogger may monitor keystrokes, e-mails, chat room dialogue, instant message dialogue, Web sites visited, usernames, passwords, programs run, and any other typed material. They may have the ability to run in the background, hiding their presence. Keyloggers and system monitors may be used for legitimate purposes but can also be installed by a user to record sensitive information for malicious purposes.
Someone with administrative access to your computer, such as a system administrator or someone who shares your computer, typically installs commercial system monitors. This program may be installed on the machine without your knowledge or consent, and may allow an unauthorized, third party to view potentially sensitive information.
Worst case scenario: A third party may be able to view your personal conversations and may gain access to private information such as your usernames, passwords, credit card numbers, or your Social Security number.


Glossary-471449.html

ActiveX
ActiveX technology is a group of functions developed by Microsoft that let programs share information. Many legitimate programs use ActiveX, but some spyware also uses ActiveX to install itself.


Glossary-471487.html

Alternate Data Stream (ADS)
An Alternate Data Stream is a highly technical way to hide images, data, or code in a file and can be used to hide malicious code. The hidden content is impossible to detect using regularly-available tools, such as Windows Explorer.


Glossary-471491.html

Browser Helper Objects (BHOs)
Browser Helper Objects are add-on programs that work with your browser. Some spyware programs add BHOs without your knowledge.


Glossary-474597.html

potentially unwanted program
A potentially unwanted program is a program that may change the security or privacy state of your computer and online activities. These programs can (but do not necessarily) collect information about your online activities and send it to a third party without your knowledge or consent. A potentially unwanted program may arrive bundled with freeware or shareware, various social engineering methods, or by someone with access to your computer. Users may decide to remove these programs by using a desktop security product.


Glossary-474686.html

viruses
A virus is a self-replicating program that can infest computer code, documents, or applications. While some viruses are purposefully malignant, others are more of a nuisance, replicating uncontrollably and inhibiting system performance.


Glossary-477237.html

Full Sweep
A thorough sweep of all internal drives and drives directly attached to your computer.


Glossary-477252.html

Quick Sweep
A fast sweep of only locations where potentially unwanted programs are commonly found. This type of sweep maximizes use of your computer’s processing power, to make the sweep as fast as possible.


Glossary-477332.html

Custom Sweep
A tailored sweep that lets you target specific areas on your computer. Spy Sweeper saves your custom sweep settings and uses them as the basis for any custom sweep that you configure.


Glossary-477364.html

rootkit or rootkit masked file
Rootkits use file obfuscation techniques to allow spyware and other malicious software to avoid detection and removal. Rootkits typically hide logins, processes, files and logs, and may include software to capture information from desktops or a network. A rootkit’s abilities to hide the presence of an intruder and the intruder's actions explain the increase in use of this method.


Glossary-477378.html

traces
Traces are the individual elements that make up the definition database. The more traces found and put into the definitions, the more complete the removal of the potential threats.


Glossary-477397.html

registry
A database of hardware and software settings about your computer’s configuration, such as the types of programs that are installed. Spyware can create entries in the Windows registry, which can ultimately slow down your computer and cause problems in your system.


Glossary-477425.html

restore point
A copy of the computer’s contents that allows you to restore your computer to a previous state.


Glossary-477436.html

random access memory (RAM)
The main memory that acts as the computer’s workspace for running programs. Spyware and other unwanted programs can steal the computer’s memory resources, which can lead to system crashes, slower performance, or instability.


Glossary-477464.html

proxy server
A computer system or router that acts as a relay between a client and server. Proxy servers are used to help prevent an attacker from invading the private network and are often used in building a firewall.


Glossary-477589.html

Quarantine
A holding area for spyware, viruses, and other potentially unwanted programs found during a sweep. The quarantine process does not delete items from your computer. Rather, it keeps the items in a safe place until you decide whether to delete them permanently or restore them.


Glossary-477619.html

malware
Malicious software that is designed to destroy or harm your computer system, such as a virus.


Glossary-477646.html

signed service
A certificate from an authorized certificate verification service (such as from VeriSign), which ensures that an application, service, or driver is from a trusted source and has not been tampered with.


Glossary-480796.html

Behavioral Detection
Additional protection against programs that may not match a threat definition, but exhibit behavior typical of malware. These programs are stopped from executing before they can cause damage. The Behavioral Detection option can locate many emerging threats, but on very rare occasions, a legitimate program could be classified as malicious because it shows malware-like behavior. This detection method is only available from Spy Sweeper with AntiVirus.


Glossary-480925.html

cleaning
A process in which Spy Sweeper with AntiVirus removes infected portions of a file where a virus has been detected. If it can remove the virus successfully, Spy Sweeper with AntiVirus restores the cleaned file to your computer in its original location and places a copy of the corrupted file in the Quarantine. The cleaned file is safe to use; the file in the Quarantine is not safe to use.


Glossary-483104.html

dialer
Dialers may disconnect your computer from your Internet Service Provider (ISP) and reconnect you to the Internet using an expensive toll or international phone number. Dialers can accrue significant phone charges and can run in the background, hiding their presence. They generally propagates itself using dialog boxes, various social engineering methods, through scripting errors, or may be delivered with a Trojan horse. The Federal Trade Commission recommends that you dispute the charges with your telephone company and report the incident.