Introduction

AVG Anti-Spyware 7.5 Program Principles

Prevention

Ideally, you should prevent spyware and other malware from intruding onto your computer. Currently, the most common source of infection is websites with potentially dangerous content. Other methods of transmission, such as via e-mail or transmission by worms and viruses are also prevalent. The most important protection is to use an always-on background scanner, such as AVG's anti-spyware resident shield that scans your applications in the background as you run them.

Regular Updating

Due to the frequency that new malware and spyware are created, it is essential to keep your AVG Anti-Spyware fully up-to-date. Both program updates, and essential spyware definition updates should be downloaded regularly. AVG Anti-Spyware allows you to schedule updates and also update on demand.

Scan on Demand

There is also the potential risk that malware has been transmitted to your computer prior to AVG Anti-Spyware installation, or that you have neglected to keep your AVG Anti-Spyware up-to-date with the latest database and program updates. For this reason, AVG Anti-Spyware allows you to fully scan your computer for malware/spyware using the scanning feature. It also detects sleeping and non-dangerous malware, i.e. malware that have been downloaded but not yet activated.

Scheduled Scanning

Regular scheduled scanning of the entire computer can further enhance security. AVG Anti-Spyware allows full scheduling of scans.

Quarantine

Suspect malware can be safely locked away in the AVG Anti-Spyware quarantine. Here the malware is stored in an encrypted format so that it cannot function nor do any harm to your computer.

Detection Technologies

To ensure that your computer is fully protected, AVG Anti-Spyware combines the following technologies for malware/spyware detection:

Scanning - searching for specific patterns that are characteristic of spyware/malware

Heuristic analysis - dynamic emulation of the scanned object's instructions in a virtual computer environment

Generic detection - detection of instructions characteristic of the given malware/group of malware

Note:

AVG Anti-Spyware 7.5 is fully compatible with Windows XP and Windows 2000 32bit operating systems.


Configuration

Launching AVG Anti-Spyware at Windows Startup

It is possible to set AVG Anti-Spyware 7.5 to launch automatically at Windows Startup so that you are always protected by the resident shield and receive automatic updates. To switch on/off automatic launching at Windows startup, please use the system tray AVG Anti-Spyware icon:

Right-click on the icon and in the context menu, choose the Start with Windows item.

When the item is "ticked", the feature is switched on.


Language Support

AVG Anti-Spyware 7.5 currently supports eight languages. Should you wish to switch the whole application interface to another language, please use the system tray AVG Anti-Spyware icon:

Right-click on the icon, and then in the context menu, move your mouse over the Language item and select the desired language version.


Program Activation

Trial Version

From the download section of the Grisoft website, you can download the trial version of AVG Anti-Spyware 7.5. After the installation, this trial version will run for 30 days - containing all the extensions of the full version.

Within these 30 days you have to register the program (using your license number) to activate the full version of AVG Anti-Spyware. At the end of the trial period, the full version extensions will be deactivated and the program will turn into a feature-limited freeware version (if you did not activate the product).

The purchased license number can be entered at any time; please refer to the Switching to Full Version topic on how to do that.


Switching to Full Version

In the Status dialog pay attention to the Your license section.

Within the 30-day trial period the section defines your program as a trial version which is exactly the same as the full version, but with no support or premium updating available:

To be able to use all features of the full version of AVG Anti-Spyware 7.5, you need to purchase the full version online.

If you have already purchased the full version and received your license number, click the Enter license code option to open a new window where you can register your license number - enter your license code into the respective field and confirm by pressing the OK button:

Having registered your license code, your program switches to the full version with all premium support and updates available:


Program Updates

Update

Any anti-spyware system can only guarantee reliable protection if they are updated regularly. New spyware threats are continually being created and spread very quickly. Therefore it is necessary that your anti-spyware program is updated at regular intervals to protect you against all new threats. For this purpose, AVG Anti-Spyware provides a reliable and fast update service with quick response times.

Update Status

The update status of your AVG Anti-Spyware is provided in the Status dialog:

Among others, the Your Computer's Security section provides the following information on the Last Update:

  • Whether the product is updated:

Yes, your program has been updated.

No, your program has not been updated recently and your computer is at risk; you should run the update process immediately.

  • When the last update was performed (date)
  • Provides the option of launching the update process directly - Update now

See also:

Update setup and scheduling


Update Setup

Specific parameters of the update process of your AVG Anti-Spyware can be set up within the Update dialog (click the main menu Update icon to get there):

The dialog is divided into four major sections:

Current Status

In case there is an update process currently running (launched manually or automatically), the progress bar provides an overview of its progress. The visual information is accompanied by a text specification on the respective process running.

The update related status information in this section defines the update availability, with the following possibilities:

  • Ready for update: The program is ready to check for updates; click on "Start update" to start this process.
  • No update was available: The program has checked for presence of new update files and has not found any; no new update files were issued since you last launched the program update.
  • Update successful: Information provided after an update process has been completed successfully.

Manual update

The Manual update section of this dialog offers the possibility of launching an update manually when the need arises. Generally, it is recommended to schedule your updates automatically (see the next section) but a situation may occur when it is critical to have the latest update files available and then you may want to launch an update manually. Simply click the Start update button; the update process will display in the above described Current Status section.

Automatic update

The option of automatic update scheduling is only available in AVG Anti-Spyware full version. If this section is not activated in your program, you may need to register your license number (please refer to the Switching to Full Version topic on how to do that) in order to be allowed to use the entire range of the full version's features.

In the full version, the automatic update option is set up in the program by default. The specifications are as follows:

  • Download and install updates automatically: The program will automatically check for new update files and download them onto your computer when they are available; the check will be performed at the time interval you have specified (see the next paragraph). If for some reason you want to disable this function (not recommended), deselect the respective checkbox.
  • Show notification when an update is installed automatically: An automatic notification window will be displayed when the update process starts and after it is successfully completed. You may disable this function by deselecting the respective checkbox.
  • Update interval: From the drop down menu select the time period that best suits your needs: the program will perform automatic update checks at the defined intervals.

The automatic update feature can also be switched on/off by right-clicking on the AVG Anti-Spyware system tray icon and choosing the Automatic Update item. When the item is "ticked", the feature is switched on.

Settings

The Settings section of this dialog deals with the detailed configuration of the Internet connection used for the update download. See the Internet Connection Settings topic for detailed description.


Resident Shield

AVG Anti-Spyware resident shield protects your computer against malicious software (malware) that tries to run on your computer. It checks files as they are opened, scans memory of all starting applications, and allows you to remove tracking cookies automatically.

You can select additional options as described below. For most users we recommend to keep the original settings.

Resident shield is...

Active/Inactive: Press the link to start or stop the resident shield.

The resident shield can also be switched on/off:

  • In the Status/Your Computer's security section by clicking the Change state button in the Resident shield row.
  • By right-clicking on the AVG Anti-Spyware system tray icon and choosing the Resident Shield item. When the item is "ticked", AVG resident shield is switched on.

Self-Protection

Block termination of AVG Anti-Spyware: Certain malicious software may try to terminate anti-malware applications. By selecting this checkbox you will ensure that termination of AVG Anti-Spyware will not be possible.

Files

Scan files on execution: Select this checkbox to allow AVG Anti-Spyware to detect and analyze all executable applications during the opening process.

Memory

Scan memory of starting applications: By selecting this checkbox, AVG Anti-Spyware will scan memory of all executed applications, and can therefore (unlike other products) even detect malware that has been heavily encrypted.

Cookies

Remove tracking cookies automatically: Removes tracking cookies from your computer. Tracking cookies are usually saved by certain websites to your hard drive during browsing the Internet. A tracking cookie can contain website-specific preferences or similar useful information, but also archived shopping cart information, user ID etc.

Therefore removing tracking cookies is not absolutely necessary in all cases.

Currently only Internet Explorer, Mozilla and Firefox are supported.

See also:

How to manage detected suspicious file


Scanner

The Scanner can be configured from the Settings dialog. Click on the main menu icon Scanner, and then select the Settings tab.

Click the links below to learn more about the option groups for configuring scanning:

How to act?

How to scan?

Possibly unwanted software

Reports

What to scan?

See also:

On-demand scanning

Scheduling scans


Exceptions

Not all the software detected as malware is necessarily unwelcome (this is particularly true for "riskware", or any other kind of software intentionally installed), and so when scanning for malware this has to be taken into consideration: Did the user deliberately install it, or did it install itself via stealth methods? Anti-malware programs therefore have to allow for exceptions - a mechanism for identifying specific malware as "permitted" so that the scanner will not repeatedly warn the user. AVG Anti-Spyware has the capability to create exceptions, so that selected programs, such as adware, can be exempt from future malware scans.

See also:

How to manage exceptions


Managing Exceptions

Click on the main menu icon Infections, and then select the Exceptions tab:

At the bottom of the dialog, there are the following buttons:

Add Rule: Opens a new Add ignore rule dialog where you can specify which file to ignore. The options are:

  • Ignore by name of threat: If you specify the name of the threat, then all instances of this threat will be ignored. This means that if any copies of the program exist then all of them will be ignored by the scanner (even if they are located in different folders).
  • Ignore file/path: Here you can browse for the exact file/folder that you wish to exclude from scans. If you select a folder then all files contained in that folder will also be excluded from scans.

Edit Rule: Opens an Edit ignore rule dialog where you can edit the selected rule.

Delete Rule: Deletes the selected rule without any further warning.


Reports

AVG Anti-Spyware can generate reports for scans and also for other actions such as file shredding. Reports can be generated manually or automatically after a manual or scheduled scan as follows:

Click on the main menu icon Scanner, and then select the Settings tab. On the right-hand side of the dialog, the Reports section offers the following options:

  • Automatically generate report after every scan: Select this option if you wish every scan result to be stored.
  • Automatically generate report for scheduled scans: Will store scan results only for scheduled scans. Note that you can still save reports for manual scans by clicking on the Save Scan Report button, (which is displayed after each scan is completed).
  • Do not automatically generate reports: Select this option if you do not want any scan results to be automatically stored. Note that you can still save reports for manual scans by clicking on the Save Scan Report button (which is displayed after each scan is completed).
  • Only if threats were found: Select this checkbox if you only want results to be stored if any the threats were found. This option will be disabled if you have selected not to automatically generate reports.

See also:

Managing reports


Managing Reports

Scan results can be saved as reports. This can be done manually by clicking on the Save Scan Report button (which is displayed after each scan is completed). Alternatively, you can configure AVG Anti-Spyware to automatically save scan results after each scan (please refer to the Reports topic on how to do it).

All saved reports are accessible from the Reports dialog:

Click on the main menu icon Reports, then select the required report from the list in the left-hand panel. The selected report will be displayed in the right-hand panel and the following buttons will become active at the bottom of the left-hand panel:

  • Save report as: Allows you to export the selected report into a text file.
  • Remove selected report: Deletes the selected report from the list.
  • Remove all reports: Deletes all reports from the list

See also:

About reports


Quarantine

Quarantine

The quarantine is a useful tool for safe storage of malware detected on the computer. All files stored in the quarantine are encrypted to make them harmless.

In most cases you will not have any reason to keep malware on your computer, therefore when the scanner detects the malware, you can delete it. However, sometimes the program detected as adware may be required by another program. Deleting any files detected as adware, which are related to a program, could affect the functionality of the application. For instance, you may have installed an application on your computer, which contains commercial supported parts that can be considered as adware. Some of these types of adware don't necessarily represent a threat. In such cases, it is advisable to move the detected adware to the quarantine; if your adware application malfunctions, you can recover the file from the quarantine.

See also:

Moving Suspect Objects to the Quarantine

Managing the Quarantine


Managing the Quarantine

Files stored in the quarantine can be deleted or restored as required. To access the Quarantine dialog, click on the main menu icon Infections, then select the Quarantine tab.

The dialog displays a list of all items stored in the quarantine, including the following information:

  • Origin: Displays the full file path to the location where the malware was found.
  • Infected with: Displays the malware identity.
  • Risk: Display the level of risk that the malware causes.
  • Date: Displays the date that the object was moved to the quarantine.

Below the list the following control buttons are displayed:

  • Remove finally: Will permanently delete the selected objects. This operation cannot be undone.
  • Restore: Will restore the selected objects to their original location.
  • Select All: Selects all items in the list.
  • Invert Selection: Selects all unselected items and deselects all selected items in the list.


Advanced Tools

File Shredder

The shredder is a utility for deleting sensitive data from your computer. This tool is useful for example, when you wish to sell the computer, and do not want any of your personal files to be available to the new owner.

Most users are satisfied with simply deleting the files from their computer, and this may be sufficient when selling the computer to a friend. However software utilities exist that can recover deleted files from a computer, and so it is wise to take further precautions to ensure that your files cannot be recovered.

Note:

The whole point of this tool is that it is not possible to recover the deleted files, so please remember that any files that you shred will not be recoverable. There is no "undo option" for shredding files!

Click on the main menu icon Tools, then select the Shredder tab. The left-hand side of the dialog displays a list of all files selected for shredding.

Operating Buttons

The Shredder tab opens with the following operating buttons available:

  • Add: Opens a dialog where you can browse for files/folders to add to the list. Note that if you select a folder, then ALL contents of the folder will also be added to the list.
  • Remove: Removes the selected files(s)/folder(s) from the list.
  • Remove All: Removes all files(s)/folder(s) from the list.

Shredding Level

On the right-hand side of the dialog you can select the "shredding level". This defines the security level for the shredding process (how difficult it would be to try and recover the files). The options are:

  • Fast Mode: The selected files will be over-written once, so that any ordinary undelete tool cannot recover them.
  • Secure Mode: The selected files will be over-written four times, so that most advanced undelete tools cannot recover them.
  • Paranoid Mode: The selected files will be over-written ten times, so that even professional undelete tools cannot recover them.

Deletion Confirmation

When you press the Start button, you will be prompted to confirm deletion. Once all selected files have been deleted, the following two buttons will be displayed:

  • Save Report: Creates a report for the shredding action. The report will be accessible from the Reports dialog.
  • Delete more files...: Returns to the Shredder dialog where you can shred more files.


System Analysis

System Analysis - Processes

This tab contains a list of processes (i.e. running applications) that are currently active. The list contains several columns:

  • Process name: Indicates the name of the running process.
  • Path: Indicates the physical path to the running process.
  • Window: if applicable indicates the application Window name.
  • Internet: Indicates if the running process also connects to the Internet.
  • Service: Shows if the running process is a service.
  • PID: Process Identification Number is a Windows internal Process identifier that uniquely identifies the Process.

You can select one or more applications (by holding down the CTRL key and clicking the left mouse button on the desired rows) and terminate them by pressing the Terminate application(s) button.

Warning: We strongly suggest not terminating any applications, unless you are absolutely sure that they represent a real threat!

Other Analysis tabs:

System Analysis - Connections

System Analysis - Autostart

System Analysis - Browser Plugins

System Analysis - LSP Viewer


Advanced Anti-Spy Configuration

Click on the main menu icon Tools, and then select the Antispy tab:

For most users we recommend to keep the Show only recommended settings checkbox selected as it is by default. Deselect the checkbox only if you prefer to change the advanced settings (highlighted in red) as well.

Click the links below to learn more about the option groups:

Error reporting

Internet Explorer

Windows Media Player

Microsoft Messenger

Miscellaneous

Services

Expert Options

More tools:

Shredder


Internet Connection Settings

If you use a proxy server to connect to the Internet, it will be necessary to specify the proxy server settings so that AVG Anti-Spyware can access the Internet for updates. If you do not use a proxy server connection please do not modify these settings!

A proxy server is a kind of buffer between your computer and outer networks. If you are unsure about your proxy server settings, please contact your network administrator or Internet provider.

Click on the main menu icon Update to view the Update dialog. Proxy server settings are specified in the Settings section on the right-hand side of the dialog. Select the checkbox Use proxy to enable further settings to be configurable. The following settings will then be available:

  • Type: Select the type of connection HTTP/Socks4 for the proxy server.
  • Host: Enter the hostname for the connection.
  • Port: Enter the port number for the connection.
  • Authenticate on proxy: (only available for HTTP type of connections). If authentication is required for the proxy server, select this checkbox, and then enter the required username and password.

See also:

Update

Update setup and scheduling


Scanning and Reports

On-demand Scanning

One of the main features of AVG Anti-Spyware is on-demand scanning. On-demand scans are designed to scan various parts of your computer whenever suspicion of possible malware infection arises. It is strongly recommended that you carry out such scans regularly, even if you think that no malware is present on your computer. The recommended period for complete system scanning is approximately once a week.

Click on the main menu icon Scanner, then select the Scan tab.

The following scans are available by default:

  • Complete System Scan: Scans all hard drives of the computer and also scans the memory and the Windows registry.
  • Fast System Scan: Scans the most vulnerable parts of your system such as the memory, windows registry, windows directory, and the cookie folder.
  • Registry Scan: Scans the windows registry.
  • Memory Scan: Scans the memory for active threats.
  • Custom Scan: Create a customized scan profile. These customized scans can be configured to scan selected areas of your computer and can also be scheduled for regular scanning. Other predefined scans cannot be scheduled.

See also:

Configuring the scanner

Scheduling scans


Scan Profiles

If you would like to schedule regular scans, then you must first create a scan profile. Click on the main menu icon Scanner, then select the Scan tab. Now click on the Custom Scan option:

Creating a Profile

There are the following options in the left-hand panel:

  • Add Profile: Creates a new profile in the Profiles list above. You can choose a name for the new profile.
  • Rename Profile: Rename the selected profile.
  • Remove Profile: Delete the selected profile without any further warning.

Configuring a Profile

Once you have created a profile you can configure it using the following buttons from the right-hand panel:

  • Add Registry: Include the windows registry in the selected profile's scan.
  • Add Memory: Include the computer's memory in the selected profile's scan.
  • Add File/Folder: Include specific files/folders in the selected profile's scan.
  • Remove Selected: Remove the profile item (selected in the central panel list) from the selected profile's scan.
  • Schedule this profile: Create a schedule for the selected profile.
  • Scan Now: Run the selected scan profile now.
  • Cancel: return to the previous dialog displaying the list of pre-defined scans.


Scheduling Scans

We recommend that you schedule a complete system scan (please refer to the On-demand Scanning topic for details of available scans) to occur daily. As new malware are released at such a fast pace, daily scanning will ensure security for your computer.

Existing scan profiles can be scheduled to run at regular intervals. Click on the main menu icon Scanner, then select the Schedule tab. Now select the required scan profile from the list of profiles in the left-hand panel. The right-hand panel will now display the following options:

Schedule this profile: Select the checkbox if you want to apply a schedule to this profile. Note that each profile can only have one schedule.

Start time: Specify the start time for the scan. Either specify an exact time (Fixed Time) or specify the length of time after starting the computer before the scan starts (Time after startup).

Period: Select how frequently the scan should be run:

  • Daily
  • Every 2nd Day
  • Once a Week: Select the day of the week from the dropdown list.
  • Once a Month: (Each first / Each last / Each), then select the day 01-31.

If scheduled time was missed, catch up as soon as possible: If this checkbox is selected, then any missed scan will be carried out at a later time (as soon as resources are available).

Don't execute if a fullscreen application is running (e.g. a game): If you have a highly-demanding application, which runs in full-screen mode, you can select this option to postpone the scheduled scan. It is advisable, if you select this option, that you also select the option above it for catching up on missed scans.

See also:

Configuring the scanner


Suspicious File Detected

Once a suspicious file is detected by the resident shield, you will get notified about the possible threat and will be offered options on how to proceed with the file.

(On what to do when a suspicious file is detected during scanning, please refer to chapter When a Scan is Finished.)

The Malware Information dialog informs you about the process during which the suspect file was detected (it can be a kind of malware, i.e. spyware, Trojan horse, virus etc.), it also provides information on the detected object location, and may even identify the infection type (if it is a known infection). The dialog also offers several operating buttons you can use for further treatment of the suspicious object:

  • Clean and move to quarantine (recommended) - allows you to heal the infected object if the cure for this kind of infection is available and move it to the quarantine for possible further examination. We recommend this option for most users.
  • Clean - allows you to heal the infected object if the cure for this kind of infection is available. If it is not possible to heal the object, it will be deleted.
  • Ignore - ignores the warning, and allows you to continue working (and also forbids access to the threat).
  • Ignore and add to exceptions - ignores the warning, allows you to continue working (and also forbids access to the threat) and adds the object to exceptions, so it will not be detected again.

Additionally, you can select the Use for all objects of this infection checkbox to process all findings of the same malware kind in the same way without confirmation dialog.


Moving Suspect Objects to the Quarantine

If a suspect/infected object is detected during scanning, and you wish to move it to the quarantine, please follow the instructions below:

When the scan is complete, all detected malware will be listed on the left-hand of the Scan dialog. After right-clicking on the Action of the desired item in the list, a context menu will appear displaying the optional actions available. Select the action Quarantine.

Once you have set the required action for each item in the list, press the Apply all actions button.


When a Scan is Finished

Once a scan is finished, and some spyware/malware/suspicious file has been found, a dialog will be displayed with the detected objects listed in a box. For each object, you can decide what to do.

After clicking an object in the list, more information on that object will be displayed in the right-hand part of the dialog. In the left-hand box, three columns of information are shown:

  • Threat - shows the name of the detected spyware/malware/virus.
  • Action - informs you what action will be/has been taken towards the detected object, unless you choose otherwise. Right-click the option to select another action from the context menu.
  • Risk - can be low, medium, or high; indicates how potentially dangerous the detected object is.

By default, actions for all detected objects are set to "Recommended actions" (pre-set and recommended by the manufacturer, according to the risk level). To change actions for all listed objects at the same time, right-click the Set all elements to: option and select the desired action from the context menu. Available actions are:

  • Quarantine - move the objects to the quarantine.
  • Delete - completely remove the objects from the disk.
  • Delete on reboot - completely remove the objects during the computer restart. This option is useful for blocked detected files. If you get an "Error during delete" message, you are advised to use this option.
  • Ignore once - leave the object on the disk without taking any action this time, and upon the next scan, detect it again.
  • Add to exceptions - add the objects to the list of exceptions, so that the objects are not detected as spyware any more.
  • Recommended actions - for each single object, perform the automatically pre-set recommended action.

When actions for all objects are set, press the Apply all actions button to perform the actions. If the button is inactive, the actions have already been performed.

To change the action for just one or several detected objects manually, right-click the action on the respective line, and select the desired action from the context menu (as described above).

After the scan, you can also save the scan report, or run a new scan.


Contact and Support

Frequently Asked Questions

Should you experience any problems with your installation of AVG Anti-Spyware 7.5, whether sales-related or technical, please refer to the FAQ section of the Grisoft (AVG producer) website. Please click the link to go directly to the website (provided you are currently online); alternatively, open your web browser and type in "http://www.grisoft.com". Then follow the "FAQ" link.

If you do not succeed in finding help in the FAQ list, you can try to consult relevant AVG documentation (AVG Anti-Spyware 7.5 User Manual). You can obtain the manual in the download section of the Grisoft website; if you are not online now, open your web browser later, type in "http://www.grisoft.com" and follow the "Downloads" -> "Documentation" links.

If the above solutions bring no success, you may want to contact the AVG technical support department.


Technical Support

If you do not succeed in finding help in the FAQ list, you may want to contact the AVG technical support department. Please follow these instructions:

  • In the top menu of AVG Anti-Spyware application, select Status.
  • On the bottom right, select Request Technical Support. (This item is only visible if you have activated the full version of the program.)
  • Enter your license code to be able to continue. (If you do not know your current license code, right-click the system tray AVG Anti-Spyware icon; then from the menu, select Information. A new dialog will appear, displaying your license code.)
  • Describe your problem in the newly opened web browser window and click Submit to confirm.

In the web form please fill in all required information in the respective text fields, and add an exact description of the problem you have encountered. Within the problem description, please do not forget to include important information like: your operating system version, Internet Service Provider (ISP), and any additional installed security software (Firewall, Anti-Virus etc.). This will help our technical support staff to obtain the information they need to help you quickly and effectively.

If for any reason you are unable to reach the technical support via the application, you may also use the common online form on the Grisoft website. The previously described method, however, is preferred.


Contacts

AVG Anti-Spyware 7.5 and other AVG products are manufactured and supplied by GRISOFT, s.r.o.

GRISOFT, s.r.o.

Lidická 31

602 00 Brno

Czech Republic

Website:

http://www.grisoft.cz

http://www.grisoft.com


Scanner - How to Act?

Click on Recommended actions then select the desired default action from the context menu. The options are as follows:

  • Recommended actions (default value): - AVG Anti-Spyware will automatically choose a suitable action depending upon the severity of the threat.
  • Ignore once: No action will be taken this time, but the malware will still be detected on the next scan.
  • Quarantine: The malware will be automatically moved to the quarantine.
  • Delete: The malware will be automatically deleted
  • Add to exceptions: The malware will be automatically added to the list of exceptions. This option is not recommended!

Other options:

How to scan?

Possibly unwanted software

Reports

What to scan?


Scanner - How to Scan?

Here you can define the scanning methods to be used. The options are as follows:

Scan for malware that is attached to other files (Binder): Select this checkbox if you want the scanner to scan for malware that is attached to other files, such as a Trojan program that is attached to a legitimate program and executes when you open the legitimate program.

Scan inside archives and setup files (ZIP, RAR, CAB, ...): Select this checkbox if you want the scanner to scan all supported types of archives.

Use heuristic analysis to detect unknown malware: Select this checkbox to use heuristic analysis.

Scan inside compressed executables (UPX, petite, FSG, ...): Select this checkbox if you want the scanner to scan inside compressed executable files.

Scan in NTFS Alternate Data Streams: Select this checkbox if you want the scanner to scan inside hidden NTFS data streams. In NTFS, a file consists of different data streams (real data and security information). There can also be alternate data streams holding other data (which is invisible to the user), e.g. a backdoor can hide inside these alternate data streams.

Other options:

How to act?

Possibly unwanted software

Reports

What to scan?


Scanner - Possibly Unwanted Software

Select the other types of malware that you want the scanner to detect. The options are as follows:

Scan for adware: Select if you would like the scanner to detect adware, (programs that receive and display advertising from an adserver).

Scan for tracking-cookies: Select if you would like the scanner to detect tracking cookies, (these cookies are files stored on your computer to help websites track your Internet browsing habits).

Scan for riskware: Select if you would like the scanner to detect riskware, (programs that can be a potential risk to the user, such as remote administration utilities).

Scan for dialers: Select if you would like the scanner to detect dialers, (programs that dial up premium-rate phone numbers from your computer modem).

Other options:

How to act?

Possibly unwanted software

Reports

What to scan?


Scanner - What to Scan?

The default recommended option here is to scan all files, but you can select to scan files by extension type. The options are as follows:

Scan every file: All file types will be scanned.

Choose files by extension: The scanner will only detect files with the given extensions. The list of extensions to scan will automatically include most common file types. You can manage the list of extensions using the following buttons:

  • Add extension: Type an extension into the textbox then click on the Add extension button to add the new extension to the existing list.
  • Set to default: Will reset the list of extensions to the default list.
  • Remove extension: Removes the selected extension from the list.

Note:

This option applies to types of file and not to file location. The location of files/folders to scan is defined in a scan profile .

Other options:

How to act?

How to scan?

Possibly unwanted software

Reports


Advanced Anti-Spy Configuration - Error Reporting

Disable Microsoft Windows Error Reporting Service: Disables error reporting for services and applications running in non-standard environments. This service is responsible for the box that pops up wanting you to report an application error or system crash to Microsoft. Select this checkbox to disable the function.

Disable Microsoft Office 2003 Error Reporting Service: Microsoft Office 2003 includes a tool that collects information automatically whenever an Office application crashes and allows users to send a report directly to Microsoft. Select this checkbox to disable this function.

Disable Microsoft Office XP Error Reporting Service: Microsoft Office XP includes a tool that collects information automatically whenever an Office application crashes down, and allows users to send a report directly to Microsoft. Select this checkbox to disable this function.

Other options:

Internet Explorer

Windows Media Player

Microsoft Messenger

Miscellaneous

Services

Expert Options


Advanced Anti-Spy Configuration - Internet Explorer

Disable Check for Updates: Internet Explorer automatically downloads and applies updates as default. To disable this feature, select the checkbox.

Changing this option is not recommended!

Disable scheduled Updates: Select the checkbox to disable scheduled updates of Internet Explorer.

Changing this option is not recommended!

Disable built-in Windows Authentication: Disable Internet Explorer users getting identified while browsing.

Set max. HTTP connections to 10: Select the checkbox to set maximum possible connections of HTTP protocol to ten.

Disable JavaScript: Select the checkbox to disallow Internet Explorer to execute JavaScript code.

Disable ActiveX Controls: ActiveX Controls are small programs that are also a set of rules for how applications should share information, which can be automatically downloaded and executed by a Internet browser. ActiveX controls may have full access to the MS Windows operating system. Therefore it is a possible security threat. Select this checkbox to prevent Internet Explorer from executing ActiveX controls.

Disable Internet Explorer error reports: Select the checkbox to disallow Internet Explorer to generate error reports.

Changing this option is not recommended!

Erase cache on quit: Once you select the checkbox, Internet Explorer will automatically erase cached files on every exit.

Changing this option is not recommended!

Other options:

Error reporting

Windows Media Player

Microsoft Messenger

Miscellaneous

Services

Expert Options


Advanced Anti-Spy Configuration - Windows Media Player

Disable Media Player to acquire content-licenses automatically: Windows Media Player is able to automatically download content-licenses for certain multimedia files. To disable this function, select this checkbox.

Disable Media Player automatic updates: Once you select the checkbox, Windows Media Player will not automatically update anymore.

Changing this option is not recommended!

Don't add played media to the Media Library: Select this checkbox if you do not want Windows Media Player to add your played media to the Media Library.

Disable online metadata retrieval: Windows Media Player automatically downloads metadata (i.e. detailed information about albums) once an Audio-CD or other media is inserted. To disable this function, check the checkbox.

Disable usage tracking: Select this checkbox if you do not want Windows Media Player to send usage-statistics to Microsoft.

Don't save data in Most Recent Used: Most Recently Used list contains names of files along with their location that have been recently executed. Some users might be willing to disable this saving feature.

Don't start Media Player on Media sites: If you prefer not to use Windows Media Player as a default player for Internet multimedia files in your Web browser, select this checkbox.

Allow removing Media Player: Select this checkbox to enable option for removing Windows Media Player in the Start/Settings/Control Panel/Add or Remove Programs.

Other options:

Error reporting

Microsoft Messenger

Miscellaneous

Services

Expert Options


Advanced Anti-Spy Configuration - Microsoft Messenger

Disable Microsoft Messenger Autostart: Microsoft Messenger is automatically started during Windows startup on default. To disable the autostart, select this checkbox.

Other options:

Error reporting

Windows Media Player

Miscellaneous

Services

Expert Options


Advanced Anti-Spy Configuration - Miscellaneous

Explorer: Disable Remote Help: Remote Assistance provides a way for you to get the help you might need from someone else when you run into problems with your computer. To disable access to your computer with Remote Assistance, select this checkbox.

Set RegDone to 1: Once this checkbox is selected, Windows operating system will stop asking you to register online.

Disable balloon-tips: Select this checkbox to disable the balloon-tips in the system tray. Please note that you will have to restart your computer if you change this option.

Changing this option is not recommended!

Erase Pagefile/Swapfile on shutdown: Select this checkbox to delete Swap file every time you shutdown your Windows. A swap file is an area on your hard disk, usually hidden, used as virtual memory.

Changing this option is not recommended!

Enable fast shutdown: Select this checkbox to increase shutdown speed of Windows.

Changing this option is not recommended!

Hides your computer from "My Network Places" on other systems: Select this checkbox to hide your computer from My Network Places on other systems. In other words, your computer should not be visible for other people in the network.

Deny Regedit/Regedit32 execution: Select this checkbox to disallow running Regedit and Regedit32 system utilities.

Changing this option is not recommended!

Disable Windows Scripting Host: Windows Script Host is an ActiveX scripting host providing an environment for the execution of scripts using one of several scripting engines or languages, such as VBScript. As this might be a potential security risk, you can disable this feature by selecting the checkbox.

Disable showing the last user on login: Select this checkbox to disable showing the last user name that logged on your computer.

Show .lnk file extensions: Shows .lnk file extensions in Windows Explorer. Note that your computer has to be restarted if you change this option.

Show .pif file extensions: Shows .pif file extensions in Windows Explorer. Note that your computer has to be restarted if you change this option.

Show .scf file extensions: Shows .scf file extensions in Windows Explorer. Note that your computer has to be restarted if you change this option.

Show .url file extensions: Shows .url file extensions in Windows Explorer. Note that your computer has to be restarted if you change this option.

Disable CD/DVD autostart: Select this checkbox to disable CD/DVD autostart once you insert a new CD or DVD into your CD-ROM (DVD-ROM) device. Note that your computer has to be restarted if you change this option.

Erase Recent Documents History: The Windows operating system stores a list of recently opened files by default. Select the checkbox to disable this feature. Note that your computer has to be restarted if you change this option.

Show known file extensions: The Windows operating system hides extensions of known file types by default. For some users it is more convenient to see the extensions in Windows Explorer. To enable this feature, check the checkbox. Note that your computer has to be restarted if you change this option.

Don't report Microsoft about infection: Select this checkbox to disable Malicious Software Removal Tool reporting to Microsoft about infections.

Other options:

Error reporting

Windows Media Player

Microsoft Messenger

Services

Expert Options


Advanced Anti-Spy Configuration - Services

Disable error reporting service: Select this checkbox to disable the Windows error reporting service which is responsible for sending error-reports to Microsoft.

Disable time synchronization services: Windows XP and related operating systems are able to synchronize your computer's clock time online over the Internet. To disable this feature, simply select the checkbox.

Disable Scheduled Tasks Service: Select this checkbox to disable the Scheduled Tasks Service. This service is used to start applications at a scheduled time.

Changing this option is not recommended!

Disable Universal Plug 'n' Play Service: If you are not using Internet Connection Sharing, it is recommended to disable the Universal Plug and Play service since it has had some serious security issues in the past.

Disable the Windows Messenger Service: The Windows operating system includes a system notification service, called Messenger Service, which is sometimes used to present pop-up advertisements to users. To disable this service, select the checkbox.

Disable Firewall/Connection Sharing: Select this checkbox to disable Firewall and Connection Sharing features. Please note that the Firewall usually protects your computer against intrusion from the Internet and it should not be stopped.

Changing this option is not recommended!

Other options:

Error reporting

Windows Media Player

Microsoft Messenger

Miscellaneous

Expert Options


Advanced Anti-Spy Configuration - Expert Options

Disable licdll.dll (Part of WPA): Select this checkbox to disable licdll.dll. This library is a part of Windows Product Activation (WPA) used to activate your Windows operating system.

Changing this option is not recommended!

De-register the "Registration Wizard Control": Select this checkbox to disable the possibility to check your registration data.

Changing this option is not recommended!

Other options:

Error reporting

Internet Explorer

Windows Media Player

Microsoft Messenger

Miscellaneous

Services


System Analysis - Connections

This tab contains a list of currently active connections. The list contains the following columns:

Application: Indicates the name of an application that is related to the connection. This column is only available on systems running Windows XP.

Protocol: Indicates the transmission protocol type that is used for the connection.

  • TCP - the protocol used in conjunction with Internet Protocol (IP) to transmit information over the Internet
  • UDP - an alternative to TCP protocol

Local address: Indicates the IP address of the local computer and the port number that is being used.

Remote address: Indicates the IP address of the remote computer and the port number that it is being connected to. If possible, it will also look up the hostname of the remote computer.

State: Indicates the most probable current state.

To list only external connections, simply select the Hide local connections checkbox. This will hide all local connections (local loopback or some system related local connections that are usually not a real threat).

Operating buttons are as follows:

  • Terminate Connection: Terminates one or more connections; select one or more rows that are currently in the connected state and press this button.
  • Terminate Application: Terminates one or more applications that are related to the connection; select one or more rows and press this button. This button is only available on systems running Windows XP.

To select more rows at once, hold down the CTRL key and use your mouse left click to select.

Note:

Sometimes it is possible to terminate only applications that are currently in the connected state.

Warning: We strongly suggest not terminating any connections or applications, unless you are absolutely sure that they represent a real threat!

Other Analysis tabs:

System Analysis - Processes

System Analysis - Autostart

System Analysis - Browser Plugins

System Analysis - LSP Viewer


System Analysis - Autostart

This tab shows a list of all applications that are executed during Windows system start-up. Very often, several malware applications add themselves automatically to the start-up registry entry.

You can delete one or more entries by selecting them and pressing Delete selected item(s) button. To select more rows at once, hold down the CTRL key and left click your mouse to select.

Warning: We strongly suggest not deleting any applications from the list, unless you are absolutely sure that they represent a real threat. If you are unsure, use the Internet and you favorite search engine to find more information about the application name.

Other Analysis tabs:

System Analysis - Processes

System Analysis - Connections

System Analysis - Browser Plugins

System Analysis - LSP Viewer


System Analysis - Browser Plugins

This tab contains a list of plugins (i.e. applications) that are installed inside the Internet Browser. This list may contain regular application plugins as well as potential malware programs. Click on the listed object to obtain more information. Plugins listed with a green icon are usually known and keeping them is quite safe.

Please note:

Unfortunately certain malware programs can pretend to be something else, therefore it cannot be 100% guaranteed that any plugin is harmless.

In the Technical part of the object's details, CLSID represents a unique identification tag that is associated with an ActiveX or OLE 2.0 object created by a specific component or server. When you click the CLSID link, two options will show up:

  • Copy CLSID to clipboard: Choose this option to copy the string to clipboard for future use (e.g. pasting it using CTRL+V key combination).
  • Search for CLSID with Google: Choose this option to open your Internet browser and search for the string in the Google search engine. After obtaining more information on the plugin you should be able to decide whether the object should be removed or not.

You can delete one or more entries by selecting them in the list and pressing the Remove object(s) button. To select more rows at once, hold down the CTRL key and left-click the desired items to select.

Warning: We strongly suggest not deleting any plugins from the list, unless you are absolutely sure that they represent a real threat. If you are unsure, use the Internet and you favorite search engine to find more information about the plugin name!

Other Analysis tabs:

System Analysis - Processes

System Analysis - Connections

System Analysis - Autostart

System Analysis - LSP Viewer


System Analysis - LSP Viewer

This tab shows a list of Layered Service Providers (LSP).

A Layered Service Provider (LSP) is a system driver linked into the networking services of the Windows operating system. It has access to all data entering and leaving the computer, including the ability to modify this data. Some LSPs are necessary to allow Windows to connect you to other computers, including the Internet. But certain malware applications may also install themselves as an LSP, thus having access to all data your computer transmits. Therefore this review may help you to check all possible LSP threats.

It is also sometimes possible to repair broken LSPs (for example when the file has been removed but the registry entries remained untouched). A new button for fixing the issue is displayed once a repairable LSP is discovered.

To include Windows LSP in the list, uncheck the Hide Windows LSP checkbox.

Other Analysis tabs:

System Analysis - Processes

System Analysis - Connections

System Analysis - Autostart

System Analysis - Browser Plugins