welcome

Uniblue SpyEraser

www.uniblue.com


introduction

1. Introduction

This is your User Manual for Uniblue SpyEraser. It offers a comprehensive overview of all the featured tasks scanning options and detection technologies that are provided for you by this product.

Copyright (c) 2006 Uniblue Systems Ltd. All rights reserved.


intro - principles

1.1 Uniblue SpyEraser Program Principles

1.1.1 Prevention

Spyware and other forms of malware are becoming more sophisticated, malicious and widespread. They are not viruses, though some viruses or worms can deposit spyware on your PC. The most common sources of infection from these pests are through email, or by downloading popular files such as music, video or photos online.

New variants of spyware are continually being produced, and so the best way to minimize the threat to your PC is to use an always-on detection scanner, such as Live Guard that scans your applications in real time as you run them.

1.1.2 Regular Updating

It is also very important to keep your SpyEraserconstantly up-to-date. SpyEraserallows you to download updated program and essential spyware definition updates regularly.

1.1.3 Scan on Demand

Before you installed this version of SpyEraser, the risk is very high that you may have picked up some malware. SpyEraser will help in two ways. Firstly, its deepscanning technology will fully scan your computer for all types of malware and spyware. It will find and remove even ‘dormant’ malware - programs that have been downloaded on to your compute but which have not yet become active. You can also ensure your SPyErase remains fully effective with the latest database and program updates, on demand.

1.1.4 Scheduled Scanning

Because new variants of malware are frequently being discovered, regular scheduled scanning of the entire computer can enhance and improve the protection that SpyEraser can offer you. The Uniblue SpyEraser allows you to schedule scans at any time and frequency to suit your needs.

1.1.5 Malware/Spyware Removal and Quarantine

Once detected, SpyEraser lets you quickly and easily remove most forms of mal/spyware. However a few forms of malware exist that are problematic to remove from a computer. In this case, Suspect malware can be safely locked away in theSpyEraserquarantine. In quarantine the malware is encrypted and rendered non-functional and harmless.


intro - detect

1.2 SpyEraser Detection Technologies and Levels of Protection

SpyEraseremploys the latest technologies to detect malware/spyware and ensure that your computer remains at optimum security levels.

Scanning – SpyEraser scanning technologies search for specific characteristics that suggest the presence of spyware/malware including variants of known types.

Heuristic analysis – Spyeraser analyzes files for suspicious commands that are symptomatic of virus or malware activity such as replication, file overwrites, and attempts to hide the existence of the suspect file.

Generic detection – SpyEraser is programmed to detect instructions characteristic of a given malware or its family group. If one or more suspicious action types are detected, or a certain percentage of the source code matches with the code of known virus or malware activities, the suspicious file is flagged as a potential pest, and the user is alerted.

SpyEraser uses a combination of these technologies to ensure that your computer is fully protected, from over 10,000 known malware pests and any future variants of them that emerge.


intro - req

1.3 Systems Requirements

  • Microsoft Windows 2000(SP4)/XP/Vista

  • Graphics mode 1024x768 with 16.7 million colours or higher

  • Minimum 10 Mb free hard disk space

  • At least Intel Pentium 3 or AMD Athlon processor with 500 MHz

  • Minimum 256MB RAM

  • CD-ROM or DVD-ROM drive


installation

2. Installation

Before you start installing SpyEraser, we recommend that you visit the Uniblue website at www.uniblue.com.This way you can be sure that you install the latest available version of SpyEraser.


install - download

2.1 Installation File Download

To install SpyEraser via the Internet, you should:

  • Visit the Uniblue Systems website at www.uniblue.com and download the latest version of the SpyEraser installation package.

  • Find and click on the Download Now button, to download the installation file and save it on your local hard disk.

  • Start the installation by following instructions to execute the downloaded file.


install - process

2.2 Installation Process

To ensure a successful outcome, it is recommended that you close all other open and running applications before installing SpyEraser. This includes any other security applications present on your system that could block the installation.

Double-click on the installation file to begin.

When setup opens, click on Next to view the License Agreement dialog box. Click on I Agree to accept the license terms and conditions.

Select the destination folder for the installation, and then click on Next. It’s a good idea to keep the default destination folder.

Now use the Start Menu folder to decide where the program's shortcuts will be located. We recommend that you keep to the default destination folder. Then, click on Install to continue.

To complete the installation process click on Finish.

After you have finished the installation, SpyEraser will launch automatically (if you do not want this feature, de-select Run Uniblue SpyEraser in the final installation screen.)


activation

3. Program Activation

3.1. Trial Version Download

If you have downloaded and installed the free trial version of Uniblue SpyEraser from the Uniblue website, the software will run and allow you to scan for spyware, but does not include the cleaning function.

3.2. Switching to Full Version

To use the cleaning feature and remove any detected malware pests, you have to register the program by entering your serial number for the full version of SpyEraser. The purchased serial number can be entered at any time by clicking the Register Now button.

3.3 Activating the Full Version

If you have already purchased the full version and received your serial number, simply click the Register Now button. In the new window, simply enter your serial number into the field indicated and confirm by pressing the Activate Now button. Once your serial number registration is confirmed, your program is immediately upgraded to the full version with full functionality and access to updates when available.


activation - launching

3.4 Launching SpyEraser for the first Time

Once the program is loaded, you will be able to see the main screen of SpyEraser.

System Overview

The System Overview section gives you a summary of various operations performed on your system using SpyEraser. A brief information of the latest spyware scan, scan results, scan schedule and other details are listed. It also shows the number of spyware found to date and the number of spyware erased. The buttons on the right side of the main screen are to scan for spyware, configure Live Guard protection and configure various other settings. The information listed on the main screen is given below:

Last Scan - It shows the date and time on which the last scan was conducted.

Last Scan Results - It displays the number of spyware detected during the last scan.

Scanning Schedule - It shows whether the System Scan schedule is activated.

Real-Time Protection - It shows the total number of protection guards that are currently active.

Online Updater - It shows whether the online updater is enabled or not.

Latest Spyware Definitions - It displays the date and time of the latest spyware definitions installed on the system.

SpyEraser Version - It displays the version number of SpyEraser currently installed on the system.

Spywares Found to Date - It shows the total number of spyware found on your system to date.

Spywares Erased - It shows the number of spyware erased from your system to date.

Note: The items marked in red in SpyEraser require your immediate attention.

After the first launch, SpyEraser is accessible either as a Start Menu item, or on your Desktop or minimised in your Tray Bar.

Upon installation, the SpyEraser icon will be placed on your desktop.

Double click on the SpyEraser icon to launch the program.

SpyEraser will start minimised in the Tray Bar. The SpyEraser icon will appear in your system tray as may be seen from the screen shot below:

To start SpyEraser, double click on the SpyEraser icon. This action will launch the program.

To start SpyEraser, you may also click on the Quick Launch Icon on the Quick Launch Bar at the bottom of your screen.


configuration

4. Configuration

After SpyEraser has been successfully installed, the SpyEraser icon will appear on your desktop. To open the SpyEraser interface, double click on this icon. Once in the interface, you can quickly configure all aspects of the application to suit your individual requirements.

Security Restrictions

Using this section of the program, you can apply certain security restrictions which will prevent users from making changes to the system. To apply one or more of the following security restrictions, simply check the box of the relevant option. Log off and log back on for the changes to take effect.

The security restrictions available are as follows:

  • Disable Registry Editor - Check this box if you want to restrict access to the Windows Registry Editor.

  • Disable Control Panel - To prevent access to the Control Panel, check this box.

  • Disable Task Manager - To prevent users from using the Task Manager, check this box.

  • Disable Lock Workstation - Check this box if you would like to prevent locking the work station.

  • Disable Changing Password - If you would like to prevent users from changing their account password, mark this box.

  • Disable Menu on Taskbar - To disable the context menu from appearing on the taskbar, check this box.


Config - System tray

4.1. System tray icon functions

A small SpyEraser icon will appear in the system tray. By right-clicking on the tray icon, you will arrive at the context menu will popup.

The following options are available:

  • Open - click this option to show the main application screen.

  • RunSpyware Scan - this option will open the Scanner dialog and automatically start scanning of your system. (Note: Refer to chapter 6.Scanning and Scan Results, for further information.)

  • Real Time Guards - This option shows the Live Guard screen which protects your system in real time. You can choose to enable or disable the Real Time Guards. At any time through this console.

  • Check for updates - this option will show up the Program update dialog and automatically starts the updating process. (Note: Refer to chapter 7. Program Updates, for more details.)

  • Exit SpyEraser - select this option to quit the application.


config - guard

4.2. Live Guard

SpyEraser Live Guard is a real time built in protection feature that protects your computer by checking files for suspicious spyware as they are opened. Live Guard scans all starting applications and alerts you as to what it finds.

Real Time Protection (Security Monitors) Settings

Real Time Protection increases system security by defending your system from spyware attacks and eliminating them. Real-time spyware threat protection extends the level of Security Guards protection. It enhances your safety by not only detecting downloads of spyware to your system but also preventing the changes that can be done to your system. Check the box Enable the Security Guards (Recommended) to activate this option.

After enabling or disabling any of the settings, click on the Apply button on the screen for the changes to take effect. To apply the default settings, click on the Default button and then click Apply button to apply the default settings.

Appropriate action from additional options

  • Activate/Deactivate – click this option to start or stop the Live Guard.
  • Block Programs - certain known malicious software applications may be blocked from running.

  • The Information dialog provides information about any suspect file by malware type (e.g. spyware, trojan horse, keylogger); by infection type (if it is a known infection) and its location on your system. The dialog also offers several function buttons for action against the suspicious object.

These are:

  • Quarantine (recommended) – Moves the infected object into quarantine for possible further examination. We recommend this option for most users.
  • Remove - allows you to delete the infected object.
  • Ignore – ignores the warning, and allows you to continue working. This feature also blocks you from accessing the threat.
  • Ignore Always – ignores the warning, allows you to continue working (and also forbids access to the threat) and adds the object to Ignore List, so it will not be detected again. No future alert on the object specified will be given.

Application Guards

To access this section, choose the option Application Guards placed in the left menu of the Live Guard window. Through this section, you can monitor running applications.

Installed Components

  • It keeps a check if additions are made to the installed component list.

  • It monitors changes in the list of registered programs or applications installed on your computer.

  • Application Restrictions

  • It restricts illegal intrusions and alterations to the applications restriction policies.

  • This option forbids the user from running certain Windows programs by setting RestrictRun option in the registry.

Internet Explorer Menu Extensions

  • It restricts unauthorized changes that can be made to Menu Extensions in Internet Explorer.

  • The items in Context Menu of Internet Explorer are called Internet Explorer Menu Extensions. These menu items are available when right-clicking a web page in a browser.

Process Execution

  • It prevents the spyware programs downloaded to your system from execution.

  • The security monitors running on your computer will prompt you to allow or block the execution of an unknown program when it runs for the first time. Thus, if a spyware or a malicious program is installed, you can enhance security by removing such programs on receiving any warning.

Block Events

SpyEraser has an in-built real-time monitoring system that can prohibit an unknown program from executing on your system. When an unknown program self executes, an alert message prompts you to either allow or block the execution of the program. All the programs blocked through this channel are displayed in the Block Events window. This window provides details about Total Items blocked along with their Date, Time, Type and Description.

On selecting an item, you can view its additional details in the supplementary details section. If you want to delete all the logs of the Blocked Events, click on the Clear Event Log button.

Internet Guards

To access this section, click the option Internet Guards placed in the left menu of the Live Guard window. Through this section, you can set security checks for all Internet based malware.

Browser Helper Objects

  • It keeps a check on the additions made to your Internet Explorer Browser Helper Objects (BHO).

  • A Browser Helper Object (BHO) module is designed as a plug-in for Internet Explorer Web browser to provide added functionality. This type of plug-in is commonly used by utilities like search toolbars. However, malicious software like spyware, adware or browser hijackers often use BHOs to pop-up advertisements or study your browsing pattern because a BHO has access to each URL you visit and can redirect you to unwanted websites or display other pages than you requested.

Internet Explorer Extensions

  • It keeps a check on changes that can be made to Internet Explorer toolbar buttons.

  • Internet Explorer toolbar buttons or the items placed in the Tools menu of Internet Explorer which are not included in the default installation are controlled by Internet Explorer Extensions. The toolbar button functions to run an application, a script, or open an Explorer Bar.

Internet Explorer Toolbars

  • It keeps a check on the changes made to Internet Explorer Toolbar.

  • A horizontal strip of buttons docked under the Menu Bar in Internet Explorer which provides shortcut for commonly used commands is a Toolbar.

Internet Reliable Sites

This option will help you stay safe and protected by keeping away unauthorized websites from being added to the list of reliable websites. Reliable websites are genuine and do not exploit the data stored on your computer.

Internet Explorer Restrictions

  • It restricts illegitimate changes that can be made to the Internet Explorer Restrictions policy setting.

  • Using Internet Explorer Restrictions policy, the administrator can prohibit the users from changing certain settings in Internet Explorer, for example, setting a new homepage. Although, spyware can also use this policy restriction and prohibit user from making changes to their own computer.

Internet Explorer Trusted Sites

  • It restricts unwanted sites from being added to your list of Trusted Sites.

  • In Trusted Sites Zone, the content of Web sites is considered more reputable or trustworthy than other sites on the Internet. Users can use this zone to assign a higher trust level to these sites to minimize the number of authentication requests.

Internet Explorer Explorer Bars

  • It restricts illegitimate changes to standard protocol drivers.

  • The exchange of information to and from your computer is accessed by some spyware. This is done using the Windows protocols filters and handlers.

Internet Explorer ShellBrowser

  • It restricts changes that can be made to the Internet Explorer Shell.

  • Information and settings about an instance of Internet Explorer are contained in Internet Explorer ShellBrowser. Modifying these settings or adding new ShellBrowser can take control of Internet Explorer and add toolbars, menus, and buttons.

Internet Explorer URLs

It keeps a check on the predefined URLs in Internet Explorer to prevent browser hijacking or any other changes that can be made to your Internet Explorer browser.

Internet Explorer Web browser

  • It prohibits any changes that can be made to Internet Explorer Web browser.

  • Information and settings about an instance of Internet Explorer are contained in Internet Explorer Web browser. Modifying these settings or adding a new Web browser can take control of Internet Explorer and add toolbars, menus, and buttons etc to it.

URL Search Hooks

It restricts illegitimate changes that can be made to Internet Explorer URL Search Hooks. URL Search hooks are used by Internet Explorer to translate the address of an unknown URL protocol.

Note: By default, the status of the guards is always active. To disable them, select the guard from the Application Guards section and click on Deactivate This Guard option. It provides the Status and Description of the guard. Additionally, you can maintain a list of allowed and blocked options or view the same list by clicking the Manage Allowed / Blocked link. Clicking on the option will open a new window where you can manage the relevant options.


config - scanner

4.3. Spyware Scanner

The Spyware Scan can be configured from the options available on the page. You can choose to do a full system scan or select one or more system areas from the following options:

  • Full System Scan – Scans the whole of your computer system and will take a while. Generally ideal to run the first time you install the software.
  • Memory: Select if you would like the scanner to detect spyware that could be loaded in memory.
  • Files: Scans for malicious files saved on your hard disk unknowingly and for other infected files.
  • Registry Keys: Deep scans your registry to search for registry entries containing malicious or spyware code characteristics.
  • Cookies: Scans for tracking cookies, (these cookies are files stored on your computer to help websites track your Internet browsing habits). An important tool for protecting your privacy from uninvited third parties, such as hackers.


config - results

4.4. Scan Results

When malware is detected, Click on Recommended actions, then select the desired default action from the drop down list. The available options are:

Recommended actions (default value): - Uniblue SpyEraser will automatically choose a suitable action depending upon the severity of the threat.

  • Ignore: No action will be taken this time, but the malware will still be detected on the next scan.

  • Ignore Always: The malware will be automatically added to the Ignore List and no future alert generated.

  • Quarantine: The malware will be automatically moved to the quarantine.

  • Remove: The malware will be automatically deleted


config - ignore

4.5. Ignore List

4.5.1. About Ignore List

Not all malware is harmful to your system. Some forms of Adware for example are harmless and may have been selected and consciously downloaded by the user. Or, it may be tolerated by the user as the price for accessing free content. Constant alerts on such Adware can however become a nuisance to the user.

The SpyEraser Ignore List, allows the user to create a list of "allowed" items, so that the scanner will not repeatedly warn the user and will exempt the listed items from future malware scans.

4.5.2. Managing Ignore List

Click on the main tab SpywareScan, and then select the Ignore List option. Here you have a list of malware that is to be ignored from scans and a Remove button at the bottom of the page:

Remove from Ignore List – removes any listed item from the list at any time, should you wish to do so.


quarantine

5. Quarantine

Most malware that is detected on computers is not desirable and may be deleted immediately. However, not all malware is dangerous and the Quarantine function is an important and useful tool that permits the user to isolate malware detected on the computer, that s/he may not yet be ready to delete, or may wish to investigate further.

An occasion may arise when the user wishes to recover a quarantined file. Because of this, all files stored in the quarantine are made harmless, until a decision to delete or restore is made.


quarantine - moving

5.1. Moving Suspect Objects to the Quarantine

When the scan is complete all detected malware will be listed in the Scan Results.

  • To move malware items into Quarantine, follow these instructions:

  • For the selected item, click on Action next to it.

  • A drop down list will appear displaying the optional actions menu.

  • Select the action Quarantine.

  • Once you have set the action instructions for each item in the list, click on the Remove all Threats option.


quarantine - manage

5.2. Managing the Quarantine

Files stored in the quarantine can be deleted or restored as required. To access the quarantine page, click on the main tab SpywareScan, then select the Quarantine option.

The page displays a list of all items stored in the quarantine, including the following information:

  • Threat Name: Displays the malware identity.

  • Threat Type: Display the level of risk that the malware causes.

  • Quarantine Date: Shows the date that the object was moved to the quarantine.

Below the list the following control buttons are displayed:

  • Remove Threats: Permanently deletes the selected objects. Caution: This operation cannot be undone.

  • Un-quarantine Threats: Restores the selected objects to their original location.


scanning

6. Scanning and Scan Results

SpyEraser lets the user scan automatically, manually but above all frequently.

It is strongly recommended that you carry out such scans regularly, even if you think that no malware is present on your computer.

Spyware Scan

The Spyware Scan tab gives a detailed description of the last scan that you conducted on your system under the Last Scan Run section. It displays the date and time of the last scan performed as well as the number of memory locations, files, registry locations and cookies which were scanned. It also displays the number of infections found, if any.


scanning - scans

6.1. Scans

  • Complete System Scan – The first scan that you should do upon installation. It Scans your complete computer system and will take a few minutes.
  • Memory: Select if you would like the scanner to detect spyware that could be loaded in memory.
  • Files: Scans for malicious files saved on your hard disk unknowingly and for other infected files.
  • Registry Keys: Deep scans your registry to search for registry entries containing malicious or spyware code characteristics.
  • Cookies: Scans for tracking cookies, (these cookies are files stored on your computer to help websites track your Internet browsing habits).


scanning - schedule

6.2. Scheduling Scans

We recommend that you schedule a full system scan (a scan profile that also checks memory and all hard drives) to run daily. This can be done in the background and will not interfere with other activities, except to warn you of any detections at the end.

New malware is being discovered every day, so daily scanning will ensure optimum security for your computer. Existing scan profiles can be scheduled to run at regular intervals. Click on the main tab Spyware Scan, then select the Scheduler option.

Next choose the scan you wish to run from the available options, or choose to perform a complete scan.

Now, set the scan timing frequency from the different options:

Period: Select how frequently the scan should be run:

· Daily

· Weekly: Select by clicking the day of the week checkbox.

· Monthly: Select the day from 01-31.

· Once

· At System Start

· At Logon

Start time: Specify the start time for the scan.

Options You can choose to:

· Automatically Quarantine found Spyware

· Hide Scan Progress

· Hide Scan Results


scanning - logs

6.3. Managing Scan Logs

Scan results are saved automatically as a log after each scan. All logs are accessible from the Logs option. Click on SpywareScan and click on the option Logs then select the required report from the list. It will display in the bottom panel. When you wish, you can delete a report by simply clicking the Delete option.

A complete log report of all the events performed on your system is provided in the All Events window. Whether the action is taken to block or allow a process, details of all such events are given with its Date, time and name of the Event. It also shows the name of the user who has taken action on the process. Further details are provided in the supplementary details section where you will find additional details about the selected event. In case you want to delete all the logs, click on Clear Event Log button.


updates

7. Regular Threat Updates

Due to the nature of the problem, Anti-spyware programs need to be regularly updated if they are to be fully effective. The Uniblue Labs provides a frequent, reliable and rapid update service for SpyEraser. Since new spyware threats are constantly emerging and spread very quickly, it is essential that you update your anti-spyware product regularly to keep your system protected against all new threats.

7.1. Manual Update

You can, if needed obtain an update manually by clicking on the update button in the system overview. It is critical to have the latest update files available. If an alert comes between scheduled updates there could be new strains for spyware that are not presently recognized by your anti-spyware program. A single click updates the process.


faq

8. FAQ and Technical Support

8.1. Online Help

The Online Help section is there to assist the user who may be unclear as to the meaning of a specific program dialog. You’ll find a Help icon in the main menu.

Click the main menu in the program to look-up the relevant information:

8.2. Frequently Asked Questions

Should you need any further information and if you experience any difficulties with your installation of SpyEraser, you can visit our website www.uniblue.com refer to the FAQ section.

8.3. Technical Support

If the website’s FAQ section does not contain the information you need, then you are invited to contact the Uniblue Labs technical support department, using the online web form located on the Uniblue Systems website at www.uniblue.com.

In the web form, please fill in all the required information in the respective text fields, i.e. provide your e-mail address and a detailed description of the problem you have encountered. Specifically we will need to know: your operating system version, Internet Service Provider (ISP), and a checklist of all other installed security software (Firewall, Anti-Virus, …) that are present on your computer. This will speed up the time it takes for us to respond.

The form also allows you to attach a specific file (e.g. diagnostic log file) or a screenshot to your report, which will further help us to identify the cause of the difficulty.