Welcome to SpyCatcher

Welcome to SpyCatcher Express

What is Spyware?

Spyware is software that hides on your computer and records the web sites you visit, the keys you press, and almost everything that you do on your computer. You oftentimes download spyware without knowing it.

For example, you can download a game, and spyware can be downloaded at the same time. Usually, the motive is for advertising purposes. However, sometimes the motive is more malicious.

Spyware is today’s fastest-growing threat to Internet users and is also proving one of the most difficult to solve.

What is SpyCatcher Express?

SpyCatcher Express is a tool that finds spyware on your computer and allows you to disable it. It is easy to use and keeps your computer safe from adware and malicious software programs. It automatically keeps itself up to date using the Internet.

SpyCatcher Express uses advanced technology to detect and disable thousands of spyware, adware, Trojans and more. SpyCatcher Express updates itself automatically to provide constant and immediate protection.

After you set up SpyCatcher Express to scan your computer regularly, it alerts you whenever it detects spyware or other suspicious programs. It can also send reports to your email account.


Status Page

Status

This is the Status page. On this page, you can access all features of SpyCatcher Express by clicking the appropriate tab.

The page is divided into three sections:
  • Spyware Scans - Click the appropriate links to run a scan or schedule automatic scans.
  • Protection - The link in this section reflects your current settings. For example, if the displayed link is Medium, then your application settings are set to medium protection. To change your protection settings, click the link and the Protection page is displayed.
  • Upgrade Manager - Click Learn More for information on upgrading to the full version of SpyCatcher.
If you upgrade to the full version of SpyCatcher, you can retrieve updates from Tenebril from this page.

Note: If a green check mark is displayed, it means everything is fine. If a red exclamation mark is displayed, it means that the item needs attention. These settings are automatically saved.


About SpyCatcher

About

This page tells you all about the software including:

  • Version of the software and the build number (Click the button to check for updates.)

  • How to upgrade to the full version of SpyCatcher (Click Learn how to upgrade to SpyCatcher 2007.)

On this page, you can reach the Tenebril Homepage and technical support. (Click the appropriate link.)

The side bar is a dynamic messaging area through which Tenebril can send information and special offers related to protecting your computer. You can control whether the side bar is dynamic or remains static.


Welcome

Welcome To the Configuration Wizard

Welcome to the SpyCatcher Express Configuration Wizard. Follow the steps on the screens. As you move through the Configuration Wizard, you make choices so SpyCatcher Express can work for you and address your specific needs.

You will:
  • Choose how you want to receive automatic updates
  • Have the opportunity to quarantine any spyware that is currently running on your computer
  • Choose a policy about suspicious files
  • Choose whether to remove tracking cookies during a scan
  • Choose whether to send anonymous spyware reports
  • Set up automatic spyware scans
When you get to the last screen and click Finish, SpyCatcher starts.


Configuration Wizard - Updates

This step of the Configuration Wizard lets you set when you want to receive automatic SpyCatcher Express updates. New spyware threats are discovered every day, so it is important for you to update fingerprints on a regular basis.

You can choose to:
  • Download and install fingerprint updates being asked before the download
  • Not to download fingerprint updates or be asked
  • Notify you when product updates are available
A security update is an improvement to the spyware detection and removal engine. Tenebril systematically improves the technology in SpyCatcher to be able to identify latest spyware threats.

Product updates are updates to the SpyCatcher application.


Configuration Wizard - Quick Scan

This step quickly scans your computer for currently running spyware. If spyware is detected, it is listed in the Spyware Detected box. You then have the opportunity to quarantine it.


Configuration Wizard - Suspicious Files

This step of the Configuration Wizard lists all suspicious
files found during the quick scan. You might recognize the file and choose to allow it, or you might consider it a threat.

Here, you can choose a policy for all suspicious files detected during a scan. When you select a file and click Choose a Policy, the Suspicious File Wizard launches a series of pages to help you determine how to handle the file. Step through the wizard and answer the questions.

Note: You need to complete the Suspicious File Wizard once for each suspicious file.


Configuration Wizard - Tracking Cookies

This step of the Configuration Wizard lets you choose whether or not to remove tracking cookies during a scan. Although cookies are not spyware, advertisers share them to create a large picture of your web browsing habits.

Click the check box to remove tracking cookies during future scans.


Configuration Wizard - Send Anonymous Reports

Configuration Wizard

Send Anonymous Reports

This page lets you send a secure, anonymous report on your computer's spyware to Tenebril. These reports help Tenebril provide up-to-date fingerprints and track the spread of spyware threats. The Tenebril Research team then investigates the spyware and updates the spyware database.

To send an anonymous spyware report, be sure that the check box is selected.


Configuration Wizard - Scheduling

This step of the Configuration Wizard lets you set up automatic scans. You can decide how often and which days and time to run scans. You can also choose one or both of the following scan options:
  • Display status when scanning
  • Display results when finished
If you do not choose to run automatic scans, protection options are still in effect.


Configuration Wizard - Finished

You have completed the Configuration Wizard and are ready to start. Click Finish to run SpyCatcher Express.


Start Scan

Scan - Start

When you click the Spyware Scan tab, you can choose your scan options. Your choices are:
  • Quick scan - Scans only memory and sensitive file locations
  • Deep scan - Scans memory, registry, folders and files
  • Custom scan - Lets you customize your scan by clicking the check boxes. When you click the Select link, you can choose specific parts of your computer to scan.
The Fingerprints box identifies the traces recognized and when the fingerprints were last updated.

The Last Scan box identifies the last run time, the type of scan, and the spyware and traces found.

When you click Scan Now, the scan begins. You can watch the progress of the scan or use your computer while the scan is running.

Note: Click the Cancel scan link if you want to stop the scan.

After the scan completes, click the Back to Spyware Scan link to return to the Spyware Scan page or click another tab.


Scan - Progress

SpyCatcher Express is scanning your computer. On this page, you can see the progress of the scan.

Note: You can abort the scan at any time by clicking the Cancel scan link.

The Options box shows you which scan is running. This is based on your choice when you set your scan options. As the scan runs, you can watch as the traces detected, processes, registry keys, files and folders scanned, and time elapsed counts are displayed.


Scan - Results

This page displays the results of the scan. The Application column lists the applications found; the Category column lists whether the file is spyware or a suspicious file. The Action column indicates the action taken on the file. If you want to change the action for any type of spyware, go to the Your Spyware page.

Look at the Scan Statistics box for the total count of traces detected, along with running processes, registry keys, files and folders scanned. The time elapsed displays exactly how long the scan took.

Click the Change Spyware Actions link to indicate that you want SpyCatcher Express to handle the file differently from the way it currently handles it.


Scheduler

On this page, you can set how often you want SpyCatcher Express to do automatic scans. You can also visit the Updates page by clicking the Updates page link.

You can schedule a scan for as often as you like and at a specific time of day.

In addition, you can choose a quick scan or a deep scan.

If you upgrade to the full version, you can enable and disable the ability to display the status when scanning and the results when the scan is complete.

Before you scan, you can visit the Protection page to reset your protections, if you like. Click the Protection Settings link to do this.

To schedule an automatic scan:

  1. Click the radio button associated with your choice.

  • Every day, every week, every two weeks, or every month. Click the drop-down box to display your options, and choose one.

  • Every week on a certain day or every day, if you choose. Click each check box to choose a day.

  2. Choose a time from the drop-down list, if you like.

  3. Choose your scan options.

  • Click a radio button to choose a quick scan or a deep scan.

  • Click one or both check boxes to display the status when scanning, when finished, or both.

Note: The Protection Settings link returns you to the Protection page if you want to change your settings. The protection description reflects your current settings.

  4. Click Apply.


Protection

This page lets you choose your protection level. The protection level you choose determines which applications are allowed to run on your computer and what the applications can do.

The Description box contains the description of the currently chosen protection level. The protection levels are:
  • High protection - SpyCatcher Express automatically quarantines all spyware and suspicious applications. Be careful when using this option since you might be blocking applications that you want.
  • Medium protection - SpyCatcher Express automatically quarantines spyware and asks for your permission when a suspicious file tries to run.
  • Low protection - SpyCatcher Express asks for your permission when spyware or a suspicious file tries to run.
  • Custom - Choose this option to link to where you can choose your protection settings or choose your system guards.
When you click the Your Spyware link, the Protection: Your Spyware page is displayed where you can control which applications can run on your computer.


Protection - System Guards

This page displays the SpyCatcher Express protective features and information about them. The protective features are:

  • Stop browser hijacking - Prevents applications from changing important Internet Explorer settings, for example, home page, search page, and blank page

  • Protect system settings - Prevents applications from changing vital system settings

  • Prevent keystroke logging - Prevents any application from monitoring your keystrokes

  • Block rootkit infections - Blocks applications from using system-level functions to install a rootkit

  • Block adware popups - Blocks programs other that Internet Explorer from opening popup windows

Here you can turn the features on or off.

  1. Select a feature.

  2. Choose ON or OFF from the drop-down list.

  3. Click Apply.

These settings protect parts of your computer from all applications. The description displayed explains the selected feature.

Note: If you choose ON for a setting, a green check mark is displayed. If you choose OFF, a red X is displayed. These settings are automatically saved.


Protection - Trusted Applications

Protection - Custom Settings

This page lets you define your custom protection actions for spyware and suspicious files. Choose one of the following from each drop-down box.
  • Allow - Lets the application run normally, without SpyCatcher asking your permission
  • Ask Me - Notifies you the next time the application tries to run. At that time, you can allow or disallow it.
  • Quarantine - Does not allow the application to run but stays on your computer so you can change your mind and run it in the future
  • Delete - Removes the application from your computer, so you will not be able to recover it
Once you have made your choices, click Apply.


Protection - Trusted Applications

Protection: Your Spyware

This page lets you set protection policies to control which applications can run on your computer. It is the result of clicking the Your Spyware link on the Protection Level page.

To change an application action on any of the files listed in the Application Actions box:
  1. Select the application.
  2. Click Change Action. The Application Action page is displayed.
  3. Click one of the radio buttons to choose a policy for the application.
Application Action

The policies you can choose are listed on the Application Action page. Here you choose a policy for the application. The policies are:
  • Allow - Lets the application run normally, without SpyCatcher asking your permission
  • Ask Me - Notifies you the next time the application tries to run. At that time, you can allow or disallow it.
  • Quarantine - Does not allow the application to run but stays on your computer so you can change your mind and run it in the future
  • Remove - Removes the application from your computer, so you will not be able to recover it

Note: If you change an application's action from Remove to Allow, Ask, or Quarantine, the application will not be restored to your computer. However, if you try to reinstall the application, SpyCatcher Express will follow your new policy.

Traces

When you click Traces on the Protection: Your Spyware page, the View Traces page is displayed.

Here you can view the application, the file location, and the size of the file.


Updates

To be sure that your computer is safe from spyware and suspicious files, SpyCatcher Express updates your computer with the latest spyware information to protect your computer.

SpyCatcher Express lets you choose how you want to receive the updates. You can choose one of the following update methods:

  • Download fingerprint updates and ask me before installing

  • Don’t download fingerprint updates or notify me

If you upgrade to the full version of SpyCatcher, you can automatically download and install fingerprint and security updates.

Security updates are improvements to the spyware detection and removal engine. Product updates are revisions to the SpyCatcher application. You can choose to be notified when product updates are available

Click Update Now when you are ready to update.


Alerts

This page lets you set how SpyCatcher Express alerts you when it prevents something harmful from happening to your computer. You can choose either an icon blink or a tray popup for your alert methods.

SpyCatcher Express blocks a file or program based on your protection policy and alerts you when:
  • A suspicious file tries to run (A program that SpyCatcher Express classifies as a suspicious file tries to run.)
  • A potentially unwanted application tries to run (A program that SpyCatcher Express classifies as an unwanted application tries to run.)
  • An application tries to change your browser settings, for example, your home page, search page or blank page.
  • An application tries to change your system settings, for example, your registry file.
  • An application tries to record your keystrokes.
To set how SpyCatcher Express alerts you:
  1. For each category in the Alerts box, choose either tray popup or icon blink from the drop-down list.
  2. Click Apply.
To return to the default settings, click Set to Defaults.


Spyware Alert

Alert - Spyware

This window appears if potentially unwanted software is trying to run on your computer. SpyCatcher Express has prevented it from running for now; however, you need to choose whether you want it to run in the future or not.

To help you determine your choice, click the Click here link to reach an online encyclopedia.

What would you like to do?

Click a radio button to choose one.
  • Allow it to run lets it run on your computer until you change your policy, if you wish to do so in the future.
  • Don't allow it to run quarantines it until you change your policy, if you wish to do so in the future.

Note: If later you change your mind about the file, you can use Change Policy to alter your policy about this file.

Click the check box to have SpyCatcher Express remember your choice.

Click Next to go to the next page.


Suspicious File Alert

Alert - Suspicious File

This window appears if a suspicious file is trying to run on your computer. SpyCatcher Express has prevented it from running for now; however, you need to choose whether you want it to run or not in the future.

To help you determine your choice, click the Click here link to reach an online encyclopedia.

The Help me decide button is there to run the Suspicious File Wizard which helps you analyze whether your file is safe to run.

What would you like to do?

Click a radio button to choose one.
  • Allow it to run lets it run on your computer until you change your policy, if you wish to do so in the future.
  • Don't allow it to run quarantines it until you change your policy, if you wish to do so in the future.

Note: If later you change your mind about the file, you can use Change Policy to alter your policy about this file in the future.

Click the check box to have SpyCatcher Express remember your choice.

Click Done to end.


Suspicious Files Wizard - File Information

Suspicious File Wizard - Trusted Source

This is the first page of the Suspicious File Wizard. It helps you determine how you want SpyCatcher to handle this file during future scans.

The page lists the location, company, product, internal name, original name, and a description of the file. It also supplies a hint to assist you in making the best choice.

Note: Use the company name as your best hint to determine the nature of the file.

Answer the question: Do you remember installing this file? Is it associated with something you trust?

  • If you answer Yes and click Next, it is likely that this file is acceptable to run on your computer.

  • If you answer No and click Next, the wizard continues with more questions

By the time you reach the wizard's final page, you can determine how you want SpyCatcher Express to handle the file during future scans.


Suspicious File Wizard - Recently Installed Applications

Suspicious Files Wizard

Recently Installed Applications

This is the second page of the Suspicious File Wizard.

Answer the question posed on this page: First, study the hint to help you determine your answer.

Did you just install new software from a publisher you trust?

  • If you answer Yes, this file is probably safe to run on your computer.

  • If you answer No and click Next, the wizard asks you one more question.

If you just installed new software, this file might be part of it.

Note: Some legitimate applications install files that might be categorized as suspicious. If a file is detected, and you have recently installed an application you know to be safe, the suspicious file might be a part of that application.


Suspicious File Wizard - Information from the Internet

Suspicious Files Wizard

Information from the Internet

On this page, the wizard gives you some information then asks you the question: Did you just install software form a publisher you trust?

Answer the question posed on this page: A hint is displayed to help you determine your answer.

Does the Internet indicate this file is trustworthy?

  • If you answer Yes, this file is probably safe to run on your computer.

  • If you answer No, this file is probably not safe to run on your computer.

Note: This page displays what other users have done about this file.

Click Next.


Suspicious File Wizard - Trusted Applications

Suspicious File Wizard - Trusted

Based on your answers, the file in question seems to be trustworthy. Click Finish and SpyCatcher Express will remember to allow this file to run in the future.

Note: The wizard might not always be correct. If you notice popups or your computer is still running slowly or acting strangely, you can change your policy for this file.


Suspicious File Wizard - Disallowed

Based on your answers, the file in question seems not to be trustworthy. Click Finish and SpyCatcher Express will remember not to allow this file to run in the future.

Note: The wizard might not always be correct. If you notice that a program you normally use is not functioning properly after quarantining this file, you can change your policy for this file on the Your Spyware page.

Caution: If your program is a free program you downloaded from the Internet, it might be spyware.

If you decide in the future that this file is a trusted application, you can make changes to your policy at any time.


Alerts

Rootkit Alert

You have received this alert because a program was performing an action frequently associated with rootkits.

A root kit is a set of tools (programs) used by an intruder after furtively accessing a computer system. These tools can help the attacker maintain access to the system and use it for malicious purposes without being detected.

Typically, a root kit is completely hidden on your computer and often includes software to intercept data from terminals, network connections, and the keyboard. A root kit can also include utilities to help the attacker subsequently access the system more easily.

To respond to this alert:

  • If you are installing drivers or other software that you trust, choose allow from the drop-down list for as long as you need.

  • If you are installing new hardware, choose allow from the drop-down list for the time it takes for the installation.

  • Choose deny from the drop-down list in all other cases.

Note: If you have lost functionality, turn off rootkit protection and repeat.


SpyCatcher Tools

Tools

This page is where you can link to each SpyCatcher Express tool. Click the link of the tool you need. The tools are:

  • Upgrade Manager - Lets you upgrade to the full version of SpyCatcher

  • System Explorer - Lets you see everything that runs on your system

  • Log Viewer - Lets you view the log files that SpyCatcher Express creates as it performs actions

  • Cookie Manager - Lets you manage your cookies

  • Configuration Wizard - Lets you rerun the SpyCatcher Express Configuration Wizard

In addition, if you upgrade to the full version of SpyCatcher, you can:

  • View and modify your hosts file

  • Send a report to the Tenebril Spyware Research team

  • View a list of phishing sites SpyCatcher is aware of


System Explorer

When you click the System Explorer link, you can view a detailed list of all applications running on your computer.

The System Explorer page gives you a window into your computer. You can look through the programs that are currently running and the programs that are configured to run when your computer starts (both in the Start menu and in the system registry). The System Explorer also shows which files connect to Internet Explorer when it runs and can watch which sites you surf.

These are all the major places where spyware, and other potentially abusive software, can be found. The System Explorer gives you detailed information about each program in these locations.

If you upgrade to the full version of SpyCatcher, you can disable suspicious files that you consider menacing.

The System Explorer directory tree has the following branches:

  • Memory - all the programs running on your computer at the time the System Explorer was filled are listed
  • Start Up menu
  • Registry start section
  • Internet Explorer plug-ins
  • Embedded network objects
  • ActiveX components

To expand the directory tree, click the plus (+) sign before the directory. To retract the directory tree, click the minus (-) sign. A plus (+) sign indicates that the tree can be further expanded.

  • Click Refresh to return to the collapsed directory tree.

  • Select a file, and click File Information to display the information about the selected file. The file information identifies the company that created it, the version number, and the product associated with it.

Note: Because the software's author provides this information, you cannot always trust it.

  • Click Quarantine if you want to quarantine that selected file.

Note: If you attempt to quarantine a file that SpyCatcher Express has not identified as spyware, a warning message is displayed.

File Information

When you click File Information in the System Explorer, it shows information about the selected file.

This page displays file details. You can even do a web search, if you like, by clicking Web search.


Log Viewer

This page lets you select the types of log entries you want to view.

  • Click the plus (+) sign to expand Policy, Errors, or Actions to view the log files associated with them.

  • Choose from the drop-down list for how far back you want to view.

  • Click Save Log to save the log file.

Note: You can select to view a certain time period. You can also click the arrows to browse through the log files.


Cookie Manager

The Cookie Manager lets you scan for tracking cookies and displays the tracking cookies detected during the scan in a list on this page.

You can remove all tracking cookies detected by clicking Select All and then clicking Remove. You can also scroll through the list and choose each file that you want to remove individually and click Remove.


About SpyCatcher

Upgrade Manager

This page lets you upgrade to the full version of SpyCatcher. In the upgrade, you have many new features including the ability to:

  • Display the status when scanning and the results when completed

  • Automatically download and install fingerprint and security updates

  • View and modify your hosts file

  • Send a report to the Tenebril Spyware Research team

  • View a list of phishing sites SpyCatcher is aware of

To upgrade to the full version of SpyCatcher:

  1. Click the link on this page, which displays the SpyCatcher Download page.

  2. Follow the upgrade instructions. An order number is email to you after you enter your email address.

  3. Enter your order number and your email address on the Upgrade Manager page to complete the upgrade.