Spybot Search and Destroy on-demand scan

Content

Tip: keyboard shortcut Ctrl+F searches in the page contents

Spybot Search and Destroy on-demand scan

In this tutorial: How to run a full scan or scan just a file or folder with Spybot Search and Destroy in Windows XP, Windows Vista or Windows 7

Last modified: 2011-12-25 12:26:36 EET

As full scan takes quite some time, it is sometimes better to scan a suspicious file or folder instead.

Please remember that this only scans files and folders for malware. It does not remove or disinfect anything!

To do that, right-click the item you want to scan and select Scan using Spybot-Search&Destroy.
Spybot Search & Destroy - scanning one item only. To scan a file or folder, right-click the item and select Scan using Spybot-Search&Destroy.

A scanning dialog opens, stand by.
Spybot Search & Destroy - scanning one item only. Wait until scan completes.

Scan is complete after status above Close button says "Scan finished".
Scroll through the list of scanned items and if each one has status of "nothing found", then close the window by clicking Close.
Spybot Search & Destroy - scanning one item only, no infection found. After status above Close button says Scan finished, click Close.

But if you see items with red X marks on the list, your computer is malware-infected. Close the scanner by clicking Close button and run a full scan immediately!
Spybot Search & Destroy - scanning one item only, infection found. After status above Close button says Scan finished, click Close. As infected items were found, perform a Spybot full scan immediately!

Launching Spybot - Search & Destroy

If Spybot Search & Destroy is not running, Windows XP users can start it by opening Start menu, All Programs, Spybot - Search & Destroy and clicking Spybot - Search & Destroy. Please remember to close all Internet browsers (Internet Explorer, Mozilla Firefox, etc) first!
Spybot Search & Destroy in Windows XP Start menu

Windows Vista and 7 users should start Spybot - Search & Destroy a bit differently because immunization and system scan need administrative rights.
Open Start menu and type "spybot" into Search box. Right-click Spybot - Search & Destroy and select Run as administrator. Alternatively, you can hold down Shift and Ctrl keys on keyboard and click Spybot - Search & Destroy.
Windows 7, to start Spybot Search & Destroy, type "spybot" into Start menu Search box. Right-click Spybot - Search & Destroy and select Run as administrator.

Windows Vista and 7 users will then see a User Account Control warning about Spybot making changes to computer. Click Continue or Yes.
Windows 7, User Account Control warning about Spybot making changes. Click Yes.

Spybot starts by loading itself - this might take some time as system immunization takes place.
Loading Spybot - Search & Destroy...

If you have an Internet browser open, you might see this warning message. Click OK after you close the browser.
Spybot Search & Destroy. When a browser is open while Spybot Search & Destroy is immunizing system, a warning window will open. Close all open browser windows and click OK.

Spybot might say that you have loads of files in your temporary folder and that it is better to delete them. Click Delete there then.

Updating Spybot - Search & Destroy and immunizing your computer

Before scanning it is very important to make sure you have latest detection rules installed, even if you have automated Spybot!
Click Search for Updates button.
Spybot Search & Destroy - updating. To check for updates, click Search for Updates.

Spybot Search & Destroy Updater automatically selects a random server, click Continue.
Spybot Search & Destroy - updating. A download server has been automatically selected, click Continue.

If you get a "No newer updates available", proceed to scanning part right away - Spybot is already up-to-date.
Spybot Search & Destroy - updating. If Spybot is already up-to-date, a message is displayed. Click OK.

If there are updates available, select all updates and click Download.
Spybot Search & Destroy - updating. Select all updates and click Download.

After downloading is complete, the new detection rules are applied. Wait until all updates in the list get a green check mark and then click Exit.
Spybot Search & Destroy - updating. Wait until downloading and installing is complete. This is indicated by putting a green check mark before each item in the list. Then click Exit.

After updating you should immunize your computer right away. Click Immunize tab on the left.
Spybot Search & Destroy - immunization. Click Immunize tab on the left.

If a number larger than zero appears in Unprotected column on the right, click Immunize button.
Spybot Search & Destroy - immunization. Click Immunize button if Unprotected column on the right has a number larger than 0.

Performing a full on-demand scan with Spybot - Search & Destroy

Click Search & Destroy tab on the left if its not already open. Click Check for problems button to start scanning:
Spybot Search & Destroy - scanning. To start scanning for malware, click Check for poblems button.

Scanning will take quite a while again. 20-40 minutes is absolutely normal. You've spent so long staring at your monitor, why not do some exercise meanwhile?
Spybot Search & Destroy - scanning. Wait until scan is complete.

If everything is fine, you'll see "Congratulations! No immediate threats were found" message. You can close Spybot Search & Destroy then by using keyboard shortcut Alt+F4 or choosing Exit from File menu:
Spybot Search & Destroy - scanning. No detections - exit the program.

If Spybot detected some malware, you'll have a red list of detections. If you want to know more about an item on the list, click on it once. Then click the yellow bar with blue arrowheads on the right, this opens description pane for the selected malware item. You can close the description pane again by click the bar with arrowheads; or you can leave the pane open.
Spybot Search & Destroy - scanning, malware has been found. Click on an item and then click the bar on the right to see detected malware's description.

Click Fix selected problems button.
Spybot Search & Destroy - scanning. If detection occured, click Fix selected problems.

Spybot will ask for your confirmation. Click Yes.
Spybot Search & Destroy - scanning. Click Yes to remove found cookies and malware.

After cleaning has successfully completed, click OK.
Spybot Search & Destroy - scanning. After problems have been fixed, click OK.

Spybot will turn all successfully removed items green. You can close Spybot Search & Destroy now by pressing Alt+F4 on your keyboard.
Spybot Search & Destroy - scanning. After removal process, all successfully deleted items will have a green check mark.

Some stubborn malware programs do not let themselves be unloaded from computer memory and they cannot be removed right away. Spybot will then ask if it can schedule a scan after Windows restart. Click Yes.
Spybot Search & Destroy - scanning, some malware could not be deleted. Spybot offers to scan your computer after a restart. Click Yes.

Spybot then opens statistics dialog and reminds you to restart your computer. Click OK.
Spybot Search & Destroy - scanning, some malware could not be deleted. Click OK and restart your computer immediately!

Restart your computer immediately! After you log on to Windows after the restart, some black windows appear and disappear quickly. This is normal - Spybot uses command prompt for deleting stubborn malware files before they get loaded into memory again.
Spybot Search & Destroy - removing stubborn malware files after you log on to your computer after the restart Spybot requested.

Windows Desktop icons and Taskbar might not appear, because Spybot Search & Destroy starts a new full system scan. This takes time, so you can safely do something else meanwhile.
Spybot Search & Destroy - scanning after the requested system restart. Windows Desktop icons and Taskbar will not appear until the scan is complete. This takes time.

After the scan is complete, Desktop icons and Taskbar appear and Spybot startup scanning window will disappear. If Spybot found some malicious remains, it will open its usual scanning results window. Click Fix selected problems.
If your computer is clean, other Spybot window will not appear. Continue working as normal.