Software Applications
Page tree

A description of the Spybot - Search & Destroy utility for Windows

Table of Contents


The Third Party Content provided here is obtained from sources believed to be reliable and no guarantees are made by Syracuse University, ITS or the providers of the Third Party Content as to its accuracy, completeness and utility. Usage of this product is completely at your own risk.


Spybot Search & Destroy (S&D) is a popular proprietary spyware and adware removal program compatible with Microsoft Windows 95 and later. It scans the computer hard disk and/or RAM for malicious software.


Safer Networking Limited

Operating system

Microsoft Windows, Windows Mobile, and Symbian


Spyware removal software


Proprietary software - Free


Installation / Usage

It is recommended to install Spy-bot without the TeaTimer option using custom installation.

  1. Update Spy-bot regularly. Newer definitions release almost every day.
  2. Immunize your PC regularly especially if you're using Internet Explorer or Mozilla Firefox.
  3. Run scans after clearing your internet cache and deleting cookies.

Spybot features

Spybot - Search & Destroy is currently released as freeware. Corporate users are required to purchase a yearly license.
Along with spyware and adware detection and disinfection capabilities, Spybot-S&D can repair (Registry), Winsock LSPs, ActiveX objects, browser hijackers and BHOs, PUPS, computer cookies, trackeware, heavy duty, homepage hijackers, keyloggers, LSP, tracks, trojans, spybots, revision, and other kinds of malware. It can also to some extent protect a user's privacy by deleting usage tracks like tracking cookies. Spybot-S&D also includes an "Immunize" feature to block the installation of spyware before it occurs e.g. by modifying the hosts file. Another tool included in Spybot-S&D is a file shredder, for the secure deletion of files. Spybot-S&D is not intended to replace anti-virus programs, but it does detect some common trojans.

Spybot-S&D also recently added an anti-rootkit function.

It is recommended to install Spy-bot without the TeaTimer option using custom installation.

The TeaTimer module can be optionally enabled, providing a level of active, real-time protection from undesirable registry changes and the like. This comes in the form of pop-ups which alert the user to registry changes, and ask for approval before allowing the change. Registry changes only tend to be made when programs are installed/uninstalled/updated, so random changes can indicate the presence of malicious software.

Some programs ship with attached spyware or adware and refuse to run when the undesired co-programs are removed; newer versions of Spybot replace the spyware binaries with inert dummies (designed to fool programs which require the spyware's presence).

In order to efficiently detect recently created programs, detection updates are released weekly along with other improvements such as added languages and better heuristics algorithms. These updates are downloaded from within the software from a variety of mirrors and are then automatically installed.

Spybot-S&D is available for all versions of Windows from Windows 95 and up, and offers more than two dozen different languages and several skins to users. Instructions are available on the website to enable users to design their own skins.
Technical support is currently supplied by means of Internet forums and support e-mails (with a usual response time of no more than 24 hours).

Incompatibility and conflicts

  • Removal by commercial security products
    Several of the largest commercial security products require users to uninstall Spybot when they are being installed or when they run.
  • Norton Internet Security
    The makers of Spybot-S&D have come into conflict over claims of incompatibility with Norton Internet Security. Symantec recommends uninstalling Spybot-S&D before installing Norton Internet Security. According to Safer Networking, no satisfactory explanation has been provided to them for this decision. Antivirus professional Mary Landesman suggests a possible explanation may stem from a graphical glitch in TeaTimer module's confirmation dialog. An official explanation from Safer Networking states that this error stemmed from a bug in the program used to build their code. The result of the bug was that users had difficulty enabling Norton Internet Security to make necessary changes to critical registry areas, such as allowing itself to launch on startup. Aside from this, Mary Landesman, like Safer Networking, concludes that the two programs have no issue with one another. The bug exists only in the 1.4 version of Spybot-Search & Destroy and has been fixed as of the 1.5 release.
  • Kaspersky Internet Security
    In certain instances Kaspersky Antivirus and Kaspersky Internet Security version 2009, forces users to uninstall Spybot during installation process, although there is no serious incompatibility yet known. The discussion was concluded in the Kaspersky forum, which said not to install Spybot at all. Kaspersky seems to be reluctant to fix the issue although they have received several complaints.
  • Internet Explorer 8
    The immunization feature of Spybot - Search & Destroy may cause Internet Explorer 8 to start slower than expected.


Sources and Relevant Links

Spybot Home