SpybotWiki - User contributions [en]

Creating a bootable CD

2013-12-03T10:08:07Z

Daemon: /* Settings */

Creating a bootable CD involves a handful of steps that are explained in detail here.

= Requirements =
== Windows Automated Installation Kit ==

The first thing you need is the Windows Automated Installation Kit, also called WAIK. This software includes all the Windows files that need to be put onto the CD, and tools to create that CD, which we cannot use, for legal reasons, from your current installation.

[[File:Trac3595-SDBootCD-WAIK-missing.png|WAIK is missing]]

If the WAIK is not installed, Boot CD Creator will offer you to download it. The download will happen in the form of a file ending with the extension .iso. To install the AIK, there are multiple ways, depending on your preferences:

# use your favorite DVD burning software to burn this image to a real DVD;
#* for example, with Windows Explorer itself:
#** right-click the downloaded file, [[File:Trac3595-Explorer-on-WAIK-ISO.png|thumb|center|Explorer context menu]]
#** and press ''Burn'' after having inserted a blank DVD. [[File:Trac3595-Explorer-burn-WAIK-ISO.png|thumb|center|Explorer burning WAIK ISO]]
# use a packer to extract the .iso to a subfolder; [[File:Trac3595-SDBootCD-iso-extract.png|thumb|center|Explorer context menu]]
#* for example using [http://www.7-zip.org/ 7-Zip],
#* or [http://www.rarlab.com/ WinRAR].
# use an image mounting software like [http://www.daemon-tools.cc/downloads Daemon Tools] to mount the image.

Once you've got there, you need to start installation from the place where you've burned or extracted or mounted the image.

Sometimes, the installation of the WAIK needs other software to be installed first. If it asks you to installed DotNET, look for the exact version of DotNET requested, and install just that. Newer versions are not downwards compatibel, but can co-exist.

[[File:Trac3595-SDBootCD-WAIK-found.png|WAIK found]]

Once the WAIK is installed, the Prerequisite panel within the Boot CD Creator will be shown with a green bar, and all other panels can be used.

= Configuration =
== Applications ==
[[File:Trac3595-SDBootCD-application-list.png|List of applications offered to include]]

In Applications to include, you can select other applications that should appear on the CD. To do that, click the arrow button at the right to expand it. For standard malware cleaning, the standard setup to include Spybot 2 is sufficient.

== Settings ==
[[File:Trac3595-SDBootCD-settings.png|Settings offered by Boot CD Creator]]

All Settings can be skipped as well if you want to, they just provide you an option to customize the CD. The Shell selection allows you to let the CD start up like old Spybot CDs would do, but the new Safer-Networking Shell, which is default starting with Spybot 2.3, is recommended.

You can also select whether your computer will boot from the CD right away, or only if you press a key within a short amount of time. This is useful if you've got your boot order set to always boot from CD first and forget the CD within the drive.

Finally, but setting a language and country, you can control that the CD will for example accept your keyboard input instead of having a foreign mapping. This should default to your current systems language.

= CD creation =

Once you're done checking the list of Applications and Settings, or right away if you just want to go ahead and skip them, the CD image creation panel is the one where you'll get your CD. You can just accept the default location and press the Create CD image button. It might take a few minutes for Boot CD Creator to combine all the necessary files and create an .iso image of your bootable CD.

[[File:Trac3595-SDBootCD-creation.png|Cd creation process]]

Again, burn this to a CD using your favorite application, or even use Windows Explorer, see above instructions on how to burn the WAIK ISO imagine, just do it on the file just created, usually stored at ''C:\SpybotBootCD\SpybotBootCD.iso''.

= CD usage =
== Make hardware boot the CD ==

To use your CD as a startup medium for your computer, you might need to tell it to look for bootable media in your CD-ROM drive. Most computers offer a key you can press right after powering it on.

[[File:Trac3595-BIOS-BootKey-hl.png|Boot screen with key listed]]

Once that key is pressed, you'll get a menu representing all drives that could be used for booting, including the CD or DVD one.

[[File:Trac3595-BIOS-BootKeyMenu-hl.png|Boot menu shown]]

By selecting this drive, your computer will start the Windows version included on the CD.

[[File:Trac3595-SDBootCD-cd-booting.png|CD booting up the embedded Windows PE]]

== Using the CD ==

In contrast to your regular system, the CD will show a toolbar representing all actions that might be of help when it comes to using Spybot to clean or repair your computer.

[[File:Trac3595-SDBootCD-cd-showing-shell.png|CD showing menu options]]

=== Adding up to date signatures ===

If you want to use the CD regularly without having to recreate it with up to date signatures every time, you can update them by running updates from an attached USB stick.

Since Spybot is completely in memory when running from the CD, you should recreate an up to date CD from time to time to avoid updates to signatures getting to big and taking up too much memory.

==== Anti-malware ====

Anti-malware signature updates can be added using the manual 1.6 updater. This updater can be found on our [http://www.safer-networking.org/dl/ Download page] at the bottom.

==== Antivirus ====

To update antivirus signatures, you can download the [https://dl.dropboxusercontent.com/u/85556593/spybot-signatures-is.exe full signature installer].

=== Scanning and cleaning ===

At the bottom in the ''Spybot 2 Basic'' menu, you can initiate a ''System Scan''. From this point, you can follow the instructions in [[Scanning for malware]].

Creating a bootable CD

2013-12-03T10:06:36Z

Daemon: /* Applications */

Creating a bootable CD involves a handful of steps that are explained in detail here.

= Requirements =
== Windows Automated Installation Kit ==

The first thing you need is the Windows Automated Installation Kit, also called WAIK. This software includes all the Windows files that need to be put onto the CD, and tools to create that CD, which we cannot use, for legal reasons, from your current installation.

[[File:Trac3595-SDBootCD-WAIK-missing.png|WAIK is missing]]

If the WAIK is not installed, Boot CD Creator will offer you to download it. The download will happen in the form of a file ending with the extension .iso. To install the AIK, there are multiple ways, depending on your preferences:

# use your favorite DVD burning software to burn this image to a real DVD;
#* for example, with Windows Explorer itself:
#** right-click the downloaded file, [[File:Trac3595-Explorer-on-WAIK-ISO.png|thumb|center|Explorer context menu]]
#** and press ''Burn'' after having inserted a blank DVD. [[File:Trac3595-Explorer-burn-WAIK-ISO.png|thumb|center|Explorer burning WAIK ISO]]
# use a packer to extract the .iso to a subfolder; [[File:Trac3595-SDBootCD-iso-extract.png|thumb|center|Explorer context menu]]
#* for example using [http://www.7-zip.org/ 7-Zip],
#* or [http://www.rarlab.com/ WinRAR].
# use an image mounting software like [http://www.daemon-tools.cc/downloads Daemon Tools] to mount the image.

Once you've got there, you need to start installation from the place where you've burned or extracted or mounted the image.

Sometimes, the installation of the WAIK needs other software to be installed first. If it asks you to installed DotNET, look for the exact version of DotNET requested, and install just that. Newer versions are not downwards compatibel, but can co-exist.

[[File:Trac3595-SDBootCD-WAIK-found.png|WAIK found]]

Once the WAIK is installed, the Prerequisite panel within the Boot CD Creator will be shown with a green bar, and all other panels can be used.

= Configuration =
== Applications ==
[[File:Trac3595-SDBootCD-application-list.png|List of applications offered to include]]

In Applications to include, you can select other applications that should appear on the CD. To do that, click the arrow button at the right to expand it. For standard malware cleaning, the standard setup to include Spybot 2 is sufficient.

== Settings ==
[[File:Trac3595-SDBootCD-settings.png|Settings offered by Boot CD Creator]]

All Settings can be skipped as well if you want to, they just provide you an option to customize the CD. The Shell selection allows you to let the CD start up like old Spybot CDs would do, but the new Safer-Networking Shell, which is default starting with Spybot 2.3, is recommended.

You can also select whether your computer will boot from the CD right away, or only if you press a key within a short amount of time. This is useful if you've got your boot order set to always boot from CD first and forget the CD within the drive.

Finally, but setting a language and country, you can control that the CD will for example accept your keyboard input instead of having a foroign mapping. This should default to your current systems language.

= CD creation =

Once you're done checking the list of Applications and Settings, or right away if you just want to go ahead and skip them, the CD image creation panel is the one where you'll get your CD. You can just accept the default location and press the Create CD image button. It might take a few minutes for Boot CD Creator to combine all the necessary files and create an .iso image of your bootable CD.

[[File:Trac3595-SDBootCD-creation.png|Cd creation process]]

Again, burn this to a CD using your favorite application, or even use Windows Explorer, see above instructions on how to burn the WAIK ISO imagine, just do it on the file just created, usually stored at ''C:\SpybotBootCD\SpybotBootCD.iso''.

= CD usage =
== Make hardware boot the CD ==

To use your CD as a startup medium for your computer, you might need to tell it to look for bootable media in your CD-ROM drive. Most computers offer a key you can press right after powering it on.

[[File:Trac3595-BIOS-BootKey-hl.png|Boot screen with key listed]]

Once that key is pressed, you'll get a menu representing all drives that could be used for booting, including the CD or DVD one.

[[File:Trac3595-BIOS-BootKeyMenu-hl.png|Boot menu shown]]

By selecting this drive, your computer will start the Windows version included on the CD.

[[File:Trac3595-SDBootCD-cd-booting.png|CD booting up the embedded Windows PE]]

== Using the CD ==

In contrast to your regular system, the CD will show a toolbar representing all actions that might be of help when it comes to using Spybot to clean or repair your computer.

[[File:Trac3595-SDBootCD-cd-showing-shell.png|CD showing menu options]]

=== Adding up to date signatures ===

If you want to use the CD regularly without having to recreate it with up to date signatures every time, you can update them by running updates from an attached USB stick.

Since Spybot is completely in memory when running from the CD, you should recreate an up to date CD from time to time to avoid updates to signatures getting to big and taking up too much memory.

==== Anti-malware ====

Anti-malware signature updates can be added using the manual 1.6 updater. This updater can be found on our [http://www.safer-networking.org/dl/ Download page] at the bottom.

==== Antivirus ====

To update antivirus signatures, you can download the [https://dl.dropboxusercontent.com/u/85556593/spybot-signatures-is.exe full signature installer].

=== Scanning and cleaning ===

At the bottom in the ''Spybot 2 Basic'' menu, you can initiate a ''System Scan''. From this point, you can follow the instructions in [[Scanning for malware]].

License (OpenSBI)

2013-09-10T09:35:44Z

Daemon:

The information available throughout this Wiki, the OpenSBI forum and the associated OpenSBI software, called ''OpenSBI environment'' below, is copyrighted and covered in this license.

==License==
* The OpenSBI environment was designed for, and is stricly licensed for, use by both home users and registered corporate customers, free of charge.
* You may not use the OpenSBI environment, or any parts within, for commercial purposes.
* You may not use tools to automatically scrape the OpenSBI documentation or database (you don't need to anyway unless you would want to violate the previous).
* You may not use the software if you are a malware author or distributor.
* Feel free to share the OpenSBI software, and the detection patterns you create, with anyone who's not on the forbidden list above, as long as you inform them about this license.
* In exchange for us providing and maintaining this environment for you, you grant Safer-Networking Ltd. the exclusive right to use detection patterns you create in their software.
* Feel free to write detection patterns for everything you like, including legit software, as long as you follow the following basic rules:
** You agree to not publish patterns that are designed solely to harm systems.
** You agree to not publish detection patterns for legit security software, unless you include, before the download and inside the file, good reasons to do so.
** You may not mislabel detection patterns for legit software as patterns to remove malicious software.
** For pattern that detect legit regular software, use the category PUPS.

Main Page

2012-07-04T13:21:35Z

Daemon:

The primary purpose of this Wiki is to give you more information about [[OpenSBI]], a file format you can use to provide Spybot - Search & Destroy with custom detection databases. Your starting points into this documentation would probably be:

* [[License (OpenSBI)|The OpenSBI License]]

== File Format ==
* [[SBI file format|Documentation of the OpenSBI file format]]
* [[SBI Commands|Information on SBI commands]]
* [[:Category:SBI Commands|List of available SBI commands]]
* [[Advanced file parameters|Information on advanced file parameters]]
* [[:Category:Advanced file parameters|List of available advanced file parameters]]

== Software ==
* [[Spybot - Search & Destroy]]
* [[OpenSBI Edit Lite]]
* [[FileAlyzer]]
* [[RegAlyzer]]
* [[RunAlyzer]]

== Tutorials ==
* [[Importing an InCtrl5 log]]
* [[Importing a HijackThis log]]
* [[Choosing advanced file parameters]]

OpenSBI Edit Lite

2008-05-29T14:53:48Z

Daemon:

[[Image:Opensbieditlite-syntaxhighlighting.png|200px|thumb|Syntax Highlighting]]
[[Image:Opensbieditlite-codecompletion.png|200px|thumb|Code Completion]]
[[Image:Opensbieditlite-contexthelp.png|200px|thumb|Context-sensitive Help]]
''OpenSBI Edit Lite'' is our editor for creating custom malware detection files for [[Spybot - Search & Destroy]]. It allows you to edit files in [[SBI file format]].

==Features==
* Syntax highlighting (provides a more structured view)
* Context sensitive help (press F1 for detailed help on the syntax of the current command)
* Code completion (hit Ctrl+Space for a list of commands, Shift+Space to complete the list of parameters)
* A quick [[:Category:SBI Commands|reference list]] of [[SBI Commands|SBI commands]]
* A quick [[:Category:Advanced file parameters|reference list]] of [[Advanced file parameters|advanced file parameters]]
* A quick [[Path templates|reference for path templates]]
* A quick [[Description templates|reference for description templates]]
* Import functions to import [[InCtrl5]] logs into the [[SBI file format]].
* Import functions to import [[HijackThis]] logs into the [[SBI file format]].
* Import functions to import [[FileMon]] and [[RegMon]] logs into the [[SBI file format]].
* Plugin structure for custom [[Importer Plugin SDK|importer plugins]].

==Tutorials==
* [[Importing an InCtrl5 log]]
* [[Importing a HijackThis log]]

==Trivia==
Various import filters that are designed to build a simple construct through point and click lead us to the describing term ''rapid detection prototyping'' (RDP), in allusion to ''rapid application development'' (RAD), a point and click technology to create software applications.