Spybot - Search & Destroy

• SDFiles.exe is registered as an AutoPlay event handler named 'SpybotScanFiles' with the ProgID of 'SpybotFilesScanner' and the action verb 'scanfiles.
• SDSettings.exe is registered as an AutoPlay event handler named 'SpybotScanFiles' with the ProgID of 'SpybotFilesScanner' and the action verb 'scanfiles.

• SDECon32.dll added to Windows Explorer under the name 'SDECon32' with a class of {44176360-2BBF-4EC1-93CE-384B8681A0BC}.
• SDECon64.dll added to Windows Explorer under the name 'SDECon64' with a class of {44176360-2BBF-4EC1-93CE-384B8681A0BC}.

• SDHelper.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'Spybot-S&D IE Protection' with the class of {53707962-6F74-2D53-2644-206D7942484F}.

• SDHelper.dll is installed as an Internet Explorer extension using the class {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}.

• SDOnAccess.exe is scheduled as a task named 'Scan most recently used file in the background' (runs when idle).
• explorer.exe is scheduled as a task named 'Scan the system' (runs monthly on Wednesdays at 00:30).
• SDImmunize.exe is scheduled as a task named 'Refresh immunization' (runs weekly on Wednesdays at 12:30 AM).
• SDFiles.exe is scheduled as a task with the class '{43A7D852-3703-4DE5-9DB9-0F3AFCA7836C}' (runs on registration).
• SDLogReport.exe is scheduled as a task with the class '{F5305E2F-3AAF-4595-A84F-54430F09A73A}' (runs on registration).
• SDUpdate.exe is scheduled as a task named 'Spybot - Search & Destroy Updater - Scheduled Task' (runs weekly on Mondays at 9:00 AM).
Plus 4 more

• SDCleaner.exe is automatically launched at startup through a scheduled task named Spybot-S&D Cleaning.
• SDUpdate.exe is automatically launched at startup through a scheduled task named Check for updates (Spybot - Search & Destroy).
• SDImmunize.exe is automatically launched at startup through a scheduled task named Refresh immunization.
• SDOnAccess.exe is automatically launched at startup through a scheduled task named Scan most recently used file in the background.
• explorer.exe is automatically launched at startup through a scheduled task named Scan the system (Spybot - Search & Destroy).
• SDWelcome.exe is automatically launched at startup through a scheduled task named Spybot-S&D Start Center.

• SDFSSvc.exe runs as a service named 'Spybot-S&D 2 Scanner Service' (SDScannerService) "Offers malware scanning services to Spybot-S&D modules".
• SDWSCSvc.exe runs as a service named 'Spybot-S&D 2 Security Center Service' (SDWSCService) "Integrates Spybot into the Windows Security Center.".
• SDUpdSvc.exe runs as a service named 'Spybot-S&D 2 Aktualisierungsdienst' (SDUpdateService) "Systemdienst zum Herunterladen und Installieren von Aktualisierungen im Hintergrund.".

• SDCleaner.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Spybot-S&D Cleaning' and executes as "C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean.
• SDPEStart.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'PE Start Menu' and executes as C:\Program Files\Spybot - Search & Destroy 2\SDPEStart.exe.
• SDOnAccess.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'On Access protection dialog' and executes as C:\Program Files\Spybot - Search & Destroy 2\SDOnAccess.exe.
• SDHookHelper.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Live Protection Helper' and executes as C:\Program Files\Spybot - Search & Destroy 2\SDHookHelper.exe.

• SDDelFile.exe is loaded once in the current user (HKCU) registry as a startup file name 'SpybotDeletingF3712' which loads as "C:\Program Files\Spybot - Search & Destroy 2\SDDelFile.exe" "C:\ProgramData\WPM\wprotectmanager.exe".

• SDCleaner.exe is loaded in the all users (HKLM) registry as a startup file name 'Spybot-S&D Cleaning' which loads as "C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean.
• SDTray.exe is loaded in the all users (HKLM) registry as a startup file name 'SDTray' which loads as "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe".

• SDDelFile.exe is loaded once in the all users (HKLM) registry as a startup file name 'SpybotDeletingE1712' which loads as "C:\Program Files\Spybot - Search & Destroy 2\SDDelFile.exe" "C:\WINDOWS\SchedLgU.Txt".

• SDFSSvc.exe is added as a firewall exception for 'C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe'.
• explorer.exe is added as a firewall exception for 'C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe'.
• SDRootAlyzer.exe is added as a firewall exception for 'C:\Program Files\Spybot - Search & Destroy 2\SDRootAlyzer.exe'.
• SDImmunize.exe is added as a firewall exception for 'C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe'.
• SDFiles.exe is added as a firewall exception for 'C:\Program Files\Spybot - Search & Destroy 2\SDFiles.exe'.
• SDTray.exe is added as a firewall exception for 'C:\pcwWinCleaner\Tools\Spybot - Search & Destroy 2\SDTray.exe'.
Plus 3 more

Comments

Error posting comment.

'Your comment has been posted to the moderator, it should be approved shortly. Thank you for commenting!'

Pick a name