Getting Started

Previous Next

Getting Started
Getting Started
Webroot® System Analyzer provides Service Desk Technicians with a simple utility that can quickly scan customer computers for spyware and other potentially unwanted programs. During the scan, System Analyzer sweeps the computer for suspicious items and compares its findings to Webroot’s evolving database of threat definitions. System Analyzer then generates a report that describes any vulnerabilities it found and makes recommendations about enhancements that can increase system performance, privacy, and protection.
Previous Next


Installing and starting System Analyzer

Previous Next

Getting Started > Installing and starting System Analyzer
Installing and starting System Analyzer
System Analyzer can run across a network, from a USB drive, or from a CD-ROM. We recommend installing and running System Analyzer from a USB drive, which makes it easy to update and available for use in any customer’s computer.
* To install and start System Analyzer:
1.
Unzip the System Analyzer files to a USB drive.
Be sure to use the unzipping option that maintains the folder structure of the files.
2.
Navigate to the USB drive and double-click the systemanalyzer.exe file.
The System Analyzer main screen opens.
Previous Next


Updating threat definitions and the program

Previous Next

Getting Started > Updating threat definitions and the program
Updating threat definitions and the program
Webroot updates its database of threat definitions several times a week. We recommend that you click the Check for Updates button on the main screen at least once a week to ensure that you have the latest version of the definitions and related files. (Definitions are often updated daily, so more frequent updates are a good idea.) You can also check for program updates with the Check for Updates button.
*
If you update from nonwriteable media, such as a CD-ROM, the updates are placed in the default temp folder of the computer you are using.
* To update threat definitions and the program (if updates are available):
1.
Navigate to the USB drive where you unzipped the System Analyzer files and double-click the systemanalyzer.exe file.
The System Analyzer main screen opens.
2.
Under Versions, click Check for Updates.
The program downloads any new definitions or software.
3.
When it’s finished, click OK.
Previous Next


Contacting Webroot Technical Support

Previous Next

Getting Started > Contacting Webroot Technical Support
Contacting Webroot Technical Support
Technical support for System Analyzer is available from the Webroot Web site at:
www.webroot.com/support
We make every effort to respond to your request on the same day you send it in, but please allow up to 48 hours.
Previous Next


Running System Scans

Previous Next

Running System Scans
Running System Scans
To run system scans and review scan reports, see the following topics:
•
Running a scan
•
Reviewing scan results
*
System Analyzer is optimized for speed. It rapidly searches the most common locations where spyware resides. For a comprehensive scan of your computer and ongoing protection from spyware, we recommend downloading Spy Sweeper from the Webroot Web site.
Previous Next


Running a scan

Previous Next

Running System Scans > Running a scan
Running a scan
System Analyzer can scan any Windows system version (Windows 98 or later). You can start a scan from the System Analyzer window or from the command line.
During a scan, System Analyzer searches the computer for possible infections of spyware and other risks, then compares its findings to Webroot’s database of threat definitions. It then generates a report that describes the vulnerabilities and suggests corrective steps. After you run a scan, you can also delete temporary files to recover space on the customer’s hard drive.
*
System Analyzer does not collect or reveal any personal information. If you use the option to delete temporary files, it will permanently remove those files from the customer’s computer. If you do not use this feature, System Analyzer does not remove or modify any files.
To run a scan, see the following topics:
•
Determining scan types to use
•
Starting a scan from the System Analyzer window
•
Starting a scan from the command line
•
Deleting temporary files
Previous Next


Determining scan types to use

Previous Next

Running System Scans > Running a scan > Determining scan types to use
Determining scan types to use
You can run any combination of the following scan types:
Scan Types
Type
Description
Scan for security software
This scan looks for the following:
•
Spyware protection installed. Looks for recent releases of many common anti-spyware programs, checks the date of the last definition update, and reports the date of the last scan.
•
Anti-virus protection installed. Looks for recent releases of many common anti-virus programs, checks the date of the last definition update, and reports the date of the last scan.
•
Firewall protection installed. Looks for recent releases of many common firewall programs and reports if it is disabled.
Scan for spyware and adware
This scan looks for the following:
•
Spyware infections. Looks for installed Trojan horses and system monitors.
•
Adware infections. Looks for installed adware.
•
Adware cookies infections. Looks for any tracking cookies.
Scan for technical system information
This scan looks at the following:
•
Processor and operating system. Reports the type and speed of the processor and the operating system version.
•
Memory. Reports the amount of memory installed and which slots it is in.
•
Hard drives. Reports the capacity and available space for the first two hard drives or partitions.
•
Drive fragmentation. Reports the percentage of each hard drive that is fragmented. Webroot uses a proprietary algorithm for rapid drive analysis. The results are not intended to match Microsoft Windows Disk Defragmenter utility, but provide an accurate assessment of drive fragmentation and whether defragmenting is recommended.
•
Recoverable disk space. Reports the amount of space taken up by Internet Explorer cache, cookies, and history, as well as Windows temporary files. To delete one or more of these types of files, click Delete Temp Files from the report window. For more information, see Deleting temporary files.
•
Exposed Internet Explorer URLs. Reports the number of Web addresses Internet Explorer has stored in history, the Address bar, and cache.
•
Status of Windows Messenger Service. Reports whether the service is active.
•
System slots. Reports the quantity and type.
•
Port connectors. Reports the quantity and type.
•
Video cards. Reports the quantity and type.
•
Audio cards. Reports the quantity and type.
•
Network connections. Reports the quantity and type.
•
Printers. Reports the quantity and type.
Previous Next


Starting a scan from the System Analyzer window

Previous Next

Running System Scans > Running a scan > Starting a scan from the System Analyzer window
Starting a scan from the System Analyzer window
You can start a scan from the System Analyzer window. The scan typically takes only a minute or two to run, then displays a report.
* To start a scan from the System Analyzer window:
1.
From the System Analyzer window, click Check for Updates to ensure that you have the latest version of all definitions and related files.
2.
Select the scans you want to run (see Determining scan types to use).
3.
Enter a name for the report that this scan will generate.
4.
Click Scan Now.
A scanning progress window opens.
When the scan is complete, the report opens (for more information, see Reviewing scan results).
5.
Review the report to see where the computer is vulnerable and to determine any actions you may want to suggest to the customer.
•
To print the report, click Print.
•
To delete temporary files, click Delete Temp Files. For more information, see Deleting temporary files.
6.
Click Close to close the report window.
Previous Next


Starting a scan from the command line

Previous Next

Running System Scans > Running a scan > Starting a scan from the command line
Starting a scan from the command line
You can start System Analyzer from the Windows Command Prompt or as part of a batch file. Use the parameters /r123 (with any combination of 1, 2, or 3 after the executable name) to start the program and immediately start a scan. You must include the full path the System Analyzer executable in the command or change directories to the folder that has the executable file in it.
Use the following command to start System Analyzer from the command line:
systemanalyzer /r123
Where:
1 = Scan for security software
2 = Scan for spyware and adware
3 = Scan for technical system information
When you execute the command, System Analyzer starts, the requested scans run, and the report opens when the scan is complete. For more information, see Reviewing scan results.
Previous Next


Deleting temporary files

Previous Next

Running System Scans > Running a scan > Deleting temporary files
Deleting temporary files
After running a scan, you can recover disk space by deleting several types of temporary files:
•
Internet Explorer cache
•
Internet Explorer cookies
•
Internet Explorer history
•
Windows temporary files
Deleting temporary files can recover a significant amount of hard drive space and save time on subsequent scans, but you may want to talk with the customer before deleting the files. Some customers may prefer to keep their Internet Explorer-related files as a convenience.
* To delete temporary files:
1.
From the report window after running a scan, click Delete Temp Files.
2.
Select the types of temporary files you want to delete.
3.
Click Delete.
Previous Next


Reviewing scan results

Previous Next

Running System Scans > Reviewing scan results
Reviewing scan results
When the scan is complete, System Analyzer creates an easy-to-read report in a Report window. This report reveals the current state of the system and provides clear recommendations that you can deliver to the customer.
From the Report window, you can do the following:
•
Save reports to a single file on the customer’s computer. See Saving reports to a single file.
•
Compare reports. If you run multiple scans and give each report a different name, you can compare the information in reports before and after you work on the customer’s computer. See Comparing reports.
Previous Next


Saving reports to a single file

Previous Next

Running System Scans > Reviewing scan results > Saving reports to a single file
Saving reports to a single file
You can save a copy of the report on the customer’s computer to a single file (.mht), which includes all text and graphics and is viewable with Internet Explorer. If you do not save the report to a single file, all reports are available in System Analyzer with the Previous Reports button, as long as you give each report a unique name when you run a scan.
* To save a report to a single file:
1.
From the System Analyzer main window, display the report window:
•
If you have already run a scan from this computer, click Previous Reports and select a report from the list.
•
If you have not already run a scan on this computer, click Start Scan then wait for the report to open.
2.
Click Export.
3.
Navigate to where you want to save the file.
4.
Enter a file name.
5.
Click Save.
Previous Next


Comparing reports

Previous Next

Running System Scans > Reviewing scan results > Comparing reports
Comparing reports
If you run multiple scans on the same computer and give each report a different name, you can compare scanning results in these reports before and after you work on the customer’s computer. The comparison shows the intersections of the two reports.
* To compare reports:
1.
Navigate to the USB drive where you unzipped the System Analyzer files and double-click the systemanalyzer.exe file.
2.
From the System Analyzer main window, click Previous Reports.
3.
Select a report from the list.
4.
Click Compare.
5.
Select another report from the list.
6.
Click Show Report.
Previous Next


Glossary

Previous Next

Glossary
Glossary
ActiveX
ActiveX technology is a group of functions developed by Microsoft that let programs share information. Many legitimate programs use ActiveX, but some spyware also uses ActiveX to install itself.
adware
Adware is a type of software that may display advertisements on your system. Some adware may also hijack Web searches, meaning it may reroute your Web searches through its own Web page. It may change your default home page to a specific Web site. Adware generally propagates itself using dialog boxes, various social engineering methods, or through scripting errors. Adware and BHOs are often bundled with various free software programs, such as clocks, messengers, alerts, and software such as screensavers, cartoon cursors, backgrounds, sounds, etc. Removing adware bundled with free software programs may cause the software to stop operating. These adware programs may also cause slowing of your Web browser and system performance issues.
Alternate Data Stream (ADS)
An Alternate Data Stream is a highly technical way to hide images, data, or code in a file and can be used to hide malicious code. The hidden content is impossible to detect using regularly-available tools, such as Windows Explorer.
Browser Helper Object (BHO)
Browser Helper Objects are add-on programs that work with your browser. Some spyware adds BHOs without your knowledge.
dialer
Dialers may disconnect your computer from your Internet Service Provider (ISP) and reconnect you to the Internet using an expensive toll or international phone number. Dialers can accrue significant phone charges and can run in the background, hiding their presence. They generally propagates itself using dialog boxes, various social engineering methods, through scripting errors, or may be delivered with a Trojan horse. The Federal Trade Commission recommends that you dispute the charges with your telephone company and report the incident.
definitions
A definition is the set of fingerprints that characterize a potentially unwanted program, such as spyware or adware. Webroot regularly updates these definitions to provide better protection against the latest versions of potentially unwanted programs discovered by Spy Sweeper.
keylogger
A keylogger is a type of system monitor that has the ability to record all keystrokes on your computer. Therefore, a keylogger may monitor keystrokes, e-mails, chat room dialogue, instant message dialogue, Web sites visited, usernames, passwords, and programs run, and any other typed material. They may have the ability to run in the background, hiding their presence. Keyloggers and system monitors may be used for legitimate purposes but can also be installed by a user to record sensitive information for malicious purposes.
Someone with administrative access to your computer, such as a system administrator or someone who shares your computer, typically installs commercial system monitors. This program may be installed on the machine without your knowledge or consent, and may allow an unauthorized, third party to view potentially sensitive information.
Worst case scenario: A third party may be able to view your personal conversations and may gain access to private information such as your usernames, passwords, credit card numbers, or your Social Security number.
potentially unwanted program
A potentially unwanted program is a program that may change the security or privacy state of your computer and online activities. These programs can (but do not necessarily) collect information about your online activities and send it to a third party without your knowledge or consent. A potentially unwanted program may arrive bundled with freeware or shareware, various social engineering methods, or by someone with access to your computer. Users may decide to remove these programs by using desktop security product.
rootkit or potentially rootkit masked files
Rootkits use file obfuscation techniques to allow spyware and other malicious software to avoid detection and removal. Rootkits typically hide logins, processes, files and logs, and may include software to capture information from desktops or a network. A rootkit's abilities to hide the presence of an intruder and the intruder's actions explain the increase in use of this method.
spyware
Spyware is a program that may either monitor a user’s online activities or possibly install programs without a user’s consent. Information about online activities may be subsequently sent to a third party for malicious purposes without your knowledge or consent. Spyware may arrive bundled with freeware or shareware, through e-mail or instant messenger, may propagate itself using dialog boxes, various social engineering methods, scripting errors, or by someone with access to your computer. Spyware is difficult to detect, and difficult (if not impossible) for the average user to remove without the use of a top-quality anti-spyware program.
system monitors
System monitors, typically non-commercial, may monitor and capture your computer activity, including recording all keystrokes, e-mails, chat room dialogue, instant message dialogue, Web sites visited, usernames, passwords, and programs run. This program may be capable of taking screen shots of your desktop at scheduled intervals, storing the information on your computer in an encrypted log file for later retrieval. These log files may be e-mailed to a pre-defined e-mail address. This program can run in the background, hiding its presence. These programs typically install via other threats, such as music downloads, and Trojan downloaders. These system monitors may allow an unauthorized, third party to view potentially sensitive information, such as passwords, e-mail, and chat room conversation.
traces
Traces are the individual elements that make up the definition database. The more traces found and put into the definitions the more complete the removal of the potential threats.
tracking cookies
Cookies are pieces of information that are generated by a Web server and stored on your computer for future access. When visiting some Web sites, a cookie may be placed on your system to track your personal preferences and Web surfing habits through uniquely identifiable information (browsing habits, usernames and passwords, areas of interest, etc.), and simultaneously share the information with other Web sites.
Trojan horses
A Trojan horse may manage files on your computer, including creating, deleting, renaming, viewing, or transferring files to or from your computer. It can utilize a program manager that allows a hacker to install, execute, open, or close programs. The hacker can gain remote control of your cursor and keyboard and can even send mass e-mails from your infected computer. It can run in the background, hiding its presence. A Trojan is usually disguised as a harmless software program and may also be distributed as an e-mail attachment. Opening the program or attachment may cause an auto-installation process that loads the downloader onto your computer and download third party programs on your computer, resulting in the installation of unwanted programs without your knowledge or consent, jeopardizing your privacy if it downloads another Trojan or a system monitor. Trojans may open a port on your computer that may enable a hacker to gain remote control of your computer.
virus
A virus is a self-replicating program that can infest computer code, documents, or applications. While some viruses are purposefully malignant, others are more of a nuisance, replicating uncontrollably and inhibiting system performance.
Previous Next


Glossary-470321.html

adware
Adware is a type of software that may display advertisements on your system. Some adware may also hijack Web searches, meaning it may reroute your Web searches through its own Web page. It may change your default home page to a specific Web site. Adware generally propagates itself using dialog boxes, various social engineering methods, or through scripting errors. Adware and BHOs are often bundled with various free software programs, such as clocks, messengers, alerts, and software such as screensavers, cartoon cursors, backgrounds, sounds, etc. Removing adware bundled with free software programs may cause the software to stop operating. These adware programs may also cause slowing of your Web browser and system performance issues.


Glossary-470326.html

definitions
A definition is the set of fingerprints that characterize a potentially unwanted program, such as spyware or adware. Webroot regularly updates these definitions to provide better protection against the latest versions of potentially unwanted programs discovered by Spy Sweeper.


Glossary-470359.html

spyware
Spyware is a program that may either monitor a user’s online activities or possibly install programs without a user’s consent. Information about online activities may be subsequently sent to a third party for malicious purposes without your knowledge or consent. Spyware may arrive bundled with freeware or shareware, through e-mail or instant messenger, may propagate itself using dialog boxes, various social engineering methods, scripting errors, or by someone with access to your computer. Spyware is difficult to detect, and difficult (if not impossible) for the average user to remove without the use of a top-quality anti-spyware program.


Glossary-470364.html

system monitors
System monitors, typically non-commercial, may monitor and capture your computer activity, including recording all keystrokes, e-mails, chat room dialogue, instant message dialogue, Web sites visited, usernames, passwords, and programs run. This program may be capable of taking screen shots of your desktop at scheduled intervals, storing the information on your computer in an encrypted log file for later retrieval. These log files may be e-mailed to a pre-defined e-mail address. This program can run in the background, hiding its presence. These programs typically install via other threats, such as music downloads, and Trojan downloaders. These system monitors may allow an unauthorized, third party to view potentially sensitive information, such as passwords, e-mail, and chat room conversation.


Glossary-470370.html

traces
Traces are the individual elements that make up the definition database. The more traces found and put into the definitions the more complete the removal of the potential threats.


Glossary-470378.html

tracking cookies
Cookies are pieces of information that are generated by a Web server and stored on your computer for future access. When visiting some Web sites, a cookie may be placed on your system to track your personal preferences and Web surfing habits through uniquely identifiable information (browsing habits, usernames and passwords, areas of interest, etc.), and simultaneously share the information with other Web sites.


Glossary-470383.html

Trojan horses
A Trojan horse may manage files on your computer, including creating, deleting, renaming, viewing, or transferring files to or from your computer. It can utilize a program manager that allows a hacker to install, execute, open, or close programs. The hacker can gain remote control of your cursor and keyboard and can even send mass e-mails from your infected computer. It can run in the background, hiding its presence. A Trojan is usually disguised as a harmless software program and may also be distributed as an e-mail attachment. Opening the program or attachment may cause an auto-installation process that loads the downloader onto your computer and download third party programs on your computer, resulting in the installation of unwanted programs without your knowledge or consent, jeopardizing your privacy if it downloads another Trojan or a system monitor. Trojans may open a port on your computer that may enable a hacker to gain remote control of your computer.


Glossary-471295.html

keylogger
A keylogger is a type of system monitor that has the ability to record all keystrokes on your computer. Therefore, a keylogger may monitor keystrokes, e-mails, chat room dialogue, instant message dialogue, Web sites visited, usernames, passwords, and programs run, and any other typed material. They may have the ability to run in the background, hiding their presence. Keyloggers and system monitors may be used for legitimate purposes but can also be installed by a user to record sensitive information for malicious purposes.
Someone with administrative access to your computer, such as a system administrator or someone who shares your computer, typically installs commercial system monitors. This program may be installed on the machine without your knowledge or consent, and may allow an unauthorized, third party to view potentially sensitive information.
Worst case scenario: A third party may be able to view your personal conversations and may gain access to private information such as your usernames, passwords, credit card numbers, or your Social Security number.


Glossary-471337.html

dialer
Dialers may disconnect your computer from your Internet Service Provider (ISP) and reconnect you to the Internet using an expensive toll or international phone number. Dialers can accrue significant phone charges and can run in the background, hiding their presence. They generally propagates itself using dialog boxes, various social engineering methods, through scripting errors, or may be delivered with a Trojan horse. The Federal Trade Commission recommends that you dispute the charges with your telephone company and report the incident.


Glossary-471441.html

rootkit or potentially rootkit masked files
Rootkits use file obfuscation techniques to allow spyware and other malicious software to avoid detection and removal. Rootkits typically hide logins, processes, files and logs, and may include software to capture information from desktops or a network. A rootkit's abilities to hide the presence of an intruder and the intruder's actions explain the increase in use of this method.


Glossary-471449.html

ActiveX
ActiveX technology is a group of functions developed by Microsoft that let programs share information. Many legitimate programs use ActiveX, but some spyware also uses ActiveX to install itself.


Glossary-471487.html

Alternate Data Stream (ADS)
An Alternate Data Stream is a highly technical way to hide images, data, or code in a file and can be used to hide malicious code. The hidden content is impossible to detect using regularly-available tools, such as Windows Explorer.


Glossary-471491.html

Browser Helper Object (BHO)
Browser Helper Objects are add-on programs that work with your browser. Some spyware adds BHOs without your knowledge.


Glossary-474597.html

potentially unwanted program
A potentially unwanted program is a program that may change the security or privacy state of your computer and online activities. These programs can (but do not necessarily) collect information about your online activities and send it to a third party without your knowledge or consent. A potentially unwanted program may arrive bundled with freeware or shareware, various social engineering methods, or by someone with access to your computer. Users may decide to remove these programs by using desktop security product.


Glossary-474686.html

virus
A virus is a self-replicating program that can infest computer code, documents, or applications. While some viruses are purposefully malignant, others are more of a nuisance, replicating uncontrollably and inhibiting system performance.