Run Spybot from CD?

[SCB__]

A friend's computer is so infected that it won't let me install Spybot on it.
Can I copy the Spybot directory from my PC to a CD-ROM and use that to run Spybot on my friend's computer, or does it require other things such as Registry entries on the target computer?
Thank you.

[LinusIT]

When you say it won't let you install it, what do you mean? Can you download the file but it won't run? If that's the case then running the install from a CD won't make any difference.

Have you tried booting into safe mode then installing?

[SCB__]

I managed to download the installer but when running it it tries to fetch components from www.safer-networking.org and fails. I can't recall the exact error message, but I believe that one of the malware programs is preventing access to that URL.

I wasn't planning to run the install from CD, I wanted to copy the already-installed software from my PC to a CD-ROM, and then copy the folder from there to the target computer, and hopefully run Spybot from there without going through the installation process.

I believe that I tried using Safe mode but couldn't get internet access in that mode.

[LinusIT]

I see, when your installing Spybot it is trying to download the latest updates during the install, this is where it's failing. When you install you get an option for "download updates" or something like that, untick this box and it should install ok. You then have two options for updating, run the program and use the built in updater or download the updates manually from the web.

Link:

http://www.spybotupdates.biz/updates...d_includes.exe

If you need internet access in safe mode choose "Safe Mode with Networking"

Copying the Spybot folder from one computer to another won't work as the computer you copy it onto will be missing the registry keys, you could try but I highly doubt it would work.

Hope this helps

[SCB__]

I'm pretty sure it was right at the beginning of the install process, trying to download components, not the updates at the end.

I'll retry it in Safe mode and see if I can do the downloads without the malware blocking access to the URL.

This is going to be a slow process as it is a 2-hour trip just to get to my friend's house and back each time I need to try something.

[LinusIT]

The option to download the updates during the install is the 2nd/3rd step. I have attached a screen shot of where you need to untick "Download Updates". If you untick this box, the install doesn't try to access the internet at all and will install fine.



If the computer is that infected, install Spybot then update, either manually or using the built in updater then restart the computer in "Safe Mode" and run the scan.

[SCB__]

Thank you.
I'll try that this evening.

[bitman]

SCB_,

Yes you can run Spybot S&D from a CD. Just copy the entire Spybot - Search and Destroy folder and sub-folder contents to a CD in exactly the same structure as currently found in Program Files from your own PC. Make certain you can view hidden and system files since portions of the installed program are not normally visible.

When at your friends house, insert the CD, browse to the Spybot - Search and Destroy folder and run SpybotSD.exe or if that is blocked, look for a .SCR file with an obfuscated name and try running that instead. Spybot S&D will create its usual recovery and other folders on the hard drive of the PC itself and simply use the CD for any required program components. Also, try running in Safe Mode initially if it still won't run, then switch back to Normal Mode after cleaning whatever it finds there.

Of course this will only contain the current detections updates and can't be updated, but once you have your friends PC cleaned you can copy the entire contents of the Spybot S&D program folder to Program Files on that PC and update it there. The CD is just to get you past the initial problem of being blocked by malware.

This still might not succeed, but hopefully it will get you a foothold to allow Spybot and other tools to clean the PC. It's probably best to still have the results of a HiJackThis log reviewed in the Malware Removal forum here, though that generally takes a couple days for an initial response, so I'd try with Spybot S&D first.

Bitman

[SCB__]

Well there wasn't time today. I'll have to try next weekend. Thank you for your help so far. I'll let you know what happened.

[SCB__]

Okay, to cut a very long (7 hours!) story short...

1) I reran the installer with all of the boxes unticked. It completed normally and I was able to start the program. However, it won't work until you have downloaded the updates, and that requires the program to go to www.safer-networking.org to get the list of mirror sites, and the spyware was blocking access to that URL.

2) I tried copying the folder containing the program and associated files from the CD to the hard disk and running it from there. The program appears to start but nothing happens.

3) I tried running it directly from the CD. This worked. Thank you SpyBot!