Go back to Help

Using Real-Time Protection

Real-Time Protection Shield in Basic Mode

You can set the Spyware Clear Real-Time Protection Shield to Basic Mode which is designed to make all the decisions for you automatically and is especially useful for inexperienced users. It automatically denies all actions being attempted by known bad applications while automatically allowing actions being performed by applications reported to be safe.

After Real-Time Protection performs an action, a small notification window appears in the lower right corner, above your system tray.

If you want to know what action has been blocked, click the "Show list of blocked actions" link to open a review list.

The Spyware Clear safe software database is continuously being expanded to include installers of the most popular applications. Most installers are automatically detected, but we strongly recommend switching to Install Mode when you are knowingly installing safe software to prevent any disruption of the installation. See more about Install Mode below.

All actions taken by Real-Time Protection are conveniently listed in the review list for you to decide if a blocked item should be moved to the White List, as not white listing may result in a newly installed application not working properly.

HIPS alerts can also be displayed in Basic Mode; however, as it is not recommended for inexperienced users, it is turned OFF by default.


Real-Time Protection Shield in Advanced Mode

The Real-Time Protection Shield can be set to Advanced Mode and is intended for the more experienced user that wants to make decisions regarding suspicious behavior. Every time an unknown operation to modify protected settings is detected, Spyware Clear in Advance Mode displays a suspicious behavior alert window allowing the experienced user to take any of the following actions.


Basic Tab

Allow (A) - Allows the installation to occur because you can identify it as a safe behavior.

Deny (B) - Denies the installation to occur as you deem it as suspicious.

Store response for this action permanently (C) - This can be checked for Spyware Clear to remember your decision and not inquire again, adding your decision to White/Black list).

Install Mode (D) - This will enable Install Mode for when new trusted software is being installed by you, see more information below.

Started by (E) - This field identifies the name of the application that is attempting to perform the action.

Process (F) - Identifies the name of the file attempting to install.

Advanced (G) - This tab provides more advanced actions to be taken as described below.

Detected action (H) - This area describes the detected action.


Advanced Tab

In the Advanced tab you can specify in more detail, what you want to allow.


Source (A) – The source is a process or a module which you can allow or deny. Spyware Clear will store your preference and no longer ask you about this source. Alternatively, you can choose to have particular modules or processes within the source to be denied or allowed.

  • (A1) Enables the whole process

    • (A1a) All child processes of source process will also be allowed.

    • (A1b) All modules of child processes will also be allowed.

  • (A2) Enables the module - when it detects a module that has performed.

Target (B) - Enabling target only (in this example only "SYSTEMEXPLORER.EXE" process will be enabled). This will also take effect if you decide an action on the Basic tab.

Basic tab (C) - Returns you to the Basic tab.

Switch to Deny All (D) - This will disable all actions for unknown processes. Only safe processes will be allowed.


Using Install Mode

If you enable Install Mode, all actions performed by the selected process will be automatically allowed and white listed as an approved safe application. After you run an installer, Spyware Clear will automatically detect it and suggest you use Install Mode.


You can activate Install Mode by clicking the "Switch to Install Mode" link.

If HIPS is enabled, information about the detected process in Install Mode is displayed in a suspicious behavior alert window:


Here again, you can enable Install Mode by clicking the “Install Mode" link.

If you run an installer and Spyware Clear doesn't suggest that you use Install Mode, you can enable it by clicking the "Switch to Install Mode" link in the Spyware Clear HIPS alert window.


When Install Mode is active, this window displays above the system tray.


If the Spyware Clear Install Mode doesn't automatically turn off after the installation, you can return to Normal Mode using the "Switch to Normal Mode" link.


Using HIPS

HIPS (Host Intrusion Prevention System) detects and controls new executable files.

You can enable HIPS through the Spyware Clear Control Center, to find out how to enable HIPS click here,

After enabling HIPS, Spyware Clear will build the HIPS database. All executable files that already reside on your computer are automatically allowed and HIPS won't ask about them. But when launching a new process or if a residing process tries to load a new module, HIPS will prompt a suspicious behavior alert window above your system tray similar to this:


Allow Mode

When Allow Mode is enabled, all actions are automatically allowed. We recommend you to switch to this mode if you experience any installation problems while using Install Mode. To switch to the Allow Mode, right-click on the Spyware Clear tray icon, click the "Adjust Real-Time Shield Mode" and then select the "Allow Mode" option.

If you could not find a solution for your problem, you can Submit a ticket and our Support Team is ready to help you.

Go back to Help