Copyright: (C) DialogueScience, Inc.


About Doctor Web for Windows 95/98/Me/NT/2000/XP
About Dr.Web® for Windows 95-XP

This product is a representative of the 32-bit family of antivirus program or Dr.Web. This product line also includes versions for Novell NetWare, OS/2, DOS/386, Linux, FreeBSD, and Solaris.

The program is designed for 32-bit Windows (i.e., Windows 95/98/Me/NT/2000/XP) and is referred to as Dr.Web for Windows 95-XP or, briefly, DrWeb32W.

This version offers two variants: with graphical interface (DrWeb32W) and with command-line interface (DrWebWCL). Both programs support the same command line options. DrWeb32W (graphical version) can also be controlled and configured via dialog panels, which is usually more convenient. On the other hand, DrWebWCL (command-line version) requires less system resources.

ATTENTION! Dr.Web for Windows distribution package for Home User (Home Edition) does not include the console version of scanner.

Both programs use the same configuration file and the same settings group in it. You can alternatively use both variants, whichever suits your need better at the moment.

Dr.Web for Windows 95-XP supports interface with ADinf32 and ADinf for DOS. However, interface with 16-bit ADinf for Windows is not supported.

The Dr.Web for Windows 95-XP distribution kit also includes SpIDer Guard for Windows 95-XP (or, briefly, SpIDer.) This utility is a memory-resident anti-virus program. Such programs are referred to as sentries.

Development team: ID Anti-Virus Lab.

Distributor: DialogueScience, Inc..


Author of this Help file: AlexanderTerentjev.


Don’t perform path check.


Perform path check.


Main Window
Controls in the Main Window

In this window, you can select scan objects (i.e., drives, folders, and files to be checked.)

Point and click elements in the picture below to see explanation.

 — Scan Results Window.

 — General information on the Dr.Web family.

 — Configuring Dr.Web.


This button clears scan results.


When down, this button shows scan results


When down, this button makes the main window appear as you see in the picture below.


When down, this button shows the statistics for recently scanned objects.


When down, this button shows the Main Window


In this window, you can select scan objects.


Changing these options affects only the current session. To make them default, open the Setup dialog, click the Scan tab, set the options, and press the OK button.


This button down, the TreeView displays both folders and files. Enable this option if you want to select individual files (groups of files) rather than folders. However, if you wish to scan the whole drive or folder, you do not need this option - file mass stuffs the window and makes it difficult to choose a scan object.


This button refreshes the TreeView control. This might be necessary if, for instance, you disconnect a network drive or create a new folder while Dr.Web is still active.


This button saves a given set of folders (drives) you scan often. For the next session you can restore the saved set (press the button below) instead of selecting all the objects once more.


When down, this button restores the saved scan objects set.


Press this button instead of cancelling the selected scan objects one by one. No selected object left (meaning they will not be anymore selected, nothing terrible having happen to them :-)).


This button assumes the following shapes:

	– no object is selected, therefore, you cannot start the scan.
	– objects to be scanned are selected.  Pressing the button starts the scan.
	– scan is in progress. Pressing the button interrupts the scan.


This status bar displays the program version, current scan path, etc.


Viewing information about infected and suspicious objects
Scan Results

This window shows the results of the last scan.

Point and click columns in the picture below to see explanation.

 — the Statistics Window.

 — General information on the Dr.Web family.

 — Configuring Dr.Web.


This column lists files which alarmed Dr.Web


This column contains full pathnames of respective files.


This column indicates why a particular file alarmed Dr.Web. For instance, the name of a virus that infected the file may appear here.


This column describes the action that Dr.Web performed on a file (cured, deleted, renamed, etc.) You can specify these actions in the Setup dialog.


This is the name of an object that is being scanned at the moment.


This is the total number of alarmed objects in the list.


This is the number of checked objects.


Statistics Window
Statistics

This window shows the statistics for the current session.

Point and click information lines in the picture below to see explanation.

 — the Confirm Dialogs.

 — General information on the Dr.Web family.

 — Configuring Dr.Web.


When down, this button shows statistics for a particular drive.


When down, this button shows statistics for all scanned drives.


This is the total number of scanned objects.


This is the total number of objects infected by main variants of known viruses.


This is the number of objects infected by modified viruses.


This is the total number of suspicious objects reported by the heuristic analyzer.


This is the number of cured objects. To specify the action to be performed on an infected object, use the Setup dialog.


This is the number of deleted objects. To specify the action to be performed on an infected object, use the Setup dialog.


This is the number of renamed objects. To specify the action to be performed on an infected object, use the Setup dialog.


This is the number of moved objects. To specify the action to be performed on an infected object, use the Setup dialog.


Scan speed (Kb/sec).


Total scan time.


This button clears the statistics.


This button updates the virus databases and/or program files via the Internet. This feature requires a TCP/IP connection to the the Internet.


This button displays the Setup dialog


This button terminates DrWeb32W.


This is the number of viruses currently known to Dr.Web.


This is the number of infected files and boot sectors.


This is the total number of scanned files and boot sectors.


Confirm Dialogs

These dialogs appear when DrWeb32W asks you to confirm an action.

Point and click element in the picture below to see explanaiton.

 — the Main Window.

 — General information on the Dr.Web family.

 — Configuring Dr.Web.


This dialog appears if the Prompt on Action checkbox is checked (the Setup dialog, the Actions tab).


You don’t speak English? :-) No means No.


You don’t speak English? :-) Yes  means Yes.


This dialog appears after a floppy disk has been checked, provided that the Prompt for multiple floppies checkbox is checked (the Setup dialog, the Actions tab).


This dialog appears when you choose File -> Scan Path from the Main Menu (or press F5.) You can enter the path manually or use the Browse button.


Press this button to accept the selected path.


Press this button to cancel the Select Folder dialog.


Press this button to display the Select Folder dialog.


This dialog appears, if the Prompt on action checkbox is checked (the Setup dialog, the Actions tab).


Yes to all means: Yes to this question and all similar questions during the current scan only.


Yes means: Yes to this question only. As the current scan proceeds, Dr.Web may ask you similar questions again.


No means: No to this question only. As the current scan proceeds, Dr.Web may ask you similar questions again.


No to all means: No to this question and all similar questions during the current scan only.


Setup Dialog, the Scan tabsheet

This tabsheet specifies default scan options.

Point and click elements in the picture below to see explanation. To display other tabsheets, click their tabs.

 — the Main Window.


If this box is checked, at startup Dr.Web searches viruses in the memory. You can also do it during a session. From the main menu, choose File and click Test Memory.


If this box is checked, Dr.Web activates its heuristic analyzer that can detect unknown viruses and suspicious files. We recommend that you use this feature, although it slows down the scan process.


If this box is checked, Dr.Web recursively scans all subfolders (if any) in each folder.


If this box is checked, Dr.Web will also scan boot sectors on the selected drives.


This is a progress indicator that shows how much work has been done.


This is the TreeView controls. Use it to select scan objects.


Setup Dialog, the File Types tabsheet

This dialog specifies how Dr.Web selects files to be checked.

Point and click elements in the picture below to see explanation. To display other tabsheets, click their tabs.

 — the Main Window.


If this option is checked, Dr.Web will scan all files in your system. This may be very time-consuming.


If this option is checked, Dr.Web will scan only those files whose extensions match the list on the right. You can edit the list (i.e., add and delete extensions.)


If this option is checked, Dr.Web will determine the type of a file by its internal format rather than its extension. This feature ensures that, for example, an executable file will be checked even if it doesn’t have an executable extension.


If this option is checked, Dr.Web will check only those files whose extensions match the user-defined masks listed on the right. This feature can substantially reduce the overall scan time if, for instance, you wish to check Microsoft Word files only (i.e., DOC and DOT files matching the DO? mask.)


Masks work as follows:
- the "*" character matches any (even empty) string of characters in this position;
- the "?" character matches any other single character in this position;
- any other character matches only this particular character in this position.


If this box is checked, Dr.Web scans archived files (e.g., Dr.Web will check a DOC file contained in a ZIP archive). This feature requires additional disk space and time, since archives are decompressed in temporary files. Dr.Web does not cure infected files within archives.


If this box is checked, Dr.Web checks “packed” executable files (by the LZEXE etc programs). If an executable file had been infected before it was packed, the virus body will be unrecognizable in the packed file. This feature ensures that packed files are properly handled.


If this box is checked, Dr.Web checks UUENCODE and MIME encoded files. In order to determine whether a file is encoded by UUENCODE or MIME, Dr.Web has to parse the whole file from the beginning to the end, which considerably slows down the scan process. Enable this option only when you have to check your e-mail files.


Here, you must specify types (if the “Selected type”) or masks (if the “User masks”).


This is an edit box where you can enter a file extension mask. If the “Selected type” or “User masks” box is checked, only files whose extensions match the listed masks will be checked.


This button adds the mask entered in the edit box, to the list.


This is a list of masks. If the “Selected type” or “User masks” box is checked, only files whose extensions match the listed masks will be checked.


This button deletes the selected mask from the list.


This button restores the default list of masks.


This group of radiobuttons selects the Scan Mode, i.e. the method that Dr.Web uses to decide which files must be checked.


Setup Dialog, the Actions tabsheet

This dialog specifies how DrWeb32W reacts to alarming objects.

Point and click elements in the picture below to see explanation. To display other tabsheets, click their tabs.

 — the Main Window.


When down, this button specifies actions to be performed on infected objects. For these objects, available actions are: report, cure, delete, rename (change extension as specified), move to a special folder.


When down, this button specifies actions to be performed on infected objects that cannot be cured. For these objects, available actions are: report, delete, rename (change extension as specified), move to a special folder. The “cure” option is disabled.


When down, this button specifies actions to be performed on suspicious objects that are probably infected. For these objects, available actions are: report, delete, rename (change extension as specified), move to a specified folder. The “cure” option is disabled.


This group of controls specifies the action that Dr.Web will perform on objects selected by one of the adjacent buttons (the one that is down.) Such actions must be defined for all three categories of objects: infected, incurable and suspicious.


If this option is checked, Dr.Web will only report all alarming objects.


If this option is checked, Dr.Web will cure infected objects.


If this option is checked, Dr.Web will delete all alarming (i.e. infected or suspicious) objects. Use this feature with caution, particularly when the “Prompt on action” box is not checked.


If this option is checked, Dr.Web will rename all alarming (i.e. infected or suspicious) objects. Renamed files are given the extension specified in the edit box on the right.


If this option is checked, Dr.Web will move all alarming (i.e. infected or suspicious) objects to the folder specified in the edit box on the right. This might be useful if you wish to examine these objects later.


This is the extension mask used to rename objects that alarmed Dr.Web. Use "?" to keep the character from the original extension in this position. Although you may enter virtually any combination of character, avoid using standard extensions (DOC, PAS, BAS, etc.). DO NOT use executable file extensions (EXE, COM, BAT, etc.), otherwise you may accidentally run an infected file.


To this folder Dr.Web will move infected or suspicious objects. If you don’t specify a full path, the folder will be created in the directory where Dr.Web is located. You may want to use this feature, if you wish to examine these objects at a later time or send them to DialogueScience.


This button displays the “Choose folder” dialog.


If this box is checked, Dr.Web will prompt you to check another floppy disk (in the same manner as the FORMAT command does).


If this box is checked, Dr.Web will prompt you to confirm each action. Click here to see sample Confirm Dialogs.


This button saves all changes and closes this dialog.


This button cancels all changes and closes this dialog.


This button saves all changes but doesn’t close the dialog.


This button shows help on this dialog.


Setup Dialog, the Log File tabsheet

This dialog specifies the log options.

Point and click elements in the picture below to see explanation. To display other tabsheets, click their tabs.

 — the Main Window.


If this box is checked, Dr.Web maintains a log file that contains information about infected, cured, etc. files, as well as other auxiliary information. You can enter the log filename in the edit box below.


In this edit box, you can enter the log filename.


This button displays the Choose Log File dialog.


If this option is checked, Dr.Web appends the recent scan results to an existing log file. If the log doesn’t exist, Dr.Web creates it.


If this option is checked, Dr.Web overwrites an existing log file with the recent scan result.


If this box is checked, Dr.Web limits the size of a log file to the value shown on the right. When the log reaches the limit, Dr.Web totally clears it and start a new log from scratch.


This is the maximal size of a log. This edit box is enabled only if the “Cut longer than” box is checked.


If this box is checked, the log will contain information about all checked objects. Note that this can make the log file very large.


If this box is checked, the log will contain the names of EXE-packers (LZEXE, PKLITE etc) that were used to compress executable files.


If this box is checked, the log will contain the names of utilities (PKZIP, ARJ etc) that were used to create archives.


If this box is checked, the log will contain the scan statistics (the number of checked objects, infected objects, etc.) When terminating a session, Dr.Web will also write the session statistics to the log.


Selects ANSI-encoding for the log (Windows character set).


Selects OEM-encoding îò÷åòà (DOS character set).


You can choose between two options: append new records to the existing log, or overwrite it.


Here, you can choose encoding for the log.


Here, you can specify the details that will be included in the log records.


Here, you can limit the maximal size of the log. You may want to use this option if there’s little free space on your disk.


Paths (the Paths tabsheet)
Setup Dialog, the Paths tabsheet

In this dialog, you can specify the location of Dr.Web’s antivirus databases and folders that will excluded from check.

Point and click elements in the picture below to see explanation. To display other tabsheets, click their tabs.

 — the Main Window.


Here, you can specify folders excluded from check.


Here, you can specify the location of Dr.Web’s virus databases and their masks.


This edit box contains a folder whose files won’t be checked.


Press this button to display the Select Folder dialog.


This button adds the folder whose name appears in the editing region of the adjacent combo box, to its drop-down list.


This button deletes the folder whose name appears in the editing region of the adjacent combo box, from its drop-down list..


This edit box contains the location of the virus databases (both main and add-on files.)


Press this button to display the drop-down list that contains locations of the virus databases and their masks.


Press this button to add the location and/or mask that appears in the editing region of the adjacent combo box, to its drop-down list.


Press this button to delete the location and/or mask that appears in the editing region of the adjacent combo box, from its drop-down list.


Sound effects (the Events tabsheet)
Setup Dialog, the Events tabsheet

In this dialog, you can enable sound effects for DrWeb32W (your PC must be equipped with a sound card.)

Point and click elements in the picture below to see explanation. To display other tabsheets, click their tabs.

 — the Main Window.


If this box is checked, Dr.Web will play different sounds when curing, deleting, etc. files.


This is a list of actions that can be associated with various sounds. The corresponding sound file must be specified in the adjacent edit box.


This box displays the Choose Sound File dialog.


This is the filename of a sound file associated with the action that appears in the adjacent combo box.


How to update virus databases and/or program files (the Update tabsheet)
Setup Dialog, the Update tabsheet

In this dialog, you can specify options for automatic update of DrWeb32W via the Internet.

The update subsystem enables an automatic delivery and installation of updates for Dr.Web for Windows 95-XP via the Internet or local network. If you have Dr.Web for Windows distribution package for Home User (Home Edition), you may use the update subsystem only from free area (see below).

The subsystem is used to update all components of the package, including program modules, virus databases, help files, and documentation. On the client's side, i.e. on the workstation where Dr.Web for Windows 95-XP is installed, the update process is supported by the special program module, DRWEBUPW.EXE.

As a rule, the update module, DrWebUpW, is called from the main menu of the antivirus scanner, DrWeb32W. In this case, the update subsystem can conveniently be configured from the setup panel of DrWeb32W.

Point and click elements in the picture below to see explanation. To display other tabsheets, click their tabs.

 — the Main Window.

Sometimes (for instance, if you didn't install all components of the Dr.Web for Windows 95-XP package) you might have to run the update module directly. You can start the update module with the /GO, /QU, /INI and /LNG options (they have the same meaning as described in the Command Line Options section).

Reports of update sessions are written to the DRWEBUPW.LOG file.

The main option of the update subsystem is configured with the following line:

UpdateURL = "network or local resource"

where the resource is one of the following:

1) Directory on a local or network drive, e.g. "F:\DRWEB\UPDATE";

2) Network (UNC) directory, e.g. "\\UPDATE_SERVER\DRWEB\UPDATE".

3) HTTP URL. Updating via Internet supports the HTTP protocol only.

By default, the update subsystem is pre-configured to connect to the non-commercial area of DialogueScience www-server: "HTTP://WWW.DIALS.RU/DRWEB/FREE". At this URL, the update is available to any user. There are not only virus databases but also corrected program modules reside in the free update area. These modules are available only if user have the last (current) version of Dr.Web.

For commercial update, change URL to: "HTTP://WWW.DIALS.RU/DRWEB/UPDATE" and specify your user name and password:

UserName = "user name"

Password = "password"

If you update from the DialogueScience server, the user name and password are given to you by DialogueScience Registration Service (reg@dials.ru). Otherwise, ask your Internet administrator for the user name and password.

ATTENTION: system administrators


There isn't DRWEB32.INI in the current directory


If you wish to enable your users to update Dr.Web from your own www-server or via your local network, create a special folder and place there all files obtained by the update subsystem from the respective area (free or commercial) of our server. In addition, place DRWEB32.LST (package description) to the same folder. If the package does not include this file, you may download it from:

HTTP://WWW.DIALS.RU/DRWEB/<area>/DRWEB32.LST

For commercial areas, an administrator must be registered by DialogueScience as a customer entitled to update via the Internet.


Here, specify the web server from which you prefer to download the updates.


Here, specify your login.


Here, specify your password.


General options (the General tabsheet)
Setup Dialog, the General tabsheet

In this panel, you can specify some general options for DrWeb32W.

Point and click elements in the picture below to see explanation. To display other tabsheets, click their tabs.

 — the Main Window.


If this box is checked, all settings will be automatically saved when a session is terminated.


If this box is checked, DrWeb32W will save (in the system registry) the current positions, sizes, etc., of its windows.


This track bar adjusts thread priority of the scan process. Higher priority enables Dr.Web to run faster and slows down other applications, and vice versa.


Development team

(c) 1992-2002 Igor Daniloff

Development team:

Igor Daniloff, Vsevolod Lutovinov, Dmitry Belousov, Andrew Basharimov, Serge Popov, Sergey Akhapkin


How to contact DialogScience
How to contact DialogueScience

Address: ul.Vavilova 40, Moscow 117786, Russia.

Tel: (+7-095) 135-6253, 137-0150

Tel/fax: (+7-095) 938-2970

BBS (24-hour):

(+7-095) 938-2856 (28800/V.34) – common access;
(+7-095) 938-2867 (28800/V.34, 33600/V.34+) – subscribers only;
(+7-095) 938-2969 (28800/V.34, 33600/V.34+) – subscribers only.

FidoNet: 2:5020/69

E-mail: Antivir@Dials.ru – comments, notes, sales, support, reception of new viruses

WWW server: http://www.Dials.ru

FTP server: ftp://ftp.Dials.ru,
ftp://ftp2.Dials.ru,
ftp://ftp3.Dials.ru


Can’t run Internet browser


Can’t run e-mail component.


Command String Options
Command Line Options

To start Dîñtor Web, use the following command line:

program_name [drive:][path] [options]

where

Program_name	executable module name (DrWeb32W or DrWebWCL)
drive:	logical drive of a hard disk, floppy drive, network drive, CD-ROM, or * (all local logical drives)
Path	location of files to be checked; it may contain path to the directory on local/network drive (or network directory) and, optionally, filename (or filename mask). The command line may contain several [disk:][path] parameters delimited with blanks. In this case, the program will sequentially scan the specified objects. When scan is finished, DrWebWCL terminates. DrWeb32W (if started without /QU) opens its main window where the user can specify new objects to scan, view the scan results, customize the settings, update or terminate the program. If started without the [disk:][path] parameter, DrWeb32W immediately opens its main window.

Command line options (delimited with blanks)

/@[+]<file>	check objects listed in <file>. Each object must be identified on a separate line containing a full pathname (to check file) or the "?boot" keyword (to check boot sectors). The list file can be created with any text editor. When scan is completed, Dr.Web deletes the list file, unless "+" is included in the option. A list file can also be generated by ADinf. In this case, the integrity checker will include in the file modified objects only. Then, this list can be used by Dr.Web to limit the scan scope, which can substantially reduce overall scan time. If ADinf32 is configured to launch Dr.Web, the integrity checker inserts the /@ option in the command line and starts the scanner automatically (see ADinf32 Manual for details)
/AL	scan all files on a given drive
/AR [D|M|R][P] [N]	check all files inside archives (ARJ, CAB, GZIP, TAR, RAR, ZIP,...). Use the optional parameters to specify how archives with infected (or suspicious) objects should be treated as a whole: D – delete, M - move (by default, to the INFECTED.!!! directory), R - rename (by default, the extension's first character is changed to "#"); P - prompt before action; the N option suppresses the archive type after the name of the archive file
/CN [D|M|R][P][N]	specify how containers (HTML, RTF, PowerPoint,..) with infected (or suspicious) objects should be treated as a whole: D – delete, M - move (by default, to the INFECTED.!!! directory), R - rename (by default, the extension's first character is changed to "#"); P - prompt before action; the N option suppresses the container type after the name of the container file
/CU[D|M|R][P]	cure infected file and deletes incurable files. Or use the optional parameters to specify how infected filed should be treated: D – delete, M – move (by default, to the INFECTED.!!! folder), R – rename (by default, the first character in the extension is replaced with “#”); P – prompt before action
/SP[D|M|R][P]	specify what to do with suspicious files: D – delete, M – move, R – rename; P – prompt before action
/IC[D|M|R][P]	specify what to do with incurable files: D – delete, M – move, R – rename; P – prompt before action
/DA	run Dr.Web only once in a day. For this option, the configuration file (INI-file) containing the date of the next scanning session must be present
/EX	scan files with “standard” extensions, i.e. executable files and MS Office documents (COM, EXE, SYS, BAT, CMD, DRV, BIN, DLL, OV?, BOO, PRG, VXD, 386, SCR, FON, DO?, XL?, WIZ, RTF, CL*, HT*, VBS, JS*, INF, A??, ZIP, R??, PP?, HLP, OBJ, LIB, MD?, INI, MBR, IMG, CSC, CPL, MBP, SH, SHB, SHS, SHT*, MSG, CHM, XML, PRC, ASP, LSP, MSO, OBD, THE*, EML, NWS, TBB)
/FM	check files by their internal format. Dr.Web will check a file regardless its extension if the file has a format of an executable module format or MS Office document with macros
/GO	Dr.Web proceeds without asking you what to do next (insufficient disk space for temporary files, invalid option in the command line, Dr.Web infected by unknown virus, etc.) This option might be useful for automatic check of, say, incoming e-mail.
/HA	enable the heuristic analyzer that can detect unknown viruses
/INI:<file>	use an alternative configuration file, INI-file
/NI	ignore the settings in the configuration file, DRWEB32.INI
/ML [D|M|R][P][N]	check files of mail format (UUENCODE, XXENCODE, BINHEX, MIME,...). Use the optional parameters to specify how mail files with infected (or suspicious) objects should be treated as a whole: D - delete, M - move (by default, to the INFECTED.!!! Directory), R - rename (by default, the extension's first character is changed to "#"); P - prompt before action; the N option suppresses the mail type after the name of the mail file
/LNG[:<file>]	use an alternative language resource file (DWL-file), or built-in (english) language
/NS	run Dr.Web non-stop. In this case, you cannot interrupt the scan process by pressing the <Esc> button (this option is currently not supported by DrWeb32W)
/OK	display the name of each scanned object and write “OK” if it’s clean
/RP[+]<file>	write the log to a file specified by the <file> parameter. DRWEB32W.LOG or DRWEBWCL.LOG (respectively) are used by default. The "+" parameter appends the log to an existing file
/NR	disable the log
/SD	recursively scan subfolders
/SO	enable sound effects
/SS	save settings on exit
/TB	check boot sectors and MBR
/TM	search viruses in memory
/UP[N]	check executable files packed by ASPACK, COMPACK, DIET, EXEPACK, LZEXE, OPTLINK, PECOMPACT, PEPACK, PGMPAK, PKLITE, WWPACK, WWPACK32, UCEXE, UPX; files converted by BJFNT, COM2EXE, CONVERT, CRYPTCOM, CRYPTEXE, PECRYPT, PESHIELD, PROTECT, TINYPROG; and files immunized by CPAV, F-XLOCK, PGPROT, VACCINE. To suppress the name of a packer, use the N parameter
/WA	wait after scan is finished if viruses or suspicious objects were found (DrWebWCL only)
/?	display a brief help (for DrWebWCL) or start the help system (for DrWeb32W)
If INI-file is not present or not used, the default options are:

/AR /FM /HA /ML /PR /SD /TB /TM /UP

Some options can be postfixed with the "-" character. This "negation" form disables the respective function or mode. It might be useful if the mode is enabled by default or via settings in the INI-file. The negation form can be applied to the following command-line options:

/AR /CU /FN /HA /IC /ML /OK /PF /PR /SD /SO /SP /TB /TM /UP /WA

Note that the negation form of /CU, /IC and /SP cancels all actions enabled by these options. It means that information about infected and suspicious objects will appear in the report file only.

/AL, /EX and /FM cannot be used in the negation form. However, any of these options disables the other two.

 — the Main Window.


Registration keys for the Dr.Web family

For the Dr.Web programs, there is an important file, a registration user key. Without a registration key all Dr.Web members offer a limited functionality only. If you have a registration key, please place it to the Dr.Web directory. Without a registration key (the DRWEB32.KEY file), all Dr.Web members offer a limited functionality only, as described below:

– at each startup, the evaluation version displays a warning (saying that   it's an evaluation version);

– archives aren't checked;

– packed executable files aren't checked;

– heuristic analyzer is disabled;

– infected and suspicious files cannot be cured, deleted, removed or renamed.

Without a registration key, the Dr.Web family members may be redistributed without any restriction.

To enable an enhanced preview of Dr.Web features, DialogueScience freely distributes a special evaluation registration key (the DRWEVAL.KEY file) that removes some of the restrictions mentioned above. However, this key only works with the one version of Dr.Web (that is attached to the key). With the evaluation key, Dr.Web will have the following restrictions:

– at each startup, the evaluation version displays a warning (saying that it's an evaluation version);

– archives are not checked;

– infected files cannot be cured.

In some cases DialogueScience and its dealers can also distribute other evaluation registration keys, with other set of restrictions.

To use all features of Dr.Web, a user must purchase a commercial registration key. This key, as well as an evaluation key, is a special file generated by UserKey. When placed in the Dr.Web home directory, the key enables the full-featured commercial operation of Dr.Web. The key contains a user name, duration and some other information, and is protected against fraud with a digital signature.

The Dr.Web programs may be distributed in various forms, for instance, as an installation package or just as an archive. The installation package may include images of 3.5" (1.44 MB) floppy disks. Disk #1 contains the installation program, SETUP.EXE. The registration key can be placed on this disk, too. In this case the key is automatically copied to the Dr.Web directory.

The distribution kit may be contained in a single EXE-file that performs the installation. In this case (or, if the key is shipped to the user separately from Dr.Web), the key must be placed to the Dr.Web directory after the installation.

If you tried an evaluation copy of Dr.Web and have received a commercial registration key, please copy it to the Dr.Web directory.


Anti-virus program

A program intended to fight computer viruses. There are different types of anti-virus software: scanners, inspectors, sentries, vaccines, etc.


Firmware sentry

Hardware and software intended to protect data and disk system areas against any unauthorized modification. Usually, it’s a card installed on the computer bus. As an example of a firmware sentry, we can mention Sheriff.


Non-resident vaccine

A program that modifies a file or boot sector in order to prevent or detect virus infection. Vaccination can be targeted against a particular virus (by changing, say, a file in such a manner that this virus thinks the file is already infected), or against any virus. In the latter case, the vaccine must be able to detect and report the modification of an vaccinated object. Sometimes, vaccines can even cure infected objects.


Resident vaccine

A memory-resident program that imitates infection of your system and, by doing this, prevents a real contamination. Unlike non-resident vaccines, resident vaccines affect the operating environment rather than individual object.


Boot virus

An infector that uses disk boot sectors to propagate itself. Floppy disks have only one object, boot sector, that can be infected, whereas hard disks have two objects, boot sector of a logical partition and master boot record (MBR) of the physical disk.


Companion (satellite) virus

An infector that uses the following contamination technique. For an executable file (say, EXE file) a virus creates a “twin” file (say, COM file) which is launched instead of the original file. Satellite viruses take advantage of the priority the operating system uses when it starts executable files with the same name: if found, BAT file is launched first, then, if found, COM is launched, and then, if found, EXE file is launched.


Computer virus

There is no precise definition of a computer virus. In general, we can say that it’s a program that can reproduce its own copies (possibly, in a modified form) that are capable of further reproduction. The term “computer virus” was introduced by F.Cohen in 1984.


Network virus

An infector that spreads over computer networks. Some viruses travel across local networks (Novell NetWare), other spread through the Internet. All known network viruses take advantage of the bugs in network software. Although these bugs have been removed by now, there can be no guarantee that the network software is absolutely free of other errors.


File-boot (combined) virus

An infector that combines features of file and boot viruses.


File virus

An infector that attaches to files to propagate itself.


Encrypted virus

An infector that uses special algorithms to encrypt its code and impede its disassembling and analysis. An encrypted virus always contains a decryptor section that is not encrypted or encrypted only partially. In the latter case, the decryptor code is decrypted when virus is active. There exist viruses with a variable encryption key. They can produce descendants encrypted by different methods (for instance, through reversible XOR with different values). Encrypted viruses with a variable encryption key is an intermediate stage to polymorphous viruses.


Worm virus

An infector that doesn’t use other files to propagate itself. Worms spread on their own, although they may take advantage of bugs in other programs (as was the case with Morris virus).


Virus constructor

A special development environment that facilitates creating computer viruses. Usually, a developer is given an opportunity to specify virus parameters, such as types and frequency of actions. There exist virus constructors practically for all types of computer viruses, including polymorphous and macro viruses.


Macro virus

An infector written in a language that is used in modern word processors and spreadsheets. Particularly wide-spread are macro viruses for Microsoft Word; there are viruses for Microsoft Excel, Microsoft Access, Microsoft PowerPoint, and Microsoft Windows Help. These viruses are written in Word Basic and Visual Basic. There also exist a virus for AmiPro.


Macro

A program written in a special language (such as Word Basic or Visual Basic) supported by some advanced word processors and spreadsheets.


Stealth virus

Some viruses use special tricks to hide themselves in order to avoid detection. To this end, they distort information about infected objects by controlling the access to these objects. Masking viruses are often referred to as stealth viruses. Stealth viruses are a hard nut to crack for many anti-virus programs. However, this not the case with ADinf that can immediately detect them.


Polymorphous viruses

The ability of some viruses to produce descendants that are partially or totally different from their parent is called polymorphism. There are a few levels of virus polymorphism.


Trojan program

A program that is called to implement a required and valid function, however this program contains a code that might cause harm.


Anti-virus scanner

A program that detects and eradicates computer viruses. Usually, a scanner uses a special database containing information about viruses known to it. Besides, modern scanners are equipped with an heuristic analyzer that can detect unknown viruses. An example of a scanner is Doctor Web.


Anti-virus disk inspector

A program that maintains data integrity on hard disks. An inspector controls the integrity of files, boot sectors and system areas and reports any changes in them. If changed, some of these objects (for example, boot sectors) can be restored by the inspector itself, without any other anti-virus software. Besides, an inspector may be supplemented with a special cure module capable of restoring files of certain types. To check data integrity, an inspector makes use of special tables that contain the so called file checksums calculated by special algorithms. An example of a disk inspector is ADinf. This program meets all requirements to modern disk inspectors. In particular, it can directly read disk sectors, thus bypassing all masking tricks employed by many viruses. Besides, ADinf can control the integrity of files using different checksums, including a CRC based on a unique, highly reliable LAN64 algorithm. ADinf can be used together with its cure module, ADinf Cure Module.


Anti-virus sentry

A memory-resident program that monitors operations performed by other program. In particular, a sentry controls the operations that are often misused by computer viruses, and alarms the user if any of such operations (for instance, modification of a boot sector) is about to be performed, asking to confirm or cancel it.


Goat program

A small test program that is intentionally infected with a virus in order to obtain the virus code.


Signature

A sequence of bytes that is specific (theoretically, unique) to a particular program. Signatures are used by anti-virus scanners for virus detection.


Checksum

A numeric value calculated for a file by a special algorithm. When a file changes, its checksum changes too. Checksums are used by disk inspectors to control data integrity.


Levels of polymorphism

Different polymorphous viruses can be detected and removed by algorithms of varying complexity. For instance, simple polymorphous viruses can be detected by a mask search, whereas complex viruses can be detected by essentially different algorithms. As of this writing, there are five levels of virus polymorphism.


Virus strain

A modification of the original virus. Most commonly, strains appear due to the availability of virus source code.


Heuristic analyzer

A programmatic device intended to detect code fragments typical to computer viruses. A heuristic analyzer is used to detect unknown viruses. The efficiency of a heuristic analyzer is determined by two parameters: percentage of detected viruses and percentage of false alarm (i.e. cases when the analyzer wrongly reports a virus in a file.) Russian scanner Doctor Web features a heuristic analyzer that is one of the best in the world.


CPU emulator

A programmatic device that emulates CPU instructions. CPU emulation is used by anti-virus scanners to detect polymorphous viruses.