Dr.Web for Windows

Top Next

Dr.Web for Windows includes the following components:

· Dr.Web Scanner for Windows is an anti-virus scanner with a graphical interface. The program is launched at a user’s request, or as scheduled, and performs computer anti-virus scanning. There is also a program's version with a command line interface (Dr.Web Console Scanner for Windows).
· SpIDer Guard for Windows is an on-access anti-virus scanner (also called a monitor). It constantly resides in memory and scans files “on the fly”, instantly detecting any virus-like activity.
· SpIDer Mail for Windows workstations is an anti-virus mail scanner. The program intercepts requests of any mail clients to mail servers via POP3/SMTP/IMAP4/NNTP (IMAP4 stands for IMAPv4rev1) protocols, detects and neutralizes viruses spreading through e-mail before they are received by the mail client from the server, or before the message is sent to the mail server. Providing the Dr.Web application is licensed to (that is, the key file allows to) work in the "Anti-virus + anti-spam" mode, SpIDer Mail® uses the Vade Retro spam filter to scan mail for spam messages.This component is not included in Dr.Web for Windows servers.
· Dr.Web automatic updating utility for Windows allows registered users to receive virus database updates and Dr.Web program modules, and automatically installs them; for unregistered users, it allows to register or receive a demo key file.
· Dr.Web for workstations also includes the Scheduler for Windows and the Scanner for DOS.


Dr.Web System Requirements

Top Previous Next

The Scanner (the GUI-version and the console version for Windows), SpIDer Mail, as well as SpIDer Guard require a PC operated by Windows 95/98/Me or Windows NT/2000/XP/2003/Vista, note that SpIDer Guard can run under 32-bit systems only. All components can work under Windows 95 only starting from Windows 95 OSR2 (v.4.00.950B). You may also need to download and install certain system components from the Microsoft web-site. The program will notify you what components are required and give you direct links.

The DOS Scanner works under MS-DOS, or in the Windows command line mode.

The minimum program requirements match those for the respective OS's. However, SpIDer Guard® requires at least 32 Mb of RAM for proper operation.The computer should be equipped with at least Intel 80386.

All the critical updates recommended by the OS developer must be installed. If the version of the OS is not supported any longer, you should upgrade it.


License Key File

User’s rights to use the anti-virus are specified in the key file. The following information is contained in the key file:

list of anti-virus components licensed to the user

product license validity period

other restrictions (i.e. the number of protected PCs, etc.)

The key file has the key extension and must be located in the installation folder by default.

The key file has a write-protected format and therefore cannot be edited. Editing invalidates the file. Therefore it is not recommended to open your key file with a text editor not to corrupt it incidentally .

A license key file is granted to the users who have purchased the anti-virus with Doctor Web’s certified partners. The parameters of the key file are specified according to the license the user has paid for. The license key file contains the user's name (or the company's name), and the name of the selling company.

For evaluation purposes there are also demo key files. Demo key files allow to take advantage of the full functionality of the program and the virus definitions updates, but have a limited term of use.

The key file can be supplied with the key extension, or as a zip archive containing the key file. It may also have the dwz extension used by the Dr.Web programs to automatically install anti-virus package add-ons.

The key file can be obtained as follows:

Via the Internet during the final installation stage or when updating the program complex for the first time with the automatic updating utility. On the basis of the registration serial number entered by the user (the serial number is provided by a local distributor), the utility registers the program complex, receives and installs the key file generated during the registration. If no serial number is available, the user can receive a demo key file only.This procedure is applied with Dr.Web anti-virus for workstations only.

After registering the anti-virus at the Doctor Web, Ltd. website, the license key file is generated on the basis of the registration serial number received from a local distributor. If no serial number is available, the user can receive a demo key file only. The key file generated is sent via e-mail; it can also be downloaded from the registration page.

From the distribution package, when included.

Sent over to a user by e-mail as an attachment with the dwz extension. In that case the user should double-click the attachment icon to automatically install the key into the right location.

Supplied on a carrier as a file with the key extension. The user should copy it into the Dr.Web installation folder manually.

Supplied as a zip archive containing a file with the key extension. The user should extract the key file using the respective archiving tool (WinZip or Pkunzip) into the Dr.Web installation folder.

Beginning with Windows XP all the Microsoft Windows OS's support the ZIP file compression format; no additional software is required to extract the contents of such archive types.
Without a valid key file, or if the file has expired, all anti-virus components are disabled. The user may only launch the automatic updating utility to register and obtain a key file (for Dr.Web for workstations only).
It is recommended to keep the key file till its expiry. If the anti-virus is re-installed, or installed on several computers, another registration of the serial number is not required. Then the key file received during the first registration is to be used. If the key file is lost, you should register again. In this case, type the personal data specified during the first registration. You may specify a different e-mail address, then the key file will be sent to new e-mail address.
The number of requests for a key file is limited. One user can register a serial number not more than 25 times. In case of more requests the key file will not be sent. To receive a key file, contact the Technical Support Service at http://support.drweb.com/request/ (when applying, describe in detail what is happening, specify your personal data entered during the registration and the serial number). The key file will be sent to you by the Technical Support Service by e-mail.


 Main Window. Scan Tab

Main window. Scan tab.

Top Previous Next

In this window, you can select a scanning mode (in the Scan tab) and see the results of the operation of the Scanner (in the Statistics tab).

Depending on the mode selected, either a list of objects to scan or a file system tree is displayed in the center of the window.

At the bottom of the window there is a table where information on infected and suspicious objects and program's actions is displayed.

Different windows, settings and actions can also be accessed by the hot keys.

F1 – Help

F3 – Main window, Scan tab

F4 – Main window, Statistics tab

F5 – Scan path and mask window

F7 – Scan RAM and startup objects

F8 – Start the automatic updating utility

F9 – Scanner settings tabs

F10 – Switch to the main menu

Ctrl+F5 – Begin scanning

Ctrl+F6 – Stop scanning

Ctrl+F2 – Clear report list

Alt+X – Exit

For more details on the settings and actions specified in this pane click the corresponding area of the window in the picture.

See also: Anti-Virus Check (Scanning) of the File System

Actions When a Virus Is Detected


 Anti-Virus Check (Scanning) of the File System

Anti-Virus Check (Scanning) of the File System

If using Windows Vista, it is recommended for the scanner to be run by a user with administrator rights because files and folders to which unprivileged users have no access (including system folders) are not scanned.

As soon as the program is started with default settings, RAM and Windows startup objects are scanned for viruses.

Other objects of the file system are scanned on your demand. Select one of the following scanning modes:

Express scan

In this mode the following objects are scanned:

· Random access memory
· Boot sectors of all disks
· Startup objects
· Boot disk root folder
· Disk root storing the Windows installation folder
· Windows system folder
· User documents folder ("My documents")
· System temporary files
· User temporary files
Complete scan

In this mode all hard drives and removable media (including boot sectors of all disks) are scanned.
Custom scan

This mode allows you to select folders and files to be scanned.

When this mode is selected, the file system tree appears in the center of the Scan pane. If necessary, you can expand the tree objects down to the level of any folder or file included.

Select objects to be scanned in the file system tree. Boot sectors of all disks will be checked along with the selected objects.

The picture below illustrates a case when in the Custom mode the C partition and a folder on the floppy disk are selected for scanning (their icons are marked with red buttons).

To scan the objects selected, click the [image] button in the right part of the pane.

Click the [image] button to suspend the scanning process. Click the [image] button to continue.

Click the [image] button to terminate scanning.

By default, the program performs anti-virus scanning of all files using both virus databases and the heuristic analyzer (an algorithm allowing to detect viruses unknown to the program with high probability on the basis of general principles of their creation). During the scanning, executable files packed with special compression utilities, are unpacked. And files contained in archives of all most commonly used types (Zip, Arj, Lha, Rar and many others), file containers (PowerPoint, RTF and other), as well as files attached to mail messages in mail boxes of mail programs (the format of mail should confirm to RFC822) are checked.

If a known virus is detected or there is a suspicion an object is infected with a virus, the Dr.Web for workstations version informs, by default, the user about it in a special report field at the bottom of the main window. Dr.Web for Windows servers, by default, automatically attempts to avert a virus threat.

For more details on the settings and actions specified in this pane click the corresponding area of the window in the picture.

Different windows, settings and actions can also be accessed by the hot keys

F1 – Help

F3 – Main window, Scan tab

F4 – Main window, Statistics tab

F5 – Scan path and mask window

F7 – Scan RAM and startup objects

F8 – Start the automatic updating utility

F9 – Scanner settings tabs

F10 – Switch to the main menu

Ctrl+F5 – Begin scanning

Ctrl+F6 – Stop scanning

Ctrl+F2 – Clear report list

Alt+X – Exit

See also: Actions When a Virus Is Detected.


 Actions When a Virus Is Detected

Actions When a Virus Is Detected

In case a known virus or a suspicious object is found, by default Dr.Web for workstations informs you about it in the report field located at the bottom of the window. Dr.Web for Windows Servers by default takes automatic action to prevent a virus threat.

The report list table includes the data on infected or suspicious objects detected during the scanning, and actions made by the program. If these objects are detected in file archives, mail files or file containers, the table lists these infected objects and the archives containing them.

In the Object column the names of infected files or a boot sector are listed.

The Path column contains the path to an infected object.

In the Status column virus names (for files and boot sectors), or information on an infected archive are listed.

In the Action column information on the actions made (curing, deletion, renaming, removing of an object) is given.

If an infected or suspicious file used by another 32-bit Windows application is found, the action specified by you is not applied immediately. A line "Will be cured after reboot" or "Will be deleted after reboot", i.e. depending on the action specified, will appear in the Action column of the Scanner’s report field. The necessary action will be taken after the next reboot. That is why, if such objects are found, it is recommended to reboot the system immediately after the scanning.

You can assign the program’s reaction to remove a detected virus threat from the report list by right-clicking the line with the description of the infected object. To select objects in the report list the following keys and key combinations can be helpful:

· Insert - select an object and move the cursor to the next position
· Ctrl+A - select all
· the * key on the numeric keyboard - invert selection

Select the action you want to enable in the context menu, or click the corresponding button under the report field:

Cure

– to restore the object to the state before the infection. This action is available for known viruses, but not always. The action is impossible for viruses detected in archives.
Delete

– to delete the infected object. The action is impossible, if a virus is detected in the boot sector.
Rename

– to change the filename extension specified in the program's settings. The action is impossible, if a virus is detected in the boot sector.
Move

– to move the infected file to a special folder (quarantine). The path to this folder is specified in the program's settings. The action is impossible if a virus is detected in the boot sector.

If the Cure option is selected, an additional context menu will open. Select a necessary action by the program, if the curing fails.

By default, when Delete is enabled for file archives, containers or mail boxes, the program generates a warning message that the data might be lost.
No actions are allowed for files inside archives. If the Delete action is selected for an archive, the whole archive will be deleted.

For more details on the settings and actions specified in this pane click the corresponding area of the window in the picture.

Different windows, settings and actions can also be accessed by the hot keys

F1 – Help

F3 – Main window, Scan tab

F4 – Main window, Statistics tab

F5 – Scan path and mask window

F7 – Scan RAM and startup objects

F8 – Start the automatic updating utility

F9 – Scanner settings tabs

F10 – Switch to the main menu

Ctrl+F5 – Begin scanning

Ctrl+F6 – Stop scanning

Ctrl+F2 – Clear report list

Alt+X – Exit


 Statistics Tab

Statistics Tab

The statistics pane shows the total information on the Scanner’s operation – the total number of the objects scanned, the quantity of objects infected with known viruses, with modifications of known viruses, suspicious objects and also the actions the program made over infected or suspicious objects.

You can also receive statistics for any logical disk of the computer. Select the disk in the drop-down list on top of the pane.

To clear the report list click the Clear button.

For more details on the settings and actions specified in this pane click the corresponding area of the window in the picture.

Different windows, settings and actions can also be accessed by the hot keys

F1 – Help

F3 – Main window, Scan tab

F4 – Main window, Statistics tab

F5 – Scan path and mask window

F7 – Scan RAM and startup objects

F8 – Start the automatic updating utility

F9 – Scanner settings tabs

F10 – Switch to the main menu

Ctrl+F5 – Begin scanning

Ctrl+F6 – Stop scanning

Ctrl+F2 – Clear report list

Alt+X – Exit


Setting the Scanner

If using Windows Vista, it is recommended for the scanner to be run by a user with administrator rights because any changes in the settings made by unprivileged users are not saved when you exit the system.

The program’s default settings are optimal in most cases. Do not modify them without necessity.

To change the program's settings:

1. Select Options in the program’s main menu. Then select Change settings in the submenu. The settings window with several tabs will open.

2. Modify the settings as necessary. Click the Apply button to open another tab.

3. After editing the settings click OK to save the changes made, or Cancel to cancel changes.

4. To get information about the settings in a tab click the Help button.

5. If in the General tab the Autosave settings mode is disabled, click Save settings on the Options menu of the main window.


 Scan Tab

Scan Tab

Files and folders to be excluded from scanning can be specified in this tab.

Location of excluded folders
· Enter a path to the folder you do not want to be scanned. You can also click the [image] button and select the necessary object.
· Click the Add button. The folder will be added to the list.
· To remove a folder from the list, select it and click the Remove button.

Here you can create a list of folders (for example, the Quarantine folder, program files folders) excluded from scanning.

Excluded files
· Enter a file name or a mask to be excluded from scanning. You can also click the [image] button and select a file. * and ? symbols can be used instead of a part of a file name. * is used instead of any symbol combination; ? is used instead of only one (any) symbol .
· Click the Add button. The file mask will be added to the list.
· To remove an object from the list, select it and click the Remove button.

Here you can create a list of files (file masks) to be excluded from scanning. If a mask is specified, all files the names of which match the mask will be excluded from scanning (this option is appropriate for temporary files, swap files, etc).

To exclude a specific file from scanning, add the path to this file (you can use the [image] button) and its name (specify the file name manually) to the list of Excluded folders.

In this pane you can also enable or disable the heuristic analyzer (helps to detect suspicious objects that can be infected with unknown viruses). By default, this option is enabled. It is not recommended to disable the option.

For more details on a certain option, click on a corresponding item in the picture above.

To view parameters set at another tab click the name of this tab.


 File Types Tab

File Types Tab

In this tab additional restrictions are set for the files to be scanned according to the scan mode.

Files are selected for scanning in the Scan mode option buttons area.

The All files option provides for maximum protection. This option is selected by default.

The Selected types and the User masks options instruct to check only those files whose extensions or names are included into the list specified in the right part of the pane. By default, the list includes the extensions of main file types, which can be virus carriers, and of the main types of file archives. The list can be edited.

In this tab you can also specify if file archives and mail files are to be included in the scanning. By default, file archives and mail boxes are scanned.

For more details on the settings and actions specified in this pane click the corresponding area of the window in the picture.

To view parameters set at another tab click the name of this tab.


 Actions Tab

Actions Tab

In this tab you can set the program’s reactions when infected or suspicious files, malicious programs and infected archives are detected.

For different types of files actions are assigned separately from the respective drop-down list.

By default, Dr.Web for workstations just informs the user when a known virus is found or when there is a suspicion an object is infected with a virus. The data for all infected or suspicious objects are displayed in the report list, in which you can manually specify the necessary program’s action.

By default, Dr.Web for Windows servers automatically makes attempts to avert a virus threat, if a known virus is found or there is a suspicion an object is infected with a virus.

Apart from reporting, there are other actions available:

Cure

(available for Infected objects only) – instructs the guard to try to cure objects infected with a known virus. If the virus is incurable, or the attempt of curing failed, the action set for incurable viruses will be applied.
Delete

– instructs to delete infected or suspicious files (no action will be taken to boot sectors).
Rename

– instructs to rename the extension of an infected or suspicious file according to the mask specified in the Rename extension field (by default, it is renamed to #??, i.e. the first symbol in the extension is replaced with #).
Move to

– instructs to move infected or suspicious files to the quarantine folder specified in the Move path field (by default, it is a subfolder in the program’s installation folder named infected.!!!).
Ignore

– (enabled for malicious programs only) instructs not to display information in the report window.

If an infected object is detected in an archive, the action specified for archives is applied. The action specified is applied to the whole archive, and not to the infected object only.

For more details on the settings and actions specified in this pane click the corresponding area of the window in the picture.

To view the parameters set on another tab click the name of this tab.


 Log File Tab

Log File Tab

In this tab logging options are set.

By default, the Log to file check box is selected.

You can specify the name and the location of the log file, text encoding, the log mode (to add new entries to the end of the log file or to overwrite the file in the beginning of each session), and the level of detail of the log. You can also specify whether the size of the log file should be limited or not, and specify the maximum size.

For more details on the settings and actions specified in this pane click the corresponding area of the window in the picture.

To view the parameters set at another tab click the name of this tab.


 Update Tab

Update Tab

In this tab additional settings of the automatic updating utility are specified.

The main updating settings (Update URL, User name and Password) are fixed at present by the key file and cannot be changed by the user.

In the Proxy mode field you can specify, if necessary, the mode of access to the Internet: do not use a proxy server (direct connection), or use system settings for the proxy server, or set up independently.

In the Proxy server address and port field you can specify, if necessary, the address of your HTTP proxy server.

If the proxy server used by you requires authentication, type the data required into the Proxy user name and Proxy password fields.

For more details on the settings specified in this pane click the corresponding area of the window in the picture.

To view the parameters set at another tab click the name of this tab.


 General Tab

General Tab

In this tab the settings of the program’s interaction with the OS and the program’s sound alerts for different events are specified.

A selected Autosave settings check box instructs the program to store the changed settings at exit. Otherwise, changes in settings are saved only if the user expressly confirms saving them by clicking the Save settings item on the Options menu of the main window. This mode is set by default.

A selected Use registry settings check box instructs to save the geometric parameters of the program’s windows during the last launch in the Windows registry.

If using Windows Vista, changes in the settings are saved to the registry only if the scanner is launched by a user with administrator rights.

The Check the battery state check box, when selected, instructs to check whether your computer is running on batteries before scanning starts. This option is available on portable computers only.

The Scan priority slider allows to modify the priority of the scan process in the system.

By default, sound alerts on virus events are disabled. You can enable sound reactions and associate events with the sound files.

For more details on the settings specified in this pane click the corresponding area of the window in the picture.

To view parameters set at another tab click the name of this tab.


SpIDer Mail for Windows Workstations

This component is not included into Dr.Web for Windows servers.

SpIDer Mail for Windows workstations with its default settings automatically intercepts all calls of any mail programs of your computer to POP3-servers over port 110 standard for this protocol, to SMTP-servers over port 25 standard for the protocol, to IMAP4-servers over port 143 standard for the protocol, and to NNTP-servers over port 119 standard for the protocol.

The program is included by default into the installation kit, is memory-resident and automatically restarts at Windows startup.

Any incoming message is received by this anti-virus mail guard instead of the mail client and is checked for viruses to the maximum level of detail. If no viruses or suspicious objects are found, it is transferred to a mail program "transparently", as if it were received directly from the server. The same way outgoing messages are checked before they are sent to the server.

The program's reaction to infected incoming messages and to unchecked messages (for example, those with complicated structure), is by default as follows:

messages infected with viruses are not delivered, the mail program is notified of the message's deletion, the server is notified of the message's accepting (this action is called the deletion of a message);

messages with suspicious objects are placed as separate files to the quarantine folder, the mail program is notified about it (this action is called moving a message);

unchecked messages are let pass, as well as not infected messages;

all deleted and moved messages are also deleted from the POP3 or IMAP4 server.

Infected or suspicious outgoing messages are not sent to the server, the user is notified of the refusal to send the message (while, as a rule, mail programs store such messages).

If there is an unknown virus distributing through e-mail, the program can detect the signs of the virus-like "activity" (mass mailing). By default, this option is enabled.

SpIDer Mail® uses the Vade Retro spam filter which allows scanning mail for spam messages. By default, this option is enabled.

Mail is checked for spam if the Dr.Web application is licensed to work in the "Anti-virus + anti-spam" mode (authorized by the key file).

The default program settings are optimal for beginners and secure the maximum protection level while user’s interference is minimal. Still, some options of mail programs are blocked (for example, sending messages to several addresses can be interpreted as mass mailing, and the mail will not be scanned for spam). Useful information cannot be retrieved from automatically destroyed messages (from their uninfected part). More experienced users can modify mail check parameters and the settings of the program's reactions to events.

In certain cases automatic interception of POP3, SMTP, IMAP4 and NNTP connections is impossible; in such cases the program allows to enable the interception of connections manually.

The SpIDer Guard monitor and the Scanner can also detect viruses in mail boxes of certain formats, still, SpIDer Mail has certain advantages as compared with these programs:

not all formats of mail boxes of popular mail programs are supported by SpIDer Guard and the Scanner; on the contrary, when SpIDer Mail is used, infected messages do not even enter mail boxes;

SpIDer Guard does not check mail boxes by default, enabling this option considerably degrades the system’s performance;

the Scanner checks mail boxes, but only at a user’s request or as scheduled, and not the moment mail is received. This action is rather labor- and time-consuming.

Thus, with the default settings, SpIDer Mail is the first to detect viruses and suspicious objects propagating through e-mail and does not let them penetrate computers. Its system’s resources consumption is low; other components' operation is often not needed during mail files checking.

Managing the mail guard

Setting SpIDer Mail for Windows workstations


Managing the Mail Guard

After installation is completed, the program generates an icon resembling an envelope with a spider behind it in the Taskbar. The presence of the icon means the program is active.

The program is managed with the help of the icon's context menu.

Selecting the Settings item will open the program's settings window.

The Language item allows to select one of the languages supported in the program’s interface.

When using Windows Vista a user should have administrator rights to change settings and language of the SpIDer Mail® interface.

The Update, Scanner and Sheduler items run the corresponding components.

In Windows NT/2000/XP/Vista the user should have the administrator's rights to be able to upgrade the Dr.Web version.

If you click Statistics, there will be displayed a window showing the results of the program’s operation during the current session (the number of checked, infected, suspicious objects and performed actions).

If the License purchase/renewal menu item is selected, the Doctor Web, Ltd. web site opens (or the web site of its regional representative), where the terms of license purchase and renewal can be found (this requires a working internet connection).

If the My Dr.Web menu item is selected, your personal page on the Doctor Web, Ltd. web site opens. On this page you can find information on your license (expiry date, serial number), renew it, see the date of the last update of the anti-virus complex, etc.


Setting SpIDer Mail for Windows Workstations

When using Windows Vista a user should have administrator rights to change settings and language of the SpIDer Mail® interface.

The program’s default settings are optimal in most cases and should not be modified without necessity.

To modify the program’s settings:

1. Select the Settings item in the context menu of the mail guard. The settings window containing several tabs will open.

2. Modify them as required.

3. After editing, click OK to save the changes made or Cancel to cancel the changes.

4. To get information about the settings in a tab click the Help button.


 Scan Tab

Scan Tab

In this tab the e-mail scan mode is set.

By default, the scan pane contains the following important settings:

Enabling the heuristic analyzer (a method allowing to detect with high probability suspicious objects infected with yet unknown viruses).

Scanning files in archives.

It is recommended to keep these settings.

It is possible to configure the spam filter only if the Dr.Web application is licensed to work in the "Anti-virus + anti-spam" mode (authorized by the key file).

The Check for spam check box enables spam-filtering of incoming messages. By default this check box is selected.

The Spam filter’s settings can be set in the SpIDer Mail® Spam Settings window. Click Advanced to open this window.

The Virus activity control check box is selected by default. This mode instructs the program to detect signs peculiar of virus distribution by e-mail. The program can block your sending mail to several addresses. In this case it is recommended to clear the check box.

The Load at startup check box is selected by default. The program automatically starts at every Windows startup. You can clear this check box, in this case the program can be started manually. To start it manually, click (All) Programs in the Windows Start menu, select the Dr.Web folder in the opened menu, and.select SpIDer Mail in the opened submenu.

By default, the mail guard detects, apart from messages with infected objects, messages containing other types of unsolicited programs:

adware

dialers

The mail guard can also detect the following types of unsolicited programs:

riskware

hacker programs

joke programs

To change the set of the unsolicited programs to be detected, select the check boxes against the types of unsolicited programs you want to be detected, and clear the check boxes against the types of programs you do not want to be detected.

The mail guard’s reaction to detection of unsolicited programs is similar to the reaction to detection of infected messages, specified in the Actions tab.

For more details on the settings specified in this pane click the corresponding area of the window in the picture.

To view parameters set at another tab click the name of this tab.


 Actions Tab

Actions Tab

In this tab the program’s reaction to detection of infected or suspicious files in e-mail are specified.

The following actions are available:

Delete – in this case the mail guard does not pass a message to the mail client; instead of a deleted message , the mail program receives a notification of the action performed.

Quarantine – in this case a message is placed to the quarantine folder, it is also not transferred to the mail program, the mail program receives a notification of the action made.

Pass – to transfer to the mail program as usually.

These actions are assigned separately for infected messages, suspicious messages and the messages the scanning of which could not be completed.

For outgoing messages any setting other than Pass results in the denial to pass the message to a SMTP server.

The Delete modified messages on server check box is selected by default. It instructs to delete messages incoming from a POP3/IMAP4 server for which the Delete or Quarantine action is specified, regardless of the mail program’s settings.

For more details on the settings specified in this tab click the corresponding area of the window in the picture.

To view parameters set at another tab click the name of this tab.


 Engine Tab

Engine Tab

In this tab the anti-virus engine parameters are set. You can specify a non-standard location of the anti-virus engine (the search module) and the virus databases.

If during the mail guard’s session there was an update by the automatic updating utility, SpIDer Mail immediately loads the databases updated. If databases were updated in another way (for example, they were copied to the installation folder), the mail guard can also load the updated databases without reloading the program. This is periodically checked by the flag file (by default, a "hot add-on" of the database). A change of the flag file means it is high time to update the databases. You can specify the name and the location of the flag file, as well as the interval between the checks (300 seconds, by default).

For more details on the settings specified in this pane click the corresponding area of the window in the picture.

To view parameters set at another tab click the name of this tab.


 Log Tab

Log Tab

In this tab the log file parameters are set.

By default, the Enable logging check box is selected.

You can specify the name and the location of the log file and the level of detail (whether information on all checked objects, including not infected objects, should be logged or not). You can also specify whether the log file size should be limited or not, and specify the maximum size.

For more details on the settings specified in this pane click the corresponding area of the window in the picture.

To view parameters set at another tab click the name of this tab.


 Interception Tab

Interception Tab

In this tab the interception parameters of connections with POP3/SMTP/IMAP4/NNTP servers are set.

Select the interception mode (manual or automatic). The automatic mode is the most convenient; the manual mode should be used in cases when automatic interception is impossible for all or several intercepted server addresses (the same mode should be applied for all addresses).

Having selected the mode, click the Parameters button. A window with interception settings of the mode selected will open.

For more details on the settings specified in this pane click the corresponding area of the window in the picture.

To view parameters set at another tab click the name of this tab.


Scheduler for Windows

This component is not included into Dr.Web for Windows servers.
This component is not installed if using Windows Vista. To manage automatic launching of tasks it is recommended to use Task Scheduler (the standard Windows scheduler) in which tasks for scanning the PC and updating the anti-virus complex are automatically created during the installation of Dr.Web® Anti-virus.

By default, the anti-virus system for Windows workstations includes an automatic tasks managing utility – the Scheduler for Windows. This program is optional; any other scheduler suitable for you can perform its functions. This program is designed to manage scanning and updating tasks of the anti-virus system and provides the user with additional facilities.

In Windows NT/2000/XP/Vista the user should have the administrator's rights to update Dr.Web. That is why, if the computer is run under an ordinary user account, the system administrator should disable Dr.Web Scheduler and enable the standard Windows scheduler to receive updates under the administrator's account.

After the program’s installation an icon representing a green clock-face is generated in the Taskbar.

Main tools for setting and managing the Scheduler reside in the context menu of this icon.

If the Open menu item is selected, the Scheduler's Main Window will open.

The Language menu item allows to select one of the languages of the program’s interface.

The Options menu item duplicates the same menu item of the main window and allows to execute the following actions:

to cancel (restore) the program’s autorun

to hide (show) the Scheduler icon in the Taskbar

to disable (enable) log writing

By default, the program is memory-resident and permanently active. You can unload it from the memory by selecting the Unload menu item, and cancel its autorun mode.

To run the Scheduler manually:

1. Select the (All) Programs item in the Windows Start menu.

2. Select the Dr.Web folder in the opened menu.

3. Choose the Scheduler in the opened submenu.

The program’s management functions are concentrated in its main window. To open the main window, double click the program’s icon in the Taskbar or select the Open item in the icon's context menu.


 Scheduler's Main Window

Scheduler’s Main Window

The Scheduler’s main window contains the menu and the list of tasks. The program stores the conditions to start each task, paths to executable files and the launching parameters.

You can add new tasks, delete the existing ones or edit them.

The main tools for work with the task list are located in the Task menu. They are fully duplicated by the context menu of the tasks listed and the buttons at the bottom of the window.

To remove a task, select it in the list and then select Remove task on the context menu.

To add a new task, select Add task on the context menu. To edit the parameters of a task selected in the list, select Edit task. A window for Adding/Editing a Task will open.

To cancel (restore) the program’s autorun clear (select) the Load at startup check box on the Options menu.

To hide (show) the Scheduler icon in the Taskbar clear (select) the Show icon in tray check box on the Options menu.

To disable (enable) log writing clear (select) the Write log file check box on the Options menu.

To unload the program from the memory, select Unload on the File menu.

For more details on the settings and actions specified in this pane click the corresponding area of the window in the picture.


 Adding/Editing Tasks

Adding/Editing Tasks

In this window tasks are assigned (the executable file of a task is set in the Path field, and the command line parameters are set in the Parameters field). Also the conditions triggering a task are specified.

If the Enable check box is not selected, the task is not to be performed, regardless of other conditions (it is blocked). None of its requisites can also be edited, except for the check box mentioned.

The group of buttons in the Run area sets the periodicity of the task’s performance. Depending on the periodicity selected, the corresponding properties are opened in the Run area.

The Critical check box instructs to perform the task the time of which was missed at the first opportunity.

When editing is finished, click OK to save the settings when closing the tab or Cancel to cancel the changes made.

When other run modes are used, the setup options in the Run area will somewhat differ.

For more details on the settings specified in this pane click the corresponding area of the window in the picture.


Dr.Web Automatic Updating Utility for Windows

Developers of the anti-virus system constantly supplement virus databases with new virus signatures. After anti-virus databases updates are installed, the anti-virus system can detect the new viruses, block their spreading and in some cases cure the infected files.

From time to time anti-virus algorithms (executable files and program libraries) are augmented. Bugs discovered in the course of the anti-virus's operation are consistently eliminated, the help system and documentation are uniformly updated and improved.

To speed up and facilitate the receipt and installation of the updates of the virus databases and other files a special component was designed – Dr.Web automatic updating utility for Windows.

The automatic updating utility requires a connection to the Internet.

In Windows NT/2000/XP/Vista a user should have administrator rights to update the Dr.Web® version.

The automatic updating utility can be run in one of the following ways:

automatically, as scheduled

from the command line by calling the drwebupw.exe executable file from the program’s installation folder

select Update on the SpIDer Guard or the SpIDer Mail context menu

click Update on the File menu in the Scanner’s main window

At startup the automatic updating utility checks if there is a key file in the installation folder. If no key file is found, it tries to obtain it via the Internet at http://www.drweb.com. Without a key file the automatic update is impossible.

If a key file is found, the program checks if this key is not blocked at http://www.drweb.com (the file may be blocked if it is discredited, i.e. if it was illegally distributed). With a blocked key file updating is not performed, the components of the anti-virus system may be blocked, a message of the corresponding content is displayed to the user.

If your key file is blocked, contact the dealer you have purchased the anti-virus from.

After the key file is successfully verified, the updating is performed. The program automatically downloads all updated files, associated with the version of your anti-virus, and it may download an upgraded version of the anti-virus system (when it is released), if it is stipulated by the terms of your license.

It may be necessary to restart the computer to update executable files and libraries. A message box with a corresponding notification is displayed to the user. If the changes affect the automatic updating utility itself, one more restart during the update may be required.

Obtaining a Key File

Automatic updating utility window

Key files


Obtaining a Key File

First of all, the automatic updating utility checks the presence of a key file (a license file or a demo file). If no key file is found, you will be asked to obtain a key file on the Internet through the user registration procedure.

To receive a license key file, you will need to enter the registration serial number, supplied to you when purchasing a Dr.Web® anti-virus license. If you do not have a registration serial number, you can receive a demo key file, which will enable you to use the Dr.Web® anti-virus for 30 days.

To receive a demo key file, click the [image] button.

To receive a license key file, click the [image] button.

To exit the updating utility, click Cancel.

Obtain a demo key file

Obtain a license key file


Obtaining a Demo Key

Registration Data Entry

To receive a key file, type the personal data (name, surname, e-mail address), select the country from the drop-down list, type the city name. All the fields listed are obligatory and should be filled in.

If you want to receive news about the Dr.Web anti-virus by e-mail, select the corresponding check box.

Click Next. A registration data confirmation window will open.

To exit the updating utility, click Cancel.

Back


Obtaining a License Key

Serial Number Entry (1)

Top Previous Next

In the Registration: Step 2 window enter a serial number to receive a license key file and click Next.

You can register only the serial numbers generated by Doctor Web, Ltd. All such serial numbers are in xxxx-xxxx-xxxx-xxxx format, i.e. they consist of four groups of alpha-numeric characters, where it is obligatory that all groups are divided by a minus sign. For example, E2E4-KH2A-7BVX-D8R6. If your serial number is different (for example, OEM-xxx, DVD-xxx, 3DRWEB), to register it go to the website or contact the customer support service of the company having supplied the number. Particularly, serial numbers of specific formats have been generated by Dialognauka JSC http://www.antivir.ru/antivir.ru, reg@antivir.ru

To exit the updating utility, click Cancel.

Next

Back


Command Line Switches

Switches are used to set parameters for programs which can be launched by opening an executable file. This relates to scanners (both the GUI and the console version) and to the Automatic updating module. The switches can set the parameters unavailable in the configuration file and have a higher priority then the parameters which are specified in it.

Switches begin with the / character and are separated with blanks as other command line parameters.


The Scanner Command Line Switches

/@<file_name> or /@+<file_name> instructs to scan objects listed in the specified file. Each object is specified in a separate line of the list-file. It can be either a full path with the file name or the ?boot string which means that scanning of boot sectors should be performed. For the GUI version of the scanner the file names with mask and directory names should be specified there. The list-file can be prepared manually in any text editor; this can also be done automatically via applications using the scanner to check certain files. After the scanning is completed, the scanner deletes the list-file, if used without the + character.

/AL – to scan all files in the given device, or in the given folder, regardless the extensions or the internal format.

/AR – to scan files inside the archives. At present, the scanning of archives (without curing) created by the ARJ, PKZIP, ALZIP, AL RAR, LHA, GZIP, TAR, BZIP2, 7-ZIP, ACE, etc. archivers, as well as of MS CAB-archives – Windows Cabinet Files (QUANTUM packing is not supported yet) and ISO-images of optical disks (CD and DVD) is available. As it is specified (/AR) the switch instructs to inform a user when an archive with infected or suspicious files is detected. If the switch is supplemented with the D, M or R modifier, other actions are taken: /ARD – delete; /ARM – move (by default, to the infected.!!! folder); /ARR – rename (by default, the first symbol of the extension is replaced by the # character). The switch may end with the N modifier, and in this case the name of the archiver after the name of the archived file will not be printed.

/CU – actions with infected files and boot sectors of drives. The curable objects are cured and the incurable files are deleted without additional D, M or R modifiers (if different action is not specified by the /IC switch). Other actions taken towards infected files: /CUD – delete; /CUM – move (by default, to the infected.!!! folder); /CUR – rename (by default, the first symbol of extension is replaced by the # character).

/SPR, /SPD or /SPM – actions with suspicious files: /SPR – rename; /SPD – delete; /SPM – move.

/ICR, /ICD or /ICM – actions with infected files which cannot be cured: /ICR – rename; /ICD – delete; /ICM – move.

/MW – actions with all types of unsolicited programs. As it is specified (/MW) the switch instructs to inform a user. If the switch is supplemented with the D, M, R or I modifier, other actions are taken: /MWD – delete; /MWM – move (by default, to the infected.!!! folder); /MWR – rename (by default, the first symbol of extension is replaced by the # character); /MWI – ignore. Actions with certain types of unsolicited programs are specified by the /ADW, /DLS, /JOK, /RSK, /HCK switches.

/DA – to scan the computer once a day. The next check date is logged into the configuration file and that is why it should be accessible for writing and subsequent rewriting.

/EX – to scan files with extensions listed in the configuration file by default, or, if unavailable, these are EXE, COM, DLL, SYS, VXD, OV?, BAT, BIN, DRV, PRG, BOO, SCR, CMD, 386, FON, DO?, XL?, WIZ, RTF, CL*, HT*, VB*, JS*, INF, PP?, OBJ, LIB, PIF, AR?, ZIP, R??, GZ, Z, TGZ, TAR, TAZ, CAB, HLP, MD?, INI, MBR, IMG, CSC, CPL, MBP, SH, SHB, SHS, SHT*, MSG, CHM, XML, PRC, ASP, LSP, MSO, OBD, THE*, EML, NWS, SWF, MPP, TBB.

If an element of the list of scanned objects contains the explicit file extension, and it is used with special characters * and ?, all files specified in this element of the list will be scanned and not only those matching this list of extensions.

/FN – to load Russian letters to the video display decoder (for Dr.Web® for DOS only).

/GO – batch mode of the program. All questions implying answers from a user are skipped; solutions implying a choice are taken automatically. This mode is useful for automatic scanning of files, for example, during a daily or weekly check of the hard disk.

/SCP:<n> – sets the priority of the scanning process, where <n> is a number ranging from 1 to 50.

/SHELL – for the GUI version of the scanner. The switch disables the splash screen display, scanning of the memory and autorun files. The earlier saved lists of paths to files and folders scanned by default are not loaded for scanning. This mode allows to use the GUI version of the scanner instead of the console version to scan only those objects which are listed in the command line switchess.

/ST – sets stealth mode of the GUI version of the scanner. The program operates without any windows opened and self-terminates. But, if during scanning virus objects were detected, the scanner window will be opened after the scanning is completed. Such scanner mode presupposes, that the list of the scanned objects is specified in the command line.

/HA – to perform heuristic scanning of files and search for unknown viruses in them.

/INI:<path> – use alternative configuration file with specified name or path.

/NI – do not use parameters specified in drweb32.ini configuration file.

/LNG:<file_name> or /LNG – use alternative language resources file (DWL-file) with specified name or path, and if the path is not specified – the inbuilt (English) language.

/ML – scan files of e-mail format (UUENCODE, XXENCODE, BINHEX and MIME). As it is specified (/ML) the switch instructs to inform a user if an infected or suspicious object is detected in a mail archive. If the switch is supplemented with the D, M or R modifier, other actions are taken: /MLD - delete; /MLM – move (by default, to the infected.!!! folder); /MLR – rename (by default, the first symbol of extension is replaced by the # character). The switch may end with the N modifier. In this case the Mail archive message will not be printed.

/NS – disable interrupting of computer scanning. With this switch specified, a user will not be able to interrupt scanning by pressing Esc.

/OK – display full list of scanned objects and mark the uninfected ones with Ok.

/PF – prompt on, if multiple floppies are scanned.

/PR – prompt for confirmation before action.

/QU – the scanner checks the objects specified in the command line (files, disks, folders) and then automatically terminates (for the GUI version of the scanner only).

/RP<file_name> or /RP+<file_name> – log to a file the name of which is specified in the switch. If no name is specified, log to a default file. If the + character is present, the file is appended. If there is no character, a new one is created.

/NR – do not create a log file.

/SD – scan subfolders.

/SO – enables sounds.

/SS – save the mode, specified during the current program launch in the configuration file when the program terminates.

/TB – scan boot sectors and master boot records (MBR) of the hard drive.

/TM – search for viruses in main memory (including Windows system area). Available for scanners for Windows only.

/TS – search for viruses in autorun files (in Autorun directory, system INI-files, Windows registry). Used only in scanners for Windows.

/UPN – disable the displayingoutput of the names of the program used for file packers used for packing the, conversion or vaccination of the scanned executable files to the log file by the scanners, the /UPN key is applied.

/WA – do not terminate the program until any key is pressed, if viruses or suspicious objects are found (for console scanners only).

/? – display short help on the program.

Certain switches allow the "-" character to be used at the end. In such "negative" form the switch means cancellation of the mode. Such option can be useful if a certain mode is enabled by default, or with the settings specified earlier in the configuration file. Here is the list of the command line switches allowing the "negative" form:
/ADW /AR /CU /DLS /FN /HCK /JOK /HA /IC /ML /MW /OK /PF /PR /RSK /SD /SO /SP/SS /TB /TM /TS /UP /WA

For /CU, /IC and /SP switches the "negative" form cancels any actions specified in the description of these switches. This means that infected and suspicious objects will be reported but no actions will be applied.

For /INI and /RP switches the "negative" form is written as /NI and /NR accordingly.

For /AL and /EX switches the "negative" form is not allowed. However, specifying one of them cancels the other.

If several alternative parameters are found in the command line, the last of them takes effect.


Automatic Updating Utility Command Line Switches

If the automatic updating utility is run by the Scheduler or in the command line mode, you can input the following command line parameters:

/URL:<url of the updating server> – only UNC-paths are accepted.

/USER:<user name of http-server> – user name for the updating server.

/PASS:<user password of http-server> – user password of the updating server.

/UPM:<proxy mode> – mode of using a proxy server. It can have the following values:

· direct – do not use proxy server
· ieproxy – use system settings
· userproxy – use settings specified by a user (in the Update pane of the Dr.Web® toolbar or via the /PURL /PUSER /PPASS switches)

/PURL:<proxy address> – address of a proxy server.

/PUSER:<proxy user name> – user name for the proxy server.

/PPASS:<proxy user password> – user password for the proxy server.

/UA – download all files specified in the updating list, regardless the used operating system and the installed components. The mode is designed for receipt of the full local copy of the Dr.Web® server updating area; this mode cannot be used for updating the anti-virus installed on a computer.

/ST – run the automatic utility in invisible mode (stealth mode).

/LNG:<file_name> – language resources file name; if not specified, English is used.

/GO – batch operation mode, without dialogs.

/QU – to compulsory close the automatic updating utility after the updating is finished, regardless whether it was successful or not. The result of the update can be checked via the drwebupw.exe return code (for example, from the BAT-file by the errorlevel variable value: 0 – successful, other values – unsuccessful).

/DIR:<directory> – change the name of the folder where the updated files are placed; by default, the folder from which the automatic updating utility was launched is used.

/URM:<mode> – to restart after the updating is finished. It can have the following values:

· prompt – prompt if a system reboot is required after the updating session is finished
· noprompt – if necessary, reboot without prompting
· force – reboot always (regardless whether it is required for the updating or not)
· disable – disable reboot

/REG – launch the automatic updating utility for registration and receipt of the registration key file.

/UPD – usual updating; it is used together with the /REG switch to run the updating session itself during the registration.

/UVB – update the virus databases and drweb32.dll kernel only (disables /UA, if it is set).

/RP<file_name> or /RP+<file_name> – log to a file the name of which is specified in the switch. If no name is specified, log to a file with the default name. If the + character is present, the file is appended. If there is no character, a new one is created.

/INI:<path> – use alternative configuration file with specified name or path.

/NI – do not use parameters specified in the drweb32.ini configuration file.

/NR – do not create a log file.

/SO – enables sounds (only when errors occur).

/DBG – detailed log.

The /SO switch allows the "-" character at the end. In such "negative" form the switch means cancellation of the mode. This option can be useful if the mode is enabled with the settings specified earlier in the configuration file.

For /INI and /RP switches the "negative" form is written as /NI and /NR accordingly.

If several alternative parameters are found in the command line, the last of them takes effect.


Return Codes

Top Previous

The values of the return code and corresponding events are as follows:

0 | OK, no virus found
1 | known virus detected
2 | modification of known virus detected
4 | suspicious object found
8 | known virus detected in file archive, mail archive or container
16 | modification of known virus detected in file archive, mail archive or container
32 | suspicious file found in file archive, mail archive or container
64 | at least one infected object successfully cured
128 | at least one infected or suspicious file deleted/renamed/moved

The actual value returned by the program is equal to the sum of codes for the events that occurred during scanning. Obviously, the sum can be easily decomposed into separate event codes.

For example, return code 9 = 1 + 8 means that known viruses were detected, including viruses in archives, mail archives or containers; curing and others actions were not executed; no other "virus" events occurred during scanning.


.topic 2156790855
Click this button to pause scanning.
.topic 2156790854
Click this button to start scanning.
.topic 2156790856
Click this button to stop scanning.
.topic 2154038292
Close the window
.topic 2155217944
Click this button to select the folder for the removed messages
.topic 2154693686
Specify the element you want to add into the entry field and click Add
.topic 2154693679
In the field to the left enter the path to the folder you want to add to the list and click the Add button.
.topic 2154562585
By clicking this button, you add the extension or the file mask specified in the field to the left into the list
.topic 2154234894
The OK button closes the main window saving the changes made in the program's parameters (the Scheduler continues operating)
.topic 2156659796
Opens a standard window to search for a file to be excluded from scanning
.topic 2156659794
Opens a standard window to search for a folder to be excluded from scanning
.topic 2154628098
Opens a standard window to browse for an existing file to which the report will be generated
.topic 2154497023
Opens a standard window to browse for a folder where the infected, incurable or suspicious objects can be moved to
.topic 2156200955
Opens a standard window to browse for a file in Windows
.topic 2159608978
Opens a standard window  to browse for the path to a file (folder) in the hierarchical Windows list
.topic 2156856353
Opens a standard window to browse for a wav-file enabling sound effects for an event
.topic 2156921933
Clear (null) the statistics
.topic 2154562587
Click this button to restore the default list (the list will contain main extensions of executable and archived files)
.topic 2156659795
Select the object for deletion in the list to the left of the button and click Remove to exclude the object from the list
.topic 2156659792
Select the object for deletion in the list to the left of the button and click Remove to exclude the object from the list
.topic 2154562586
By clicking this button, you remove the selected file extension or the mask from the scanning list
.topic 2156200982
Click to cancel adding a task
.topic 2156200981
Click to add a created/edited task to the schedule
.topic 2156200989
Click to run the task immediately
.topic 2154890307
Close the window without saving the changes
.topic 2154890306
Close the window and save the changes
.topic 2154824735
Click this button to select the virus database location
.topic 2154824732
Click this button to select the location of the search engine
.topic 2154824755
Click this button to select the path to the flag file
.topic 2154300535
Opens the web site of Dr.Web for Windows 95-XP developers in an Internet browser
.topic 2155283517
Click to add the address of the server into the list
.topic 2155283569
Close the window without saving the changes
.topic 2155283515
Click to delete the selected server from the list
.topic 2155283570
Close the window and save the settings
.topic 2155545722
Add the interception to the list
.topic 2155545717
Close the window without saving the changes
.topic 2155545723
Delete the selected interception from the list
.topic 2155545716
Close the window and save the settings
.topic 2155021361
Click to select the name and the location of the log file
.topic 2154300429
Click to close this window
.topic 2156790842
By clicking this button you suspend the scanning. The second click will resume the scanning.
.topic 2156790766
Restore the set of objects for scanning saved previously. If you select new objects for scanning and click Restore, the previously saved objects will be added to the new ones.
.topic 2156790852
By clicking this button you initiate scanning (in case objects for scanning are selected). To stop scanning, click the button again.
.topic 12155152448
Close the window without saving changes to the settings
.topic 2155152449
Close the window and save changes to the settings
.topic 2155087026
Click to configure the antispam filter.
.topic 2155611320
Close the window and abort changes.
.topic 2155611319
Close the window and save changes.
.topic 2156790765
Save the disks and folders selected for scanning. In future, this set can be restored by clicking the Restore button, instead of choosing the objects anew
.topic 2154234906
Click the button to add a new task to the task list to be run by the Scheduler and set the task parameters
.topic 2154234907
Select the task in the list the parameters of which you want to edit and click the button. The window for adding/editing a task will open
.topic 2154234908
Select a task in the list to be deleted and click the button
.topic 2154169320
This button is used to start and stop updating, and close the window of the updating utility .

.topic 2155218061
With the check box selected the deleted and removed messages will also be deleted from the POP3/IMAP4 server
.topic 2155218063
Clear this check box to disable adding  an "X-Antivirus" message line with data about the check and the version of the anti-virus to every checked e-mail's header
.topic 2154562579
Unpack archives and check the files inside them? This action consumes vast time, memory and other Windows OS resources. To disable this mode clear this check box
.topic 2156856377
Enable automatic saving of changes in the configuration at exit?
.topic 2156200984
Select this check box to run the task at the first opportunity, even if the scheduled term has expired
.topic 2154628103
If the Cut it longer than check box is selected, the log file size will not exceed the size indicated in the neighboring field. If the file size limit is exceeded, the log file is cleared and new data is logged at the beginning
.topic 2154562581
Scan e-mail files of certain mail clients (those storing mail messages as texts). Clear the check box, if you do not use such mail clients
.topic 2156200956
If it is necessary to disable a task for some reason, it is possible to block the task in the Scheduler, i.e. to  exclude it temporarily from the schedule. To block the task (launching time settings will be saved, but the task will not actually be launched),  clear the default Enable check box in the task parameter settings window. To unblock the task –  select the check box
.topic 2156200968
With this option enabled, the task will be performed weekly on Fridays
.topic 2156659725
Enabling the heuristic analysis mode (the detection of unknown viruses based on a priori presumptions regarding the structure of virus codes).  Such scanning is characterized by an approximate, probabilistic method of discovering infection, allowing to detect suspicious objects, rather than infected ones. A whole class of programs (for example, multisystem PC loaders) have codes similar to viruses and thus can cause false positives of the heuristic analyzer. Besides, such check somewhat increases the scanning time in PCs with low-power processors. This may argue for disabling the heuristic analysis. At the same time, enabling it will raise the reliability of anti-virus protection. By default, this mode is enabled.
.topic 2155283591
Check the automatic interception functioning at every program start
.topic 2154628247
List the archives scanned and their contents, as well as error reports (for example, if it failed to unpack as it was password protected). This check box is not selected by default
.topic 2155021489
Select this check box to enable a bubble help above the SpIDer Mail's icon notifying about the program's version, the number of virus signatures, etc. The bubble help appears immediately after the program start
.topic 2154169362
Select this check box to enable detailed reporting of the current updating session. In case of an updating error this report is to be sent to the technical support service. The check box will be cleared at the next session
.topic 2155021455
Allow icon animation during the mail scanning
.topic 2155021366
Enable logging
.topic 2155021367
Log all messages (not only infected) or not
.topic 2155021459
If the check box is selected, the log file size cannot exceed the size indicated in the neighboring field
.topic 2154628107
List detected executable files packed with special packers, and the names of their packers. This check box is cleared by default
.topic 2154628106
List all scanned objects, at this uninfected objects will be marked with Ok (this mode may considerably increase the log file size). This check box is not selected by default
.topic 2155021485
Display the program icon in the system tray or not
.topic 2154628108
If the Statistics check box is selected, the statistics on the program's performance during the regular scanning and the whole session is displayed
.topic 2154628096
Log to a file?
.topic 2156200985
Select the check box to run the application minimized according to the Scheduler's task
.topic 2156200964
With this option enabled, the task will be performed weekly on Mondays
.topic 2156200959
Select the check box to run the task while online
.topic 2156856350
By default, sound effects are disabled. To enable sound reactions, select the Sounds check box
.topic 2156659857
This mode instructs the program to open a dialog box requesting Scan another floppy? after a diskette is scanned. To scan the next floppy insert it into the disk drive and click Yes; to finish the scanning of floppies in the current disk drive click No
.topic 2154497056
To ask user's permission to any action with objects? It is recommended to save this mode (except for the cases when scanning is performed in the automatic mode without user's active participation)
.topic 2156200969
With this option enabled, the task will be performed weekly on Saturdays
.topic 2155152516
Enable alerts when the program blocks an outgoing message (the check box can be cleared if the mail program provides such alerts)
.topic 2155087000
Detect adware or not
.topic 2155086939
Run the program at system start
.topic 2156659753
The boot sectors of disks and the MBR of the hard drive are scanned when this mode is enabled. The Scan boot sectors mode is enabled by default and it is not recommended to disable it. If you still want to disable it, clear the check box.
.topic 2155086856
Scan files in archives or not
.topic 2155087001
Select whether the dialers redirecting modem calls to predefined paid numbers or paid resources should be detected or not
.topic 2155087003
Detect hacker programs or not
.topic 2155086855
Perform heuristic analysis to detect unknown viruses or not
.topic 2155087004
Detect joke programs or not
.topic 2156659862
To disable obligatory scanning of the main memory immediately after the program start clear the Scan memory check box (the memory can be checked at a user's request). By default, this mode is enabled and it is not recommended to disable it
.topic 2155087002
Detect riskware or not
.topic 2156659726
By default, startup files (according to the Autorun folder, system ini-files, the Windows registry) are checked at the Scanner's launch. Clear the check box to disable this option
.topic 2156659765
Scan the subfolders within the folders selected for scanning?
.topic 2155086975
Check for virus activity (outgoing spam) or not?
.topic 2155086857
Select this check box to enable the spam filter. Click the Advanced... button below to open the spam filter’s settings window.
.topic 2156200970
With this option enabled, the task will be performed weekly on Sundays
.topic 2156856371
Select the Check the battery state check box to verify whether your computer runs on battery. If the check box is selected, a warning about the battery state will appear with the prompt to start the scan.
.topic 2156200967
With this option enabled, the task will be performed weekly on Thursdays
.topic 2156200965
With this option enabled, the task will be performed weekly on Tuesdays
.topic 2156856501
To fix the program's window sizes and their respective parameters in the Windows registry, select the Use registry settings check box. The geometric parameters of main windows will be automatically saved between Scanner's sessions. This mode is enabled by default
.topic 2156200966
With this option enabled, the task will be performed weekly on Wednesdays
.topic 2154497055
Select a reaction to the detection of objects infected with adware
.topic 2154497043
Select a reaction to the detection of infected files in archives. The action will be applied to the whole archive
.topic 2154497053
Select a reaction to the detection of infected files in containers of ActiveMIME (MSO), PowerPoint, HTML, OLEMessage, RTF formats. The action will be applied to the whole archive
.topic 2156200975
Select the day of the week the task must be run on
.topic 2154497058
Select a reaction to the detection of dialers redirecting modem calls to predefined paid numbers or paid resources
.topic 2156921921
Display statistics for all scanned disks or a specific one.
.topic 2154497073
Select a reaction to the detection  of hacker programs
.topic 2154497046
Select a reaction to the detection of objects infected with incurable viruses
.topic 2154497042
Select a reaction to the detection of objects infected with known viruses
.topic 2154497061
Select a reaction to the detection of joke programs
.topic 2154497051
Select a reaction to the detection of infected mail files. The action will be applied to the whole mail archive
.topic 2156200963
Select the month in the drop-down list
.topic 2156463145
Specify in this field, if necessary, the mode of access to the Internet: do not use a proxy server (direct connection), or use system settings for the proxy server, or set up independently
.topic 2154497070
Select a reaction to the detection of riskware
.topic 2156856372
The list contains the events with files which can be "sounded". The corresponding sound file is shown on the right.
.topic 2154497049
Select a reaction to the detection of objects infected with supposedly unknown viruses
.topic 2154562610
The list contains the file name masks and files extensions to be scanned by the Scanner
.topic 2155217942
Set the path for the removed messages
.topic 2154890275
Specify the maximum number of search engines
.topic 2154890277
Specify the number of originally loaded search engines
.topic 2154890278
A time period after which an unused search engine is unloaded
.topic 2154824737
Set the path to virus databases
.topic 2154824730
Set the path to a search engine
.topic 2154824744
Type the flag file name
.topic 2154824746
Specify the flag file's check period
.topic 2155283518
Type the address of the server (a server domain name or an IP address), * is admitted
.topic 2155283519
Type the port of the server
.topic 2155545729
Type the port of the program (starting from 7000, the numbers must follow in ascending order)
.topic 2155545730
Type the address of the server (digital or domain)
.topic 2155545613
Type the port of the server
.topic 2155021359
Specify the log file name
.topic 2155021365
Specify the maximum log file size
.topic 2154628097
Type the log file name
.topic 2154497021
In the entry filed specify the folder where infected files are to be moved to. By default, it is infected.!!! (the folder is created in the program's installation folder). You can type the path and the name of a specific folder in the entry field, or click the button to the right of the entry field to select it from the standard Windows folder tree
.topic 2156200940
Parameters - additional parameters (keys) to be processed when the given task is launched. This field may be left empty
.topic 2156200941
Path - the full path and the name of the executable file. You can specify the path to and the name of a specific file in the entry field, or click the button on the right to select it in the standard Windows folder tree. This field is obligatory to fill in
.topic 2154497020
In the entry field specify an extension mask applied to renamed files. The extension can be changed, but standard extensions (EXE, COM, BAT, DOC, PAS, BAS etc.) should not be used instead. By default, it is #??, i. e. the first character of the extension is replaced with #. You can also type your own variant into the entry field in question. This mode is inapplicable to boot records
.topic 2155152398
Specify the maximum archive nesting level (in mail attachments)
.topic 2155152454
Specify the maximum archive compression rate (in mail attachments)
.topic 2155152396
Specify the maximum file size at unpacking
.topic 2155152395
Specify the maximum message checking time
.topic 2154628104
In this field specify the maximum log file size in kilobytes
.topic 2156200957
Specify the time as HH:MM
.topic 2156200937
Title - an arbitrary name of an added task. To simplify working with the Scheduler it is recommended to give meaningful names to tasks. This field is obligatory to fill in
.topic 2156856352
 In this field specify a sound file name associated with the event
.topic 2156659769
Enter the path to a folder you want to exclude from scanning. You can also use the button on the right to select a necessary folder.
.topic 2156659770
Enter the name (mask) of a file you want to exclude from scanning. .* and ? can be used instead of a part of a file name. The * character is used instead of any symbol sequences; the ? character is used instead of any (single) symbol.
.topic 2155217935
Select an action over infected messages
.topic 2155217937
Select an action over unchecked messages
.topic 2155217936
Select an action over suspicious messages
.topic 2156659793
List of files excluded from scanning.
.topic 2156659791
List of folders and files you want to exclude from scanning
.topic 2155283512
List of intercepted POP?/SMTP/IMAP4/NNTP servers
.topic 2155545721
List of intercepted addresses
.topic 2154300406
The list contains general information about the program: the license term, the key validity term, the components' versions, the last date of virus databases updating and the number of signatures in  virus databases
.topic 2154562575
The All files option means full scanning of all files within the objects selected for scanning
.topic 2154628110
Keep logs in ANSI (Windows)
.topic 2154628100
Instruct the Scanner to append new log entries in the end of the log file
.topic 2156790859
Custom scanning mode
.topic 2156200947
The button sets the task to run at a definite time on specified days of the week. Specify the run time in the entry field and select the check boxes against the days of the week on which the task must be run. By default, the current time and all days of the week are set
.topic 2156790857
Fast scanning mode
.topic 2156790858
Full scanning mode. All the files on hard drives and removable media are scanned.
.topic 2156200950
The button sets the task to run every hour. Specify the minute of the hour the task must be run at. By default, the current minute of the hour is set
.topic 2156200949
The button sets the task to run at a definite time once a month. The launching time and the day when the task must be run should be specified. By default, the current time and day are set
.topic 2154497019
The Move to option instructs to move an infected file to the folder the name of which is specified in the entry field to the right of this button. By default, it is infected.!!! (the folder is created in the program's installation folder). You can enter the path and the name of a specific folder in the entry field, or click the button to the right of the entry field to select it from the standard Windows  folder tree
.topic 2154431596
Automatic interception mode
.topic 2154431597
Manual interception mode
.topic 2154628111
Keep logs in OEM (DOS)
.topic 2156200953
The button enables launching the task at the program start
.topic 2156200952
The button sets the task to run only once at the specified time. The following fields should be filled in: launch time (entry field on the left), launch date (central entry field) and year (entry field on the right) are typed in from the keyboard; the month is selected from the drop-down list. By default the current time and date are set
.topic 2154628101
Instruct to clear log files at every Scanner's launch
.topic 2154562576
To scan the files the extensions of which are included into the list of extensions selected by a user.
Special * and ? characters may be used in the extension list. The program keeps a list of main extensions of executable and archive files by default. You can edit this list.
To add a new element for scanning, type it into the entry field in the upper part of the List area and click the Add button. To delete an element from the list, select it in the list and click the Delete button. To restore the default list, click the Default button
.topic 2154562578
This option is analogous to the Selected types, but allows to select files not only by extensions, but also by files names masks
.topic 2156200948
The button sets the task to run at a definite time once a week. Specify the launch time and select the day of the week from the list on which the task must be run. By default, the current time and day are set
.topic 2154497018
The Rename option selected instructs to replace the extension of the file name according to the extension mask specified in the entry field  to the right of this text. By default, it is #??, i. e. the first  character in the extension is replaced with #. You can also type in your own variant in the mentioned entry field. The mode is inapplicable to boot records
.topic 2156200962
The button sets the task to run every X minute. Specify the value of the interval in minutes (value from 1 to 1440) in the minute entry box. By default, 30 minutes is set
.topic 2156856378
Set the priority of this program with respect to other Windows applications
.topic 2155611325
When the check box is selected, the spam filter does not process messages in Chinese/Japanese/Korean as spam without analysis. When the check box is not selected, it is highly possible that such messages will be regarded as spam.
.topic 2155611324
When the check box is selected, the spam filter does not process messages with Cyrillic encoding as spam without analysis. When the check box is not selected, it is highly possible that such messages  will be regarded as spam.
.topic 2155611318
Specify sender addresses which should be added to the black list. Addresses are separated with the ";" sign. The "*" sign can be used instead of a part of the address (For example, *@domain.org  stands for all addresses the domain name of which is domain.org).
.topic 2155611315
Specify the prefix which SpIDer Mail® should add to the subjects of spam messages.
.topic 2155611310
Select  this check box to  instruct SpIDer Mail®  to add a special prefix to the subjects of spam messages. This prefix can be specified in the field below.
.topic 2155611317
Enter addresses which should be added to the white list. Addresses are separated with the ";" sign. The "*" sign can be used instead of a part of the address (for example, *@domain.org  denotes all addresses  the domain name of which is domain.org).
.topic 2155218062
Delete (regardless of the mail program settings) messages stopped by the anti-virus at the POP3/IMAP4 server or not
.topic 2155217938
Reaction to infected messages
.topic 2155217940
Reaction to unchecked messages
.topic 2155217941
Quarantine folder for removed messages
.topic 2155217939
Reaction to suspicious messages
.topic 2155218064
Clear this check box to disable adding  an "X-Antivirus" message line with data about the check and the version of the anti-virus to every checked e-mail's header
.topic 2156921984
Quantity of cured objects. The action to be performed over an infected object is set in the corresponding dialog box
.topic 2156921985
Quantity of deleted objects. The action to be performed over an infected object is set in the corresponding dialog box
.topic 2154890274
Maximum number of simultaneously loaded search engines
.topic 2154890276
Number of search engines loaded at the program launch
.topic 2154890285
Time interval after which unused search engines are unloaded
.topic 2154824733
Path to virus databases
.topic 2154824729
Path to the complex engine (the drweb32.dll file)
.topic 2154824743
The flag file changes in which cause updates of virus databases
.topic 2154824745
Flag file check period
.topic 2154693804
Enter the name of a file you want to exclude from scanning. Click the Add button to add the file to the list of objects excluded from scanning. You can use * and ? characters instead of a part of a file name. The * character is used instead of any symbol sequences; the ? character is used instead of any (single) symbol.
.topic 2154693802
Enter the path to a folder you want to exclude from scanning and click the Add button. The folder will be added to the list of folders excluded from scanning.
.topic 2155283513
Server address
.topic 2155283592
Whether the automatic interception mode should be checked or not
.topic 2155283514
Server port
.topic 2155545738
Type the SpIDer Mail port number (the numbers must follow in ascending order, starting from 7000)
.topic 2155545739
Type the IP, or the domain address of the intercepted POP3/SMTP/IMAP4/NNTP server
.topic 2155545740
Type the port of the intercepted POP3/SMTP/IMAP4/NNTP server
.topic 2156921989
Quantity of objects to which, according to the program's settings, Ignore was applied upon detection
.topic 2156922019
Quantity of objects infected by main modifications of known viruses
.topic 2155021487
Select this check box to enable a bubble help above the SpIDer Mail's icon notifying about the program's version, the number of virus signatures, etc. The bubble help appears immediately after the program start
.topic 2154628105
This group of check boxes allows to choose the kind of data to be logged. Provided that Log to file is enabled, even if none of the check boxes is selected, the program always makes records of the detection of infected or suspicious objects, including names of viruses or their modifications (suspicious objects are classified by suspicious codes by the heuristic analyzer), and the actions taken.
.topic 2155021456
Enable animation of the program icon in the Taskbar or not
.topic 2155021392
Enable logging
.topic 2155021393
Log all messages (not only infected) or not
.topic 2154628109
Select the log file's encoding
.topic 2155021358
Log file name
.topic 2154628099
Append logs to the end of the log file, or clear the log file at every Scanner's launch?
.topic 2155021484
Display the program's icon in the system tray or not
.topic 2156922020
Quantity of objects infected by modifications of viruses
.topic 2156921987
Quantity of removed objects
.topic 2156200944
Parameters - additional parameters (keys) to be processed at the given task launch. This field may be left empty
.topic 2156463284
This field is not used at present; the corresponding setting is specified by your key file and cannot be modified by you
.topic 2156200943
Path - the full path and the name of the executable file. You can enter the path and the name of a specific folder in the entry field, or click the button on the right to select it in the standard Windows folder tree. This field is obligatory to fill in
.topic 2156463287
In this field, if necessary, specify the user password at the HTTP proxy server, via which you connect your computer to the Internet. Contact your system administrator for this data
.topic 2156463285
In this field, if necessary, specify the user name at the HTTP proxy server, via which you connect your computer to the Internet. Contact your system administrator for this data
.topic 2156921986
Quantity of renamed objects. The action to be performed over infected objects is set in the corresponding dialog box
.topic 2156921942
Quantity of objects containing riskware
.topic 2155152452
Maximum archives nesting level
.topic 2155152453
Maximum archives compression rate
.topic 2155152455
Maximum file size at unpacking
.topic 2155152456
Maximum message scanning time, if exceeded, the message is acknowledged unchecked
.topic 2155152517
Display a dialog box when an outgoing message is blocked (it is usually displayed by the mail program), or not
.topic 2156790878
Dr.Web Scanner for Windows (GUI-version) logo
.topic 2154562733
Select a scan mode: what files are to be scanned. Select the necessary option (for more details point the cursor at any option and left-click it)
.topic 2156922022
Scanning speed (KB/s)
.topic 2156921935
Scanning speed (KB/s)
.topic 2156921983
Scanning time
.topic 2156922018
Total quantity of scanned objects
.topic 2154628102
You can limit the log file size in the Maximum log file size area and set the maximum possible size value
.topic 2155611322
In the field below specify the addresses to be added to the black list.
.topic 2155611321
In the field below specify the addresses to be added to the white list.
.topic 2156921892
Quantity of objects containing adware
.topic 2156921887
Quantity of objects containing dialers redirecting modem calls to predefined paid numbers or paid resources
.topic 2156921890
Quantity of objects containing programs for hacking computers and other electronic devices
.topic 2156921888
Quantity of objects containing joke programs (threatening users and interfering with normal work)
.topic 2156921889
Quantity of objects containing riskware
.topic 2156922021
Total quantity of suspicious objects possibly infected by viruses
.topic 2156200942
Title - an arbitrary name of an added task. To simplify working with the Scheduler it is recommended to give meaningful names to tasks. This field is obligatory to fill in
.topic 2156463289
In this field specify, if necessary,  the HTTP proxy server address through which you connect your computer to the Internet. Contact your system administrator for this data
.topic 2156463282
This field is not used at present; the corresponding setting is specified by your key file and cannot be modified by you
.topic 2156463283
This field is not used at present; the corresponding setting is specified by your key file and cannot be modified by you
.topic 2154103972
Quantity of messages containing adware
.topic 2154103795
Total quantity of messages
.topic 2154103800
Quantity of deleted messages
.topic 2154103973
Quantity of messages containing dialers redirecting modem calls to predefined paid numbers or paid resources
.topic 2154103976
Quantity of messages containing programs for hacking computers and other electronic devices
.topic 2154103797
Infected messages detected
.topic 2154103974
Quantity of messages containing joke programs (threatening users and interfering with normal work)
.topic 2154103801
Quantity of messages moved to the quarantine folder
.topic 2154103799
Quantity of messages scanning of which was interrupted
.topic 2154103796
Total quantity of scanned messages
.topic 2154103975
Quantity of messages containing riskware
.topic 2154103802
Quantity of skipped messages
.topic 2154103798
Suspicious messages detected
.topic 2154103967
Quantity of messages containing adware
.topic 2154103891
Total quantity of messages
.topic 2154103896
Quantity of deleted messages
.topic 2154103968
Quantity of messages containing dialers redirecting modem calls to predefined paid numbers or paid resources
.topic 2154103970
Quantity of messages containing programs for hacking computers and other electronic devices
.topic 2154103893
Infected messages detected
.topic 2154103969
Quantity of messages containing joke programs (threatening users and interfering with normal work)
.topic 2154103897
Quantity of messages moved to the quarantine folder
.topic 2154103895
Quantity of messages scanning of which was interrupted
.topic 2154103892
Total quantity of scanned messages
.topic 2154103971
Quantity of messages containing riskware
.topic 2154103894
Suspicious messages detected
.topic 2154234856
The task list consists of the following columns:
    Title - arbitrary task name
    Next run - the date and the time set for the given task (or the value is blocked, if the task blocking was selected)
    Path - the full path and the name of the executable file
    Parameters - additional launching parameters (keys)
.topic 2156790838
Window for selecting the objects to be scanned
.topic 2159607810
Click the button to cancel the scanning and close the window
.topic 5
Click this button to apply the Cure action to the objects selected in the report list.
In the additional context menu, select an action to be taken if the curing fails. Use the hot keys to select objects in the list:
    Insert - select an object and move the cursor to the next position
    Ctrl+A - select all
    the * key on the numeric keyboard - invert selection
.topic 8
Click this button to apply the Delete action to the objects selected in the report list.
Use the hot keys to select objects in the list:
    Insert - select an object and move the cursor to the next position
    Ctrl+A - select all
    the * key on the numeric keyboard - invert selection
.topic 7
Click this button to apply the Move to quarantine action to the objects selected in the report list.
The infected files will be moved to a special folder (quarantine). The path to this folder is specified
in the program's settings (by default, it is the infected.!!! subfolder in the program's installation folder).
Use the hot keys to select objects in the list:
    Insert - select an object and move the cursor to the next position
    Ctrl+A - select all
    the * key on the numeric keyboard - invert selection
.topic 6
Click this button to apply the Rename action to the objects selected in the report list, i.e. to replace
their file name extensions in accordance with the program's settings (by default, the first symbol of the extension
is replaced by the # symbol). Use the hot keys to select objects in the list:
    Insert - select an object and move the cursor to the next position
    Ctrl+A - select all
    the * key on the numeric keyboard - invert selection
.topic 2156004395
Select all objects in the report list
.topic 2
The date and the time of the last update of Dr.Web virus databases
.topic 3
Number of signatures in a Dr.Web virus database
.topic 2154299393
It launches Dr.Web Scanner (GUI-version) to scan a single file or a group of files specified in the Scan path and mask entry field
.topic 1
To select objects in the report list the following keys and key combinations are additionally used:
    Insert - select an object and move the cursor to the next position
    Ctrl+A - select all
    the * key on the numeric keyboard - invert selection


 Hook mode

Automatic interception mode

In this window the automatic interception mode settings are specified.

The list of intercepted addresses of mail servers by default contains four lines. In the first line any addresses on port 143 (standard IMAP4 servers) are set, in the second line – any addresses on port 119 (standard NNTP servers), in the third line – any addresses on port 110 (standard POP3 servers), and the fourth line – any addresses on port 25 (standard SMTP servers). The list can be edited.

The Test interception functionality at every starting check box is selected by default, in this case the program is instructed to test the automatic interception functionality. If automatic interception of at least one connection fails, select the manual interception mode.

For more details on the settings specified in this window click the corresponding area in the picture.

Setting manual interception mode

In this window the manual interception mode settings are set.

The list of intercepted addresses consists of entries setting a correspondence between the program's port, a server's address and a server's port. The list can be edited.

The program's port numbers in the list must begin with 7000 and follow in ascending order.

If you switch from the automatic to the manual interception mode, then it is also necessary to adjust the mail client's settings. Enter “localhost” in the incoming and outgoing mail server address fields and change ports to the corresponding SpiDer Mail ports. E.g. if a server pop.mail.ru and port 110 are set to SpiDer Mail port 7000 then the mail client's settings must be as follows: incoming mail server – localhost, port – 7000.


 Additional settings of search modules

Additional settings of search modules

Top

In this window additional settings for search modules are specified.

For more details on the settings and actions specified in this window click the corresponding area in the picture.


 Automatic hook mode

Automatic interception mode

Top

In this window the automatic interception mode settings are specified.

The list of intercepted addresses of mail servers by default contains four lines. In the first line any addresses on port 143 (standard IMAP4 servers) are set, in the second line – any addresses on port 119 (standard NNTP servers), in the third line – any addresses on port 110 (standard POP3 servers), and the fourth line – any addresses on port 25 (standard SMTP servers). The list can be edited.

The Test interception functionality at every starting check box is selected by default, in this case the program is instructed to test the automatic interception functionality. If automatic interception of at least one connection fails, select the manual interception mode.

For more details on the settings specified in this window click the corresponding area in the picture.


 Setting manual hook mode

Setting manual interception mode

Top

In this window the manual interception mode settings are set.

The list of intercepted addresses consists of entries setting a correspondence between a program's port, a server's address and a server's port. The list can be edited.

The program's port numbers in the list must begin with 7000 and follow in ascending order.

If you switch from the automatic to the manual interception mode, then it is also necessary to adjust the mail client's settings. Enter “localhost” in the incoming and outgoing mail server address fields and change ports to the corresponding SpiDer Mail ports. E.g. if a server pop.mail.ru and port 110 are set to SpiDer Mail port 7000 then the mail client's settings must be as follows: incoming mail server – localhost, port – 7000.

For more details on the settings specified in this window click the corresponding area of the window in the picture.


 Advanced scan settings

Advanced scan settings

Top

In this window advanced e-mail scan settings are fixed. The major part of the settings specify the conditions under which too complicated messages (their scanning is too time consuming) are admitted as unchecked.

The Show virus alerts for outgoing mail check box is selected by default. The program generates a message box notifying of the denial to deliver an infected message to an SMTP server. As a rule, the same message is generated by the mail program; in such case the check box can be cleared.

For more details on the settings and actions specified in this window click the corresponding area in the picture.


 Spam settings

Spam settings

Top

If you use IMAP/NNTP protocols, configure your åmail client to download complete messages from the e-mail server at once – without previewing their headers. This is important for correct operation of the spam filter.

The following headers will be added to all scanned messages:

· X-DrWeb-SpamState: Yes/No. Yes shows that the message is spam. No says that SpIDer Mail® does not regard the message as spam.
· X-DrWeb-SpamRate: n. n — a number in the range from -5000 to 5000; the threshold value is 100 (if n is above the threshold, the message is treated as spam, if n is below the threshold, the message is not spam).
· X-DrWeb-SpamVersion: version. version – version of the Vade Retro spam filter’s library.

A selected Add prefix to the subjects of the spam messages check box instructs SpIDer Mail® to add a special prefix to the subjects of spam messages. This prefix can be specified in the field below. Using a prefix will allow you to create filter rules for spam in those mail clients (for example, MS Outlook Express), where it is not possible to enable filtering by headers.

A selected Allow Cyrillic text check box instructs the spam filter to analyze messages with Cyrillic encoding. If the check box is not selected, it is highly possible that messages with Cyrillic encoding will be regarded as spam.

The Allow Chinese/Japanese/Korean text check box functions the same as described above.

In the White list and Black list fields, white and black lists of senders’ addresses are specified.

· If the sender’s address is on the white list, the message is not scanned for spam. But in case domain names of the recipient and the sender coincide, and this domain name is on the white list with the "*" symbol, the message and its content will be scanned for spam.
· If the sender’s address is on the black list, the message will be automatically regarded as spam.

Addresses must be divided by the ";" symbol. The "*" symbol can stand for a part of the address (for example, *@domain.org denotes all addresses with the domain.org domain name).

If the spam filter wrongly regards certain messages as spam, you are advised to forward such messages to special e-mail addresses for analysis. It is designed to improve the spam filter's performance. Messages which are wrongly regarded as spam should be forwarded to vrnonspam@drweb.com, and unblocked spam messages should be forwarded to vrspam@drweb.com. Forward the messages as attachments. Do not include them to the message body.

For more details on the options specified in this window click the corresponding area of the window in the picture.


 Statistics window

Statistics window

Top

Information about the program's performance during the current session is displayed in this window: the number of checked, infected, suspicious and other objects and the actions taken.

To close the window, click OK.


 About … window

About … window

Top

This window contains information about the developers of the anti-virus, program versions (the engine and the components), virus databases, the license key and its owner, and the date of the last update.

Click the [image] button to visit the web site of Doctor Web, Ltd.

Click OK to close the window.

For more details on the settings and actions specified in this window click the corresponding area in the picture.


 Scan path and mask window

Scan path and mask window

Top

Enter the path to the folder and the mask for the files to be scanned. If no mask is specified, *.* is applied. Files matching the mask are additionally scanned according to the criteria specified in the File types tab.

For more details on the settings and actions specified in this window click the corresponding area in the picture.


 Automatic Updating Utility Window

Automatic Updating Utility Window

Top

The automatic updating utility run according to the schedule operates in the “invisible” mode. If the utility is run explicitly, namely, if you click Update on the File menu in the Scanner’s main window or Update in the context menu of the SpIDer Guard's or the SpIDer Mail's icon, the module's performance is displayed in the automatic updating utility window.

Click the [image] button to start the updating procedure.

If you want to terminate the downloading of files, click [image].

If the updating terminates due to a connection error, a corresponding message is displayed in the window. In such case, click [image] to close the window, check the availability of Internet connection and run the updating again.


Registration Data Confirmation

Top

Check that the data you have entered are correct. If so, click Next. Otherwise, click Back.

To exit the updating utility, click Cancel.

Next

Back


Obtaining a Demo Key File

Top

Information about the procedure of obtaining a license key file is displayed in the Status field.

If the key file is successfully received, a message with the location of the key file will be displayed in the Status field.

Click Finish to update the virus databases and upgrade the package files. As a rule, this procedure does not require user's active participation.

If obtaining a key file fails, an error message will be displayed in the Status field.

Click Back to correct the input data.

To exit the updating utility, click Cancel.


Serial Number Entry (2)

Top

If you have already used a licensed version of Dr.Web anti-virus for Windows 95-XP for not less than 6 months, enter your registered serial number or provide the license key file in the corresponding fields of the window.

If you have entered a license renewal serial number in the Registration: Step 2 window, the window will look as follows:

Otherwise, the window will look as follows:

Next

Back


Registration Data Entry

Top

To receive a key file, type the personal data (name, surname, e-mail address), select the country from the drop-down list, type the city name. All the fields listed are obligatory and should be filled in.

If you want to receive news about the Dr.Web anti-virus by e-mail, select the corresponding check box.

Click Next. A registration data confirmation window will open.

To exit the updating utility, click Cancel.

Back


Obtaining a License Key File

Top

Information about the procedure of obtaining a license key file is displayed in the Status field.

If the key file is successfully received, a message with the location of the key file will be displayed in the Status field.

Click Finish to update the virus databases and upgrade the package files. As a rule, this procedure does not require user's active participation.

If obtaining a key file fails, an error message will be displayed in the Status field.

Click Back to correct the input data.

To exit the updating utility, click Cancel.