Dr.Web for Windows

Dr.Web for Windows incorporates the following components:

Dr.Web Scanner for Windows is an antivirus scanner with graphical interface. The program is launched at a user’s request, or as scheduled, and performs a computer antivirus scanning. There exists also a program version with the command line interface (Dr.Web Console scanner for Windows).

SpIDer Guard for Windows is an antivirus on-access scanners (also called as monitor). It constantly resides in memory scanning the files “on the fly” detecting any viral activity.

SpIDer Mail for Windows workstations is an antivirus mail scanner. The program intercepts requests of any mail clients to mail servers via POP3/SMTP protocols, detects and neutralizes viruses spreading through email before they are received by the mail client from the server, or before the message is sent to the mail server.

Dr.Web automatic updating module for Windows allows the registered users to receive virus database updates and Dr.Web program modules, and automatically installs them.

Dr.Web Scheduler for Windows makes it easier to schedule repeated tasks such virus definitions updates.

An antivirus scanner for DOS environment and some other auxiliary programs are also included into Dr.Web for Windows package.


License key file
The license key file

User’s rights to use the antivirus are specified in the key file. The following information is contained in the key file:

list of antivirus components licensed to the user;

product license term;

virus definitions automatic updates period (also called the “subscription period” and may not be equal to the license period);

other restrictions (i.e. the number of protected PCs, etc.).

The key file has the key extension and must be located by default in the installation directory.

The key file has a write-protected format and therefore cannot be edited. Editing the file makes it invalid. That is why it is not recommended to open your key file with a text editor which may occasionally corrupt it.

Users who have purchased the antivirus with Doctor Web’s certified partners obtain a license key file. The parameters of the key file are specified according to the license the user has paid for. The license key file contains the name of the user (or a company name), and the name of the selling company.

For evaluation purposes users may also obtain demo key files. Demo key files allow to take advantage of the full functionality of the program and the virus definitions updates, but have a limited term of use and no users’ support is provided.

The key file may be supplied with a key extension, or as a zip archive containing the key file. It may also have a dwz extension, which is used by the Dr.Web programs to automatically install the antivirus package updates.

The key file may be obtained in one of the following ways:

downloaded from the vendor’s web-server. At the end of the installation procedure, when updating the virus definitions bases for the first time, the user is invited to get registered and to input the registration serial number supplied with the product at the time of purchase. The license key file is then downloaded by the updating utility and saved into the Dr.Web’s working directory. If the user fails to supply the serial number, a demo key file may be obtained from the server.

included into the distribution package.

sent over to the user by e-mail as an attachment with the dwz extension. In that case the user should double-click the attachment icon to automatically install the key into the right location.

supplied on a media as a file with the .key extension. The user should copy it into the Dr.Web installation directory manually.

supplied as a zip archive containing a file with the key extension. The user should extract the key file using the respective archiving tool (WinZip or Pkunzip) into the Dr.Web installation directory.

If no key file has been obtained, or the present one has expired all antivirus components are disabled. The user may only launch the automatic updating utility to register and to obtain a key file.


Dr.Web OS requirements

The Scanner (GUI-version and the console version for Windows), as well as SpIDer Guard function in PCs operated by Windows 95/98/Me or Windows NT/2000/XP operating systems. The minimum program requirements match those for the respective OSs.

The DOS Scanner works under MS-DOS, or in the Windows command line mode. The computer has to fully support i80386 processor commands system.

All the security patches recommended by the OS developer must be installed. If the OS version is not supported any longer, you should upgrade it.


To scan only created or changed files on the fixed disks (hard drives partitions of PC), to check all opened files on removable disks (diskettes, compact disks). Thus, the files on the fixed disks are checked only once when they are created (or changed)


Scan all the files opened for reading and launched programs?


With the Create and write files checkbox selected the new created files are checked, as well as files opened for editing. The launched programs are not scanned


Enable heuristic analysis?


Control the virus activity? This mode instructs the program to trace and block actions associated with viruses. The virus itself may not be detected by the virus base, or even by the heuristic analyzer. If such activity is traced, the program will terminate suspicious application and open the dialog notifying about it. User will be asked to choose the action for this event


Check at the system shutdown whether a floppy is left in the disk drive, and, if positive, to scan it for viruses (if the floppy is infected a PC may get infection at the next loading)


The System kernel protection checkbox is not selected by default. It was done to ensure the compatibility of the program with applications using the "virus-like" technology (i.e. HASP keys)


By default, the program is automatically loaded at the Windows start. To disable this option deselect the Load at startup checkbox. After the Windows reboot the program will not be automatically loaded


Chose this option to enable scanning of all files (except for those excluded from the scan). The selection of this option considerably decreases the computer performance


This option instructs to check only those files the internal format of which allows an implantation of viruses. This mode is enabled by default


This option instructs to check only those files the extension of which is specified in the extensions list


This option enables scanning of those files only the extensions of which correspond to file name masks


Select the checkbox to scan files in archives (this scanning may considerably slowdown the computer performance)


Select the checkbox to scan files compressed by executable files’ packers (we strongly recommend to select this checkbox, as overwhelming majority of modern viruses pack their executable files.)


Select the checkbox to check mail boxes of email clients. This check may considerably slowdown the computer performance and possibly result in conflicts in mail clients; that is why we recommend to check the mail traffic with the SpIDer Mail monitor before the mail client receives the mail, or use the Doctor Web scanner for scanning email files


Add button of the File types pane
If this button is pressed, the extension or the mask of files specified in the left field is added into the list


Remove button of the File types pane
If this button is pressed, the selected file extension or the mask are removed from the scanning list


List field
Depending on the type of the scanning chosen, the extension of the file name, or the mask for scanning can be input into the entry field.

The list contains the file names masks and files extensions to be scanned by the guard. The masks can have special symbols * and ?


Default button of the File types pane
Press this button to restore the default list (the list will contain main extensions of executable and archived files)


Moves to the dialog with the reaction to the infected objects program settings


Moves to the dialog with the reaction to the incurable objects program settings


Moves to the dialog with the reaction to the suspicious objects program settings


The selection of this option (set by default) instructs the guard to halt all applications and open the window requesting a user’s further reaction


The selection of this option (available only if the Infected objects button is pressed) instructs the guard to try to cure the objects infected by the known viruses. If the virus is incurable, or the attempt of curing failed, the action chosen with the Incurable objects button is made


This option instructs to delete the infected or suspicious files (there will be no actions for boot sectors). Attention: this is an automatic action. No confirmation will be requested from the user!


This option instructs to rename the extension of infected or suspicious files as per the mask specified in the entry field on the right (there will be no actions for boot sectors). Attention: this is an automatic action. No confirmation will be requested from the user!


This option instructs to move the infected or suspicious files to the directory specified in the entry field on the right (there will be no actions for boot sectors). Attention: this is an automatic action. No confirmation will be requested from the user!


This option instructs to lock access to a file the guard has reacted to. Locking access to the file is disabled at the next computer reboot only


This option instructs to ignore suspicious objects


This option instructs to immediately terminate the Windows session if the object is detected (in some cases the virus activity may hinder proper shutdown). It is recommended to delete the virus with the help of Dr.Web for DOS run from a protected disk


Specify the file names extension mask after renaming in this entry field. By default, it is #??, which replaces the first extension symbol with #


Specify in this entry field the name of the directory the detected file will be moved to. By default, it is the INFECTED.!!! subdirectory, resided in the package installation directory. To select the directory in the standard Windows directory tree press


Enable sound effects associated with the program events?


Specify the name of the directory the detected file will be moved to. By default, it is the INFECTED.!!! subdirectory resided in the package installation directory. To select the directory in the standard Windows directory tree press


Infected archives button of the Archives pane
This switches to the window of setting up the handling of infected objects detected in the archived files


Infected mail button of the Archives pane
This switches to the window of setting up the handling of infected objects in mail files


Infected containers button of the Archives pane
This switches to the window of setting up the handling of infected objects detected in file containers of the ActiveMIME (MSO), PowerPoint, HTML, OLEMessage, RTF formats


Report option of the Archives pane
This option enabled (set by default) instructs the guard to halt all applications and open the window requesting a user’s further reaction


Rename option of the Archives pane
This option instructs to rename the extensions of infected or suspicious file names as per the mask specified in the entry field on the right Attention: this is an automatic action. No confirmation will be requested from the user!

Attention: this action is applied to the whole archive which may contain hundreds and thousands of files!


Move to a special folder option of the Archives pane
This option enables moving of infected and suspicious files to the directory specified in the entry field on the rightAttention: this is an automatic action. No confirmation will be requested from the user!

Attention: this action is applied to the whole archive which may contain hundreds and thousands of files!


Lock option of the Archives pane
This option locks access to a file the guard has reacted to. Locking access to the file is disabled after the computer reboot only


Ignore option of the Archives pane
This option instructs refrain from any action when a suspicious object is detected


Shutdown option of the Archives pane
This option instructs to immediately terminate the Windows session if the object is found (in some cases due to the virus activity the correct shutdown may be impossible). It is recommended further to Delete the virus with the help of Dr.Web for DOS run from a protected disk


The selection of the Rename option instructs to replace the extension of the file name with that specified in the entry field on the right of this radio button. By default, it is #??, i. e. the first extension symbol is replaced with #. You can also add your own variant into the entry field.


The selection of Move to a special folder instructs to move the infected file to the directory the name of which is specified in the entry field on the right of the checkbox. By default it is INFECTED.!!! (created in the directory you have installed the program to). You can yourself specify the path and the name of the directory, or select it in the standard Windows directory tree. Press [image] on the right of the entry field


Directory selection button for the Move to a special folder option in the Archives pane
Specify the directory the detected files will be moved to. By default, it is INFECTED.!!! created in the installation directory of the program. To select the directory in the standard Windows directory tree press


Delete option of the Archives pane
If this radio button is selected, the program will be instructed to delete the infected or suspicious files. Attention: this is an automatic action. No confirmation will be requested from the user!

Attention: this action is applied to the whole archive which may contain hundreds and thousands of files!


Keep the log file?


Specify the path and the log file name in the entry field and press [image] to select this file in the standard browsing for a file window


Specify the path and the log file name in the entry field and press [image] to select this file in the standard browsing for a file window


Append new entries to the log file


Keep logs in ANSI (Windows)


Overwrite the log file at the guard’s launch


Keep logs in OEM (DOS)


Log the names of all scanned objects (not only the objects the program has reacted to). This will considerably increase the log file


Log the checkbox to add the names of packers of the packed executable files


Log the names of archivers of the scanned archives


Limit the log file size (specify the maximum file size in kilobytes in the entry field)


Limit the log file size (specify the maximum file size in kilobytes in the entry field)


This drop-down list contains the paths to the virus bases. The base files with non-standard (different from .vdb) extensions and resided not in the package installation directory should be included into it


The list of paths to the virus bases contains the list of paths to the directories the virus bases reside, and every path ends with the file name mask *.extension. Originally, the list contains just one entry  — *.vdb (that means all files with vdb extension associated with main virus base and the updates in the Dr.Web directory)


It opens a standard window for browsing for a directory with the virus bases


Input the element you wish to add on the list and press Add


Select the object for deletion in the drop-down list on the right of the button and press Remove to exclude the object from the list


This drop-down list contains the directories to be excluded from scanning


The list contains the paths to the directories the files in which will not be scanned


It opens a standard window for browsing for a directory to be excluded from scanning


Specify the element you wish to add into the list and press Edit


Select the object for deletion in the drop-down list on the right of the button and press Delete to exclude the object from the list


The list contains the file names which will not be scanned


This drop-down list contains the file names to be excluded from scanning


It opens a standard window for browsing for a file to be excluded from scanning


Specify the element you wish to add into the list and press Edit


Select the object for deletion in the drop-down list on the right of the button and press Delete to exclude the object from the list


Total quantity of scanned objects (files and boot sectors)


The quantity of successfully cured objects


The quantity of objects infected by the known "standard" viruses


Total quantity of files deleted by your orders


The quantity of objects infected by modifications of the "standard" viruses


The quantity of objects renamed by your orders


The quantity of suspicious objects


The quantity of files moved by your orders


The quantity of suspicious actions noticed by the virus-like activity analyzer. Non-zero values may reflect both the presence of unknown viruses and the "suspicious" behaviour of certain specific applications


Quantity of access locks to the objects


Chose this option to disable automatic loading of SpIDerNT at a system start (With this option chosen, for the program loading /unloading you can use the Load and Unload buttons)


Chose this option to enable automatic loading of SpIDerNT at a system start. With this option chosen, the Load and Unload buttons and functions are not available


Terminate SpIDerNT (it functions only if the monitor was manually loaded)


Run SpIDerNT (it functions only if the monitor was manually loaded)


This field contains the information on the installation of the guard and its current status


Press this button to register SpIDerNT in the system as a service


Cancel registration of SpIDerNT in the system as a service


If necessary, specify the path to the directory SpIDerNT is installed


Open the window to browse for the directory SpIDerNT resides


Put an integer into this field specifying the number of files for which a piece of memory should be allocated. By default, this parameter equals to 100 and corresponds to about 25 Kb of the allocated memory for every logical drive. If the system has sufficient memory, it makes sense to increase this parameter to 500—1000


Select the checkbox to spare computer resources while scanning the network drives


Show the icon in the system tray in the Settings pane
Select the checkbox if you wish to display the iSpIDer Guard icon in the system tray; now a user can change the program’s settings via the Settings pane


In this area one or several checkboxes can be selected next to the events a notification will be sent via email and/or in the local network


Send notifications on the virus situation via email


Send notifications on the virus situation via the Microsoft messaging service


Ñïèñîê e-mail àäðåñîâ
A list of email addresses the messages on the selected events are sent to. The list depends on the notifications recipients’ list in the local network, and only one element can be chosen from these two lists (the buttons Edit and Remove are applied to it)


A list of messages recipients’ addresses in the local Microsoft network the messages on the selected event are sent to. The list depends on the email recipients’ list and just one element from these two lists can be selected (the Edit and Remove buttons are applied to it)


Add a new address to the list of the recipients to whom the notifications will be sent. The entry field for the address in the local address will be opened


Input the network address into this entry field (in Microsoft network) to which the message on the virus situation will be sent and press the OK button


Select the address you wish to edit in the email addresses list, or in the notifications recipients’ list in the local network and press this button. A window for editing an email address, or in the local network, analogues to the new addresses entry field, will open


Select the address you wish to remove from the list of email addresses, or from the list of notifications’ recipients in the local network and press this button


Infected object found checkbox
Send notifications on infected objects


Incurable object found checkbox
Send notifications on incurable objects


Suspicious object found checkbox
Send notifications, if a suspicious object is found


Virus activity detected checkbox
Send notifications, if the virus activity is detected


A list of the email addresses to which the messages on the selected events are sent. The list depends on the notifications recipients’ list in the local network and just one element can be selected from these two lists (the Edit and Remove buttons are applied to it)


A list of the recipients of messages in the Microsoft local network to which the messages on the selected events are sent. The list depends on the email addresses list, and only one element can be selected from these two lists (the Edit and Remove buttons are applied to it)


Specify the domain or the IP-address of the SMTP-server (the server of outgoing mail)


Specify the port used by the SMTP-server


Specify the address to which a notification on the virus situation will be sent (the To: field of the standard message heading)


Specify the address in this field which will appear in the notifications on the virus situation as the sender’s address (the From: field of the standard message heading)


Input the address into this field to which the mail program of the recipient of the message on the virus situation will send replies (the Reply-To: field of the standard message heading)