DrWEB and Windows XP

[Mongol]

Im a McAfee Viriusscan 8 user and like it but wish it had more functionality and dont care for it heavy handed marketing. I uninstalled it and am giving DrWEb 4.31 a trial run. I was wondering if it is fully compatible with Windows XP and what y'all thought of it overall. I remember reading something about it not handling XP files very well. It seems to be a very complete program and light on resources...

[tahoma]

hi
imho drweb is only surpassed by kav. has run nicely on my xp machine for years until i switched to kav5 a few months ago. never heard anything about it not handling xp files well...nor expierienced it

[Mongol]

Thanks for the response. So far I havent noticed any problems at all but somewhere in my recent past I remember reading about DrWeb having problems with the files on XP. Im quite pleased with the program and its configurability. Looks like it may be a keeper for me.....

[Blackcat]

{QUOTE-> So far I havent noticed any problems at all but somewhere in my recent past I remember reading about DrWeb having problems with the files on XP. Looks like it may be a keeper for me..... <-QUOTE}
this was discussed here;

http://www.wilderssecurity.com/showthread.php?t=35141

The NT SpiderGuard when in 'smart-mode' does not check files when they are executed.

In other than "smart" mode all files will be scanned. However, use "run and open" and "create and write" instead of smart mode, and it will take for ever for every program to open. That's the reason why smart mode is the default setting in Spiderguard.

But one way round this is to make sure you scan EVERY new file coming in to your system manually and back this up with regular scanning using FULL settings of the Dr Web on-demand scanner.

I have used Dr Web as my main scanner on one of my NT computers here for over 2 years now and so far it has not let anything through. Choosing your main AV and the settings of the running Monitor will always be a balance between protection AND performance.

[bellgamin]

DrWeb has given me bullet-proof protection for nearly 1 year. If you decide to buy a license, I recommend you do it at HERE (http://esd.element5.com/product.html?productid=502727). You get it for $29. They are a bonefide DrWeb reseller. In fact, your license code will come from the DrWeb folks.

The advantage of using the above reseller is that, when you renew {a year later} you can do it HERE (http://esd.element5.com/product.html?productid=507463) for only $20!!!

NOTE: The above links were given to me by the estimable Blackcat when, under another thread (http://www.wilderssecurity.com/showthread.php?t=42637), I was bemoaning my inability to renew at a good price.

[Mongol]

Thanks for the replies to all. Im giving it serious consideration. Do I finish up my 6 months with McAfee which has top notch detection rates or go with this little gem DrWeb. HMMMMMMMMMMM....... ;D

[Blackcat]

'If it aint broke'. If McAfee is running well on your system then carry on using it. Then near to its renewal time you can decide whether to stay with this AV or change over to Dr Web.

McAfee has one of the best engines and is one of the few AV's together with Dr Web that offers excellent protection against viruses AND trojans.

If they both run well on your computer, it will come down to personal choice in the end. And in 6 months time you may well have to choose between NEW versions of both programs.

Stay put for now ;)

[AMRX]

dear Mongol, don't worry about the SMART scan as it is really smart. just remember to do full system scan every week. it is because of this smart scan DrWeb is very very resource friendly. but let me tell you that Spider Netting is disabled in NT platform. so you won't get the same protection as in 9x platform.

[Mongol]

I noticed that about spider netting on the webpage. With the new build expected soon maybe it will be enabled for XP and our prayers will be answered...nudge-nudge

[AgentX]

DrWeb is undoubtedly a decent programm. But some quirks associated it with
really annoy me. For example, when a manually modified (coded in hex) Ivan.exe
is executed, SpIDer Guard reboots my XP system. Remember that SpIDer Guard
is running with default settings, i.e Smart scan enabled. It shouldn't check the
executables when they're executed ...but somehow it manages to do that in
this case.

The included file is a binary Ivan.exe, hand coded in assembly by some Russian
assembly language hacker. It is NOT a virus, a trojan or any malicious piece of
code. It was coded only to demostrate how small a Win32 PE can get. Due to
the uploading restrictions, I'm forced to upload it as a text file.

SpIDer Guard is the only program so far which reboots my system upon execution
of this little and harmless program. Other scanners like NOD32, F-Prot and
Command flag it as unknown WIN32.CRYPT virus, heuristically ...probably
because of the incomplete and purposely edited PE header.

I'll repeat once again, DrWeb and SpIDer Gaurd must be rewritten with
extreme care and with Windows 2000/XP/2003 systems in mind to be able to
get more users in close intimacy with the program.

Regards,
AgentX

[AMRX]

dear AgentX, when your system reboots? when you run Ivan.exe or when you run a modified Ivan.exe? DrWeb will surely check the file when it is modified and run provided SpiderGuard should be running in the background.

[AgentX]

It reboots when executed. I know that Smart Scan option checks files when are opened
for reading and writing, but it is rebooting when it shouldn't.

Regards,
AgentX

[AMRX]

well i never got that file to run on my Windows ME. yes DrWeb sometimes reboots.

[Mongol]

Well after a couple of weeks giving DrWeb a trial run and seeing it bag a few viruses and trojans I decided to get the license key. A very impressive program indeed. McAfee's a nice program but that annoying splash screen and hideous security center drew me away. Throw in the popup ridden website and you know what Im typing about... 8)

[Ailric]

No splash here! I used Regedit and did this:
Goto-
HKLM\Software\Microsoft\Windows\CurrentVersion\Run and modify the string value MCAgentExe to:
c:\PROGRA~1\mcafee.com\agent\mcagent.exe /nosplash

[Blackcat]

{QUOTE-> Well after a couple of weeks giving DrWeb a trial run and seeing it bag a few viruses and trojans I decided to get the license key. <-QUOTE}

Good choice, Mongol ;)

Will you be keeping McAfee as a secondary backup scanner?

I only ask as Dr Web is known to be sensitive to other AV's installed on the same system.

[Mongol]

I dont think so, DrWEB seems more than capable by itself and hasnt let me down. I scan all files and set it to do twice a week thorough scans. I am looking at backing it up with Trojan Hunter though, just as a precautionary safety net..... 8)

[Mongol]

I should add that I use Sygates latest Version 5 firewall, really nice. I had used Look N Stop Version 2.05 but for some odd reason DrWEB keeps picking up SQL Slammer in the firewall even though I set the scanner to ignore its folder. It keeps deleting it and killing the firewall. I wonder if its something with the driver. Maybe I should email them and see if they have some theory to what this might be. ;D