Dr. Web v.4.33 problems

Thank you Firefighter, another way to avoid slowdown.

Putin

 

Hi
(Caveat here...don't shoot)
I have some questions that someone versed with Dr. Web can answer.
1. With the previous version (4.32b) I could d/l the "beta" spyware defs and load it in the Dr. Web folder (drnasty and another one..don't remember the name now). With the new version 4.33, do I still need to d/l and install these extra files or are they included with the regular updates?
2. Sometime ago someone (I am not sure if it was shorty1) gave an instruction for the ini file that would make the Dr. Web updates more immediate to be shown, instead of waiting for 2 mins, the changed line allowed only 5 seconds. Does anyone have those instructions?
P.S. I did a search but was unable to find it.
3. Is the default for Spider Guard
Scan Options (Smart & Disable Enh. Prot. Mode)?
What is "Enhaced Prot. Mode"?
File Types (By Format)?
What is the difference between "By Format" and "All Files"?
Thanks
Cheers

 

Putin

 

The update value in the ini file is in minutes so 5 seconds is not possible, nor would it be desirable for that matter as far as I am concerned.
As for the enhanced protection mode I believe it protects the drwb32.ini file from unauthorized modification but I have no direct confirmation of this. Truthfully, I am assuming this because one of the changes in 4.33 was that the ini file could be protected from modification and so I am assuming that is what "Enhanced Protection Mode" means.

P.S. Here is the original thread on changing the update period in the ini file.
https://www.wilderssecurity.com/showthread.php?t=54826

edit: spelling

 

To putin and shorty1
Thanks
Cheers

 

Just had to try the new Dr. Web after I had problems with my binary files.
(I had to reboot before I could do anything with 4+ Gb (gigabyte) files).
I now have no problems with these files; can move them, delete them etc without any problems.
It is lighting fast and gives me no problems.

 

That's great news and maybe you could let us know what the engine number is? And what are your settings in Spider Guard?

Putin

 

I have 4.33.0.09273.
Everything is default; I have changed nothing, only in spidermail from delete to move.
In spider guard I have
enabled smart
enabled disable enhanced protection mode
enabled scan boor floppy
enabled scan running program and modules
enabled enable heuristic analysis
and file types scan by format
changed no ini files etc

 

Ok, looks good and now I wonder why you don't have trouble with these very large files. I'll check my sons computer now with Dr. Web running and see what happens now.......

Putin

 

Binary files are a different story. Just tried again with an exe file of 31Mb and it is still terrible, no change at all.........took 3 minutes to delete. Spider Guard unpacks and scans......To avoid all this, is to uncheck archive scanning, but why do I use an AV scanner??
So.....nothing heard from support yet and I definitely made the switch tonite to the scanner I trialled. Keep Dr. Web on my son's pc till licence is runs out. I'm just very diasappointed, that these matters were not noted when testing the Beta.

Like Blackcat said on the Dr.Web forum: " I am sure that the incompatibilities found in the new version could have been picked up easily by a more thorough beta-testing program which users of the AV would have been more than willing to participate in."

Putin

 

I agree. It seems strange to me that they never released a beta version for workstations but did release betas for 2003 server and the enterprise versions.. But then, after reading a news bulletin on their site, it made me wonder if maybe there was internal pressure to the release 4.33 so as to be out in time for the International virus conference in Dublin, Ireland on Oct. 5-7. If you recall, 4.33 was released about one week prior to this on 9/27.
Anyway, that is merely speculation on my part and I've been known to have a overly suspicious mind.
The only responses I have seen on the forums were along the lines of that the beta release didn't matter because only about 1 percent of beta testers actually give feedback.
The bottom line is that it's released. We know they are working on it so, hopefully, they will release a corrected version soon.

From drweb.com:

 

Blackcat made two extremely significant posts at the DRW forum...

#1- he reported DRW's poor showing at Comparative's latest tests.

#2- he questioned as to why there was not more beta testing, & why it was not *more open*.

Could it be that the answer to #2 lies in the answer to #1? In other words, at least part of the reason why DRW rushed to release was because 4.32b's detection rate had fallen behind other AV's.

In any event, the main thing I find worrisome is the VERY rare participation of DRW personnel in their own forum.

 

Testing further.
With me copying a 50 mb exe file also takes ages.
There is something wrong.

 

Pretty much the same here. When copying or deleting I usually disable the program til I'm through...for now...

 

Just definitely removed Dr. Web from all of our home computers......support does not react whatsoever and this is the end for me!
Too bad, as I really liked the program, but I have to renew my licence within a few weeks and just won't if I don't hear anything from support.

Hope they will sort things out and who knows.......will I ever buy Dr. Web again!

Putin

 

Sorry to hear you had to leave the Doctor and have to admit I am in a similar situation with license renewal just 3 weeks away. Customer supports lagging response is a bit troubling so I may also be headed down another path. I give them about one more week. Counterspy's very buggy and RAM hungry new version drove me to their competitors software just last week. And their new version is running along swimmingly here...I won't name names but it has "spy" in it...oops...

 

It's very hard to believe that the others just can't get the SpIDer Guard settings to work. Am I really the only one that has no problems now with SpIDer Guard in here? Here are my main settings to "actions" and "excludes" in my SpIDer Guard. In "actions" I have the same settings with Adware & Dialers and the same too with Jokes, Riskware & Hacktools.

The other SpIDer Guard settings I have, scan "smart", "Disable enhanced protection mode", "Enable heuristic analysis" and scan files "By format". I have added some limits to my "drweb32.ini" file too, to [SpIDerGuardNT] section I added

MaxFileSizeToExtract = 25000
MaxFileSizeToScan = 40000

Best regards,
Firefighter!

 

Good post Firefighter, your settings and the visuals helped me smooth a few things out here. The Doctor is running more like I remember, nice, secure and light...cheers...

 

I understand you have unchecked the 'archive scanning' in Spider Guard? Therefore you don't have the problems I had........I bet, as soon as you let Spider Guard also scan archives and you copy/move these large exe files, you'll have the same trouble! You have also added the recyclebins to the exclusions, so deleting these files isn't a problem either.
But I keep on calling: This is not the proper way to configure an AV scanner!
I use an AV scanner that should be able to scan archives at a normal scanning speed and just for speeding up things, I shouldn't have to disable this option. Also about not scanning files to be deleted.........I have never ever had to exclude recyclebins when using an AV scanner.
This really is a problem within Dr. Web 4.33 as it was not acting up within 4.32 and prior to that.
I refuse using an AV scanner, as where I have to make some crazy configuration in order to avoid a terrible slowdown when copying/moving or deleting files.

You state now: "That it's very hard to believe that the others just can't get the SpIDer Guard settings to work. Am I really the only one that has no problems now with SpIDer Guard in here?" and that's not really fair, as you have excluded and disabled things that normally shouldn't.

Also putting restrictions in the ini files should not be needed, when an AV scanner is working as it should!

I had the Sipder Guard settings just the same and that does not solve the slowdown problems. The slowdown problems are solved when you disable archive scanning, adding the recyclebins to the exclusions and adjusting the drweb.ini.

The big silence from support is a bad thing as well and I'm not the only one feeling this way.

I have dumped Dr. Web already, but I still think I should state this!
I have bought Nod32, I never even came close to doing so, but comparing this product now with Dr. Web, I have never seen such a smooth AV scanner.

Good luck! Putin

 

No, there are several Dr Web users here who are having problems with the new version. And since you have checked over on their Russian forums then you will know that we are not the only ones.

I think that FF was trying to say that he has had no problems with SpiderGuard with HIS settings on HIS machine.

Sorry to hear that you have dropped Dr Web, putin, but glad to hear that you have found an AV which suits you and your machine. NOD is very stable, light and will give you good protection and with BlackSpear and company here at Wilders, you will receive much better support than from DW.

 

Too too true! That's why NOD32 is on my short list in case DRW goes belly-up.

I DO expect DRW to fix its problems in the near future. The DRW folks are great with respect to technical skills, even though it seems they are very poor as to business management, customer relations and tech support.

 

Support has posted on their forum that a corrected version of Spider Guard NT is planned for Monday. That message was posted yesterday.
I anticipate/hope that the issues with high CPU usage have been fixed with this release.
While I have been lucky in that I haven't had any issues with the 4.33 release I certainly can understand the resentment others are feeling. I hope that some of those that had troubles with the current 4.33 will at least try the corrected version to confirm that the issuse have indeed been corrected. Regardlees, of course, if they have switched faith.

For the record, I have Spider Guard set to scan archives and by format with no size restrictions and I don't have any problems deleting large files of any type. The only time I see high CPU is when I enable "scan running programs and modules". I don't know if this is a bug or not but I hope they do something about it in this release though I am not counting on it.

The good news, as I see it, is that many users are experiencing the high cpu problem and with that in mind they should be able to reproduce it and if the can reproduce it they ought to be able to fix them.
Also, I see a post that the corrected version includes, "restriction of the size will be cleaned in next fikse"... Of course that is the English translation of the post but I take it to mean that the setting for file size restriction will be in the gui in the new release so editing the ini file won't be necessary in regard to file size restriction anyway. I could be wrong on that translation though.

 

Thanks for for the heads up, shorty.

Unfortunately, it has arrived too late for some users like putin.

 

May I have missed something special. I don't understand why archive scanning and recycle bin scanning in real time are so important? They don't make any risk in my mind, because SpIDer Guard is still protecting against runtime packed malware!

Best regards,
Firefighter!

 

All I mean to say is, that it shouldn't be needed to disable these functions, in order to get rid of the terrible slowdowns. Recycle bin scanning isn't important, but Dr. Web 4.33 made it important.....as it scanning this and I never asked for it! When deleting files, it should not be slowed down by Spider Guard!

Good luck!
Putin