dr web 4.44 scan speed

I am still a licensed user of Dr Web but no longer run it as a primary AV. The reasons have nothing to do with the tests over at av-comparatives as most members here realise that most of this zoo malware will never come into contact with their machines.

My main reason is that Dr Web seems to be treading water/going backwards compared to other AV vendors.

In the late 90's Dr Web was considered one of the best choices as an AV, as apart from its low footprint, among its strengths was considered its strong heuristics, good unpacking engine and its great detection of polymorphic viruses, and trojans.

However, over time its strong points seem to have diminished. For example, with NT/2000/XP sytems, Spider-Netting did not work. Smart-mode is the only one that can be used with SpIderGuard as trying to use the "other" options to scan, "run and open" and "create and write" will take for ever for any program to open. The same heuristic engine is still being used with some minor tweaks and heuristic, polymorphic and trojan detection have all apparently dropped compared to other AV vendors.

The web-scanner, SpIderGate has still not appeared after extensive beta-testing and small bugs such as the common freezing after updating are still not fixed in the full version. And the sparse Help-File, IMHO, still needs a lot of work. A Vista-compatible version is as yet still in the beta-stage.

As Technodrome pointed out in a past post here, " there has not been any major changes to the code in a very long time".

The results over at av-comparatives per se are not critical for most users in choosing an AV; but comparing the results again suggest a falling AV. Compare Dr Web with AVG, Avast, and Avira for example; Dr Web last reached an Advanced award in 2005 ( on-demand). In contrast, Avira for example has reached the Advanced-level in seven out of the last 8 tests. Further, DW is the slowest in adding missed samples of all the vendors.

Overall, Dr Web is still a good choice as an AV, particularly for safe users on older machines.

So although most of the above points are due to the constraints of a small Company, I have moved on to other AVs, which have the same minimal effect on performance as DW. But more importantly, they appear not to be stagnating but improving in both features and perceived detection rates.

 

sure, i understand your comments, and i agree with alot of it.

but doesnt this change for 4.44 on tuesday?

i certainly understand drweb seem to be in 1st gear, they certainly have the resources to push it into 2nd or 3rd, but the new release with new .orgin detection of complicated malware, and the better removal is certainly a step ahead of 4.33

4.44 is an improvement on 4.33, and v5 will be an improvement on 4.44, so this is definatly the correct way.

I, like you blackcat, want it all quicker though

its been discontinued, a http scanner will still arrive for v5 though, unless they change this.

 

This specific issue absolutely drove me crazy. It appears fixed in the latest 4.44 release (at least as I've installed it - which is without SpiderMail - on my machine)

Blue

 

Has an avid drweb user I have to agree, Excellent post Blackcat. No Bullshit here.
Badcompany.

 

blue: yes i was told a while back, that issue will be fixed in 4.44

to be honest, i never really noticed it till someone posted about it, i checked and it did give a cpu spurt

 

I still don't understand why Dr.Web doesn't add an encrypted quarantine into v4.44....It should be a farily minor feature to implement, and lets face it - every good AV has an encrypted quarantine these days...

An encrypted quarantine has its uses, maybe Dr.Web doesn't agree on the use of such a quarantine?

 

ask em for it

you dont get anything without a little asking.

i still think 4.44 is only a product, because certain parts of v5 aint ready, maybe this is one of those things firecat.

 

I left Dr.Web because of support.
It was non-responsive via e-mail for me.

 

hello tester, did you try a support ticket?

i think support is no reason to leave an antivirus, it should be the antivirus itself, and nothing else.

what about norton, they dont have any do they?

 

Hi the Tester,
The support from drweb is second to none, i sent a e-mail last night ( Saturday.) to support at 20:00 and received a reply at 20:25.You must be taking about along time ago, When the support was not so good.
Badcompany.

 

C.S.J,

Basically anything a customer deems appropriate in rendering a selection is sufficient reason. That's the way this planet operates.

As for support, I also had a spell in which I thought DrWeb was being quite unresponsive. It turned out my ISP (Comcast) was filtering their attempts to contact me at the server level via originating IP address block. I discovered this by assuming, since they were located in Russia, that a block was possible and using a second, non-comcast account. The cause was not obvious since no notification appeared in my mail or screened mail inboxes. Dr Web had received notification of the bounce, but had no way to contact me - it was a perfect Catch-22.

Blue

 

yeah, isp spam filtering can be a b1tch, i always miss my ebay auctions because of it. *lol*

comcast, like my ISP Sky, offer free Mcafee, and to be fair, it aint too bad.

i havnt really tried 'email' but the support tickets are fantastic, so id recommend people to do that instead.

 

I can not say (mainly because I and neither you know) what impact it will have on the results, so it is yet not even sure that DrWeb has to expect any excuses - could even be that I have to expect excuses from Dr.Web. We will see how accurate it was.
Than what about the even more important tests like VB? They are also not always fool-proof and just 1 little error makes you fail to get the VB100 award (which peoples look at and spread results in forums when it gets released and not later when it gets amended):
http://www.virusbtn.com/news/2006/10_06_vb.xml
http://www.virusbtn.com/news/2007/04_18a_vb.xml
http://www.virusbtn.com/news/2002/07_29_vb.xml
http://www.virusbtn.com/news/2002/12_01_vb.xml
http://www.virusbtn.com/news/2004/02_28_vb.xml
http://www.virusbtn.com/news/2006/09_01_vb.xml
etc.

In case of false alarms, Dr.Web gets from us the samples weeks before we publish the results, giving them the opportunity to report in case a false alarm is not a false positive.
I am sorry that this time it took that long to get the DVD's with the misses, but you got if I remember correctly (at least the mails I have confirm that) 1 week before publication some ten tousands misses by FTP (mainly from those categories where you miss less). Not that it makes a difference, but as usual I did not get any report about that files. But at that time you did not know that DrWeb was going to be on place 17th.
But at least in the meantime you already detect over 7000 samples that you missed in August (compared to the 5 months you needed before to add this amount after the previous tests).

 

goooooood,

so far, Severyanin is keeping his word

 

It is a premium reason for me to leave an AV company. What good is 99.99 detection rate if you can't make it work properly on your computer and there is complete silence on the support side?

Softwin is starting to get on my nerve with the 2008 version on that account and if I drop them it will be because of that.

And at work we have Norton deployed on over 2000 computers, their v10 is causing us some problem and if we had not good support they would be out of there before the next renewal for sure, you can't leave 2000 workstations vulnerable(and some of the people working there are virus honeypot. Webmail is a scourge for that since we have no control over it.) Fortunately, we have good experience with Norton support so far(on the corporate side, dunno about the home version)

 

Let's hope they can maintain this increase in the addition rate of the missed samples. But for now this is a definite step in the right direction.

 

I am sorry to read this but to avoid mail exchange we introduced the online web-based support.
It is working, I believe, because many people of the company controll the tickets status and do their best to be responsive as possible.

 

Yes, everything that concerns the mail exchange is subject to filtering. We had many problems with our responses not coming to users, whit our licence numbers not reaching those who have paid for them.
We are trying to extend the support service to another, US-based server.
But then Russian users will not get our notification mails.

 

There will be a quarantine, managed in a special databse - not in the V5, probably, but in the Control Center which will be ready earlier than V5 (V5 is basically the new engine for all the products in the line, not just a desktop version).

The scanner speed is being revised now - looking for some external reasons not directly related to the engine.
The new SpIDer will be a wonder, I hope. It will be multi-threaded, with an ability to scan up to 4 files simultaniously on a workstation and much-myuch more on a server. This will be in 4.44.

Mobile solution for Windows Mobile is about to be released in beta (we are too busy now to work on this beta these days).

 

very good news,

there you go firecat

ask, and they respond *lol*

 

It was 2004.
According to your experience they have made improvements.That's good for customers and the company.
Support,particularly for a pay-for program is essential.
I have dropped a few programs for poor support and I'm sure I will continue to do so.I will not tolerate poor support.
Regarding BlueZannetti's explanation...I don't know if I had the "bounce" problem with my ISP.I never had the problem with other foreign e-mails.That's not to say it couldn't have been an issue in my case.

 

I've had two multiple email events, different companies, separated in time, both Russian based, where this has happened. Given what was getting through the gateway level screening only to be picked off at the mail server which I could examine to my "screened mail" inbox, I was rather surprised. I've also had plenty of other foreign communications which were fine.

Blue

 

Maybe you should not expect that much, russian mentality is a bit colder.

 

Nothing has changed in their anti-chinese-numerology-version, only mass of false positives, here´s the prove:

http://i24.tinypic.com/5l58ch

Stubborness at expense of the customers

 

anyone could create a similar screenshot for most of the antiviruses, as they all create FP's.

im sure if you look on the internet, you will even find them all.

but anyway, 'ignore' is an option for a reason

whats wrong with the russians, they are fine.... some speak very good english and are down-to-earth as any of my mates are.

if your nice with them, im sure they will be nice back

@Severyanin - i hope Drweb dont pull out of the tests, that would leave a v.negative thought in most peoples minds, and surely drweb do benefit from the dvds, but i worry, as i know drweb have never really had the marketing skills of others.