questions for you dr web users

hello,
i tried dr web on my test pc today.
first off i tryed to install all componants but it got stuck on the mail guard and i had to stop the install. i then went to add/remove programs and it only wanted to install and uninstall so i had to do a manual registtry clean and delete the folder manually. but dr web was still listed in program files.
but you know how crappy windows ME is
probaly one bad install after 1000's of sucessful installs.
i will finish off later with some questions
lodore

 

Hi,lodore

Compared with you,i didn't get any serious trouble with dr.web.Since i didn't need a mail-guard,i didn't install that componet.

Dr.Web worked perfectly on my pc!High detection rate,with few fp's.However,i must say that Dr.Web's CPU usage is quite a problem.It used to increase to 100% suddenly when i downloaded .rar files from websites.When i had excluded .rar files in real-time protection,the CPU usage would sometimes increase to more than 90% when unraring .rar files.

Another problem was that Dr.Web's real-time protection would not report some viruses when i opened some folders which contained viruses.But on-demand scanning it reported indeed.

xuerge

 

Hi iodore and xuerge
There are a few experienced DR WEB users who should drop in to address your concerns...CSJ or SHORTY1 (to name a few).
They seem to be very knowledgeable with the functionality of the good Doctor.
I use DR. Web, however, I have not seen the problems you have outlined (that does not mean it does not happen), but thoce two contributors will be able to provide some assistance.
Cheers

 

ok in the end it installed fine without installing the mail guard.
but it seems to silent for me and i want to know a few things.
1. if the normal on access scanner blocks any malware how can i get it to popup with an alert?
i checked the log and it told me that 3 infections where found and blocked but didnt tell me what.
i know it was just 3 eicar test viruses but i would like it setup to popup with a message with options on what to do or just a box telling me so and so virus was blocked rather than just how many where found and stopped in numbers. some screenshots would be nice.
btw im using the 4.33 beta from the beta login site.
also where is the spidergate?
ive got spider guard,spider updater,dr web scanner(on demand) and the one to set tasks.
its quite nice now i know i can rightr click the spider guard and open each menu from that one rigtht click menu.
thanks
lodore

 

With any beta some initial problems are to be expected!

SpIDerGuard should pop up with a Window saying that an infection has been found and then it will give you a choice of options. At least it does do this with any malware in the full version. But even the beta should do this.

If you want to give Dr Web a proper testing I would recommend the trial version over any beta.

Have you uninstalled completely your previous AV's that you used and not just disabled them and carried out a registry clean. IME, Dr Web is very sensitive to previously installed AV's.

And SpIDerGate is not present in the latest beta.

 

SpIDerGuard full version and Eicar test-file; plenty of options and on default Settings of Actions of SG.

 

that box only came up when it was in system restore.
i ran an ondemand scan of the file and it found the eicar test virus then the box that you show me comes up showing the eicar test virus in system restore.
btw i renamed the file to eicar.cab and another one i renamed eicar.com
i had scan archives scanning on.
lodore

 

Select archives in the File Types settings of SG and the on-access scanner Window comes up immediately with eicar.com and the two eicar.com zip files.

 

any screen shots of the settings you use?
lodore

 

lodore, I am just using the default settings.

But as stated previously, I would still recommend you try the present trial full version rather than any beta.

 

ok then.
do dr web have uninstaller tools?
or do i juts uninstall in add/remove programs then install a realaased version?
lodore

 

No specific removal tools so just use the program's uninstaller from the start menu entry.

But since it is a beta I would also, after rebooting, remove the Dr Web entry in the Programs folder and then run a good registry cleaner after the uninstall. Then you can install the demo version.

 

This caused some raised eyebrows here as well. (Running 4.33 non-beta).
I thought maybe it was just an anomaly here, or I was the only one that experienced it.

Apparently if your Spider Guard "Actions" settings are:
Infected Objects:
Primary Action: Cure
What to do if action failed: Move to quarantine
In such cases, it seems infected objects are moved (quiet as a spider) to your quarantine file without a peep.
Call me old fashioned, but I would REALLY like to know if an infected file has been found.
Workaround:
What to do if action failed: Report

I may post on the Dr Web forum, as I found this lack of infection notice disconcerting.
I CAN see SOME rationale to this logic, however, i.e.: on your kid's puter. You really DON'T want them to make any potentially harmful decisions.
Infected = quarantine. NO user interaction or override of DW's detection.

 

But since the default Action setting for Infected Objects is REPORT, then all new users should see a SpIDerGuard warning Window.

It is much safer using any AV to make sure that the default settings are set to some sort of user Interaction.

 

But I can see your point here, Bob. I have the same problem with my kids; they would not know what to do with any report Window popping up.

 

the thing is nod32 does the same thing if set to clean automatically.
with kis6.0 if a virus is got rid of automatically then it comes up with a red popup at the bottom of the screen saying something like virus detected, cleaned. or cleaned failed, delete sucucess full.
lodore

 

lodore,

are you seeing the popup malware Window of SpiderGuard now with the beta version?

 

yes I am on default settings.
i downloaded the demo dr web from the link you gave.
oddly thou it still got stuck on installed spider guard.
but if i installed it without spider guard after uninstalling and using a decent registry cleaner then it installs fine.
Thanks blackcat
lodore

 

lodore,

spiderguard settings:

all files and email files should be ticked, do not tick archives.

leave the rest on default.

scanner settings:

all files, tick archives and email.

infected objects: cure
incurable: delete
suspicious: move
achives: report
mail: report
containers: report
adware: delete
dialers: delete
jokes: delete
riskware: report
hacktools: delete

those are the settings i use lodore.

 

Chris,

It is probably better for any Dr Web newbies reading this thread to state that these are your preferred selections and not definite recommended settings.

 

actually it is recommended settings blackcat,

there are no limits on archive scanning, if you enable it in guard and download a 500mb pc demo etc, your spiderguard will scan the archive causing your machine to hang for 10 mins, as it stands now, you dont need that feature ticked, and it is recommended you do not if you download large archive files such as pc demos.

this particular setting was recommended to me from the dr.web team, serge popov because i do download large archive files.

 

Agreed. These are the best (recommended) settings for the way you use your machine.

But I was talking about general recommended settings, in particular the tick all files and email files. So initially, for a newbie, it may be better to stay with the default settings of not selecting all files, emails and archives. Because of the potential general hit on performance of real-time archive scanning I agree that the default for these files should be kept as it is i.e do not scan archives. No argument there.

But, IMO, all new Dr Web users should stay with the default settings at first and only change these if they feel the need to for their particular system. For example, with regular on-demand scans and scanning any new downloaded files from the context menu, I feel safe just using the scan by format. In contrast you prefer an all file settings. Horses for courses

In fact Dr Web's CEO recommended the default settings by format to me; the scan option he uses on his machine

 

i dont agree,

spiderguard: scan by format and scan all files makes ZERO difference in system performance,no extra ram usage, no extra cpu usage, so why would one select a less-secure option?

archives can be selected for spiderguard, but as i mentioned, if you plan on download large .rars or .zips, i dont recommend it at all, so i turn it off..... if you do, your system will hang after download is complete.

 

With SpIDer Guard for Windows NT you can actually receive notifications. In order to enable notifications:

1) Open drweb32.ini in a text editor (notepad would be ok) and add/change "Acknowledge" key in "[SpIDerGuardNT]" section. It must be set to "Yes".
2) Open SpIDer Guard control applet (tray menu -> control). Open "Notifications" tab and select events you wish to be notified.

This does not work for SpIDer Guard for Windows9x.

 

You may wish to use these drweb32.ini options to limit archive scanning:

[SpIDerGuardNT]
MaxFileSizeToExtract
MaxCompressionRatio
CompressionCheckThreshold