Dr Web and suspicious file submissions.

As we know, Dr Web has very strong heuristics which can increase false positives. Also, as we know, tech support in the past has been very slow in reacting (if ever) to false positive submissions, but recently I have seen a change in that attitude I can only hope that it signals a permanent change for the better on their part.....

Last week while trialing the new antispyware from Giant I found that the on demand scanner alerted on two files for the Giant program. More specifically, the files "gcasDTServ.exe" and "gcasServ.exe". Knowing that these files were in all probability false positives I submitted them to Dr Web. Two days later ( I submitted on Saturday) I received a reply that the files were indeed false positives and that it was being corrected with the next definition update, and, indeed, it was.

Time will tell if I just got lucky or if they really are trying to make a concerted effort to improve in this area. I hope it’s the latter.

Also, it is my opinion that licensed Dr Web users who submit files or ask for tech support are much more likely to receive a response if they include their license key number in the space provided in the submittal form. If you aren't a licensed user or you don't include your license number with requests, then I think, unfortunately, that support will continue to be poor.

 

I had the same experience with both SpiderGuard and the on-demand scanner reporting 'Possible backdoor' with both files. I submitted these 2 false positives and support answered back within 24 hours, stating that they would be corrected.

This is definitely a better response compared to other false positives I have reported in the past and let's hope this is a permanent change for the better. Particularly, as until the new patch is produced, we cannot exclude false positives in SpiderGuard without crashing the RTM; https://www.wilderssecurity.com/showthread.php?t=52733

Recently( within the last 10 days) I have received replies to all my queries from both the on-line forum at www.drweb.com, from support@drweb.com and mike kolyadko; mike.kolyadko@drweb.com.

In fact, recently I have had the quickest response from the on-line forum where there now seems to be some knowledgeable personnel with a good level of English understanding; http://support.drweb.com/forums/.

This contrasts with a very poor response about 4-6 weeks ago but this probably coincided with the release of the new version and the upgrading of the new web site. So let's hope the patchy support is finally put to rest.

But as shorty1 has suggested, inclusion of your key-file number in any email query is very important for a quick response.

Apart from the improved response to false positives, the actual number of false positives generated by Dr Web, IMHO, seems to be exaggerated, particularly with the newer versions. I presume fine tuning of the heuristic engine has helped in this respect?

So as the old adage "it cannot detect trojans" cannot now be applied to NOD, hopefully the old chestnut " support is very patchy, there are a great number of false positives which are rarely corrected" for Dr Web can also be put to rest.

 

Ah yes, the user "pig" is indeed a very dedicated person when comes to helping out on the Dr Web forums. He responds to many threads and is most knowlegble and helpful.

I discovered previously, when the english help forums were all but dead, that if I asked for help in the Russian forums I always got a response and often times right from the tech support people. I was a little leery at first in asking questions on the Russian forum but they were more then glad to help. Funny (sort of) story: For my first feeble attempts I would type the question in English, then translate it to Russian and post it thinking that was the best way to communicate the question. They had no idea what the heck I was talking about. They told me just to ask the questions in English. I expressed reservations because it is a Russian forum and was told it was perfectly fine. I think the fact that I was taking the extra step to try and meet them halfway, so to speak, with the language barrier that they were even more willing to help. I still browse through the forum Here every now and then. It seems to be one of the busiest of the Dr Web forums.

 

Thanks for link to the other forum It does seem very busy.

Hopefully with all these options, including Wilders, current Dr Web users should be able to receive some help with any problems that come up.

 

I just looked there. HOW do you know where to post or to trial Dr. Web? I was a little confused at what to do.

Marja

 

Trial for Dr Web here; http://download.drweb.com/win/

For the posting at one of the forums, try here; http://support.drweb.com/forums/viewforum.php?l=10

For the Russian forum, http://forum.drweb.ru/ try Babel Fish;http://babelfish.altavista.com/

But I could only translate when inputting blocks of text NOT the web-page itself.

 

In addition to Babelfish I use "IM Translator"... You can find it here: http://webtranslation.paralink.com/urlmode.asp

As with any of the online translators, some comments are very easy to understand and others, well, not so easy to grasp.

 

Nice find, shorty1. I have not used Im Translator before

This one will accept most web pages and there are some interesting posts over at the Russian forum.

It will make good bed-time reading!!!!!!