Dr Web CureIt vs Traditional AV

Not A Vs B.

Dr Web CureIt seems to be a more specialized scanner sort of like a HMP of the AV world where as other antiviruses are more traditional with their scanning scope and offer more customization. Am I off base or would Dr Web Cureit be suitable for file scanning?

 

More then suitable. Also a great edition to HP. Dr Web is excellent at detecting trojans, rogues and rootkits.

 

Can DrWeb CureIt be a direct replacement for a traditional AV or is it more of a compliment to a traditional AV sort of like Immunet Protect Free.

 

It's an on-demand scanner, not real-time.

What I don't like about it is that you have to download the whole program again just to update definitions.

 

On demand is what Im after. Its a real let down about the definitions though. That would require a new download every few days.

 

It can scan single files by browsing to the file to be scanned and then scanning the file. However, you have to download DrWeb Cureit again in order to get updated Malware signatures. The download file size is around 52 MB.

 

No it cant. It is just a On-Demand Scanner ( but a very good one) , so no real time protection.

 

Be prepared to wait a long time for the good dr. scan to finish. If you aren't in a hurry then that is moot anyhow.

 

The long scan time is probably due to Dr Web's unpacking abilities (can unpack just about any file/format). I would suggest running an AV real-time, and scan certain areas of the hard drive with CureIt from time to time, like C:\Documents and Settings (or C:\Users) and C:\Windows.

 

You can also try the full real time av for 30 days here:

http://download.drweb.com/demoreq/biz/?lng=en

 

I believe the current scanner is not multi-threaded, and therefore is very slow. They have a new scanner under development (beta I think) that is a lot faster. There are also other new features coming for Dr.Web, sadly google translate doesn't translate the beta section. I believe the new SpiDer Netting is supposed to be some kind of hips component and so on ..

 

@risl: Their current scanner is already multi-threaded. They support virtually countless packers and this might be main reason for slow performance on few computers with more files packed/archive/compressed. I have tested it thoroughly and it is fast, stable, and reliable scanner.

 

My wish is to hopefully see more competitive pricing for multiple computers. When you look at the suites for 4 computers, it is almost unrealistic what they are asking.

 

What settings from default would you use to greatly reduce the scan times? I think that you can have it not scan archives. If Malware is in an archive, isn't the Malware relatively harmless?

Thanks in Advance.

 

Personally Im not worried about real time protection at all. I have my browsers sandboxed and suspect files get ran in a hardened sandbox with no net access and dropped rights. I run Spyshelter real time in the off chance that there is a keylogger Im protected until the sandbox is cleared.

 

Default settings are very good for both on-demand and on-access scanner (optimal settings).

 

correct, this is the first software I bought that I actually installed it and walked away.

 

Yes, that is correct. But there are also runtime compressed executables or "encrypted" executables (to avoid AV detection or to "hide" code) that DrWeb decompresses or "decrypts".

 

Then I don't understand what the discussion in Dr.Web Russian user forum is all about. They are talking about multi-threaded test versions that currently work only for command line scanner.

.. I've used Dr.Web for the past 4 years and I can say it's stable and reliable, but still: avast scans my computer in 20 minutes with speed of MB's/sec, Dr.Web does this in over 2 hours. I have only around 60-90GB of data

It's 2010 now and not 1998. Some people have terabytes of data and I can't imagine them using Dr.Web complete scans at all.

 

Dr. Web has been great when disinfecting files others failed -BUT-

Besides,

 

honestly, I cant remember when I did a complete scan, with any AV. With Web, the quick scanner is very good and covers a lot of areas.

 

I am running Avast Internet Security 5. If I want to run Dr.Web CureIt, shall I have to temporarily de-activate Avast?

 

I ran DrWeb Cureit recently on one of my PC's that has Avast Home installed. I did not disable Avast. I selected DrWeb's EPM (Enhanced Protection Mode) option which seems to lock the PC. It is my understanding that EPM prevents malware from attacking the DrWeb scanner during the scan/clean process. So I assume that it also locks Avast during the scan/clean process.

 

Ok a few more scenarios similar to what was in the OP.

Instead of Dr Web CureIt what about using the AV without the Spider Agent (real time monitoring module)? Seems that that would offer the same types of things as running an AV on demand.

Also what about Hitman Pro? Could someone use HMP to scan the C drive folder to ensure it was clean and then just scan files individually from the right click menu and use HMP as an on demand "AV" solution for lack of a better term?

 

You can install Dr.Web with a custom installation and pick out which of the "Spiders" you want and which ones you don't. Of course this isn't free. BTW, you can also do the same with Avira and leave out the guard.

An on-demand AV solution is exactly what it is, so yes. For free I would do the custom install of Avira, if you don't mind paying I'd go for Hitman Pro. It's cheaper than Dr. Web and I'd suspect that it has much better detection.