Dr Web Problem

Hi, I have been trialing Dr Web for my fathers PC, he's running Panda Titanium at the monent but he will be due to resubcribe in a weeks time.
Dr Web seemed to be a good answer for him, fairly easy to use, good protection "out of the box". I came to uninstall it from my PC yesterday, and go back to NOD, and somehow the unistall routine has screwed up my network settings.
Device manager shows my network card as ok, but doing a "release/renew" results in the error "renew command faild due to attempting to renew on hardware that is not a socket". After spending two hours trying to correct this I did a clean format and re-install of my HDD (Win XP Home edition)
Now I'm very vary to recommend Dr Web to my father untill I can work out what happend with it's un-installer.
Has anybody else had a similar problem with Dr Web, or for that matter any other AV, I would really like to get a "handle" on what happened? Grr, now I have to send about 9 hours re-installing, I regret the fact that I put off doing a ghost image last week when I did a clean format and re-install.......

TIA,

Trev

 

Hi Trevor,

did you install the SpiderMail component of DrWeb? If yes, then sometimes this component leave trails in the network settings, which can be removed by manually invoking it with the -remove option, e.g. spiderml.exe -remove.

 

Due to compatibilty problems with other AV programs, I must have installed/uninstalled Dr Web and its 'clone' VirusChaser many times over the last 8 months!!! But I have not had any major uninstall problems.

The only minor problem was that the usual uninstall AND the use of various Registry Cleaners, would not remove DRWHOOK.DLL- a Spidermail component. This meant I could not successfully reload Spidermail again. The only remedy was to use LSPFix, which did remove this entry and I had no more problems.

If you look at this recent thread it will give you information on this and it also indicates that this entry may be responsible for the 'sensitivity' of Dr Web and any other AV software on the same box.

http://www.wilderssecurity.com/showthread.php?t=9662;start=0

Maybe this 'debris' was responsible for your problems?

Dr Web is a very good AV, and although I have no direct knowledge of Panda Titanium, I would think that Dr Web may offer greater better overall protection against viruses and trojans.

But the important consideration is how it will affect the stability of your father's box. All systems are unique, and therefore any problems on your computer may not show themselves on your father's box and vice versa.

I would say that overall, in my experience the uninstaller TOGETHER with LSPFix will remove all of Dr Web's entries. After rebooting, run a Registry Cleaner as a double check.

If your father has no disc imaging software, such as Acronis TrueImage, I would recommend 'watching' any trial install with Norton CleanSweep or the freeware program ' Total Uninstall'.

Overall, in my experience, if you want to try Dr Web it is ESSENTIAL to remove any previously installed AV software and therefore it is essential that Panda is removed before trialing Dr Web.

It may give slightly more false positives than some other programs, but again in my experience, these are not very many more.

One other program, that is very similar to Dr Web in its small memory imprint is F-Prot for Windows, which fulfils your choice of being 'easy to use and offers good protection out of the box'. I would therefore also recommend this AV as another possibility.

http://www.wilderssecurity.com/showthread.php?t=10006

If you look through the numerous posts here, there are many suitable AV programs which would offer good virus protection. The important factor, since most of them now give 100% ITW protection, is how your FATHER finds the program, in terms of effects on HIS system and how easy HE finds it to use.

For example given a choice I would load KAV on my daughter's laptop, but she is much 'happier' with Norton AV And she is still virus free

 

Blackcat: I second your description...had the same problems from time to time, and yes, drwhook.dll has to be removed either manually or by using LSPfix. That's why I was asking, if Trevor had installed the spiderml.exe.

 

Hi Karl

I tried the 'manual' remove of the DrWHook.dll several times as recommended by Dr Web's support but I could never successfully accomplish this. Did the manual fix work for you as a matter of interest?

 

well, it worked in about 1 of 10 cases...the other nine leaving everything as is. Seems as if the remove rountine gives up whenever spiderml has messed too much with the registry...at least that's my opinion after long hours of watching it .

 

Thanks for replying Karl, I just thought it was my incompetence again!!!!

LSPFix is therefore the way to go

 

btw, Blackcat, which OS do you use? It seems to me that they tested it more thoroughly on NT based, than on 9x...

 

Win 2000 and XP Pro.

 

Hmmm...and I thought it was just my fault of using the old fashioned Win98

 

the LSPfix is wonderful!!
and man can i tell you about this DRWHOOK.dll
but that is another day?

LSP does wonders.highly reccomend it to anyone!!
5-STARS!!

 

I wish, the DrWeb team had fixed this issues themselves, though. I remember lots of complaints during the beta phase of spiderml, but still no solution in the final product...

 

i do also, because its a fine product, just needs some fine tuning

 

Thanks for all the replies. I must admit that when I did the unistall I assumed that (as I had stopped all running Dr Web processes) that the uninstall had gone smoothly. From your responses it would seem that possibly parts of Spider Mail had been left behind, and re-installing NOD32 v2 perhaps caused the problem (Dr Web problem, not a NOD32 problem I mean).
I was pretty impressed by Dr Web in day to day usage and as my father is a complete PC novice the AV of choice needs "do it's job" without too much user input or understanding, along with a relativly small resource impact. (his PC is a Duron 700 with 256Mb RAM runing Win XP Home)
I have, since reading the replies here, trialed F-Prot which also fills the criteria nicely, and I think I will recommend he goes with F-Prot to be honest, I think he maybe a little wary of Dr Web's false positives, also I'm not madly keen on a program that leaves trouble making bit's of it's self lying around after an un-install.
Thanks again for all the replies, I've just about got my system back after the format/re-install and this time I've remembered to "Ghost" an image....

Trev