Dr.Web self-protection becomes more vigilant

Discussion in 'other anti-virus software' started by pjb024, Nov 18, 2009.

Thread Status:
Not open for further replies.
  1. pjb024

    pjb024 Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    351
    Location:
    Leeds, UK
    November 17, 2009

    Doctor Web updated components of the Dr.Web SelfPROtect module used in its single-user anti-virus solutions. Self-protection of Dr.Web anti-viruses has been enhanced with the integrity control.

    Now if the self-protection is enabled, all unsigned processes attempting to start from the anti-virus installation directory will get into the untrusted list. If the digital signature of the process starting from the Dr.Web installation directory has been corrupted, the new feature will not allow the process to start. If an integrity breach is detected, a user will receive a corresponding notification from the anti-virus.

    The self-protection mechanism of Dr.Web single-user anti-virus solutions will be updated automatically You will need to reboot your system after updating.

    http://news.drweb.com/
     
  2. disinter1

    disinter1 Guest

    That's all nice and dandy, but when is Dr Web gonna look like it's not from the early 80's?
     
  3. Fajo

    Fajo Registered Member

    Joined:
    Jun 13, 2008
    Posts:
    1,812
    Sigh back to the self protection Again... I wish they would work on something a little more important, like detections. And no this is not a hit at Web, I would rather see the product have less use for protection because it did not let it in the door in the first place. But they just seem to be stuck on one thing for the time being.
     
  4. pjb024

    pjb024 Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    351
    Location:
    Leeds, UK
    A new GUI has been in development for some time. Dr.Web don't pre-announce changes so I can't give a specific time frame but I expect it to be introduced quite soon. The focus of attention is always on the anti-viral components and I believe that's how it should be. A glitzy new GUI may win customers but it adds nothing to the protection of the system although, admittedly, it may make it easier to use.
     
  5. Dr33

    Dr33 Registered Member

    Joined:
    Jan 23, 2009
    Posts:
    103
    DrWeb detection rate is very good and its getting even better
     
  6. risl

    risl Registered Member

    Joined:
    Dec 8, 2006
    Posts:
    581
    They've started to add more signatures lately, I believe because of moving to automatic systems like other vendors. It used to be around 300-900 per day but now it's over 3000 per day. I mentioned this in some other recent thread.

    Don't know if it has any effect because they don't participate in tests anymore, but considering their "total amount" is around 800.000 and in last 2 or 3 months they've done over 200.000 signatures which is 1/4 of the total.
     
  7. pjb024

    pjb024 Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    351
    Location:
    Leeds, UK
    Dr.Web is developing on many fronts not just self protection. There is the new GUI in development that I mentioned in an earlier post. Also Dr.Web has continued to develop the capabilities of the on-demand and realtime scanners. Scanning time is much reduced and I can confirm that I have compared it with other AV's on my system and found it to be in the same ballpark for scanning speed.

    Detection has improved with incremental changes to the scanner. In October Dr.Web announced better detection of rootkit and improved algorithm for boot sectors scan.

    http://news.drweb.com/show/?i=633&c=5&p=0

    Dr.Web has been Windows 7 compatible sionce September 3

    http://news.drweb.com/show/?i=442&c=5&p=1

    Support for 64-bit systems is available in beta so full 64-bit support will not be far off.

    Dr.Web Pro is in beta and this incorporates a firewall.

    So, as you can see, it's not just self protection that is being developed. There is much changing beneath the hood and I suspect that Dr.Web is much more capable than many give it credit for.

    One thing that has not changed ... it is incredibly light on system resources.
     
  8. Fajo

    Fajo Registered Member

    Joined:
    Jun 13, 2008
    Posts:
    1,812

    Thats good to hear. I would not mind seeing them in tests again, But I don't put to much faith into that happening. It is good to hear that they are working on detection rates tho. :)
     
  9. dawgg

    dawgg Registered Member

    Joined:
    Jun 18, 2006
    Posts:
    817
    Seems like blabber... How often does malware start from DrWeb's installation directory? - doesn't it normally start from Temp, Desktop (or USB sticks) o_O

    DrWeb making technologies solely for marketing purposes?
     
  10. Fajo

    Fajo Registered Member

    Joined:
    Jun 13, 2008
    Posts:
    1,812
    Unfortunately its just them saying there is changes. There is objectivity like 3rd party independent tests, they pulled out of those once they started failing consistently. I would just like to see good test or 2 would be nice (From a reputable source that is). :doubt:

    Edited.
    Typo's
     
  11. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,852
    Again, self-protection is really not important at all. If the AV misses a threat, it's as good as dead anyway.

    Besides that, simply run a 64bit OS with a 64bit AV and there's your self defense. 32bit processes (of which nearly all malware is) can't touch 64bit processes.
     
  12. Arin

    Arin Registered Member

    Joined:
    May 1, 2004
    Posts:
    997
    Location:
    India
    So this stops someone from tampering with Dr.Web files. Looks like Dr.Web is interested on improving something which is already very good.
     
  13. lodore

    lodore Registered Member

    Joined:
    Jun 22, 2006
    Posts:
    9,006
    i thought they would of at least got a 64bit version out by now.
     
  14. Baz_kasp

    Baz_kasp Registered Member

    Joined:
    May 1, 2008
    Posts:
    593
    Location:
    London
    Isnt this a bit of a hollow feature update anyway?

    I mean most av stop files being written to their directory already so it's nothing new, but it isn't very common for malware to launch from av directory anyway.

    Secondly about the verifying signatures thing...that makes me laugh, because if a malware modifies one of the drweb files in order to break the digital signature...dr.web will not start itself up? lol
     
  15. NAMOR

    NAMOR Registered Member

    Joined:
    May 19, 2004
    Posts:
    1,526
    Location:
    Arkham Asylum
    Same here. Sometimes they are a little too quiet about development.

    @pjb024 I don't think the self protection module works on Windows 7 64 bit, at least it didn't install when I tried the Dr.Web Pro beta version. Also, is there just a regular version of Dr.Web for 64 bit in beta, I only see Dr.Web Pro for DL on the beta site.
     
    Last edited: Nov 18, 2009
  16. pjb024

    pjb024 Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    351
    Location:
    Leeds, UK
    There is:

    Dr.web Antivirus For Windows (x86/x64) (includes ant-spam and SpIDer Mail)

    Dr.web Security Space (x86/x64) (+ HTTP Monitor + Parental Control)

    Dr.web Security Space Pro (x86/x64) (+ Firewall)

    Dr.web Antivirus For Windows Servers (x86/x64)

    These are all first Public Beta and there are also x32 versions.

    Dr.Web is modular in structure so the download for Windows Workstations includes all the modules for Dr.web Security Space Pro as this is the top product which includes all the new features. If you just want to test anti-virus without firewall then during the installation simply select custom installation option and then deselect any features you don't require. You can deselect the firewall and you can also deselect SpIDer Gate if you don't require the HTTP monitor and so on. When the new programs are out of beta then there will be separate downloads for each product in the range. Bundling all features into a single download makes sense for beta testing.
     
    Last edited: Nov 18, 2009
  17. mant

    mant Registered Member

    Joined:
    Sep 8, 2006
    Posts:
    73
    Location:
    DIY
    Dr.Web and Kaspersky should MERGE become Dr.KAV
     
  18. Macstorm

    Macstorm Registered Member

    Joined:
    Mar 7, 2005
    Posts:
    2,531
    Location:
    Sneffels volcano
    :D :D :D
     
  19. gery

    gery Registered Member

    Joined:
    Mar 8, 2008
    Posts:
    1,785
    :thumb: :thumb: :thumb: :thumb: lol
     
  20. Nomad Soul

    Nomad Soul Registered Member

    Joined:
    Jul 10, 2009
    Posts:
    28
    Location:
    Russia, Khabarovsk
    Specially for you)
    http://www.shadowserver.org/wiki/pmwiki.php/Stats/VirusYearlyStats
     
  21. Edwin024

    Edwin024 Registered Member

    Joined:
    Nov 14, 2004
    Posts:
    1,000
    A test with G-Data as number last. This is hardly believable when you look at all other tests done with that program participating. And were is Norton in the zero day test? And MSE. Or A2?
     
  22. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,852
    Shadowserver has already been proven extremely out of date, for example, GData uses the Bitdefender engine which scored 85%. Completely ignore these outdated results.
     
  23. Fajo

    Fajo Registered Member

    Joined:
    Jun 13, 2008
    Posts:
    1,812
  24. codylucas16

    codylucas16 Registered Member

    Joined:
    Nov 17, 2009
    Posts:
    267
    I actually am liking Dr. Web. Did some tests on it and it blocked some viruses AVs such as MSE and Avira let through. The CureIt also picked up some trojans on my main PC i didn't even know were there.
     
  25. quanzi_1507

    quanzi_1507 Registered Member

    Joined:
    Feb 18, 2009
    Posts:
    320
    Actually, new Dr.Web products got some really nice GUIs.

    Code:
    http://www.wilderssecurity.com/showpost.php?p=1523922&postcount=2
    Code:
    http://news.drweb.com/show/?i=196&c=6&p=1
     

    Attached Files:

    • 1.jpg
      1.jpg
      File size:
      180.7 KB
      Views:
      499
    Last edited: Dec 12, 2009
Loading...
Thread Status:
Not open for further replies.