Chapter 3. Dr.Web for Linux

This Manual describes management aspects of Dr.Web for Linux anti-virus software designed for the GNU/Linux OS. The manual is designed for a person responsible for anti-virus protection and security ("Administrator" hereinafter).

Dr.Web for Linux main functions:

1.Detection and neutralization of malicious programs (for example, viruses, including those that infect mail files and boot records, Trojans, mail worms) and unwanted software (for example, adware, joke programs, dialers).

The product uses several malware detection methods simultaneously:

•Signature analysis, which allows detection of known threats information on which is stored in virus bases

•Heuristic analysis, which allows detection of unknown threats

•Dr.Web Cloud service that collects up-to-date information about recent threats and sends it to Dr.Web products.

Note that the heuristics analyzer may raise false alarms. Thus, objects that contain threats detected by the analyzer are considered "suspicious". It is recommended to quarantine such files and send them for analysis to Doctor Web anti-virus laboratory.

File system scanning can be started in two ways: manually on user request and automatically, according to the schedule. There are two modes of scanning: full scan (scan of all file system objects) and custom scan of selected objects (directories or files). Moreover, the user can start a separate scan of volume boot records and executable files that ran currently active processes. In the latter case, if a malicious executable file is detected, it is neutralized and all processes run by this file are forced to terminate.

2.Monitoring of file reference. File events and attempts to run executable files are monitored. This feature allows to detect and neutralize malware at its attempt to infect the computer.

3.Monitoring of access to the Internet. All attempts to access Internet servers (web servers, mail servers, file servers) are monitored in order to block access to the websites of the unwanted categories, and to prevent the transfer of email messages with infected files, unwanted links or spam. Check of email messages and files downloaded for viruses and other threats from the web is performed on the fly. To restrict access to unwanted websites, Dr.Web for Linux supports a database of web resource categories that is automatically updated, and black and white lists that are edited by the user. Dr.Web Cloud service is also used to check whether the requested web resource is marked malicious by other anti-virus products of Dr.Web.

4.Reliable isolation of infected or suspicious objects. Such objects are moved to a special storage, quarantine, to prevent any harm to the system. When moved to quarantine, objects are renamed according to special rules and, if necessary, they can be restored to their original location only on demand.