Configuring SpIDer Guard

The default settings are optimal for most cases. Do not change them unnecessarily.

By default, SpIDer Guard checks files that are opened, changed or launched on removable media such as CD/DVD, flash drives, and so on. This option helps to protect your computer from viruses transmitted via removable media. When these options are disabled, the objects on removable media are not checked for viruses.

On this page, you can configure reactions of SpIDer Guard to detection of infected or suspicious files and malware.

For different types of compromised objects, actions are assigned separately from the respective drop-down lists:

•Suspicious—objects supposedly infected with a virus or containing a malicious object.

•Various potentially dangerous objects (riskware). To expand the entire list of objects, click the Advanced settings link.

Separate reaction of SpIDer Guard to detection of each object type. Set of actions available for the selection depends on the threat type.

By default, SpIDer Guard attempts to cure infected and supposedly curable files, moves other most dangerous objects to Quarantine, and ignores minor threats such as jokes, hacktools, and riskware. The reactions of SpIDer Guard are similar to those of Dr.Web Scanner.

You can select one of the following actions for detected threats:

Action	Description
Cure, move to quarantine if not cured	Instructs to restore the original state of the object before infection. If the object is incurable, or the attempt of curing fails, this object is moved to quarantine. The action is available only for objects infected with a known virus that can be cured except for Trojan programs and files within complex objects such as archives, mailboxes, or file containers.
Cure, delete if not cured	Instructs to restore the original state of the object before infection. If the object is incurable, or the attempt of curing fails, this object is deleted. The action is available only for objects infected with a known virus that can be cured except for Trojan programs and files within complex objects such as archives, mailboxes, or file containers.
Delete	Instructs to delete the object. This action is not available for boot sectors.
Move to Quarantine	Instructs to move the object to a specific folder of Quarantine. This action is not available for boot sectors.
Ignore	Instructs to skip the object without performing any action or displaying a notification. The action is available only for potentially dangerous files: adware, dialers, jokes, hacktools and riskware.

SpIDer Guard does not check complex objects such as archives, mailboxes, or file containers. No action is performed on such objects or on files within them.

Copies of all processed objects are stored in Quarantine.

In this group, you can set up what actions with objects require scanning “on-the-fly” with SpIDer Guard.

Option

Description

Optimal (recommended)

This scan mode is used by default.

In this mode, SpIDer Guard scans objects only when one of the following actions is traced:

•For objects on hard drives, an attempt to execute a file, create a new file, or add a record to an existing file or boot sector.

•For objects on removable media, an attempt to access file or boot sectors in any way (write, read, execute).

Paranoid

In this mode, SpIDer Guard scans files and boot sectors on hard or network drives and removable media at any attempt to access them (create, write, read, execute).

The Optimal mode is recommended to use after a thorough scan of all hard drives by Dr.Web Scanner. With this mode activated, SpIDer Guard prevents penetration of new viruses and other malicious objects via removable media into your computer while preserving performance by omitting knowingly “clean” objects from repeated scans.

The Paranoid mode ensures maximum protection but considerably reduces computer performance.

In any mode, objects on removable media and network drives are scanned only if the corresponding options in the Scan options group are enabled.

Operating system may register some removable media as hard drives (for example, portable USB hard drives). Scan such devices with Dr.Web Scanner when you connect them to the computer.

By default, files within archives and mailboxes are not scanned. This does not affect security of your computer when it is constantly protected by SpIDer Guard, only delays the moment of detection. If a file within an archive or email attachment is infected, the malicious object will be detected and neutralized by SpIDer Guard immediately when you try to extract the archived files or download the attachment.

The settings of this group allow to specify parameters for scanning objects on-the-fly and are always applied regardless of the selected SpIDer Guard operation mode. You can enable:

•scan of scripts executed with Windows Script Host and PowerShell (for Windows Server 2016).

By default, SpIDer Guard performs scan using heuristic analysis. If this option is disabled, SpIDer Guard will use signature analysis only.

Anti-rootkit component included in Dr.Web provides options for background scanning of the operating system for complex threats and curing of detected active infections when necessary.

If this option is enabled, Dr.Web Anti-rootkit constantly resides in memory. In contrast to the on-the-fly scanning of files by SpIDer Guard, scanning for rootkits i.e. malicious programs that are used for hiding changes in the operating system such as running of particular processes, registry changes, modifications of files and folders includes checking of autorun objects, running processes and modules, Random Access Memory (RAM), MBR/VBR disks, computer BIOS system, and other system objects.

One of the key features of Dr.Web Anti-rootkit is delicate attitude towards consumption of system resources (processor time, free RAM, and others) as well as consideration of hardware capacity.

When Dr.Web Anti-rootkit detects a threat, it notifies you on the detection and neutralizes the malicious activity.