drweb 800 curenet en

© 2009-2013 Doctor Web. All rights reserved.

Dr.Web® CureNet!™Version 8.0.0Administrator Manual2.7.2013

Doctor Web Head Office2-12A, 3rd str. Yamskogo polyaMoscow, Russia125124

Web site: www.drweb.comPhone: +7 (495) 789-45-87

Refer to the official web site for regional and international officeinformation.

This document is the property of Doctor Web. No part of this documentmay be reproduced, published or transmitted in any form or by anymeans for any purpose other than the purchaser's personal use withoutproper attribution.

TRADEMARKSDr.Web, the Dr.WEB logos, SpIDer Mail, SpIDer Guard, CureIt!,CureNet!, and AV-desk are trademarks and registered trademarks ofDoctor Web in Russia and/or other countries. Other trademarks,registered trademarks and company names used in this document areproperty of their respective owners.

DISCLAIMERIn no event shall Doctor Web and its resellers or distributors be liable forerrors or omissions, or any loss of profit or any other damage caused oralleged to be caused directly or indirectly by this document, the use of orinability to use information contained in this document.

Doctor Web

We thank all our customers for their support anddevotion to the Dr.Web products!

Doctor Web develops and distributes Dr.Web® informationsecurity solutions which provide efficient protection from

malicious software and spam.

Doctor Web customers can be found among home users from allover the world and in government enterprises, small companies

and nationwide corporations.

Dr.Web antivirus solutions are well known since 1992 forcontinuing excellence in malware detection and compliance

with international information security standards. State certificatesand awards received by the Dr.Web solutions, as well as the

globally widespread use of our products are the best evidence ofexceptional trust to the company products.

Administrator Manual

4

Table of Contents

6Document Conventions

71. Dr.Web® CureNet!™

91.1. System Requirements

101.1.1. Station Requirements

121.1.2. Requirements for Windows Vista® or Later OS

211.1.3. Requirements for Windows XP® or Older OS

281.2. Licensing

302. Get Started

302.1. Administration Console

322.2. Dr.Web CureNet! Repository

322.3. Detection Methods

342.4. Operation Modes

353. Anti-virus Scans

373.1. Scan Profiles

393.2. Select Stations

423.2.1. Configure Accounts

443.3. Select Actions

463.3.1. General Tab

483.3.2. File Types Tab

493.3.3. Actions Tab

513.3.4. Network Tab

523.3.5. Proxy Tab

533.4. Dr.Web CureNet! Report


5

553.4.1. Station Statistics

594. Update

63Appendix А. Network Masks

64Appendix B. Technical Support


6Document Conventions

Document Conventions

This guide utilizes the following content conventions and signs (seeTable 1).

Table 1. Document Conventions and Signs

Convention Description

Bold Names of buttons and other elements of the graphicaluser interface (GUI), and required user input that mustbe entered exactly as given in the guide.

Green and bold Names of Doctor Web products and components.

Green andunderlined

Hyperlinks to topics and web pages.

Monospace Code examples, input to the command line andapplication output.

Italic Placeholders which represent information that must besupplied by the user. For command-line input, itindicates parameter values.

In addition, it may indicate a term in position of adefinition.

CAPITAL LETTERS Names of keys and key sequences.

Plus sign ('+') Indicates a combination of keys. For example, ALT+F1means to hold down the ALT key while pressing the F1key.

Exclamation mark A warning about potential errors or any otherimportant comment.




Thank you for purchasing Dr.Web® CureNet!™ (hereinafter referredto as Dr.Web CureNet!).

This product allows you to configure and Start anti-virus scans ofremote computers without installing anti-virus software. Dr.WebCureNet! helps you cure workstations and servers running underMicrosoft® Windows® operating systems in networks of any topologyand size. Anti-virus solutions of Doctor Web or other vendorsinstalled on remote computers do not prevent the use and distributionof Dr.Web CureNet! components, which provides enforced securityand protection of your network. Scanning speed and statisticsgathering is independent of network load or availability of specificservers and services, therefore Dr.Web CureNet! can even be usedto scan computers which have no access to the Internet.

Dr.Web CureNet! incorporates the latest and most advanced anti-virus technologies of Doctor Web aimed to detect and neutralizemalicious objects which may present a threat to network operation andinformation security. The product checks files, archives, containers, e-mail, and boot sectors of hard drives for various threats includingviruses, worms, Trojan programs, rootkits, adware, dialer programs,riskware, hacktools and joke programs. On detection of a securitythreat, Dr.Web CureNet! attempts to neutralize the maliciousobjects.

Dr.Web SelfPROtect technology protects Dr.Web CureNet! filesand components on remote computers from unauthorized changes andanti-anti-virus software, which strives to disable anti-virus solutions.



Key Features

Dr.Web CureNet! provides you with the following advantages:

Centralized anti-virus scanning of computers in local networkswithout installing anti-virus software to each remote host

Malicious software detection

High scanning speed

Anti-virus checks for archives and file containers

Infected objects recovery

Information on scanning progress on your computer

Statistics gathering and reporting to your computer

Regular updates to Dr.Web virus databases and Dr.WebCureNet! components

Dr.Web CureNet! report in XML

This guide is designed to help administrators configure and run anti-virus scans on network computers using Doctor Web technologies.



1.1. System Requirements

Dr.Web® CureNet!™ can be installed and run on computers whichmeet the following minimum hardware and software requirements (seeTable 2).

Table 2. System Requirements

Component Requirement

Platform Full support of i80386 command system.

Free RAM Minimum 256 MB.

Hard DiskSpace

Minimum of free disk space required:

230 MB on the computer where AdministrationConsole runs, which includes up to 110 MB ofinstallation files

42 MB on every remote computer to be checked

OperatingSystem

One of the following operating systems for 32-bit or 64-bitplatforms:

Microsoft® Windows® 2000

Windows® XP Professional with Service Pack 2 orlater

Microsoft® Windows Server® 2003 with ServicePack 1 or later

Windows Vista® (Business, Enterprise or Ultimateedition) with Service Pack 1 or later

Microsoft® Windows Server® 2008

Microsoft® Windows® 7 (Professional, Enterprise,or Ultimate edition)

Microsoft® Windows Server® 2008 with ServicePack2

Microsoft® Windows® 8

Microsoft® Windows Server® 2012

Other To update Dr.Web virus databases and Dr.WebCureNet! components, an Internet connection is requiredon the computer where Administration Console runs.



Component Requirement

TCP/IP connection to all remote computers to be checked.

Other system requirements are similar to those for correspondingoperating systems.

To start Administrative Console and scan remote computers, youmust have administrative privileges on your computer and connect toremote computers under administrative accounts.

1.1.1. Station Requirements

It is recommended to install all critical updates provided by theoperating system vendor, or upgrade to a newer version operatingsystem if support for the installed operating system is no longerprovided.

To ensure complete scanning using Dr.Web CureNet!, werecommend to manually disable Automatic Windows Updates duringanti-virus scans.

To scan remote computers using Dr.Web CureNet!, review thefollowing requirements:

Remote computers must be present on the network where thecomputer running Administrative Console resides

User accounts which Dr.Web CureNet! uses to connect toremote computers and run anti-virus scans must exist and haveall necessary administrative privileges

The 139 and 445 ports on remote computers must be open

Additional requirements for new (starting from Windows Vista)or old (up to Windows XP) operating systems

Connection Accounts

Dr.Web CureNet! allows you to use the following administrativeaccounts to connect to remote computers:



The account running Administrative Console (default)

Administrative accounts on remote computers which you specifywith Administrative Console

Before starting anti-virus scans, ensure you have usernames andpasswords of administrative accounts on all computers you want tocheck.

Configuring Firewalls

If a remote computer is protected by a third party firewall, it isrequired to allow connection to 139 and 445 ports in the firewallsettings.

To scan computers protected by a standard Windows Firewall,configure the firewall settings on each remote computer.

Configuring Windows Firewall

1. Open Control Panel on the remote computer. When configuringWindows Vista, Windows 7 or Microsoft Windows Server 2008,select the view mode by category.

2. To access Windows Firewall settings, do one of the following:

when configuring Windows XP or Microsoft WindowsServer 2003, select Windows Firewall (if this item isabsent, click Switch to Classic View).

when configuring Windows Vista, select WindowsFirewall and click Allow a program throughWindows Firewall.

when configuring Windows 7 or Microsoft Windows Server2008, select System and Security and then selectWindows Firewall. In the navigation pane of theopened window, click Advanced settings.

3. Configure the firewall settings as follows:

when configuring Windows XP, Microsoft Windows Server2003 or Windows Vista, open the Exceptions tab andenable File and Printer Sharing.



when configuring Windows 7 or Microsoft Windows Server2008, select Inbound Rules in the console tree andenable all rules with the following names: File andPrinter Sharing (SMB-In) and File and PrinterSharing (NB-Session-In).

4. Save the changes and close the settings window.

1.1.2. Requirements for Windows Vista® orLater OS

Each computer running the Windows Vista or Windows 7 operatingsystem that you want to scan for security threats, should meet thefollowing requirements:

The UAC remote restrictions must be disabled

All necessary network services must be installed and configuredproperly

Sharing settings must allow advanced configuration

The sharing and security model for local accounts must be set toclassic mode

Preparation of a remote operating system to use Dr.Web CureNet!must be performed under an administrative account.

UAC Restruictions

By default, Windows Vista and later operating systems forbid accessingremote computers using local administrative accounts. For moreinformation, refer to the official Microsoft Help and Support website athttp://support.microsoft.com/kb/951016.

To scan remote computers running Windows Vista or later operatingsystems with Dr.Web CureNet!, disable this restriction of the UserAccount Control system (UAC).

http://support.microsoft.com/kb/951016



To disable UAC remote restrictions

This operation is recommended for experienced users only. Seriousproblems might occur if you modify the registry incorrectly.Microsoft recommends to backup the registry before you modify it.

1. Open a registry editor.

2. Locate and select the the following registry subkey:HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM

3. If the LocalAccountTokenFilterPolicy registry entry does notexist, create the entry:

a. On the Edit menu, select New, then click DWORDValue.

b. In the entry name filed, typeLocalAccountTokenFilterPolicy.

4. Right-click LocalAccountTokenFilterPolicy and selectModify.

5. In the Value data box, type 1.

6. Click OK and exit the registry editor.

7. Restart the remote computer.

8. Repeat steps 1 to 7 for all remote computers you want to scan.

You can also access domain remote computers running WindowsVista using a domain administrative account. When using a domainaccount, you do not have to disable UAC restrictions.

Network Settings

All computers that you want to scan for security threats must beconfigured to use a network where the computer runningAdministrative Console resides.



To check network settings

1. On remote computers, open the Control Panel and select toview items by Category.

2. In the Network and Internet section, click View networkstatus and tasks.

Picture 1. Control Panel

3. Do one of the following:

when configuring Windows Vista, in the Network andSharing Center select Manage Network Connections;

when configuring Windows 7 or Microsoft Windows Server2008, in the Network and Sharing Center navigationpane (on the left), select Change adapter settings.



Picture 2. Network and Sharing Center

4. Right-click the connection to the network with the computerrunning Administrative Console, and then selectProperties.

Picture 3. Network Connections



5. Ensure that the following services are installed and configured:

Client for Microsoft Networks

File and Printer Sharing for Microsoft Networks

Internet Protocol version 4 (TCP/IPv4)

Picture 4. Connection Properties

6. Save changes and close the properties window.



Share

You can allow Dr.Web CureNet! to access remote computers withthe Advanced Sharing option.

To enable Advanced Sharing:

1. Open Control Panel on the remote computer and select theview mode by category.

2. In the Network and Internet category select Viewnetwork status and tasks.

Picture 5. Control Panel: Network and Internet


when configuring Windows Vista, in the Network andSharing Center select Sharing and Discovery.

when configuring Windows 7 or Microsoft Windows Server2008, in the Network and sharing center navigation paneselect Change advanced sharing settings.

4. In the Sharing settings window select one of the following:

when configuring Windows Vista, turn on NetworkDiscovery and File Sharing.



when configuring Windows 7, in the File and PrinterSharing turn on Turn on network discovery and Turnon file and printer sharing.

when configuring Microsoft Windows Server 2008, in theFile and Printer Sharing select Turn on file and printersharing.

5. Save the changes and close the window.

Security Policy

You can configure sharing and security settings for local accounts withthe the Local Security Policy tool.

To set classic user authentication method

To open the Local Security Policy tool, you can type secpol.msc inWindows Search and click ENTER.

1. On remote computers, open the Control Panel and select toview items by Category.

2. Select System and Security.




3. From the System and Security center, open AdministrativeTools.

Picture 7. Administrative Tools

4. Run the Local Security Policy tool.

Picture 8. Local Security Policy



5. Under the Local Policies node in the policy tree, selectSecurity Options.

Picture 9. Local Policies

6. Right-click the Network access: Sharing and securitymodel for local accounts policy, select Properties and then setthe Classic - local users authenticate as themselves mode.



Picture 10. Sharing and security model

By default, connection to a remote computer can beestablished only if the used account has a non-blank password.You can disable blank password restriction by changing thecorresponding policy. To do that, right-click the Accounts:Limit local account use of blank passwords to consolelogon only policy, select Properties and then set theDisabled mode.

7. Close the console.

1.1.3. Requirements for Windows XP® or OlderOS

Each computer running the Windows Vista or Windows 7 operatingsystem that you want to scan for security threats, should meet thefollowing requirements:

All necessary network services must be installed and configuredproperly



Sharing settings must allow advanced configuration (notrequired for remote computers under Microsoft Windows Server2003)

The sharing and security model for local accounts must be set toclassic mode

Preparation of the operating system installed in the remotecomputer to use Dr.Web CureNet! must be performed under anadministrative account.

Network Settings

All computers that you want to scan for security threats must beconfigured to use a network where the computer runningAdministrative Console resides.

To check network settings

1. To access network settings of the remote computer, do one ofthe following:

when configuring Microsoft Windows 2000, open the startmenu, select Settings and then select Network andDial-Up Connections.

when configuring Windows XP or Microsoft WindowsServer 2003, open Control Panel and select NetworkConnections (if this item is absent, click Switch toClassic View).



Figure 11. Control Panel

2. Right-click the connection to the network with the computerrunning Administrative Console, and then selectProperties.

Figure 12. Network Connections

3. Ensure that the following services are installed and configured:

Client for Microsoft Networks



File and Printer Sharing for Microsoft Networks

Internet Protocol (TCP/IP)

Figure 13. Connection Properties

4. Save changes and close the window.

File Sharing

You can allow Dr.Web CureNet! to access remote computers withthe Advanced Sharing option.

To enable Advanced Sharing:

1. Open Control Panel on the remote computer.

2. Select Folder Options (if this item is absent, click Switch toClassic View).




3. In the Folder Options click the View tab.

4. Disable the Use simple file sharing option.

5. Click ОК.

Security Policy

You can configure sharing and security settings for local accounts withthe the Local Security Policy tool.

To set classic user authentication method

To open the Local Security Policy tool, you can type secpol.msc inWindows Search and click ENTER.

1. On remote computers, open the Control Panel.

2. Open Administrative Tools.



Figure 15. Control Panel

3. Run the Local Security Policy tool.

Figure 16. Local Security Policy



4. Under the Local Policies node in the policy tree, selectSecurity Options.

Figure 17. Local Policies

5. Right-click the Network access: Sharing and securitymodel for local accounts policy, select Properties and thenset the Classic - local users authenticate as themselvesmode.

Figure 18. Sharing and security model



By default, connection to a remote computer can beestablished only if the used account has a non-blank password.You can disable blank password restriction by changing thecorresponding policy. To do that, right-click the Accounts:Limit local account use of blank passwords to consolelogon only policy, select Properties and then set theDisabled mode.

6. Close the console.

1.2. Licensing

The use rights for the product are regulated by a key file.

Key File

The license key has the .key extension and contains the followinginformation:

Licensed period for the product

List of licensed anti-virus components

Subscription period when the product may be updated

Other restrictions (for example, the number of remotecomputers allowed for simultaneous anti-virus check)

A valid license key file satisfies the following criteria:

License is not expired

Integrity of the license key file is not violated

If any of the conditions are violated, the license key file becomesinvalid, a corresponding message displays, use of Dr.Web CureNet!is blocked.

For demonstrative purposes Doctor Web may provide you with ademo key file. Demo license provides full functionality for running anti-virus checks of remote computers, but does not support aversion ofdetected virus threats. No support is provided during demo period.



For more information on licensing and types of key files, visit theofficial Doctor Web website at http://www.drweb.com/.

Get Key Files

Your key file is included in the distributive package. The key file shouldbe located in the Dr.Web CureNet! folder where you extract theapplication files (usually, <DistributiveLocation>\CureNet!, where<DistributiveLocation> is the folder where you store the Dr.WebCureNet! distribution package).

Update License

When license expires or your network expands, you may need torenew your license.

To renew a license

1. Start Administrative Console.

2. On the updates and profiles page, click My Dr.Web, or on any

other page, click Help and select My Dr.Web.

This opens your personal page on the Doctor Web officialwebsite with the default Internet browser. On this page, youcan renew your current license. Once your license is valid, youcan download the latest version of the Dr.Web CureNet!distributive package which contains your renewed license.

3. Close the old Administrative Console, then run the newdistributive package to extract the program files and start theupdated Administrative Console.

License Parameters

The key file regulates the use of Dr.Web CureNet!. You can reviewlicensing parameters in the About windows of Administrative

Console. To view this windows, on any page click Help andselect About.

http://www.drweb.com/


302. Get Started

2. Get Started

Dr.Web CureNet! does not require installation or any adjustment ofcomputer settings. To start using the application and run anti-virusscans, do the following:

Copy the Dr.Web CureNet! distributive package to yourcomputer and run it. This extracts the application files to the Dr.Web CureNet! folder, automatically creates Dr.Web CureNet! Repository, and starts Administrative Console

Ensure availability of remote computers you want to scan

From Administrative Console, you can update Dr.Web CureNet!Repository.

2.1. Administration Console

Administrative Console (CureNet.exe) is the main Dr.WebCureNet! management tool, which provides you with graphical userinterface for configuring and running anti-virus scans on remotecomputers and updating Dr.Web virus databases and applicationcomponents on your computer.

Administrative Console contains the following embeddedcomponents:

Updater, which helps you keep Dr.Web virus databases up-to-date and download the latest updates to Dr.Web CureNet!executable and library files from the official Doctor Webwebsite

Network scanner, which provides you with the automatic searchfor all computers present on the networks and helps youpopulate the list of computers to scan for virus threats

Account Management tool, which allows you configure the list ofaccounts to use when connecting to remote computers forscanning


312. Get Started

While running anti-virus scans, Dr.Web CureNet! employs a specialScanning Service on remote computers. This service is implementedas a Windows application without graphical user interface which runsin the background with high priority and performs the following tasks:

Start anti-virus scans on the remote computer

Control scanning process

Collect and send scan statistics to the Administrative Console

Administrative Console starts automatically when you run the Dr.Web CureNet! distributive package.

Picture 19. Dr.Web CureNet! Administrative Console


322. Get Started

2.2. Dr.Web CureNet! Repository

Dr.Web CureNet! Repository is stored in the Repository sub-folderof the Dr.Web CureNet! folder and contains all files necessary foranti-virus scans:

Dr.Web Scanner (drweb32w.exe)

Dr.Web virus databases (drwebase.vdb, drwnasty.vdb,drwrisky.vdb)

Add-ons to virus databases (*.vdb files) including the latest add-ons (drwtoday.vdb, dwntoday.vdb, dwrtoday.vdb)

Dr.Web core (drweb32.dll).

When you start anti-virus scans from Administrative Console, thenecessary files are uploaded from Dr.Web CureNet! Repository tothe remote computers.

Dr.Web CureNet! Repository is created automatically when you runthe Dr.Web CureNet! distributive package and can be updated viaAdministrative Console only. You cannot create or update Dr.Web CureNet! Repository manually.

2.3. Detection Methods

The Dr.Web anti-virus solutions use several malicious softwaredetection methods simultaneously, and that allows them to performthorough checks on suspicious files and control software behaviour:

1. The scans begin with signature analysis, which is performedby comparison of file code segments to the known virussignatures. A signature is a finite continuous sequence of byteswhich is necessary and sufficient to identify a specific virus. Toreduce the size of the signature dictionary, the Dr.Web anti-virus solutions use signature checksumsinstead of using complete signature sequences. Checksumsuniquely identify signatures which preserves correctness ofvirus detection and neutralization. The Dr.Web virusdatabases are composed so that some entries can be used to


332. Get Started

detect not just specific viruses, but whole classes of threats.

2. On completion of signature analysis, the Dr.Web anti-virussolutions use the unique Origins Tracing™ method todetect new and modified viruses which use the known infectionmechanisms. Thus the Dr.Web users are protected againstsuch viruses as notorious blackmailer Trojan.Encoder.18 (alsoknown as gpcode). In addition to detection of new andmodified viruses, the Origins Tracing mechanism allowed toconsiderably reduce the number of false triggering of the Dr.Web heuristics analyser.

3. The detection method used by the heuristics analyser is basedon certain knowledge about attributes that characterizemalicious code. Each attribute or characteristic has weightcoefficient which determines the level of its severity andreliability. Depending on the sum weight of a file, the heuristicsanalyzer calculates the probability of unknown virus infection.As any system of hypothesis testing under uncertainty, theheuristics analyser may commit type I or type II errors (omitviruses or raise false alarms).

While performing any of these checks, the Dr.Web anti-virussolutions use the most recent information about known malicioussoftware. As soon as experts of Doctor Web Virus Laboratorydiscover new threats, the update for virus signatures, behaviourcharacteristics and attributes is issued. In some cases updates can beissued several times per hour. Therefore even if a brand new viruspenetrates the system, then after update the virus is detected in thelist of processes and neutralized.


342. Get Started

2.4. Operation Modes

Dr.Web CureNet! allows you to run antivirus scans in demo orregular mode depending on the type of key file included in thedistributive package.

Demo Mode

This mode provides you with full functionality for detecting virusthreats on remote computers. You can select stations to check, choosea scan type, and examine possibilities for threat aversion which Dr.Web CureNet! provides in regular mode. Scan statistics and resultsdisplay in Dr.Web CureNet! Report.

In this mode Dr.Web CureNet! performs no actions to avert detectedthreats.

Regular Mode

This mode provides you with full application functionality includingthreat aversion.



3. Anti-virus Scans

You can configure and start anti-virus scans on remote computersusing Administrative Console.

To ensure complete scanning using Dr.Web CureNet!, werecommend to manually disable Automatic Windows Updates duringanti-virus scans.

To scans remote computers


2. On the Welcome page, click Next.

3. On the update and profiles page, review the information onvirus databases and select a scan profile to use (by default,Default profile).

When Dr.Web virus databases become considerablyoutdated, this page displays an appropriate warning.

4. If necessary, update Dr.Web CureNet!:To download the latest updates to scan modules and Dr.Web virus databases from the official Doctor Webwebsite, click Update

To download the latest version of the Dr.Web CureNet!distributive, click My Dr.Web

5. If you choose to update Dr.Web virus databases, wait untildownload completes. If you choose to update the Dr.Web CureNet! distributive, close the old AdministrativeConsole, run the new distributive package, and proceed to theupdate and profiles page.

6. Click Next to proceed.

7. On the stations selection page, do the following:

Select remote computers to scan

Configure accounts for Dr.Web CureNet! to use whenconnecting to the remote computers



After you make your selection, click Next.

8. On the scanning mode page, select the type of scan you want to perform and change the following settings if necessary:

General settings of Dr.Web CureNet! scans on remotecomputers such as notification of remote users and rebootoptions

Types of objects to scan for viruses

Actions to perform to avert virus threats on remotecomputers

Network settings during anti-virus scans and availabilitychecks for remote computers

Network connection parameters to use when updating Dr.Web CureNet! Repository

After you make your selection, click Start.

All files necessary to perform anti-virus scan are stored in theRepository. When you initiate an anti-virus scan, the files areuploaded to each available remote computer that you selected.When upload to a remote computer completes, Dr.Web Scanner starts scanning the computer automaticallyand displays a notification in the system tray if configured.

9. Dr.Web CureNet! report reflects progress of the anti-virus scansand their results. If necessary, you can export the report inXML.

10. Anti-virus scans of remote computers run independently fromAdministrative Console. To exit Administrative Console,click Exit. Scans on remote computers continue, but statisticswill not be available.



3.1. Scan Profiles

Dr.Web CureNet! allows you to save all scan settings in XML profiles.

To create a profile

1. Click the profile name in top part of any page (by default,Default profile) and select Save.

Picture 20. Scan Profiles

2. In the Save profile window, enter the name for the profileand, if necessary, the password to use when accessing it.

Access password is required only when you saveconnection accounts in the profile.

3. Click Save profile.

4. Proceed to the following pages or click Exit.

Administrative Console does not save changes in scansettings automatically. To preserve modifications to theprofile, save the profile under the same name again.



Picture 21. Saving Profile

To use a profile

1. On any step prior to selecting actions, click the profile name intop part of a page (by default, Default profile) and select theprofile to use. On the update and profiles page you can alsoselect the profile to use in the main window ofAdministrative Console.

2. If required, enter the access password for the profile.

Picture 22. Accessing Profile

3. Administrative Console configures all scan settingsaccording to the information in the selected profile. Ifnecessary, proceed to the following pages and modify scansettings.

To delete a profile

You cannot delete scan profiles using Dr.Web CureNet!. Todelete a scan profile, delete an XML file with the profile name inthe Profiles sub-folder of the Dr.Web CureNet! folder.



3.2. Select Stations

This page helps you compose the list of remote computers to scan andconfigure access parameters.

Computers to scan are selected from the list of available stations. With Dr.Web CureNet!, you can add computers to the list using thefollowing options:

Manual selection, which allows you to add one or morecomputers by their network names or IP addresses

Automatic search, which allows you add all computers availablethrough network connections of your computer

Dr.Web CureNet! detects only those networks and computers thatare visible under the account that Administrative Console uses.

Picture 23. Stations selection page



To add computers using automatic search

1. To detect all computers present on the networks, click Searchfor Computers.

Full search may take some time. To terminate the search, clickStop Searching. All detected computers will be added to thestation list.

If a computer you want to scan was not found, add itmanually.

Picture 24. Automatic search

2. Select computers to scan:

To add a computer for scanning, select the checkbox nextto the appropriate item in the list

Picture 25. A computer to scan

To add all computers in the station list for scanning, clickCheck all

To remove all computers from scanning, click Clear all



3. After you make your selection, configure accounts for Dr.Web CureNet! to use when connecting to the selectedcomputers. By default, the account running AdministrativeConsole is used. If Dr.Web CureNet! cannot connect to aremote computer using the default account, listed accounts areused in consecutive order.

To add computer manually

1. Click Add.

2. In the Add stations window, enter one of the following:

Picture 26. Manual selection

An IP address or network name of the computer you wantto add

A range of IP addresses with a hyphen ('-') or using masks(for details, refer to Appendix A. Network Masks).

When adding a computer to the station list, ensure that thespecified IP address is not a broadcast address (reserved forsending information to all hosts on the given network).

Click OK.

3. The computers added to the stations list manually are selectedfor scanning automatically. If necessary, clear checkboxes nextto items in the list which refer to computers you want toexclude from scanning.



4. After you make your selection, configure accounts for Dr.Web CureNet! to use when connecting to the selectedcomputers. By default, the account running AdministrativeConsole is used. If Dr.Web CureNet! cannot connect to aremote computer using the default account, listed accounts areused in consecutive order.

To remove a computer from the list

1. In the list, click the item you want to remove.

Picture 27. A computer to remove

2. Click Remove.

3.2.1. Configure Accounts

This window allows you to list usernames and passwords to use whenconnecting to the remote computers you want to scan.

Dr.Web CureNet! uses these accounts to upload the necessary filesand run Dr.Web Scanner. By default, the account runningAdministrative Console is used. If Dr.Web CureNet! cannotconnect to a remote computer using the default account, listedaccounts are used in consecutive order.

To configure accounts

1. On the station selection page, click Accounts list. TheAccounts windows displays.


To add an account to the list, enter username andpassword, then click Add



Enter a username in the following format:

<domain>\<username> where <domain> is thename of the network domain with the account

<computer>\<username> where <computer> isthe network name of the computer with theaccount

If all remote computers that you want to scan resideoutside domains and have identical administrativeaccounts, you may speed up scanning by adding tothe list one common account only and omittingcomputer names. Dr.Web CureNet! will try toconnect to all remote computers using this account.

You cannot use this method if network is incorrectlyconfigured.

Picture 28. A new account

To remove an account from the list, select the appropriateitem in the list and click Remove



To edit an account, select the appropriate item in the list,then enter a new password or username and clickChange

To specify another password for an account, select theappropriate item in the list, then enter a new passwordand click Add

Picture 29. Account management

If you have difficulties entering passwords, select Showpassword.

3. After you make your configuration, click Close.

3.3. Select Actions

This page helps you configure scanning options such as extent of anti-virus scan on remote computers and actions to perform to avert virusthreats.



Picture 30. Scanning mode

Scanning Mode

By default, immediately after Dr.Web CureNet! uploads files, Dr.Web Scanner starts on the remote computer and performs anExpress scan. In this mode the following objects are scanned:

Random access memory

Boot sectors of all disks

Boot disk root directory

Windows installation disk root directory

Windows system folder

User documents folder ("My documents")

System temporary folder

User temporary folder

In this mode, files in archives are not scanned.

To instruct Dr.Web Scanner to scan RAM and all hard including bootsectors, select the Full scan mode.



The full scan may take considerable time. Once you start thescanning process, you will not be able to stop it. Scanning runsindependently from Administrative Console.

Advanced Settings

The default settings are optimal for most cases. If necessary, you canenable scanning of archives and e-mail, change default Dr.WebScanner reaction on detection of virus threats, and configure networksettings of remote computers.

To modify default settings

1. Click Settings. The Dr.Web Scanner Settings windowdisplays.

2. Configure options on the following tabs:

General

File Types

Actions

Network

Proxy

If necessary, click Apply.

3. After you make you selection, click ОК to save changes, orclick Cancel to cancel changes.

Changes affect only the current scan. Next time you start Dr.WebCureNet!, the application uses the default settings. Use scan profilesto save the settings.

3.3.1. General Tab

On this tab, you can configure general settings of Dr.Web CureNet!scans on remote computers.



Picture 31. Dr.Web CureNet! settings. General tab

Aversion of some threats requires a system reboot. For example, wheninfected files are in use during scan or when it is necessary to modifyregistry keys. On this tab, you can configure settings for curing suchinfections.

The Reboot computer or Shutdown computer modes instruct Dr.Web Scanner to perform the selected action on a remote computer ifnecessary once the scan finishes. The user of the remote computer isprovided with an appropriate warning and a short period of time tocomplete current tasks and save information. The reboot is performedone time only when scanning completes.

The Do nothing mode allows users to continue operating withoutrestart, but in this case some infections may not be cured completely.

When a virus threat is detected in the master boot record (MBR),Dr.Web Scanner terminates the anti-virus scan and reboots theremote computer immediately to avert the threat. In such cases,remote computers are rebooted regardless of the selected mode.



By default, Dr.Web CureNet! notifies users of remote computerswith a pop-up above the taskbar notification before starting anti-virusscans. To scan computers without notification, select Hidenotifications.

3.3.2. File Types Tab

On this tab, you can select additional types of objects to scan by Dr.Web Scanner on the remote computers.

You can select the following modes:

Scan archives – enable this mode to scan files in archives

Scan mail – enable this mode to scan mail files

Picture 32. Dr.Web CureNet! settings. File Types tab



If an infected object is detected in an archive, Dr.Web Scannerperforms an action specified for archives. The reaction is applied tothe archive as a whole. Dr.Web Scanner cannot apply reactionsto infected objects only.

Scanning of archives or email may decrease scanning speed.

When you run an Express scan, files in archives are not scanned.

3.3.3. Actions Tab

Threat aversion actions are only executed when operating in regularmode (with valid license key file).

When operating in demo mode, Dr.Web CureNet! only informsyou on detected threats.

On this tab, you can set Dr.Web Scanner reaction on detection ofvirus threats depending on the type of threat and object infected.

By default, Dr.Web Scanner automatically attempts to avert a virusthreat on detection or a known virus or suspicious object on theremote computer.

The reaction is set separately for each type of objects:

Infected objects, which are modified by a known andsupposedly curable virus

Incurable objects, which are modified by an incurable virus

Suspicious objects, which supposedly present a present athreat to information security

The reaction is also set separately for different types of malicioussoftware and packages (archives, e-mails, and file containers).



Picture 33. Dr.Web CureNet! settings. Actions tab

If an infected object is detected in an archive, Dr.Web Scannerperforms an action specified for archives. The reaction is applied tothe archive as a whole. Dr.Web Scanner cannot apply reactions toinfected objects only.

If necessary, you can modify the default action to one of the following:

Cure – (available for infected objects only) instructs Dr.WebScanner to try to cure objects infected with a known virus. Ifthe virus is incurable or the attempt of curing failed, the actionset for incurable viruses is applied.

Move – (not available for boot sectors) instructs Dr.WebScanner to move infected or suspicious objects to theQuarantine located on the remote computer in the %ALLUSERSPROFILE%\DoctorWeb\CureNet\Quarantine folder.

Ignore – (available for malicious software only) instructs Dr.Web Scanner to take no action on detection of a maliciousobject.



Report – instructs Dr.Web Scanner to provide information onmalicious or suspicious objects for displaying in the Dr.WebCureNet! report and take no other action.

3.3.4. Network Tab

On this tab, you can configure options of network communication onthe remote computers during anti-virus scans.

Picture 34. Dr.Web CureNet! settings. Network tab

If necessary, you can enable one of the following modes:

Block network while scanning – enable this mode to disablenetwork communication of the remote computers duringscanning and prevent recurrent infection

Terminate current NetBIOS connections – enable thismode to terminate all existing connections between yourcomputer and the remote computers you selected for scanningprior to starting anti-virus scans (required to ensure correctuploading and starting of the Dr.Web Scanner on remotecomputers)



Check access to remote computers before connecting(ping) – enable this mode to determine presence of the remotecomputers on the network prior to attempting to upload Dr.Web CureNet! files

3.3.5. Proxy Tab

On this tab, you can configure network connection parameters to usewhen updating Dr.Web CureNet! Repository.

Picture 35. Dr.Web CureNet! Settings. Proxy tab

You can select one of the following connection mode:

If you do not use proxy server, select Direct connection

To use custom connection settings when downloading updates,select User-defined and enter Address and port of the HTTPproxy server to use. If the proxy server requires authorization,enter User name and Password.



3.4. Dr.Web CureNet! Report

This page presents progress and results of anti-virus scans performedby Dr.Web Scanner on all remote computers. Statistics gathering isindependent from the quality of connection between the computerrunning Administrative Console and remote computers. If a remotecomputer goes offline during scanning, Dr.Web CureNet! updates its statistics once the computer becomesonline again.

The top of the windows displays general information on scanningstatus and statistics.

The Remote Computers section presents the following statistics forall remote computers:

Selected – Total number of remote computers selected forscanning

Found – Number of remote computers present on the network

Not found – Number of remote computers unavailable via thenetwork connections

Deployed – Number of remote computers where to Dr.WebCureNet! connected and uploaded files successfully

Deployment errors – Number of remote computers where toDr.Web CureNet! failed to connect and/or upload files

Running – Number of running anti-virus scans

Completed – Number of completed anti-virus scans

Cured – Number of completed cured remote computers whereall virus threats were averted

Restarted – Number of remote computers restarted tocomplete curing

The Objects section presents the following statistics for all objectsscanned on remote computers:

Scanned – Total number of objects scanned on all remotecomputers

Threats – Total number of virus threats detected on all remotecomputers



Neutralized – Total number of objects cured on all remotecomputers

Scan errors – Total number of objects Dr.Web Scanner failedto scan on all remote computers

Picture 36. Dr.Web CureNet! report

The scan table below general statistics presents the following data:

Column Description

Computer An IP address or network name of the remote computer.

Status Status of the anti-virus scan on the remote computer(installation, scan progress, error messages etc).

Scanned The total number objects scanned on the remote computer.

Threats The total number of virus threats detected on the remotecomputer.

Neutralized The total number of virus threats averted on the remotecomputer.

If necessary, use the filter feature to list only the statistics of interest.



Authenticity of the master boot record (MBR) is critical for theoperating system security. Dr.Web Scanner terminates the anti-virus scan and reboots the remote computer immediately if an MBRvirus is detected. This reboot is mandatory to cure an MBR.

In the Dr.Web CureNet! report, this situation is indicated byearlier completion of anti-virus scans of some computers ascompared to the others. Information on MBR virus detection is alsoprovided in the station statistics window.

The anti-virus scanning of remote computers infected with MBRviruses may be incomplete. To ensure maximum security, run theanti-virus scan on these remote computer again usingAdministrative Console.

You can view the detailed statistics of a particular scan.

To display detailed statistics

Do one of the following:

Double-click an item referring to the remote computer inthe list

Select an item referring to the remote computer in the listand click Details.

Details on the anti-virus scan of the remote computer display inthe station statistics window.

To export report

To save the Dr.Web CureNet! report in XML, click Generatereport.

3.4.1. Station Statistics

The station statistics window displays details of the last anti-virus scanof a remote computer.



If errors occur while copying Dr.Web CureNet! files to the remotecomputer, or the remote computers goes offline during scan, thiswindow displays an appropriate warning.

Picture 37. Report. Station Statistics

The Threats section includes the following statistics on all objectsscanned on the remote computer:

Number of objects infected with a known virus

Number of incurable objects

Number of suspicious objects

Number of adware programs

Number of joke programs

Number of dialer programs, which redirect modem calls topredefined paid numbers or resources

Number of potentially dangerous programs (riskware)

Number of programs for hacking computers and electronicdevices (hacktools)



The Actions section presents statistics on actions performed to avertvirus threats:

Number of objects cured

Number of objects deleted

Number of objects renamed

Number of objects moved to the Quarantine

Number of objects ignored

The Statistics section displays information on total size and numberof objects scanned on the remote computer.

The threats table below the general statistics presents details on allthreats detected on the remote computer and actions performed byDr.Web Scanner:

Column Description

Path The full path and name of the infected or suspicious object.

Threat The name of the virus threat according to the Dr.Web internalclassification (for files or boot sectors) or notification on aninfected archive.

Action The action performed to avert the virus threat.

If an infected object is detected within a package (archive, e-mail, orfile container), the table lists both the infected object, and the packagecontaining it.



Some actions (modification of registry keys or files used by otherWindows applications etc) cannot be executed immediately ondetection of a virus threat. Dr.Web Scanner marks thecorresponding objects as requiring actions after system reboot anddisplays appropriate information in the report. To avert such threats,allow Dr.Web Scanner to automatically reboot if necessary orshutdown remote computers once the anti-virus scan completes.Users of the remote computers will be provided with appropriatewarnings and a short period of time to complete current tasks andsave information.

For details on actions performed to avert virus threats, seeAdvanced Settings.

When a virus threat is detected in the master boot record (MBR),Dr.Web Scanner terminates the anti-virus scan and reboots theremote computer immediately to avert the threat. In such cases,remote computers are rebooted regardless of the Restartcomputer after cure mode. The anti-virus scanning of the remotecomputer may be incomplete. To ensure maximum security, startanti-virus scans on these remote computers again usingAdministrative Console.


594. Update

4. Update

Anti-virus solutions of Doctor Web use Dr.Web virus databases todetect malicious software. These databases contain details andsignatures for all virus threats known at the moment of the productrelease. However, modern virus threats are characterized by high-speed evolvement and modification. Within several days andsometimes hours, new viruses and malicious programs emerge. Tomitigate the risk of infection during the licensed period, Doctor Webprovides you with regular updates to virus databases and productcomponents, which are distributed via the Internet. With the updates,Dr.Web CureNet! receives information required to detect newviruses, block their spreading and sometimes cure infected files whichwere incurable before. From time to time, the updates also includeenhancements to anti-virus algorithms and fix bugs in software anddocumentation.

Updater helps you download and install the updates during thelicensed period.

Dr.Web CureNet! is a tool for centralized scanning, therefore all filesnecessary for scanning are stored in Dr.Web CureNet! Repository,and then uploaded to the remote computers when you start anti-virusscans. To use the latest virus databases on all remote computers, youneed to keep just the central Dr.Web CureNet! Repository up-to-date. When Dr.Web virus databases become considerably outdated, Administrative Console displays an appropriate warning.


604. Update

Internet connection is required for an update.

Only automatic updates are supported. Dr.Web CureNet! ignoresany files added to Dr.Web CureNet! Repository manually.

Updater helps you bring up-to-date Dr.Web CureNet!Repository only. To update Administrative Console and otherspecific Dr.Web CureNet! components, download a new Dr.WebCureNet! distributive package using My Dr.Web.

Picture 38. Dr.Web CureNet! Update.

To update Dr.Web CureNet! Repository



614. Update

2. On the update and profiles page, review information on virusdatabases and select the scan profile to use.

3. If necessary, click Update. A valid key file is required for anupdate.

Validity of your key file is also verified at the officialDoctor Web website. If your key file is blocked due tomisuse, Updater displays an appropriate warning,terminates the update, and blocks Dr.Web CureNet!components.

If your key file is blocked, contact Doctor Web TechnicalSupport.

4. When the key file is verified, Updater downloads all new filesnecessary for your version of Dr.Web CureNet!. Please, waituntil the download completes.

Picture 39. Dr.Web CureNet! update process

After update of Dr.Web CureNet! executable files or libraries, aprogram restart may be required. In such case, an appropriatewarning displays.


624. Update

To update the Dr.Web CureNet! distributive package viaMy Dr.Web

During the licensed period, you may update the Dr.Web CureNet!distributive package without limit. To ensure maximumperformance, we recommend you to update the Dr.Web CureNet!distributive package on weekly basis.


2. On the update and profiles page, click My Dr.Web, or on any

other page, click Help and select My Dr.Web.

This opens your personal page on the official Doctor Webwebsite with the default Internet browser. From this page, youcan download the latest version of the Dr.Web CureNet!distributive package provided that you license has not expired,or renew you license.

3. Download the updated Dr.Web CureNet! distributivepackage.

4. To extract files and start the updated AdministrativeConsole, run the Dr.Web CureNet! distributive package.


63Appendix А. Network Masks

Appendix А. Network Masks

A mask determines the sequence of common leading bits in IPaddresses of the computers you want to add for scanning. To select agroup of IP addresses using masks, specify an IP address of acomputer in the subnet and the mask, which determines the rest ofthe computers by bitwise AND operation.

For example, to add for scanning 254 remote computers with range ofIP addresses from 10.30.0.1 to 10.30.0.254, you can use the10.30.0.0/24 mask:

IP address10.30.0.1

00001010.00011110.00000000.00000001

Mask255.255.255.0 (24)

11111111.11111111.11111111.00000000

Minimal IP address10.30.0.1

00001010.00011110.00000000.00000001

Maximal IP address10.30.0.254

00001010.00011110.00000000.11111110

Broadcast IP address10.30.0.255

00001010.00011110.00000000.11111111

Total number of computers in the network: 254

Dr.Web CureNet! supports the following mask notations:

Quad-dotted decimal notation, for example,192.168.0.1/255.255.255.0 where 192.168.0.1 is an IP addressand 255.255.255.0 is a mask

Binary (CIDR) notation which determines the length, in bits, ofthe mask prefix, for example, 192.168.0.1/24 where192.168.0.1 is an IP address, 24 is a decimal notation of a bitmask with first 24 bits on

In IPv4 networks both notations can be use. IPv6 networks supportsthe CIDR notation only.


64Appendix B. Technical Support

Appendix B. Technical Support

Support is available to customers who have purchased a commercialversion of Dr.Web products. Visit Doctor Web Technical Supportwebsite at http://support.drweb.com/.

If you encounter any issues installing or using company products, takeadvantage of the following Doctor Web support options:

Download and review the latest manuals and guides at http://download.drweb.com/

Read the frequently asked questions at http://support.drweb.com/

Look for the answer in Dr.Web knowledge database at http://wiki.drweb.com/

Browse Dr.Web official forum at http://forum.drweb.com/

If you have not found solution for the problem, you can request directassistance from Doctor Web Technical Support by filling in theweb-from in the corresponding section of the support site at http://support.drweb.com/.

For regional office information, visit the official Doctor Webwebsite at http://company.drweb.com/contacts/moscow.

http://support.drweb.com/?lng=en

http://download.drweb.com/?lng=en

http://download.drweb.com/?lng=en



http://wiki.drweb.com/

http://wiki.drweb.com/

http://forum.drweb.com/



http://company.drweb.com/contacts/moscow/?lng=en

drweb 800 curenet en

Documents

web curenet

web solutions

web pages

doctor web customers

property of doctor web

web antivirus solutions

official web site

doctor web head office2