Cures viruses

High detection rate and speed of scanning are not the only criteria that determine the quality of an anti-virus. It should also be capable of curing files – restoring them to their original state instead of deletion making sure that a user doesn’t lose important information.

• Improved! Dr.Web has the industry-highest successful rate of curing active infections.
• Improved! Unique technologies for scan of processes in the memory and excellent curing capabilities allow installing Dr.Web onto the infected system without its preliminary curing.
• High probability of a successful launch of the scanning process in an infected system without an installation using a removable media.

Self-protection

Dr.Web SelfPROtect makes the anti-virus immune to any attempts of malicious programs to disrupt its operation.

• Dr.Web SelfPROtect is implemented as a driver that runs on the lowest system level. It can’t be stopped or disabled unless the system is restarted.
• In order to keep the anti-virus operational Dr.Web SelfPROtect can restrict access to files, folders, removable data storage devices and certain branches of the Windows Registry.
• Some anti-viruses modify the Windows kernel (intercept interrupts, change vector tables or use other undocumented features). It may have a negative impact on the stability of a system and path new ways for malicious programs to get into a system. At the same time Dr.Web SelfPROtect maintains security of the anti-virus and doesn’t interfere with routines of the Windows kernel.

Anti-virus engine

• Improved! Dr.Web checks archives of any nesting level. If a malicious object was archived many times and different types of archives were used, Dr.Web will detect and neutralize the threat.
  
  
• Improved! Dr.Web can scan archives of any nesting level and detects malicious objects disguised using several archivers.
  
  
• Improved! Best-of-breed technologies and algorithms allow Dr.Web to detect packed objects, analyze their components and expose hidden threats. Even if an unknown packer has been used to disguise malware, it will be detected by Dr.Web anyway.
  
  
• Improved! Unsurpassable detection rate for complex malware such as MaosBoot, Rustock.C, Sector.
  
  
• Blocking a virus in the RAM before it replicates itself to a hard drive lowers the probability for malware to exploit a vulnerability of a third-party application or the operating system itself.
  
  
• Dr.Web detects and neutralizes viruses that can be found only in the RAM but don’t exist as files on a hard drive. July 2001 saw the epidemics of CodeRed virus and Dr.Web turned out to be the only anti-virus capable of detecting it. Even now few anti-viruses can detect malware like CodeRed or Slammer.

Anti-rootkit

• Improved! Dr.Web Shield™ ensures detection of viruses featuring rootkit-technologies that allow them to hide their presence in the system.
  
  
• Dr.Web Shield™ provides the scanner with privileged access to files, registry and other key system components so it would be able to expose rootkits and block self-protection features of rootkits and stealth-viruses.

Detection of unknown threats

Advanced Dr.Web technologies detect unknown threats and keep your personal information safe.

• New! FLY-CODE is a unique universal decompression technology implemented in the Dr.Web scanner 5.0. It allows unpacking files compressed with unknkown packers. Special entries in the virus database are used by the scanner to guess if a packed file contains malicious code. Files detected by means of this technology are reported as “Probably Trojan.Packed”.
  
  

• Improved! Origins Tracing™ is the cutting-edge technology that allows detecting malicious code that has not been registered by security vendors. It has already proven its efficiency during epidemics that caused data losses to many users of competitive solutions. Origins Tracing™ allowed reducing the size of the virus database and decreased the number of false positives by the heuristic analyzer.
  
  
• Improved! The heuristic analyzer detects most known threats with its analysis based on criteria typical of various groups of malicious programs.