Lists of frequently asked questions

Search:

Services

Terms

Malware analysis — malware research by Doctor Web security researchers.
Anti-virus laboratory — the Doctor Web division whose specialists (virus analysts) analyse malware and potentially dangerous software, decrypt files, analyse VCIs and other computer incidents, and release Dr.Web updates, hotfixes, workarounds and virus database updates.
Beta version — a preliminary Dr.Web version that is offered to an indefinite range of stakeholders for testing purposes (to test its features or compatibility). It can contain errors and is not recommended to be used in a production environment. Technical support is not available to users of beta versions.
A virus-related computer incident (VCI) — a computer incident that occurred as a result of a malicious program(s) or of using a malicious program(s). A VCI can, for example, result in theft, data leaks, information resource hacking, information system surveillance, information system disruptions or data modification using malicious software and potentially dangerous software.
Malicious software — a malicious program(s), i.e., a program(s) or other computer information intentionally designed to carry out the unauthorised deletion, blocking, modification, and copying of computer data or the neutralisation of its means of protection.
Ticket response time — the time between a request’s creation and the initial response from a technical support specialist in the corresponding ticket. A ticket’s response time depends on the support level to which a Dr.Web user is entitled.
Request creation time — the time that a Dr.Web user submits a request.
Trial license (trial) — a time-limited, free full version license/sublicense (from 14 days to 3 months) intended for customer use to test the Dr.Web software.
Detect — a specific anti-virus software reaction indicating that signs of malware, potentially dangerous software or other software containing unsafe features may have been detected on a scanned object.
Dr.Web software defect (bug) — a Dr.Web software error that has been recognised by the developer and considered to be corrected with the help of an update or a hotfix release.
Request — a Dr.Web user request that has been submitted to the technical support service via the request interface at support.drweb.com (hereinafter–Request form) or via the user’s Dr.Web personal account area.
Request initiator (Ticket initiator) — a Dr.Web user who submits request to the technical support service.
Computer incident — the fact of a violation and (or) termination of the functioning of an object within the information infrastructure, the telecommunication network used for the interaction of such objects, and (or) the violation of the security of the information processed by such an object, including those that have occurred as the consequence of a computer attack.
Conflict (incompatibility) — a violation or the absence of Dr.Web’s normal interaction with third-party software installed on a protected device, as well as the situation occurring when the simultaneous installation of Dr.Web and another software program can cause Dr.Web, the third-party software, or the protected device to operate incorrectly.
False positive — failure in Detecting malware or Detecting software that is not malware, potentially dangerous software, or suspicious software.
Dr.Web version numbering — a numerical designation of Dr.Web generations, consisting of 3 parts: major (current) version (before the first dot), minor version (before the second dot), and version update (after the second dot). For example: 11.0.2.
Update (of versions, program modules, virus databases) — all changes made to the Dr.Web software and databases that are, for example, associated with adding new functionality. Version upgrading is accompanied by a change in version number.
Workaround — a temporary solution to eliminate an identified problem or defect in the Dr.Web software, which implies that a full correction will be made in the future.
Ticket operator — a technical support service employee who is responsible for processing requests in the tracker.
Software — computer software.
Dr.Web software — any software developed by Doctor Web — the owner of the exclusive rights to the Dr.Web family of anti-virus software.
Potentially dangerous software — software that may be used for malicious purposes: for the unauthorised deletion, blocking, modification, and copying of computer data or the neutralisation of its protection.
Decryption — the recovery of a user's decrypted files.
AVS — Doctor Web Ltd.'s anti-virus solution.
Incident severity — characteristics of a computer incident involving Dr.Web or VCIs in a system protected by Dr.Web. The technical support specialist and the Dr.Web user (the request initiator) may interpret the severity of an incident differly.
Sales support service — several Doctor Web divisions tasked with providing consulting services to Dr.Web users regarding the purchase of non-exclusive licenses/sublicenses to use Dr.Web software.
Technical support service — the Doctor Web division tasked with providing operational assistance to Dr.Web users on issues related to Dr.Web’s installation, configuration, operation and removal, and other assistance related to information security, including technical investigations of computer incidents and virus-related computer incidents that have occurred in Dr.Web users' systems, within the scope of their rights.
Ticket lifecycle — the time from when a request is created to the moment the ticket is closed by its initiator or operator.
Ticket status — the status that is assigned to a ticket depending on its lifecycle stage. All statuses.
Ticket — a formalised record in the tracker containing the communications between its initiator (the Dr.Web user) and its operator (the technical support specialist) on the topic of the corresponding request.
Tracker — the technical support service used to receive and process requests from Dr.Web users.
Hotfix — the prompt correction of a detected critical defect (bug) in the Dr.Web software.

Decryption of data encoded by ransomware Trojans

My files have been encrypted by malware. If I buy a Dr.Web license, will I be able to have them decrypted free of charge?

Unfortunately, the probability of successfully decrypting your files is less than 1% (find out more). We will only be able to tell you for sure after you provide our technical support engineers with several samples of the encrypted files.

Permanent link

I do not use Dr.Web. Can you still decrypt files for me?

We will only be able to tell you for sure after you provide our technical support engineers with several samples of the encrypted files. Unfortunately, the probability of successfully decrypting your files is less than 1%. Find out more.

Permanent link

Where can I file a request to have my files, which have been compromised by encryption ransomware, decrypted?

Use the form at https://support.drweb.com/new/free_unlocker/?keyno=&for_decode=1&lng=en.

Permanent link

Who can file a request for free decryption?

You are welcome to submit a request via the form.

You can find the list of reasons why Doctor Web may decline requests for free data recovery here.

Permanent link

My customer's data has been corrupted by encryption ransomware. How can I submit a decryption request on their behalf?

If, at the moment of infection, you had a valid commercial Dr.Web license and the current version of Dr.Web Enterprise Security Suite/Dr.Web Desktop Security Suite/Dr.Web Security Space was installed, you are entitled to free decryption if it is possible. Submit a request for free decryption via the form. Attach to your request the power of attorney that entitles you to represent the interests of the customer, as well as documents confirming that your customer is the legal owner of this license (a photo or a scanned copy of the license certificate, the payment receipt, an email from the online store or other confirming documents).

You can find the list of reasons why Doctor Web may decline requests for free data recovery here.

Permanent link

Ticket statuses in Doctor Web's technical support tracker

New — the ticket has been created by the user, but it has not yet been processed by Doctor Web’s support engineers.
Acknowledged — the ticket is assigned to a Doctor Web support engineer for processing.
User response needed — the Doctor Web support engineer has replied to the user's question and now waits for the user to react to this answer or close the ticket to indicate that their question has been resolved.
Pending support response — the user has made an entry in the ticket and now awaits the support engineer's response.
Closed — the ticket is closed by the customer, the support engineer, or automatically. This means that the work it complete. The user can still open the ticket and read its notes.
Waiting for (development response / virus monitoring service response / partners department response) — the question cannot be resolved either partially or completely by the technical support engineers since it is not within their scope of competence. The question is forwarded to profile specialists, and the answer is awaited from them.
Waiting for updated component release — the technical support engineers cannot solve the issue, and a product update is required. The ticket is put into release standby mode, and the date of release depends on Doctor Web development department procedures.
Closed (decryption failed) — files corrupted by encryption ransomware cannot be recovered.
Closed (decryption success) — files corrupted by encryption ransomware were recovered.

Permanent link

How to quickly access the support request form

Using the Contact us widget, access the support request form by clicking on the Query form button.

Permanent link

How to create a support request from your Doctor Web account

Sign in to your Doctor Web account via the sign-in widget in the Profile tab.
Using the Contact us widget, access the support request form by clicking on the New ticket button.

Why is it better to contact the support service via My Dr.Web Portal?

No need to enter your license information
Your entire support request history is here

Why is it better to write than call?

We respond quickly
We’ll need logs and others additional files for our investigation
The correspondence history will be stored

Permanent link

How to create a support request in My Dr.Web Portal for business users

Sign in to My Dr.Web Portal via the sign-in widget in the Profile tab.
In My Dr.Web Portal, click on the Contact us widget and then on the New ticket button.
Ask your question in the support request form.

Why is it better to contact the support service via My Dr.Web Portal?

No need to enter your license information
Your entire support request history for all your accounts is here
Your employees’ work with Doctor Web's support service can be monitored

Why is it better to write than call?

We respond quickly
We’ll need logs and others additional files for our investigation
The correspondence history will be stored

Permanent link

Recovering a blocked key file

How to restore a magazine license , demo or OEM license

These are non-commercial licenses (they are not for sale) and, therefore, cannot be restored.

To continue using Dr.Web, purchase a commercial license in the Dr.Web eStore or from an authorized Doctor Web partner

Permanent link

If you access the service to restore a blocked key file via My Dr.Web Portal

Log into My Dr.Web Portal—select the appropriate option from the menu of your Dr.Web application.
Go to the ‘Licenses’ section, and in the ‘Blocked’ tab, select ‘Replace serial number’.

What happens next

A new serial number will be sent to the email address you specified when you registered the serial number.

IMPORTANT! If you no longer use this email address, contact Doctor Web's Technical Support Service to replace your license.

Permanent link

If you've already used the one-time option to restore your license free of charge

If your license has been blocked because of piracy, it means that you violated the terms of the license that enabled you to use the Dr.Web key you received when you registred your serial number. You have violated terms in clauses 5.1. and/or 5.3 of the Doctor Web software usage agreement you accepted when registering your Dr.Web serial number.

clause 5.1… The software can only be used within a specified period of time, under a defined operating system and with the number of protected objects specified in the license key file, and in accordance with other parameters specified in the file.

«п. 5.3... You can store no more than two backup copies of a license key file. You may not give these copies to a third party or place them on tangible media that is accessible to a third party or make the files accessible to the public over the Internet or by any other means. If a valid key file is found to be in the public domain, the Rights Holder is entitled to render a software copy non-operational and disable its features.

If you have already used the one-time option to restore a Dr.Web key file and wish to continue using Dr.Web, you need to renew or expand (if necessary) your blocked license — via the Dr.Web eStore or an authorized partner of Doctor Web.

In either case, you will get a renewal discount — starting at 40% for a one-year license.

Permanent link

What’s in the report produced by the Dr.Web utility used to collect system information?

A report contains the following information:

Technical information about the operating system:
- general system information;
- launched processes;
- scheduled tasks;
- services, drivers;
- the default browser;
- installed applications;
- restriction policies;
- the HOSTS file;
- DNS servers;
- entries in the system event log;
- a list of system directories;
- registry branches;
- Winsock providers;
- network connections;
- Dr.Watson debugger reports;
- performance index.
Information about the installed Dr.Web software:
- type and version of the installed Dr.Web software;
- information about the set of installed components;
- information about the Dr.Web software modules (files);
- settings and configuration parameters of Dr.Web software;
- license information;
- Dr.Web software operation logs.

Permanent link

Download Wizard

How to sign in to the Download Wizard

Use the Download Wizard to download distributions for Dr.Web products and the documentation for them. Access to these files is provided in accordance with your Dr.Web product’s license; this helps avoid confusion — you will only be able to download those files that may be needed.

The Download Wizard is available at https://download.drweb.com/.

Enter your license’s serial number and the email address you used to register it. If your license hasn't yet been registered, register it using the service at: https://products.drweb.com/register.

Permanent link

The license covers one product — how to download

Let's assume that you have a Dr.Web Desktop Security Suite license.

Once you sign in to the Download Wizard, you will be prompted to choose the OS that you want to protect. Let’s say that you have workstations running Windows and Mac. Select the corresponding checkboxes and click on the Send button.

In the next step, select the Dr.Web Enterprise Suite version.

Always use the latest version of Dr.Web.

If you are going to use centralised anti-virus protection, select the appropriate edition of the Dr.Web server distribution. Each operating system has its own edition of Dr.Web server. For example, if the Dr.Web server will be installed on Windows, select Dr.Web server's Windows edition.

You will see a link to download the Dr.Web server distribution.

The distribution also contains installation files for workstations running Windows, Windows Server, Linux and Mac. That's why you usually do not need to download other distribution files.
Also download the documentation (the Administrator Manual, the Anti-virus network Installation Guide and the Installation Guide).
If the network connection between the Dr.Web server and the protected stations has significant speed restrictions, use the full version of the anti-virus agent to install the anti-virus on the stations.
If you are going to install Dr.Web server on a computer that is not connected to the Internet, you can take advantage of the Dr.Web repository downloader. Use it to download updates to a local folder on any computer that is connected to the Internet; then use this folder to update the Dr.Web repository on the computer where Dr.Web server is installed.
- If you do not intend to use centralised protection, download individual Dr.Web distributions for the workstations. Since you previously selected Windows and Mac stations, the Download Wizard will offer you links for downloading the distributions specifically for these operating systems.

Permanent link

The license covers two products — how to download

Once you enter your serial number, choose the OSs used by the protected objects — workstations and servers. In this example, this is Windows workstations and a couple of servers — one for Linux and one for Windows. Select the corresponding checkboxes. For the Linux server, select "Unix". Click on the Send button.

Also, download the documentation (the Administrator Manual, the Anti-virus network Installation Guide and the Installation Guide).
If you are going to use centralised anti-virus protection, just select the Dr.Web Enterprise Suite version and the edition of the Dr.Web server distribution for your OS.
If you do not intend to use centralised protection, download individual Dr.Web distributions for workstations and servers.

Individual distributions are provided for different types of OSs.

Permanent link

How can I track the status of a ticket via the @DrWebSupportBot in Telegram?

To configure tracking, do the following:

Find the DrWebSupportBot account in Telegram or follow the link https://telegram.me/DrWebSupportBot.
In the bot's main menu, select "Connect to Dr.Web account". In this step, the bot will request an authorisation code that will link your Doctor Web account with your Telegram account.
Go to the page https://www.drweb.com/user/profile/authenticator/?lng=en to get the authorisation code and copy it.
Send the acquired code in a message to the bot.

Done—now you will receive notifications on all ticket status changes in the form of a bot notification.
This option is available only for those tickets that were created after the authorisation code was entered.

You can unlink your account from the bot on your own by clicking on the "Disconnect from Dr.Web account" button in the bot's menu.

Permanent link

Back

Nothing found

Find out more

User
Guide

Configure
Dr.Web!

Training
courses

Video