The page may not load correctly.
Both are aimed at keeping the anti-virus current to protect a computer against any and all threats, including the latest ones. The difference is that when only the virus databases are updated, you don’t need to reboot the system, but when the anti-virus components are updated, rebooting may often be necessary. We strongly recommend that you act on Dr.Web reboot notifications related to component updates because out-of-sequence updating may lead to a weakening of protection.
Rebooting is needed so that the updated Dr.Web drivers work properly with the operating system. Our competitors’ anti-virus solutions are updated in the same manner.
Doctor Web strives to release Dr.Web component updates, especially critical ones, as quickly as possible. After all, the reliability of the protection directly depends on the anti-virus’s ability to intercept and cure the latest threats and still operate error free. Experience shows that for each individual product, updates that require a reboot are being released no more than once or twice a month, the only exception to this being recently released program versions and those under active development.
In the window that notifies users that a reboot is required, you can choose when you want the system rebooted. You can choose to do it now or postpone it until a time convenient for you.
Just one Dr.Web database entry can lead to the detection of tens, or hundreds, or sometimes even thousands of similar viruses.
Moreover, the presence of Origins Tracing™ and structural entropy analysis in the Dr.Web anti-virus makes it possible to detect malicious programs that are so new they have yet to undergo analysis in the Doctor Web anti-virus laboratory.
The smaller number of virus entries (compared to some other anti-virus programs) even makes it possible to detect unknown viruses (i.e., those not in the virus database) with a high degree of certainty. These are viruses that will be created on the basis of existing viruses.
How do users benefit from the small size of the virus database and the fewer number of entries in it?
Thus, the fundamental difference between the Dr.Web virus databases and the virus databases of other anti-virus programs is that with its fewer number of database entries, the Dr.Web database allows as many (or even more) viruses and malicious programs to be detected.
Virus databases do indeed get larger with each update. But Dr.Web solutions use the most cutting-edge anti-virus database format so that as the virus databases get bigger, scan speed is not reduced.
Moreover, because the latest technologies are applied to Dr.Web solutions, the size of the virus databases can be reduced. This is because they exclude entries containing information about malicious programs that are automatically detected with the help of the newest technologies.
When an Internet connection is present, the anti-virus updates every 30 minutes by default (this is the most optimal setting).
When required, you can change this setting by doing the following: right-click on the Dr.Web icon located in the bottom-right corner of the system tray. Then, in the context menu, select Tools → Settings and go to the Updating tab.
Alternatively, you can update the anti-virus manually by right-clicking on the Dr.Web icon in the bottom-right corner of the system tray, and then selecting Updating in the context menu.
No, that’s not true. When you buy the anti-virus, you are paying not only for the program itself, but also for the right to get anti-virus database and module updates as well as the opportunity to contact the technical support service while your license is valid. Nobody will ever come after you for additional money! Proof of this can be found in the Dr.Web license agreement which you are invited to read before you install the anti-virus. Doctor Web assumes a number of obligations and guarantees the following:
‘Throughout the entire software usage period, the User is granted the right to receive through the Internet virus database updates as well as upgrades of the software modules as they are made available by the Rights Holder’.
The Dr.Web license agreement is a legal document that guarantees your rights as a consumer.
Hundreds of thousands of new viruses appear DAILY — and correspondingly, tens of thousands appear every hour. The overwhelming majority of them are modifications—brothers and sisters of existing viruses. Yes, the Dr.Web heuristic analyser and the Dr.Web behavioural analyser really do make it possible to detect with a high degree of probability that a file has been infected or is a Trojan itself. But “probably infected” does not mean “infected for sure”! This file will be declared a virus only after its virus signature has been added to the Dr.Web virus database.
But no anti-virus software vendor will ever guarantee you that today won’t be the day that somebody writes a brand new virus that can’t be detected by even the most perfect heuristic analyser.
As a rule, malicious programs reach their victims at the same time they reach the Doctor Web anti-virus laboratory for analysis, and in the case of the newest malicious programs (those not yet detected by any available mechanism), anti-virus analysts need time to develop and test a “cure”. Frequent updating makes it possible to minimise the time it takes for potential victims of criminal attacks to get hold of updates. Often ‘cures’ for malicious files are available, but have not yet been downloaded.
Unlike its competitors, Doctor Web’s principled position is to release updates as frequently as possible so as to minimise the time period during which new threats can pose a danger.
That is why the anti-virus databases need to be updated every time the computer is connected to the Internet or as frequently as possible if the connection is continuous.
First do the following:
If after trying the above, you are still experiencing difficulties, please contact the Doctor Web technical support service and describe in detail how your computer connects to the Internet (note: if a proxy server is involved, please specify whether authentication is required, and whether your browser or Dr.Web update module is configured to be used via the proxy server).
The update mirror is the folder to which update files are copied. The update mirror can be used as the Dr.Web update source for other local network computers that are not connected to the Internet.
Click on the Dr.Web icon in the system tray, and in the Dr.Web menu, select Security Center;
First, on any computer with Internet access, copy the following 3 files—take them from a computer on which a standalone anti-virus requiring updating is installed:
These files are necessary and sufficient to start creating an update mirror. In the example below, all of these files will be saved in the folder C:\mirror on a PC with Internet access.
The update utility has several operating modes and a myriad of parameters, which are described in the documentation. After placing all the above-mentioned files in the correct directory (in this case, C:\mirror), you must run the command prompt as administrator and set the following command in it:
C:\mirror\drwupsrv.exe -c download -s 90 --zones=C:\mirror\drwzones.xml -r C:\mirror\repo --key-dir=C:\mirror --data-dir=C:\mirror -l --log-dir=C:\mirror --verbosity debug
|-c [ --command ] arg (=update)||
The executable command: getversions — get versions, getcomponents — get components, update — update, uninstall — remove, exec — execute, keyupdate — update the key, download — download.
In our case, the update mirror must first be downloaded. Accordingly, the download mode is used for downloading.
|-d [ --data-dir ]||The path to the directory where the current product repository is located. In practice, indicating this parameter is very important if any version of the Dr.Web anti-virus is already installed on the PC where the mirror is being created.|
|--key-dir arg||The directory serving as the location of the current key, without which the download from the zone will be impossible. If the parameter is omitted, the key is taken from the directory in which the updater itself is located.|
|-l [ --progress-to-console ]||Display information in the console about the update utility’s operation. It can be convenient to track the updating process or the mirror’s creation in real time.|
|--log-dir arg||Sets the utility’s regular log location directory with the default name — dwupdater.log. If this parameter is not specified, the log will still be recorded, but in its regular directory C:\ProgramData\Doctor Web\Logs, which is not always convenient.
|-r [ --repo-dir ] arg||The repository folder in which the update mirror will be downloaded. By default <data_dir>/repo|
|-s [ --version ] arg||The name of the product list version. For all product versions, starting with 9.0, this parameter is 90. That means that this parameter will always be equal to 90 for 10.0, 11, 11.5, or 12.0.|
|-v [ --verbosity ]||Sets the update utility’s log verbosity. It can have the following values: error (standard), info (advanced), debug (debugging).|
|--zones arg||The path to the file containing a list of update areas (drwzones.xml). This tells the update utility where to download the mirror from.|
-g [ --proxy ] lets you specify the address of a proxy server for updating in the format <address>: <port>. Example
If, on the PC where the mirror is being created, a proxy server is used when connecting to the Internet, when you start creating the mirror from the command line, you need to set additional parameters:
C:\mirror\drwupsrv.exe -c download -s 90 --zones=C:\mirror\drwzones.xml -r C:\mirror\repo --key-dir=C:\mirror --data-dir=C:\mirror -l --log-dir=C:\mirror --verbosity debug --proxy=18.104.22.168:3128 --user=qwerty --password=qwerty
-u [ --user ] и
-k [ --password ] allow you to specify the proxy server login and password, if available. Example:
-u qwerty -k qwerty
You can find out the name of the current computer in a variety of ways. The fastest one is the shortcut Win + Pause break. In the System Properties window – Computer name. You can also open the properties of any shortcut or file and go to the tab Details or Security. Another way to find out a local computer’s name is using the hostname command. You can find out the name of a remote computer by running ping with the parameter -a, for example: ping -a 22.214.171.124
In the Update source section, you can also select the option Anti-Virus Network. In the opened line, select the local address of the computer on which the Dr.Web product is installed and the update mirror is configured.
Similar to the download mode (download) the utility also has the update mode (update) and a corresponding set of parameters, some of which are unique for this mode.
To run the utility in the update mode, the parameter
-c [ --command ] with the update value is used.
To initiate updating from the mirror that is, in this example, located in the folder
C:\mirror\drwupsrv.exe -c update -r C:\mirror\repo -l --log-dir=C:\mirror --verbosity debug
Important! Updating the anti-virus from the mirror using the update utility in command line mode has its own characteristics. The anti-virus installed on the computer will not record such a launch of the update utility. The databases and components will be updated, but the main control anti-virus service "will not find out" about it. Similarly, only using the update utility log can you find out whether the updating process occurred correctly. It follows from this that when using a similar way to update the product, you may receive the error "The virus databases are outdated", when in fact they will be updated. This feature is related to the anti-virus architecture. Launching the update utility separately from the control services is a process that is required only for service purposes.
Usually, it is recommended that you use the standard way to update via the interface.
Certified versions can be updated using one of two methods:
Versioning and the originality of files is very important if a certified product is installed on an isolated computer. Updating a certified version via the mirror that was created by the actual (release) version of the anti-virus will change the checksums of the executable files and lead to the loss of Information Security System certification status. The drwzones.xml file, taken from the anti-virus that was installed from a certified distribution, will contain its own update zone. During the mirror creation process, it will be used to load database and component updates. Using a release drwzones.xml will lead to the loss of the certified status.
To minimise the risks of damaging files when transferring them manually to the directory from which updates will be downloaded, we recommend using a file manager with a binary data transfer mode when transferring a folder. An alternative solution is to transmit files in an archive.
Update the anti-virus on computers, using the obtained repository.
Anti-virus update downloads can include updated anti-virus databases as well as application files. In the latter case, a system restart may be required to apply the update. And in this case, the corresponding notification will appear.
The user can restart the system immediately—by closing all the running applications and pressing the Restart now button. They can also make the anti-virus show the notification later or schedule a system restart. To use either of the two latter options, first select Remind me later.
You can set the reboot time to occur within the next 24 hours.
Users are also able to restart the system on their own whenever they want. For example, go to Start → Shut down or sign out→ Restart/Shut down.
Important! Selecting the option to enter sleep mode or switching user accounts won't restart the system so that the pending updates are applied.
Important! Pressing the power button on a tablet or laptop will make the device enter sleep mode. To apply updates, restart the system using any of the available methods (including the restart option in the anti-virus notification pop-up).
Doctor Web is a Russian cybersecurity company focused on threat detection, prevention and response technologies.
Doctor Web in social networksLink accounts