Dr.Web Firewall

• Protects against unauthorized access by a network; prevents data leaks; blocks suspicious connections on packet and application layers.
• The application layer connection control manages the ability of applications and processes to access network resources and registers access attempts in the applications log.
• The packet layer filtering allows controlling connection to the Internet regardless of an application that uses it. The packet filter log stores information about packets sent over network interfaces.

Cures Viruses

• Dr.Web has the industry-highest successful rate of curing active infections.
• Unique technologies for scan of processes in the memory and excellent curing capabilities allow installing Dr.Web onto the infected system without its preliminary curing.
• High probability of a successful launch of the scanning process in an infected system without an installation using a removable media.

Anti-virus engine

• Dr.Web checks archives of any nesting level. If a malicious object was archived many times and different types of archives were used, Dr.Web will detect and neutralize the threat.
• Best-of-breed technologies and algorithms allow Dr.Web to detect packed objects, analyze their components and expose hidden threats. Even if an unknown packer has been used to disguise malware, it will be detected by Dr.Web anyway.
• Unsurpassable detection rate for complex rootkits such as Shadow.based (Conficker), MaosBoot, Rustock.C, Sector.
• Blocking a virus in the RAM before it replicates itself to a hard drive lowers the probability for malware to exploit a vulnerability of a third-party application or the operating system itself.
• Dr.Web detects and neutralizes viruses that can be found only in the RAM but don't exist as files on a hard drive. July 2001 saw the epidemics of CodeRed virus and Dr.Web turned out to be the only anti-virus capable of detecting it. Even now few anti-viruses can detect malware like CodeRed or Slammer.

Detection of unknown threats

• FLY-CODE is a unique universal decompression technology implemented in the Dr.Web scanner. It allows unpacking files compressed with unknown packers. Special entries in the virus database are used by the scanner to guess if a packed file contains malicious code. Files detected by means of this technology are reported as "Probably Trojan.Packed".
• Origins Tracing^TM is the cutting-edge technology that allows detecting malicious code that has not been registered by security vendors. It has already proven its efficiency during epidemics that caused data losses to many users of competitive solutions. Origins Tracing^TM allowed reducing the size of the virus database and decreased the number of false positives by the heuristic analyzer.
• The heuristic analyzer detects most known threats with its analysis based on criteria typical of various groups of malicious programs.

Self-protection

• Dr.Web SelfPROtect is implemented as a driver that runs on the lowest system level. It can't be stopped or disabled unless the system is restarted.
• In order to keep the anti-virus operational Dr.Web SelfPROtect can restrict access to files, folders, removable data storage devices and certain branches of the Windows Registry.
• Some anti-viruses modify the Windows kernel (intercept interrupts, change vector tables or use other undocumented features). It may have a negative impact on the stability of a system and path new ways for malicious programs to get into a system. At the same time Dr.Web SelfPROtect maintains security of the anti-virus and doesn't interfere with routines of the Windows kernel.

Anti-rootkit

• Dr.Web Shield^TM ensures detection of viruses featuring rootkit-technologies that allow them to hide their presence in the system.
• Dr.Web Shield^TM provides the scanner with privileged access to files, registry and other key system components so it would be able to expose rootkits and block self-protection features of rootkits and stealth-viruses.

SpIDer Guard® file monitor

• Provides real-time protection and instant interception of all calls to files on hard and removable drives, floppy and compact disks, flash drives and smart cards.
• Resists attempts of malicious programs to disrupt its operation.
• Flexible configuration of SpIDer Guard allows changing the software settings on-the-fly depending on the actual load of the system.
• Implemented as a Windows service SpIDer Guard provides a corporate network administrator with an opportunity to restrict user rights regarding changes of its configuration.

Protection of e-mail

• SpIDer Mail doesn't depend on an e-mail client and won't delay receipt of e-mail.
• It supports SMTP/POP3/NNTP/IMAP4 mail protocols.
• Individual rules can be created for different types of malicious programs - viruses, riskware, adware, hack tools, paid dialers and jokers.
• The Virus activity control feature protects a system against mass mailings performed by mail worms. SpIDer Mail examines components of a message and considers sending time in order to determine if an outgoing message is a part of malicious activities in a system.

Compact and user-friendly

• Software can be set to update automatically, on-demand or according to a schedule.
• Update files are downloaded very quickly even if a connection speed is low.
• There are always available update servers.
• No need to restart a computer after updating. Dr.Web starts using the latest virus definitions right away.

Virus monitoring service

• The Doctor Web virus monitoring service collects malware samples all over the world.
• A hot update is released immediately after a new threat has been analyzed.
• As an update is released, it becomes available on several servers located in different parts of the globe to all Dr.Web customers.
• A new update is tested over a huge number of clean files to ensure that no false detection will occur.
• An intelligent system automatically adding similar viruses to a database ensures even prompter response to emerging threats.