
    Antivirus program Doctor Web for FreeBSD (Version 4.32)

             Copyright (c) 1992-2004, Igor Daniloff
    Igor Daniloff's antivirus laboratory, DialogueScience, Inc.

                         User manual


1. INTRODUCTION
2. INSTALLING DOCTOR WEB ANTIVIRUS PROGRAM
  2.1. Installing Doctor Web for FreeBSD
  2.2. Package registration
  2.3. Updating the program and virus databases
3. USING DOCTOR WEB SCANNING MODULE
  3.1. Package files arrangement
  3.2. Starting the scanner program
  3.3. Command line options
  3.4. Configuring scanner program
4. CONTACTS


                       1. INTRODUCTION

Doctor Web, an antivirus program, besides the versions for Windows
95/98/Me/NT/2000/XP, DOS/386, OS/2 and Novell NetWare, is now offered as
versions for the Unix-like systems - Linux (based on glibc 2.1, 2.2 and 2.3), 
FreeBSD (3.x, 4.x, 5.x), SunOS Solaris (5.8, 5.9, 5.10; Intel only) and
OpenBSD (3.x).

It should be noted that there are two aspects of struggling against viruses
in Unix-like operating systems (hereinafter - Unix systems). The first is
that of protecting local system and user data against the destructive
impact of virus programs. Till recently this aspect was of merely
theoretical interest. But starting from January, 2001 practically any Unix
system user (in the first place Linux OS users, it being the most
widespread) may face such problems, like users of such desk-top OS as
Windows of any version.

The second aspect is that of virus diagnostics which will render viruses
harmless if Unix system is used as platform for communication services,
first of all mail servers, file servers of local networks etc. It does not
necessarily regard viruses specific for Unix systems, in most cases those
will be usual Windows viruses, including macroviruses for Word, Excel and
other office applications, transmitted by local networks and mail services.

Antivirus program Doctor Web for Unix systems performs both functions. On
one hand it is a scanner Dr.Web aimed at detecting and curing viruses on a
local computer. On the other hand there is a component Dr.Web Daemon
(daemon) in the package which may be used practically in any data
processing system as attached external antivirus filter. For example, mail
systems (such as Communigate Pro, Sendmail, Qmail, Exim, Postfix, Zmailer
and others) may be quite easily and quickly set for using Dr.Web daemon to
check the e-mail messages transmitted by the mail server.

In the present manual we will dwell on the first aspect of using Doctor Web
program in Unix systems, i.e. on detecting and neutralizing viruses on a
local computer. Here we will cover the following points:

- general characteristics of the program, distinctions between the versions
- installing the program from the packages of different formats (chapter 2);
- using virus scanner, mainly on the local computer (chapter 3).

As for the second aspect, you can find the details in the separate manual
(readme.daemon).

In the ending chapter you will find contact information about the
developers and technical support service.

It should be said that Doctor Web program gets continuously improved.
Adds-on to databases of the known virus get released daily (as a rule,
several times a day). The program gets improved both towards perfecting
diagnostics methods and struggling against viruses and towards integrating
it with other applications to Unix systems. Besides, the number of
applications able to work jointly with Doctor Web constantly increases.
That is why it is possible that some details of setting up and utilization
of the current version will differ from that described in the present
manual. To get the present-day information on the program you should turn
to the files of electronic documentation, enclosed in the delivery package.

You can download evaluation version of any delivered package for free from
http://www.drweb.com.

Besides the program itself the developer's site offers also regular adds-on
to databases of the known viruses. Those are common (for all the platforms)
files drwXXXXX.vdb, updating virus databases weekly (regularly) and
drwtoday.vdb files - "hot" adds-on appearing daily or a few times a day.


                 2. INSTALLING DOCTOR WEB ANTIVIRUS PROGRAM

  2.1. Installing Doctor Web for FreeBSD

Doctor Web distribution is delivered in two formats.

- as FreeBSD packages drweb-4.32-freebsdX.tgz
- as tarball archive (drweb-4.32-freebsdX.tar.gz), this delivered variant 
is not connected with any concrete distribution. If installing this type of
distribution Doctor Web has its own hierarchy in /usr/local/drweb.

Both forms include all the necessary components for installing and running
Doctor Web. The only requirement is that if you are installing rpm package
the distribution of the system must support this . If you are using
tarball package the only manual installation is possible.

Doctor Web delivered in the form of bsd package gets installed as usually -
with the help of rpm package management utility:

> pkg_add drweb-4.32-freebsd4.tgz

executed with administrator rights. 

If you want to use tarball archive for installation: unpack tarball-archive,
directory drweb-4.32-freebsd4 will been created and will contains a directory
tree. This tree you should copy to root directory (or place in your system as you
want, you should edit drweb32.ini in this case). Example:

> tar xzf drweb-4.32-freebsd4.tar.gz
> cp -a drweb-4.32-freebsd4/* /

Also you need create drweb account and setup correct permissions:

> chown -R drweb /usr/local/etc/drweb
> chown -R drweb /usr/local/drweb
> chown -R drweb /var/drweb


2.2. Package registration

To activate Dr.Web for FreeBSD a license key file (usually named drweb32.key) 
is required. You can receive the key by one of the following ways:

PURCHASE WITH AUTHORIZED PARTNERS OF DOCTOR WEB, Ltd.

You can purchase the license for the Dr. Web antivirus with authorized
partners of Doctor Web, Ltd. At the moment of purchase you will receive a
personal license with the key file, or a registration number for
registration on the web-site, which will allow you to obtain the key file
by yourself.

Find the addresses of our partners at the web-site of Doctor Web, Ltd. 
in the Purchase section (http://buy.drweb.com/).

Find the conditions of purchase at the web-site of Doctor Web, Ltd. 
in the Purchase section (http://buy.drweb.com/).


REGISTER THE PRODUCT  GET YOU LICENSE KEY FILE.

If you have already purchased the serial number you can generate the key on
the web-site of Doctor Web, Ltd. in the registration section
(http://buy.drweb.com/register/) by filling in the form. Input the serial
number into the form. The key will be immediately forwarded to the email
address specified by you. A link will be also generated enabling you to
download the key file directly from the site.

Be attentive while writing the email address!

DEMO KEY

To test the product before purchase ask for a test key at our web-site 
(http://download.drweb.com/demo/) or from our authorized partners.

But since in the default settings (in the configuration file) the name of
the key file is specified, the correspondent lines should be corrected (see
chapter 3.5) in the configuration file. To use the new registration file
you should edit the value of Key parameter in the correspondent section.

For example, if you got drweb.key and copy them to /usr/local/drweb then you 
should edit Key parameter in [Scanner] section of drweb32.ini:

--- cut ---
...
[Scanner]
...
Key = "/usr/local/drweb/drweb.key"
...
--- cut ---

Important note: the key file is not a text file. It may not be edited in any
way, specifically not automatically be converted by some programs. It often
happens that a too smart mail program converts the key file from DOS 
(with CR LF line ends (in hexadecimal notation 0D 0A) into UNIX 
(with LF line ends (in hexadecimal notation 0A)).


2.3. Updating the program and virus databases

As any antivirus package Doctor Web needs regular updating of databases of
the known viruses. The task is accomplished in the following way: virus
database consists of *.vdb files representing its separate parts. If new
viruses appear small (1Kb or a little over) files containing a fragment of
the base describing it get released. 

Adds-on are such files (common for the supported platforms) as drwtoday.vdb
(daily "hot" adds-on) and drwXXXXX.vdb (regular adds-on released weekly as
a rule). To get added to the main virus base, the file of the
correspondent add-on should be placed into /var/drweb/bases directory, or 
another directory specified in the configuration file (see chapter 3.4).

Periodically (in particular, in connection with the advent of brand new virus
and antivirus technologies) new versions of the package with the updated
algorithms realized in the antivirus kernel get issued. Simultaneously all
the released adds-on get brought together and the new version is completed
by the general actualized database, containing the description of all the
viruses known by the moment of its appearance. As a rule, when going to
the package of a new version bases  succession is preserved, i.e. new
bases can be linked up to the old kernel. However, this does not guarantee
that new viruses that require treating with the renewed antivirus kernel
algorithms will be detected or cured.

If you regularly update your virus base it acquires the following structure:

- drwebase.vdb - general base received together with the new package;
- drwXXXXX.vdb - regular (weekly) virus base adds-on;
- drwtoday.vdb - "hot" adds-on, released daily or several times a day.

The peculiarity of the "hot" adds-on is connected with the fact that in the
interval between the appearance of regular (numbered) adds-on the file
drwtoday.vdb gets replenished by new records, i.e. it has to be installed
in place of the previous one. The periodical add-on released, all the
records from this file are copied into the periodical add-on and it is
cleaned (the file drwtoday.vdb clear of any database record is released).
Consequently, if you are updating the base by hand, ALL the missing regular
adds-on should be installed, and then the 'hot' add-on file should be
written (in place of the previous one).

To automate the process of getting and installing virus database adds-on a
special script from update subdirectory should be used:

> /usr/local/drweb/update/update.pl

Virus base gets updated in the following way:

- the script reads the ini file (it may be specified clearly the first and
the only argument in the command line, for example,
update.pl /usr/local/etc/drweb/drweb32.ini);

- the following parameters get read from the ini:

  EnginePath (serves to specify daemon version and to the directory 
  where the received drweb32.dll file should be placed),

  VirusBase (the first of the masks specified in this parameter indicates
  where to place the received virus bases),

  UpdatePath (all the rest received files get placed here),

  PidFile (from this file drwebd process identifier gets read,
  used to reload the daemon);

- files are received and placed in the directories, as described above
  (all the files for the current Doctor Web version get received; if 
  sections of the later version will be found in the add-on list only
  *.vdb will be received for them).

Before using the script you should edit the lines containing addresses for
loading the file with the data on adds-on (there may be a few of them) and
specify what section of the configuration file the data should be used from
(the scanner or the daemon).


           3. USING DOCTOR WEB SCANNING MODULE

In this chapter we will consider arrangement of the files of Doctor Web,
program start, command line options and structure of the configuration
file.


3.1. Package files arrangement

As we have already mentioned, Doctor Web for FreeBSD by default gets installed
into the directories: /usr/local/drweb, /usr/local/etc/drweb and 
/var/drweb. Below the entire contents is described:

- executed program modules - scanner (drweb) and daemon (drwebd), and also 
  antivirus kernel as loadable library (/usr/local/drweb/lib/drweb32.dll);
- database of the known viruses (/var/drweb/bases/drwebase.vdb);
- configuration file (/usr/local/etc/drweb/drweb32.ini);
- language resource files (i.e. to enable work with Russian interface -
  /usr/local/drweb/lib/russian.dwl);
- directory /usr/local/drweb/doc with program documentation.

Here you can also see subdirectories: doc, update and infected. doc
subdirectory contains documentation on separate aspects of using the
package programs. 

In update subdirectory you will see perl script to update the program
(update.pl) and the description of the process in English and in Russian
(readme.update and readme.update.rus).

infected subdirectory is meant for the infected files to be move into when
using the correspondent options (see below).


3.2. Starting the scanner program

Scanner Doctor Web is a program with text interface, functioning in console
mode (or in the terminal emulator window in X Window). It gets started by the 
sequence of commands:

> /usr/local/drweb/drweb -path=<path>

or, if /usr/local/drweb directory is put into command shell environment variable
PATH, from any directory. However, we would not recommend you neither the
latter variant for reasons of safety nor that of creating a reference to
the executable file drweb in any of the directories like /bin, /usr/bin
etc.

The scanner may be started both under the name of administrator and under
the name of a common user. Naturally, in the latter case only those
directories will get checked for viruses to which the user has read access
and infected files will get cured only in those directories to which the
user has write access (as a rule it is user's home directory, $HOME).
Besides, there exist other restrictions limiting functionality of the
program started in user mode (for example, restriction on moving and
renaming infected files).

After the start of the scanner the headpiece with the name of the program
and the platform, version number and release date, contact information gets 
displayed. It is followed by user's registration information and report of 
antivirus database load (including adds-on if there were any installed).

        Dr.Web (R) for FreeBSD, version 4.32.0 (2004-07-07)
        Copyright (c) Igor Daniloff, 1992-2004
        Support service: http://support.drweb.com
        To purshase: http://sales.drweb.com
        Tel. +7(095) 789-45-87 Fax +7(095) 789-45-97
        Command line: -path=tmp
        Loading /var/drweb/bases/drwebase.vdb - Ok, virus records: 46736
        Loading /var/drweb/bases/drw43201.vdb - Ok, virus records: 263
        Total virus records: 46999
        Key file: /usr/local/drweb/drweb32.key
        Registration number: XXXXXXXX

After that command shell invitation is returned. All the other virus
detecting and neutralizing actions require using the command line options.


3.3. Command line options

The general  of starting the program is the following (it is assumed
that /usr/local/drweb are current):

  ./drweb  -path=<path> [options]

where path is path to the scanned directory or tested files mask. Started
without options, with path as argument only, the scanner performs scanning
of the specified directory, for example, user's home directory, using the
general default option set (about it - further in this chapter):

  ./drweb  -path=~

and outputs the report of the following kind:

        Scan report for "/opt/drweb/tmp":
        Scanned       : 34/32           Cured      : 0
        Infected      : 5/5             Deleted    : 0
        Modifications : 0/0             Renamed    : 0
        Suspicious    : 0/0             Moved      : 0
        Scan time     : 00:00:02        Scan speed : 5233 Kb/s

Numbers divided by the "/" character mean: the first - total number of
files, the second - number of files in the archives. Besides, if files
infected by the known viruses or files suspected of this are detected
before the summary report there appear the corresponding lines of the
following kind:

  /path/file infected by [virus] VIRUS_NAME

You should pay attention to the fact that Doctor Web distribution includes
a test file eicar.txt. It is easy to make a program of it, eicar.com, with
the help of the text editor (see instructions in the file), which acts like
virus, causing output of the following report:

  /path/clients/drwebdc/eicar.txt infected by Eicar Test File (Not a Virus!)

This file is not a virus, usually it is used in order to test antivirus'
response to the presence of virus. Purposing this aim all the up-to-date
antivirus programs add information on it to their virus bases.

As for any Unix program, numerous command line options are also provided
for Doctor Web scanner. They are separated by the blank from the specified
path and are prefixed by the - (hyphen) character. To get the complete
options list run drweb program with the following options: -?, -h, -help or
--help.

Principle options of the program may be classified in the following way:

- checking area options;
- diagnostics options;
- action options;
- interface options.


Checking area options specify where scanning should be performed. They
include:

-@[+]<file> - checking objects listed in the given file, the + (plus)
character prescribes not to delete file with the check object list after
the check; the list file may contain paths to directories scanned
periodically or just list of files to be checked regularly;

-sd - recursive search and testing files in subdirectories, starting from
the current one;

-ml - checking files of mail programs;

-fl - follow the references, both for files and for directories; at the
same time references resulting in "getting into a loop" get ignored.


Diagnostics options specifying what types of objects should be scanned for
viruses include:

-al - diagnostics of all the files on the specified drive or in the
directory specified as argument;

-ar[n] - checking archive files (ARJ, CAB, GZIP, RAR, TAR, ZIP); the
additional option n disables displaying archiving programs names; here we
call "archive" not only archives proper (for example, such as *.tar), but
also their compressed forms (in particular compressed tar archives such as
*.tar.gz and *.tgz);

-cn[n] - checking containers files (HTML, RTF, PowerPoint,..); the
additional option n disables displaying types of containers;
                  
-up[n] - checking executable files packed by LZEXE, DIET, PKLITE, EXEPACK...;
the additional option n disables displaying packing utility names;

-ex - diagnostics of the files with the names corresponding with the
specified masks (see FilesTypes option of the configuration file, chapter
4.5);

-fm - diagnostics of the files with the inner structure of program modules;

-ha - heuristic analysis of files, searching for unknown viruses.


Action options specify what actions should be taken against infected (or
suspicious) files. They are the following:

-cu[dmr] - curing infected files; additional options prescribe: d -
delete, m - move, r - rename infected files; 

-ic[dmr] - specifies actions for incurable files: d - delete, m - move,
r - rename incurable files; 

-sp[dmr] - specifies actions for suspicious files: d - delete, m - move,
r - rename suspicious files;


Interface options define conditions of displaying the results of program
operation. These are the following options:

-ot - output information to STDOUT, i.e. standard output;

-oq - disable information output;

-ok - display 'Ok' for non-infected files;

-log=<file> - logging operating protocol into the specified file

-ini=<file> - using alternative ini file;

-lng[=<file>] - using alternative language file; if you chose the English
interface in the installation process you should specify russian.dwl as
such a file to have messages in Russian output.


Some of the options disable the correspondent action if postfixed by - (minus)
character. The following options belong to them:

-ar -cu -ha -ic -fl -ml -ok -pr -sd

For example, starting the scanner as 

  drweb -path=<path> -ha-

files will get scanned for viruses without heuristic analysis, usually
enabled be default.

By default (without specifying options), if no actions of re-configuring
the program were taken (discussed in the next chapter), the scanner gets
started with the following options:

-ar -fm -ha -fl- -ml -pr -sd -up

This set of the default options for the scanner (including archive and
packed file scanning, checking file of the mail programs, recursive search,
heuristic analysis etc.) is quite appropriate for diagnostics aims and may
be applied in most typical cases. If you do not need any of the default
option in a concrete case, you can disable it by indicating - (minus)
character after it, like in the example with ha option (heuristic analyzer)
adduced above.

We would like to add that by disabling checking of archived and packed
files one will significantly decrease antivirus protection level, since
file viruses get spread as archives (often self-unpacked) enclosed into
e-mail messages. Application program documents, potentially subject to
infections by macroviruses (Word, Excel), also get usually sent by e-mail
as packed and archived files.

However, if started with the default options, the scanner does not perform
any actions to cure infected files. There are no actions provided against
incurable and suspicious files. All that requires specifying additional
command line options - action options.

Sets of options may be different in every concrete case, but we would
recommend you the following as appropriate ones:

-cu - curing infected files and system areas without deleting, moving or
renaming infected files, 

-icd - deleting incurable files; since deletion of system files
may result in a totally disabled system;

-spm - moving or -spr - renaming suspicious files; 

Starting the scanner with curing option means that the program will make an
attempt to restore the state of the infected object before the infection.
The action is possible only if the known virus in detected and the
necessary curing instruction are there in the base; however, even in the
cases of the kind cure attempt may fail, for example, if the infected file
has already been seriously damaged by the virus.

It should be noted that if infected files were found within archives they
do not get cured, deleted, moved or renamed. To have the viruses deleted
from such kind of objects you should unpack the archives manually by the
correspondent software tools, it is desirable to unpack it into a separate
directory which will be specified as argument at another start of the
scanner.

If started with delete option the program will delete the infected file on
the disc. We would recommend it for incurable (i.e. irreversibly damaged by
the virus) files.

Rename option causes changing file name extension into a certain pre-set
one (by default - *.#??, i.e. the first character of the extension gets
replaced by # character). This option is advisable for files of other
operating systems (for example, DOS/Windows), detected at heuristic
analysis as suspicious. By renaming you will make impossible accidental
start of the executable modules of the system or Word or Excel document
load until the file gets checked later on thus preventing infecting by
possible virus and its further spreading.

Move option will move the infected (or suspicious) file into the directory
meant for it (by default it is /var/drweb/infected). Anyway, by now 
it is of theoretical value only: it has no meaning for the files of other 
operating systems because they cannot cause damage to the host system. As 
for moving suspicious file of Unix system itself, it can produce errors in 
the operation of the system which may lead to total failure.

Here we adduce the result: an advisable form of starting the scanner for
day-to-day use:

  drweb -path=<path> -cu -icd -spm -ar -fm -ha -fl- -ml -sd -up

Such a command may be saved as text file which with the help of the
following command

  chmod a+x [name]

may be then adjusted as command shell script, or series of scripts for
various situations. However, the set of the default options may be also
changed when setting the scanner up, for details see the next chapter.


3.4. Configuring scanner program

Doctor Web program for Unix is configured by editing the file
/usr/local/etc/drweb/drweb32.ini, consisting of the two sections - [Scanner] section
and [Daemon] section. All parameters used by Dr.Web scanner are described in 
[Scanner] section of default drweb32.ini


                         4. CONTACTS

Doctor Web program gets constantly developed, for fresh updating information 
and news please visit our site:

http://www.drweb.com

Marketing dept.: 
  E-Mail: sales@drweb.com
Support:
  WWW: http://support.drweb.com
  E-Mail: support@drweb.com

Please include following information in your problem report: 

- full name and version of your unix distribution
- Dr.Web version that is logged during program start
