    Antivirus program Doctor Web for Linux, FreeBSD and Solaris
                         Version 4.29

             Copyright (c) 1992-2002, Igor Daniloff
    Igor Daniloff's antivirus laboratory, DialogueScience, Inc.

                         User manual


1. INTRODUCTION
2. GENERAL CHARACTERISTICS OF THE PROGRAM DOCTOR WEB
3. INSTALLING DOCTOR WEB ANTIVIRUS PROGRAM
  3.1. Installing Doctor Web for Linux 
  3.2. Installing Doctor Web for FreeBSD
  3.3. Installing Doctor Web for Solaris
  3.4. Package registration
  3.5. Updating the program and virus databases
4. USING DOCTOR WEB SCANNING MODULE
  4.1. Package files arrangement
  4.2. Files of electronic documentation
  4.3. Starting the scanner program
  4.4. Command line options
  4.5. Configuring scanner program
5. CONTACTS


                       1. INTRODUCTION

Doctor Web, an antivirus program, besides the versions for Windows
95/98/Me/NT/2000/XP, DOS/386, OS/2 and Novell NetWare, is now offered as
versions for the two open Unix-like systems - Linux and FreeBSD, and also
for one of the commercial variants of Unix - Sun Solaris (Intel).

It should be noted that there are two aspects of struggling against viruses
in Unix-like operating systems (hereinafter - Unix systems). The first is
that of protecting local system and user data against the destructive
impact of virus programs. Till recently this aspect was of merely
theoretical interest. But starting from January, 2001 practically any Unix
system user (in the first place Linux OS users, it being the most
widespread) may face such problems, like users of such desk-top OS as
Windows of any version.

The second aspect is that of virus diagnostics which will render viruses
harmless if Unix system is used as platform for communication services,
first of all mail servers, file servers of local networks etc. It does not
necessarily regard viruses specific for Unix systems, in most cases those
will be usual Windows viruses, including macroviruses for Word, Excel and
other office applications, transmitted by local networks and mail services.

Antivirus program Doctor Web for Unix systems performs both functions. On
one hand it is a scanner DrWeb aimed at detecting and curing viruses on a
local computer. On the other hand there is a resident component DrWebD
(daemon) in the package which may be used practically in any data
processing system as attached external antivirus filter. For example, mail
systems (such as Communigate Pro, Sendmail, Qmail, Exim, Postfix, Zmailer
and others) may be quite easily and quickly set for using DrWebD daemon to
check the e-mail messages transmitted by the mail server.

In the present manual we will dwell on the first aspect of using Doctor Web
program in Unix systems, i.e. on detecting and neutralizing viruses on a
local computer. Here we will cover the following points:

- general characteristics of the program, distinctions between the versions
  (chapter 2);
- installing the program from the packages of different formats (chapter 3);
- using virus scanner, mainly on the local computer (chapter 4).

As for the second aspect, you can find the details in the separate manual.

In the ending chapter you will find contact information about the
developers and technical support service.

It should be said that Doctor Web program gets continuously improved.
Adds-on to databases of the known virus get released daily (as a rule,
several times a day). New program versions appear periodically, on average,
every 2-3 months. The program gets improved both towards perfecting
diagnostics methods and struggling against viruses and towards integrating
it with other applications to Unix systems. Besides, the number of
applications able to work jointly with Doctor Web constantly increases.
That is why it is possible that some details of setting up and utilization
of the current version will differ from that described in the present
manual. To get the present-day information on the program you should turn
to the files of electronic documentation, enclosed in the delivery package,
which will be referred to in the chapter 4.2.


            2. GENERAL CHARACTERISTICS OF THE PROGRAM DOCTOR WEB

Doctor Web for Linux is compatible with all the main up-to-date Linux
distribution, working on the Intel platform, - RedHat, ASPLinux, Slackware,
SuSE, Mandrake and many other. Doctor Web for FreeBSD works with FreeBSD v.3
and 4. Doctor Web for Solaris works with Solaris v.8.

From the point of view of hardware support, requirements of Doctor Web
coincide with requirements of the console (text) mode of the operating
systems it is meant to work in - Linux, FreeBSD and Solaris. Installation
of the program (scanner and daemon) requires about 2.5 Mb of disc space.

You can download evaluation version of any delivered package for free from
http://www.dials.ru and http://www.drweb.ru.

Functionality of the evaluation versions is limited to detecting viruses,
files do not get cured. The scanner does not check file in the archives,
mail bases and those packed by the programs to compress executable modules
(DIET, PKLITE etc). The work of the daemon has the same restrictions, but
for operations with mail bases and packed programs. To turn evaluation
version into a full-functional one you should register.

Besides the program itself the developer's site offers also regular adds-on
to databases of the known viruses. Those are common (for all the platforms)
files drwXXXXX.vdb, updating virus databases weekly (regularly) and
drwtoday.vdb files - "hot" adds-on appearing daily or a few times a day.


                 3. INSTALLING DOCTOR WEB ANTIVIRUS PROGRAM
        
Doctor Web distribution is delivered in two formats.

- as rpm package drweb-VER-glibc.?.?.i386.rpm aimed at being used with Linux
system (Red Hat distribution and other systems compatible with it);

- as tgz archive (drweb-VER-OS.tgz), containing in addition to the proper
archived program modules the installation script; this delivered variant is
not connected with any concrete distribution. If installing this type of
distribution Doctor Web has its own hierarchy in /usr/local.

Both forms include all the necessary components for installing and running
Doctor Web. The only requirement is that if you are installing rpm package
the distribution of the system must support this format. If you are using
tgz package the only thing required to start installation script is bash
compatible command shell.

3.1. Installing Doctor Web for Linux 

Doctor Web delivered in the form of rpm package gets installed as usually -
with the help of rpm package management utility:

 rpm -ihv drweb-VER-glibc.?.?.i386.rpm

executed with administrator rights. As a consequence, rpm package gets
installed (by default) into /opt/drweb, configuration file into /etc/drweb
directory.

Naturally, you can make use of the graphics mode utilities to install
Doctor Web from rpm package, such as kpackage (in KDE environment),
Software Manager (in Linux Mandrake distribution) etc.


3.2. Installing Doctor Web for FreeBSD

Doctor Web in the FreeBSD system gets installed from tgz archive. You start
with unpacking it into any directory, where ~/drweb-VER-freebsdN
subdirectory gets created. The subdirectory contains the packed archive
drweb-VER-freebsdN.tar.gz and installation script INSTALL.SH. The latter
must get started with administrator rights from the current directory in
such a way, for example:
 
~/drweb-VER-freebsd4/INSTALL.SH

After that the directory into which the program must be installed is
demanded. By default it is /usr/local/drweb - if there are no weighty
reasons to change it just press Enter.

You will be asked to choose the interface language. This is the last point
of the installation, to set the program further you can directly edit the
configuration file drweb32.ini, the details will be discussed in the
chapter 4.5.
 

3.3. Installing Doctor Web for Solaris

In the Solaris system Doctor Web is installed in the same way Doctor Web
for FreeBSD from tgz archive is, but here a double extension tar.gz is used.
Another difference regards created subdirectory name where in place of
freebsdN the word solaris is used.


3.4. Package registration

Having been installed, Doctor Web program may be started only as evaluation
version. To make it full functional you need to get the registration key
from the distributor or the dealer at whose you purchased the program.
Registration key is a file usually delivered under the name of drweb32.key.
It should be copied into the directory where you have installed the
program.

But since in the default settings (in the configuration file) the name of
the key file is specified, the correspondent lines should be corrected (see
chapter 4.5) in the configuration file. To use the new registration file
you should edit the value of Key parameter in the correspondent section.
For example, in place of

--- cut ---
...
[Linux]
Key = "/opt/drweb/drweb.key"
...
--- cut ---

write

--- cut ---
...
[Linux]
Key = "/opt/drweb/drweb32.key"
...
--- cut ---

Important note: the key file IS NOT a text file. It may not be edited in any
way, specifically not automatically be converted by some programs. It often
happens that a too smart mail program converts the key file from DOS format
(with CR LF line ends (in hexadecimal notation 0D 0A) into UNIX format
(with LF line ends (in hexadecimal notation 0A)).


3.6. Updating the program and virus databases

As any antivirus package Doctor Web needs regular updating of databases of
the known viruses. The task is accomplished in the following way: virus
database consists of *.vdb files representing its separate parts. If new
viruses appear small (1Kb or a little over) files containing a fragment of
the base describing it get released. These fragments (virus database
adds-on) are available promptly at http://www.dials.ru/drweb/free

Adds-on are such files (common for the supported platforms) as drwtoday.vdb
(daily "hot" adds-on) and drwXXXXX.vdb (regular adds-on released weekly as
a rule). To get added to the main virus base, the file of the
correspondent add-on should be placed into Doctor Web program directory (by
default into /opt/drweb for Linux, into /usr/local/drweb for FreeBSD and
Solaris), or another directory specified in the configuration file (see
chapter 4.5).

Periodically (in particular, in connection with the advent of brand new virus
and antivirus technologies) new versions of the package with the updated
algorithms realized in the antivirus kernel get issued. Simultaneously all
the released adds-on get brought together and the new version is completed
by the general actualized database, containing the description of all the
viruses known by the moment of its appearance. As a rule, when going to
the package of a new version bases format succession is preserved, i.e. new
bases can be linked up to the old kernel. However, this does not guarantee
that new viruses that require treating with the renewed antivirus kernel
algorithms will be detected or cured.

If you regularly update your virus base it acquires the following structure:

- drwebase.vdb - general base received together with the new package;
- drwXXXXX.vdb - regular (weekly) virus base adds-on;
- drwtoday.vdb - "hot" adds-on, released daily or several times a day.

The peculiarity of the "hot" adds-on is connected with the fact that in the
interval between the appearance of regular (numbered) adds-on the file
drwtoday.vdb gets replenished by new records, i.e. it has to be installed
in place of the previous one. The periodical add-on released, all the
records from this file are copied into the periodical add-on and it is
cleaned (the file drwtoday.vdb clear of any database record is released).
Consequently, if you are updating the base by hand, ALL the missing regular
adds-on should be installed, and then the 'hot' add-on file should be
written (in place of the previous one).

To automate the process of getting and installing virus database adds-on a
special script from update subdirectory should be used:

   /opt/drweb/update/update.pl

Virus base gets updated in the following way:

- the script reads the ini file (it may be specified clearly the first and
the only argument in the command line, for example,
update.pl /etc/drweb/drweb32.ini);

- the following parameters get read from the ini:

  EnginePath (serves to specify daemon version and to the directory 
  where the received drweb32.dll file should be placed),

  VirusBase (the first of the masks specified in this parameter indicates
  where to place the received virus bases),

  UpdatePath (all the rest received files get placed here),

  PidFile (from this file drwebd process identifier gets read,
  used to reload the daemon);

- files are received and placed in the directories, as described above
  (all the files for the current Doctor Web version get received; if 
  sections of the later version will be found in the add-on list only
  *.vdb will be received for them).

Before using the script you should edit the lines containing addresses for
loading the file with the data on adds-on (there may be a few of them) and
specify what section of the configuration file the data should be used from
(the scanner or the daemon).


           4. USING DOCTOR WEB SCANNING MODULE

In this chapter we will consider arrangement of the files of Doctor Web,
program start, command line options and structure of the configuration
file.


4.1. Package files arrangement

As we have already mentioned, Doctor Web for Linux by default gets installed
into the directory /opt, where /opt/drweb subdirectory is created. Below the
entire contents is described:

- executed program modules - scanner (drweb) and daemon (drwebd), and also 
  antivirus kernel as loadable library (drweb32.dll);
- database of the known viruses (drwebase.vdb);
- configuration file (drweb32.ini);
- language resource files (to enable work with Russian interface -
  russian.dwl);
- registration key files drweb.key and drwebd.key;
- brief description of the program in English (README) and in Russian
  (README.RUS).

Here you can also see subdirectories: doc, update and infected. doc
subdirectory contains documentation on separate aspects of using the
package programs. The contents of the documentation is considered in
chapter 4.2.

In update subdirectory you will see perl script to update the program
(update.pl) and the description of the process in English and in Russian
(readme.update and readme.update.rus).

infected subdirectory is meant for the infected files to be move into when
using the correspondent options (see below).

Doctor Web versions for FreeBSD and for Solaris get installed into
/usr/local/drweb directory, its structure being similar to the Linux version.


4.2. Files of electronic documentation

We should devote our attention to arrangement and contents of the files of
documentation included in the delivery package. The user will very likely
have to turn to them because Doctor Web is continuously improved and
perfected.

All the documentation files are text files present both in English and in
Russian (in KOI8-R coding). In the root directory of the program
(/opt/drweb and /usr/local/drweb, for Linux and FreeBSD-Solaris versions
correspondingly) there are README and README.RUS files. They contain
general characteristics of the program, description of the facilities it
provides and the restrictions it has and also brief notes on installing the
program and setting it up.

In doc subdirectory you will find files describing how to use DrWeb scanner
and DrWebD daemon, containing material on structure and options of the
configuration file drweb32.ini, partly repeating contents of the chapter
4.5 of the present manual, and description of the daemon's program interface.


4.3. Starting the scanner program

Scanner Doctor Web is a program with text interface, functioning in console
mode (or in the terminal emulator window in X Window). In Linux it gets
started from /opt/drweb directory by the sequence of commands:

  cd /opt/drweb
  ./drweb

or, if /opt/drweb directory is put into command shell environment variable
PATH, from any directory. However, we would not recommend you neither the
latter variant for reasons of safety nor that of creating a reference to
the executable file drweb in any of the directories like /bin, /usr/bin
etc.

In FreeBSD and in Solaris the correspondent commands look like as follows:

  cd /usr/local/drweb
  ./drweb

The scanner may be started both under the name of administrator and under
the name of a common user. Naturally, in the latter case only those
directories will get checked for viruses to which the user has read access
and infected files will get cured only in those directories to which the
user has write access (as a rule it is user's home directory, $HOME).
Besides, there exist other restrictions limiting functionality of the
program started in user mode (for example, restriction on moving and
renaming infected files).

After the start of the scanner the headpiece with the name of the program
and the platform (Linux, FreeBSD or Solaris), version number and release
date, contact information gets displayed. It is followed by user's
registration information and report of antivirus database load (including
adds-on if there were any installed).

  Key file: /opt/drweb/drwebd.key
  Registration information:
  xxxxxxxxxxx
  User name
  Loading /opt/drweb/drwtoday.vdb - Ok, virus records: 4
  Loading /opt/drweb/drw42602.vdb - Ok, virus records: 40
  Loading /opt/drweb/drw42601.vdb - Ok, virus records: 59
  Loading /opt/drweb/drwebase.vdb - Ok, virus records: 26390

After that command shell invitation is returned. All the other virus
detecting and neutralizing actions require using the command line options.


4.4. Command line options

The general format of starting the program is the following (it is assumed
that /opt/drweb directory for Linux version and /usr/local/drweb directory
for FreeBSD and Solaris versions are current):

  ./drweb [path] [options]

where path is path to the scanned directory or tested files mask. Started
without options, with path as argument only, the scanner performs scanning
of the specified directory, for example, user's home directory, using the
general default option set (about it - further in this chapter):

  ./drweb ~

and outputs the report of the following kind:

  Report on "/home/USERNAME":
  Checked        : 11641/9639      Cured         : 0
  Infected       : 4/4             Deleted       : 0
  Modifications  : 0/0             Renamed       : 0
  Suspicious     : 0/0             Moved         : 0
  Checking time  : 00:03:59        Speed         : 1412 Kb/s

Numbers divided by the "/" character mean: the first - total number of
files, the second - number of files in the archives. Besides, if files
infected by the known viruses or files suspected of this are detected
before the summary report there appear the corresponding lines of the
following kind:

  /path/file infected by [virus] VIRUS_NAME

You should pay attention to the fact that Doctor Web distribution includes
a test file eicar.txt. It is easy to make a program of it, eicar.com, with
the help of the text editor (see instructions in the file), which acts like
virus, causing output of the following report:

  /path/clients/drwebdc/eicar.txt infected by Eicar Test File (Not a Virus!)

This file is not a virus, usually it is used in order to test antivirus'
response to the presence of virus. Purposing this aim all the up-to-date
antivirus programs add information on it to their virus bases.

As for any Unix program, numerous command line options are also provided
for Doctor Web scanner. They are separated by the blank from the specified
path and are prefixed by the - (hyphen) character. To get the complete
options list run drweb program with the following options: -?, -h, -help or
--help.

Principle options of the program may be classified in the following way:

- checking area options;
- diagnostics options;
- action options;
- interface options.


Checking area options specify where scanning should be performed. They
include:

-@[+]<file> - checking objects listed in the given file, the + (plus)
character prescribes not to delete file with the check object list after
the check; the list file may contain paths to directories scanned
periodically or just list of files to be checked regularly;

-sd - recursive search and testing files in subdirectories, starting from
the current one;

-ml - checking files of mail programs;

-fl - follow the references, both for files and for directories; at the
same time references resulting in "getting into a loop" get ignored.


Diagnostics options specifying what types of objects should be scanned for
viruses include:

-al - diagnostics of all the files on the specified drive or in the
directory specified as argument;

-ar[n] - checking archive files (ARJ, CAB, GZIP, RAR, TAR, ZIP); the
additional option n disables displaying archiving programs names; here we
call "archive" not only archives proper (for example, such as *.tar), but
also their compressed forms (in particular compressed tar archives such as
*.tar.gz and *.tgz);

-up[n] - checking executable files packed by LZEXE, DIET, PKLITE, EXEPACK...;
the additional option n disables displaying packing utility names;

-ex - diagnostics of the files with the names corresponding with the
specified masks (see FilesTypes option of the configuration file, chapter
4.5);

-fm - diagnostics of the files with the inner structure of program modules;

-ha - heuristic analysis of files, searching for unknown viruses.


Action options specify what actions should be taken against infected (or
suspicious) files. They are the following:

-cu[dmr][p] - curing infected files; additional options prescribe: d -
delete, m - move, r - rename infected files; p option enables displaying
prompt before action;

-ic[dmr][p] - specifies actions for incurable files: d - delete, m - move,
r - rename incurable files; p - prompt before action;

-sp[dmr][p] - specifies actions for suspicious files: d - delete, m - move,
r - rename suspicious files; p - prompt before action.


Interface options define conditions of displaying the results of program
operation. These are the following options:

-go - automatic program operating;

-ns - non-interruptable testing;

-ot - output information to STDOUT, i.e. standard output;

-oq - disable information output;

-ok - display 'Ok' for non-infected files;

-rp[+][file] - logging operating protocol into the specified file, '+' -
adding the current report in the end of the file;

-da - scanning only once in a day;

-ini:<file> - using alternative ini file;

-ni - ignore parameters in ini file;

-pr - all actions of deleting viruses with prompt to confirm;

-wa - waiting after having scanned if any viruses were found;

-lng[:<file>] - using alternative language file; if you chose the English
interface in the installation process you should specify russian.dwl as
such a file to have messages in Russian output.


Some of the options disable the correspondent action if postfixed by - (minus)
character. The following options belong to them:

-ar -cu -ha -ic -fl -ml -ok -pr -sd

For example, starting the scanner as 

  drweb [path] -ha-

files will get scanned for viruses without heuristic analysis, usually
enabled be default.

By default (without specifying options), if no actions of re-configuring
the program were taken (discussed in the next chapter), the scanner gets
started with the following options:

-ar -fm -ha -fl- -ml -pr -sd -up

This set of the default options for the scanner (including archive and
packed file scanning, checking file of the mail programs, recursive search,
heuristic analysis etc.) is quite appropriate for diagnostics aims and may
be applied in most typical cases. If you do not need any of the default
option in a concrete case, you can disable it by indicating - (minus)
character after it, like in the example with ha option (heuristic analyzer)
adduced above.

We would like to add that by disabling checking of archived and packed
files one will significantly decrease antivirus protection level, since
file viruses get spread as archives (often self-unpacked) enclosed into
e-mail messages. Application program documents, potentially subject to
infections by macroviruses (Word, Excel), also get usually sent by e-mail
as packed and archived files.

However, if started with the default options, the scanner does not perform
any actions to cure infected files. There are no actions provided against
incurable and suspicious files. All that requires specifying additional
command line options - action options.

Sets of options may be different in every concrete case, but we would
recommend you the following as appropriate ones:

-cup - curing infected files and system areas without deleting, moving or
renaming infected files, but with prompt before action;

-icdp - deleting incurable files; since deletion of system files
may result in a totally disabled system, prompt before action is
essential;

-spmp - moving or -sprp - renaming suspicious files; as in the previous
case such actions taken against system files may lead to system
failure, and therefor prompt before action is compulsory.

Starting the scanner with curing option means that the program will make an
attempt to restore the state of the infected object before the infection.
The action is possible only if the known virus in detected and the
necessary curing instruction are there in the base; however, even in the
cases of the kind cure attempt may fail, for example, if the infected file
has already been seriously damaged by the virus.

It should be noted that if infected files were found within archives they
do not get cured, deleted, moved or renamed. To have the viruses deleted
from such kind of objects you should unpack the archives manually by the
correspondent software tools, it is desirable to unpack it into a separate
directory which will be specified as argument at another start of the
scanner.

If started with delete option the program will delete the infected file on
the disc. We would recommend it for incurable (i.e. irreversibly damaged by
the virus) files.

Rename option causes changing file name extension into a certain pre-set
one (by default - *.#??, i.e. the first character of the extension gets
replaced by # character). This option is advisable for files of other
operating systems (for example, DOS/Windows), detected at heuristic
analysis as suspicious. By renaming you will make impossible accidental
start of the executable modules of the system or Word or Excel document
load until the file gets checked later on thus preventing infecting by
possible virus and its further spreading.

Move option will move the infected (or suspicious) file into the directory
meant for it (by default it is /opt/drweb/infected/ in Linux or
/usr/local/drweb/infected/ in FreeBSD and Solaris). Anyway, by now it is of
theoretical value only: it has no meaning for the files of other operating
systems because they cannot cause damage to the host system. As for moving
suspicious file of Unix system itself, it can produce errors in the
operation of the system which may lead to total failure.

Here we adduce the result: an advisable form of starting the scanner for
day-to-day use:

  drweb [path] -cup -icdp -spmp -ar -fm -ha -fl- -ml -pr -sd -up

Such a command may be saved as text file which with the help of the
following command

  chmod a+x [name]

may be then adjusted as command shell script, or series of scripts for
various situations. However, the set of the default options may be also
changed when setting the scanner up, for details see the next chapter.


4.5. Configuring scanner program

Doctor Web program for Linux is configured by editing the file
/opt/drweb/drweb32.ini, consisting of the two sections - [Linux] section
and [Linux:Daemon] section. In the present manual we will consider scanner
program settings only.

The general section contains the lines of the following kinds:

  EnginePath = "/opt/drweb/drweb32.dll"
  VirusBase = "/opt/drweb/*.vdb"
  MoveFilesTo = "/opt/drweb/infected"
  LngFileName = "/opt/drweb/russian.dwl"

They describe path to the main library (the kernel) of the program, mask of
the known virus database files, directory for the infected files to be moved
into (if they do not get deleted when being cured) and language support module,
correspondingly. In particular, to use files of virus database received
from Windows systems without renaming them with the letters of the lower
case, it is advisable to give VirusBase line as:

  VirusBase = "/opt/drweb/*.vdb,/opt/drweb/*.VDB"

As far as language support is concerned, we would like to note the
following. If LngFileName remains blank its default value will be taken,
i.e. all the messages of the program will be output in English. In this
case you can resort to the Russian interface if necessary, the scanner may
be started with the correspondent command line option as described in the
chapter 4.4. In the opposite case, i.e. if the Russian interface is enabled
in the configuration file, you should run the scanner with a blank file
name in -lng option to use English temporarily.

In the first lines of [Linux] section the path to the registration file and
log file for logging the taken action is specified and also the mask for
renaming infected files:

  Key = "/opt/drweb/drweb.key"
  LogFileName = "/var/log/drweb.log"
  RenameFilesTo = #??

The value of Key option here must correspond precisely to the name of the
registration key file in the directory /opt/drweb, as we have already noted
in the chapter devoted to registration of the program (3.4). If Key option
is not specified the value /opt/drweb/drweb32.key is taken by default.

The next group of lines describes types of files to be scanned for viruses
(if the correspondent value in the line ScanFiles = ByType is set, see
below):

  FilesTypes = EXE,COM,SYS,OV?,...

and their masks:

  UserMasks = "*.EXE","*.COM","*.SYS","*.OV?",...

Finally, the last, the most numerous group of lines specifies default
options of scanner start:

  ScanFiles = ByFormat
  HeuristicAnalysis = Yes
  CheckPackedFiles = Yes
  CheckArchives = Yes
  CheckEMailFiles = Yes
  ...

and so on. It is here where you should make changes to set your scanner
individually and to eliminate the necessity of inputting numerous options
directly in the command line. For detailed commentaries on each line of the
section please refer to the manual on the daemon. We will dwell on the most
important ones only.

The line 

   ScanPriority = { value }
   
sets priority of the scanner. This value should be in the range -20 (highest) 
to 20 (lowest).

The line

  ScanFiles = ByFormat

sets that the scanner will detect by inner format of the files, included in
the checkable set if they can be "virus carriers", i.e. executable files
(file name and extension are not taken into account) and then only for
the presumably executable files antivirus scanning will be performed.

This variant is set by default, and we would advise you to keep the choice.
Other possible values of the line are All and ByType. The first one
prescribes complete scanning of all the files of the indicated checkable
set. Choosing this variant will significantly increase the total checking
time. At the same time level of antivirus protection remains almost the
same because, for example, text files constituting the substantial part of
the data corpus in any Unix system cannot contain viruses by definition.

ByType value allows to set (in FilesTypes line, described above) the list
of the file types to be scanned; all the remaining files getting in the
path to be scanned will get skipped. This setting is advisable if mainly
DOS/Windows files undergo checking as the fixed connection of file format
and its extension is peculiar to them.

In the line

  HeuristicAnalysis = Yes

possible values - Yes or No. The first one enables heuristic analysis of
the scanned files, the second disables it. Permits DrWeb Daemon to
use heuristic analysis, which the help of which the unknown viruses can be
detected judging by the comprehension of the structure of virus code. The
distinctive feature of this type of scanning for viruses is the
approximate, probabilistic detecting of the infected objects therefore
called suspicious, not infected. The line disabled, only the known viruses
from the virus data base are searched for.

There exists an entire class of programs which may cause false alarms of
the heuristics analyzer because they use the code similar to that used by
viruses. Besides, enabling this type of checking may increase the total
scanning time (although insignificantly). These are arguments for disabling
heuristic analysis. But on the whole, this type of analysis noticeably
increases the safety of antivirus protection. That is why the default value
of the line is Yes.

The line

  CheckPackedFiles = Yes

prescribes to check executable files, packed by one of the known to Doctor
Web package packers. This action does not require considerable PC
resources, and that is why such a check is enabled by default (Yes value).
If you specify No packed files will be checked as usual executable ones,
without being unpacked.

In the line 

  CheckArchives = Yes

it is specified if the scanner will unpack archives and check the files
they contain. The action requires much time, memory and other resources.
However, disabling the option will sharply decrease the level of antivirus
protection, because when using a Unix like platform as mail or ftp server
many files potentially dangerous from the point of view of possible virus
infection are stored on the disk as archived and compressed files.

As for two latter lines, we would like to stress that the terms "packed"
and "archived" are understand here in the sense common for DOS/Windows
family systems, not Unix ones. We call "packed" an executable file
compressed by such programs as LZEXE, DIET, PKLITE, EXEPACK... As for
comprehension of "archived file", it includes not only archives proper
(such as *.tar), but also their compressed forms (such as *.tar.gz), since
in DOS/Windows these two ideas are not divided, as a rule.

The line

  CheckEMailFiles = Yes

indicates the necessity of checking files of number of mail clients having
format of mail messages. Since scanning mail streams for viruses is one of
the essential functions of the program on Unix platforms used as mail
servers, we would not recommend to disable the option.

Users experienced in working with Doctor Web for DOS or Windows will take
note of the fact that there is no option enabling/disabling disk boot
sectors and main memory scanning in the configuration file. It is due to
fact that the program version for Linux/FreeBSD basically has no such
functions.

A very important group of lines considers actions taken against infected or
Suspicious and incurable files:

  InfectedFiles =
  SuspiciousFiles =
  IncurableFiles =

Possible values of each line are the following: Cure (cure), Remove
(delete), Move (move) or Rename (rename). Some notes on taking these
actions against the specified objects were adduced in the end of chapter
4.4. Following them, you may make a default start form for the scanner
setting the considered options. As a result the correspondent lines will
look as follows:

  InfectedFiles = Cure
  #Curing infected files 
  SuspiciousFiles = Move
  #Moving suspicious files
  IncurableFiles = Remove
  #Deleting incurable files

And finally we have already discussed the necessity of enabling 

  PromptOnAction = Yes

line prescribing to the program to prompt user before any action to be
taken with infected or suspicious files (such as curing, moving, deleting
or renaming) in chapter 4.4. We would suggest to keep the default value. As
for the cases when automatic scanning without user's interference is
required and the known objects are to be scanned, the scanner should be
simply run with the correspondent command line option having priority over
configuration file options.

As for Doctor Web for FreeBSD and for Solaris, all mentioned above is valid,
but taking into consideration that in the ini file [FreeBSD] (or [Solaris])
and [FreeBSD:Daemon] (or [Solaris:Daemon]) sections are used, and in all the
parameters in place of /opt/ directory /usr/local/ directory is specified.


                         5. CONTACTS

As we have already noted, Doctor Web program gets constantly developed.
For updating information please see the sites at:

http://www.dials.ru
http://www.drweb.ru
http://www.drweb.ru/unix/forum
http://www.drweb.ru/unix

You comments, suggestions and remarks you can forward to the antivirus
department of DialogueScience, Inc to:

Street address: 117786 Moscow, Vavilova st. 40, office 103.

Tel.(+7-095) 135-6253, 137-0150
Tel/fax      938-2970, 938-2855

FidoNet: 2:5020/69

WWW: http://www.dials.ru
FTP: ftp.dials.ru, ftp2.dials.ru, ftp3.dials.ru

E-mail: Antivir@dials.ru
         
To consult us the registered users can write to:
e-mail: Support@dials.ru, asv@drweb.ru

Please enclose the following information to help us in analyzing the
situation:

- Unix system distribution name and version;
- kernel and standard libc library version;
- versions of applications Doctor Web integrates with;
- Doctor Web program version.
