1

Anti-virus in Russian means
Dr.WebThis booklet is our love confession. We confess our love for the creator of Dr.Web and for his life's work towhich all of us at Doctor Web are committed heart and soul.
This booklet is an expression of the pride we take in our work.
On Dr.Web’s 20th anniversary, we'd like to share our genuine admiration for the talent and qualities found in the man fully responsible for every stepof the way to create a unique phenomenon on a global scale: Russia’s state-of-the-art anti-virus—Dr.Web.
Dr.Web was at the height of popularity almost from the moment it was born—in the mid-90s there was no computer in Russia that did not have
Dr.Web installed. The supreme-quality high-tech product experienced several years of unjust neglect on the turn of the century and was revived once
again thanks to the efforts of people who believed in it. It would have had no chance of surviving on the extremely competitive global anti-virus market were it not for its author—Igor Danilov—who has adhered all these years to the principle that one must create only what people genuinely need.

“We make the product the way I've always wanted to — with an emphasis on quality. This is the mostimportant thing”.

2

3

Igor Danilov – a fighter by nature
Igor Danilov is a living Russian programming legend, a unique, extraordinary, self-taught genius who created the renowned virus fighter—
Dr.Web Anti-virus.

It started out in the early `90s as a hobby. Back then, I was working at a secret
research facility in St. Petersburg on a project that dealt with signal processingin jet fighter guidance systems. And for some reason I got interested in the virus
problem...

He was born on April 22, 1964, in Leningrad (present-day St. Petersburg) andgraduated from Kachinskoye Higher Military Pilot School in Volgograd, after
which he served as a military pilot.

Igor Danilov, from an interview with Webcity“Books were scarce and we didn’t have anything to learn from, there was no Internet at that time. We went to the Technicheskaya kniga book store on Pushkin
Street in St. Petersburg, looked through subscriptions lists for the upcoming year
and subscribed to books we needed. When a desired book appeared, it changed
hands many times. We often read all night long, because we needed to learn as
quickly as possible”.

“It’s simple: they lift you into the sky and you must give your life and/or eliminate
the enemy. Looking back now, I realize that I was only ever interested in mathand flying. So, while my desire to become a fighter pilot seemed at the very least
strange to others, it was obvious to me”.
Igor Danilov, from an interview with “System Administrator” magazine

Igor Danilov from an interview with “System Administrator” magazine

After studying at the Leningrad Institute of Avionics, Igor Danilov worked as an engineer in aviation defence projects at the Leninets research and production facility.
In the `80s, the company manufactured onboard CPUs for MIG-29 fighter jets. It
was the time when viruses were first appearing, and Igor Danilov was tasked withcalculating the probability of onboard fighter computers getting infected.
“I described possible schemes for introducing viruses into computer systems in
the early 90s. Then I had to assess the probability of a Soviet fighter’s onboard
computer getting infected. I showed how a Trojan horse could be deployed in thesystem so that, upon receiving a certain signal from the ground, the plane could
not simply be rendered non-operational, it could be transformed into a weaponof the enemy.
... the Stuxnet outbreak followed a similar pattern. However, in my description
I used a scheme based on social engineering and 5-inch floppy disks but not a
USB-flash drive, as it was with Stuxnet. If you understand how the software that
controls a particular device works, an attack on such a device is feasible, even if it
is a stand-alone device. The world, immersed in IT is very fragile“.
Igor Danilov, from an interview with PC Week/RE /RE
In 1990, Igor Danilov started developing anti-virus software. The first version of
SpiderWeb (the prototype for Dr.Web) appeared in 1992.

4

5

The Company and its People

Doctor Web geography

On December 21, 2003 Igor Danilov founded Doctor Web. Boris Sharov
became the company’s general director.

There are a lot of very smart people at our company and I take credit for this. I cansay that I found some of our experts myself in different cities and even in different
countries, and now they set the standard for the newcomers”.

St. Petersburg, Russia

Doctor Web’s strategic goal became to create the best anti-virus software thatmeets all present requirements and to develop new technologies to arm users
against all types of computer threats.

Igor Danilov from an interview with “System Administrator” magazine“The good news is that we have helped many young people, who came to Doctor
Web at different times, to become professionals. I’m also delighted to see thatthe company is growing, and it pleases me that the entire time I’ve worked in theanti-virus industry, which is since its emergence, it is one of the few industries inour country that produces rather than”.

At the time of Doctor Web’s founding, only around 10 percent of Russian users
were running Dr.Web. The launch of Doctor Web, Ltd. resulted in skyrocketing
sales of Dr.Web products in Russia and abroad. Today, Doctor Web has more than
300 employees.
“Finding a professional to employ is a big problem. There are a lot of companies
and all of them are seeking professionals. They do not want to nurture them, it’s
expensive. Outbidding is cheaper. Typically, we don’t hesitate to let go people
who can be outbidden easily. We value a different attitude. Our main requirements for a candidate are the ability to think logically and to know the basics. We
will gladly hire anyone who is willing to work and able to think logically. We willteach them the rest.

Moscow, Russia

Traditionally our anti-virus products have been developed in St. Petersburg, and,
therefore, the development department headed by Igor Danilov is stationed
there. Also here is the virus monitoring service that collects virus samples fromaround the world.

The headquarters is located in Moscow. The distribution, marketing, businessdevelopment and web design departments and technical support service also reside in Moscow. The support staff consists of highly skilled engineers who provide
a variety of support services in Russian, English, German, French and Japanese.

Address:
3d street Yamskogo polya 2-12А, Moscow, Russia, 125124
Tel: +7 (495) 789-45-87, +7 (495) 789-45-86 (support)

Igor Danilov, from an interview with PC Week/RE

Fax: +7 (495) 789-45-97
www.drweb.com

Boris Sharov – General director

Igor Danilov – Technical Director
67Regional offices“There was a time when I was alone, and my workplace was in a basement. Now, we are a teamin a comfortable office and there are branch offices in various countries around the world“.
Igor Danilov

Doctor Web – Central Asia

Doctor Web France

Republic of Kazakhstan, 050009, Almaty,
Shevchenko, 165b office 910

333b, Avenue de Colmar, 67100 Strasbourg

Tel.: +7 (727) 323-62-30, 323-62-31,
323-62-32

E-mail: p.curien@drweb.com

Sales department: sales@drweb.kz
Support department: support@drweb.kz
www.drweb.kz

Tel.: +33 (0) 3-90-40-40-20
www.drweb.fr

Doctor Web Pacific, Inc.
NKF Kawasaki building 2F,

Doctor Web Technical Support Centre

1-2, Higashida-cho, Kawasaki-ku,
Kawasaki-shi, Kanagawa-ken

Office 3, 4 Kostelnaya str., Kiyev 01001, Ukraine

210-0005, Japan

Tel/fax: +38 (044) 238-24-35, 279-77-70

Tel.: +81 (0) 44-201-7711

E-mail: dr.web@drweb.com.ua
www.drweb.ua

Doctor Web Deutschland GmbH
Rodenbacher Chaussee 6, D-63457 Hanau

www.drweb.co.jp

Doctor Web Software Company(Tianjin), Ltd.

Tel.: +49 (0) 6039-939-54-14

Add: 112, North software tower, № 80, 4th Avenue,
TEDA, Tianjin, China

Fax: +49 (0) 6039-939-54-15

天津市经济技术开发区第四大街80号软件大厦北楼112

www.drweb-av.de

Tel/fax: +86 (0) 22-5982-3480

Foundation of Doctor Web

E-mail: D.Liu@drweb.com
www.drweb.com

Development of Dr.Web anti-virus since 1992

1995

8

2000

2005

9

2010

Dr.Web users

They trust us

Doctor Web’s annual sales growth rate is above the average for the industry. The company is steadily strengthening its position as a supplier of anti-virus solutions for large governmental organizations. Dr.Web softwareis deployed by ministries and large banks and enterprises.
Doctor Web’s customers include home users from many countries, Russian corporations, small companies and backbone corporations. The company
is grateful to all its customers for their loyalty and support through the years. Doctor Web has received state certificates and awards; our satisfied
customers spanning the globe are clear evidence of the complete trust placed in the products created by our talented Russian programmers.

1011

History
1990 — 1991


The first experiments to cure viruses take place(using AIDStest and other anti-viruses and debuggers).
The first resident anti-virus monitor Tadpole is created.

Igor Danilov, from an interview with Webcity

1991


“... Speed was its key advantage. That’s why the
product was called Tornado and back then it was
indeed the fastest anti-virus scanner. Then theanti-virus, which was already being called SpiderWeb, won a contest, and I ended up at CeBIT93 in
Hanover. At this huge exhibition I talked to otheranti-virus makers and clients and realized that I
needed to do everything completely differently”.

The book Computer Virology by Nikolai N. Bezrukov is published.
“... when it comes to my current profession, Bezrukov’s “Computer Virology” influenced me most.
It was published in 1991 and that must have been
when I bought it. My family and I went to thecountryside for a weekend and the book was sointeresting that I finished it in one night. The following morning, I understood how an anti-virus
should work

The anti-virus doctor (scanner) Tornado is created. Tornado could interact with hard disk filesystem at a low level (BIOS), cope with the new
Ghost-1963 virus and was distinguished by ahigh scanning speed.

1996

2000



Dr.Web at CeBIT’93 (Hanover, Germany).

Scorpion disc inspector is created. Like the Tornado, Scorpion worked with a hard disk file systemat the BIOS level, which enabled it to detect stealthviruses.

The heuristic analyzer, which detects previously
unknown viruses, is implemented.



The Dr.Web anti-virus is certified by the Russian
Defence Ministry.



A processor emulator to uncoil and detect polymorphic viruses is implemented. Dr.Web Antivirus becomes one of the few in the world to have
coped the world-famous polymorphic virus Phantom-1.



Virus Bulletin magazine publishes its first review of
the Dr.Web Anti-virus. The Dr.Web heuristic analyzer is awarded the highest mark.

Dr.Web virus database updating frequency increases dramatically. Today the databases are updated every day on an hourly basis.

Doctor Web anti-virus scanner 1.00 is released.

The online Dr.Web scanner service appears.

Commercial distribution of the Dr.Web anti-virus
begins.

SpiderWeb incorporating the Spider Guard (Tadpole successor) and Doctor Web (the successor
to Tornado) is released. That moment became thestarting point in the history of Dr.Web’s development.
“First there was the SpiderWeb suite, which consisted of three programs: Spider, Dr.Web andScorpion disk checker. It was after I had visitedGermany that I realized I wouldn’t be able to copewith the whole hi-tech project on my own andimplement all the features I wanted. That’s why
I chose one component—Dr.Web—and continued developing it. But, I always remembered thatthe other components were important, too, and,sooner or later, I would make them properly andincorporate them into the suite”.

Igor Danilov from an interview with
“System Administrator” magazine
Tadpole is rewritten and becomes more flexible
and versatile.

1994

1992

I met Nikolai Bezrukov in 1997 in San Francisco,
he was very upset that we had not met earlier but
delighted to hear how much his book had influenced me”.



1993

Igor Danilov, from an interview with Webcity
The first polymorphic virus is created. Its emergence became a watershed separating real ant-viruses capable of detecting and curing polymorphs
from other programs performing some of the antivirus functions. Dr.Web becomes the first programin the history of the anti-virus industry that could
detect and cure complex polymorphic viruses. It is
this anti-virus technology that first made Dr.Web
famous among professionals.

1995

The January issue of Virus Bulletin magazine features the results of comparative testing for programs capable of neutralizing polymorphic viruses.

1998





2003

Dr.Web 4.0 is released. It incorporated innovations
that , fundamentally changed the anti-virus’s architecture and operational routines.

“I remember in 1993 and 1994 going aroundshops on Pushkin Street (we made Dr.Web to neutralize polymorphic viruses) and giving the antivirus to salespeople. I told them: you can copy it toa floppy disk for free. It became popular instantly.... Back then I was just happy that people wereusing our anti-virus. Although I was not paid forit, hearing words of thanks felt great! “.



Dr.Web anti-virus is presented at CeBIT’95 (Hanover, Germany).

Dr.Web is ported from the 16-bit to the 32-bit
platform.

1999



A feature is created that enables updates to bedelivered to the Dr.Web virus database withoutchanging the code of the program.



The first comprehensive system to prevent virus
penetration is created for Windows 95/98.

Dr.Web for WinWord is released.



Igor Danilov, from an interview with
“System Administrator” magazine



Dr.Web becomes one of the first anti-viruses forNovell NetWare.

The resident monitor SpIDer Guard for Windows
95/98 joined the Dr.Web family.

For the first time, Igor Danilov presents a reportat the EICAR-95 conference in Zurich. Computer
virologists from all over the world attend these
conferences.

Dr.Web becomes the first anti-virus in the world
to feature a virtual machine memory scan underWindows NT.

Igor Danilov participated in the All-Russian Seminar and became acquainted with Dmitry Lozinsky
and other virologists.

Igor Danilov took part in the “1 & 1” contest, held
this year for Eastern European countries, to findinteresting software products and technologies.
His SpiderWeb won a grant providing its makerwith a stand at CeBIT’93.

12

2002

13



The Dr.Web engine is licensed to the Chinese antivirus developer KingSoft.

Igor Danilov establishes Doctor Web and becomesits permanent technical director.

History
2004

2005

2007

2008

2009

2012









Doctor Web France opens for business.







Doctor Web announces that it will no longer participate in comparative tests by the British magazine Virus Bulletin, as they “have little to do withassessing the capabilities that are really in demandin the face of today’s virus threats”.

Dr.Web Enterprise Suite for corporate network
protection is released.
“— Corporate solutions are our top priority?
— Yes, because we have a product no one else
has. In the late `90s, it was believed that Dr.Web
was more an anti-virus for home users than forcorporate clients. I decided that this perception
had to be changed and created a special teamthat worked on enterprise solutions for five years.
Naturally, we set ourselves the challenging goalof being at least as good as major developers like
Symantec, MacAfee, and Trend Micro”.

The Technical Support Center in the Ukraine is
opened.

2006
Doctor Web Central Asia is established in the Republic of KazakhstanDoctor Web Deutschland GmbH office opens inGermany.

Igor Danilov, during an interview with
“System Administrator” magazine


Dr.Web engine is licensed to the South Korean developer of the Virus Chaser.



The free utility, Dr.Web CureIt!, is released and immediately becomes the most popular and trusted
means for emergency virus curing among users ofother anti-viruses.

The first version of Dr.Web AV-Desk is released.
From this point on, the Software-as-a-Service(SaaS) era in Russia’s anti-virus industry is underway. Now service providers are delivering theDr.Web Anti-virus to home users on a monthly
subscription basis. Dr.Web AV-Desk public testing is held on the servers of the provider Corbina
Telecom (now Beeline). Doctor Web becomes thefirst company to offer an anti-virus as a service on
the Russian market and, to this day, is still the undisputed leader in this segment of the anti-virus
market.

2007 Dr.Web for Windows Mobile is released.



Since viruses for mobile devices are scarce at thistime, Doctor Web makes the unprecedented decision to provide the product free of charge. The
motto: Protection from non-existing threats must
be free! Doctor Web adheres to this principle withregard to all its anti-viruses for mobile devices till
2012 when the number of threats to mobile platforms starts growing exponentially.

“Anti-virus tests have become a marketing tool.
Supposedly performed by so-called independent experts, they misguide users who trust themwithout thinking. The Russian market is flooded
with foreign products incorporating state-of-theart marketing technology but very little anti-virus
hi-tech. And while damage to a home system may
amount to a few hundred dollars, a large enterprise can meet catastrophe when it adopts a technologically outdated product. This is especiallytrue for government entities”.
Igor Danilov during an interview with CNews




14

Doctor Web releases an anti-virus for Mac OS X.
The number of viruses for Mac OS X has been
negligible only because there have been too few
users to make virus writing for Macs profitable;
Doctor Web invested in developing this productand is proud of its quality. Only in April 2012, after Doctor Web found a botnet of many thousandsof Macs, did Apple release a utility that removes
Backdoor.Flashback.39, thus acknowledging defacto the existence of viruses for Macs.

2010


Dr.Web AV-Desk makes it possible to provide
business users with the Dr.Web Anti-virus Service.

The in-house developed firewall has been incorporated into Dr.Web products for home users.



Doctor Web Pacific opens its office in Japan.

Dr.Web Office Shield appliance is released. Like
many Doctor Web products, it is ahead of its time.
In 2012, four years after its release, Dr.Web Office
Shield is named top innovation for SMB softwareby PC Magazine.

Dr.Web AV-Desk is recognized as one of the best
security products in 2007 by PC Magazine.

Dr.Web Enterprise Security Suite achieves certification required to deliver software to Gazprom.



Doctor Web Software Company (Tianjin), Ltd
opens in China.

2011

15

Doctor Web marks the 20th anniversary of Dr.Web
anti-virus development.

2013


Doctor Web celebrates its 10th anniversary.

Technology awarded the quality markAll rights for Dr.Web technologies are reserved by Doctor Web. Doctor
Web is one of the few anti-virus vendors in the world to have its own
technologies to detect and cure malware. Dr.Web software incorporates
a proprietary anti-virus engine, and the company has its own anti-virus
lab and global virus monitoring service.

The checksum module
The module verifies file checksums against virus database entries, determines
their format and initiates curing. This technique is a part of the signature-based
search.

Origins Tracing - non-signature virus detection technology

A variety of technologies to detect and disarm malware is incorporated
into Dr.Web software and these technologies are being improved constantly. We’ll describe just a few of them.

When scanning, an executable file is considered as a sample that has a certain
structure and that structure is compared against database of known malicious
patterns. The technology ensures the high probability that viruses not registeredin the Dr.Web database will be recognized.

Heuristic analyzer
The heuristic analyzer is designed to identify new, previously unknown viruses
that have no entries in the virus database. The heuristic analyzer relies upon theknowledge (heuristics) about certain properties typical of virus code, and viceversa, that are extremely rare in viruses. Each of these attributes is weighted, thatis to say each one is assigned a number whose modulus denotes the importanceand severity of the attribute.

Execution emulation module
Program code execution is emulated to detect polymorphic and highly encryptedviruses, when the search against checksums cannot be applied directly, or is very
difficult to be performed (because of the impossibility of building secure signatures). The anti-virus uses an emulator (a CPU simulator and in part a systememulator) to simulate the execution of an analyzed code.

16

FLY-CODE

Comprehensive analysis of packed threats

This dynamic unpacking module is designed to extract executable files compressed with an unknown packer. It is an expanded version of the execution emulation module. The module simulates the Windows environment and compares asequence of viral routines performed by the code against the database of known
viral routine sets. This unique universal decompression technology allows viruses
disguised with packers unknown to Dr.Web to be detected.

The new technology significantly improves the detection of supposedly “new”
threats that were known to the Dr.Web virus database before they were concealed by new packers. In addition, with such an analysis there is no need to add
redundant definitions of new threats into the virus database. With Dr.Web virus
databases kept small, a constant increase in system requirements is not needed.
Updates remain traditionally small, while the quality of detection and curing remains at the same traditionally high level.

Static unpacking module
The Static unpacking module is designed to extract executable files, compressedwith known packers such as UPX, ASPACK, FSG and ASPROTECT (Dr.Web recognizes about 120 known packers), and to unpack archives such as ARJ, ZIP, RAR,
ISO, TAR and other containers. The unpacker extracts the original file and sends itto the top of the scanning procedure.

Dr.Web Process Heuristic
Protects systems against new, highly prolific malicious programs that are capableof avoiding detection by traditional signature-based analysis and heuristic routines because they haven’t yet been analysed in the anti-virus laboratory and,
therefore, are unknown to Dr.Web at the moment of intrusion. It analyses behaviour of a suspicious program to determine if it is malignant and takes necessary
steps to neutralise the threat, if there is any. It helps minimize losses from actionsof an unknown virus.

17

The history of Dr.Web versions
Version
9.00
8.00
14.11.2012

9.00
17.09.2013

8.00

7.00
7.00

6.00

11.10.2011

15.03.2010

6.00

5.00

4.33
27.09.2005

4.20
4.00

18.12.2008

06.04.1998

4.00

4.44

4.30

25.09.2007

11.08.2003

4.10

3.00

5.00

14.07.2000

08.05.1999

10.06.1995

3.00
2.10
19.03.1995

2.00
1.00
20.07.1994

2.00
18.01.1995

1.00

1994

2000

18

2005

2010

19

2015

Dr.Web boxed products

2005

2006

2007

20

2008

2009

2010

2011

2012

21

2013

And what do you think a real anti-virus shouldbe?
“— An anti-Virus must be able to detect complex polymorphic viruses without missing a single one.
— An anti-virus must not only perform its functions flawlessly but also must not annoy the user.
— It should not lower system performance significantly nor should it notify you in an inhuman voice every
second that it has once again saved you from certain death.
— There is only one criterion — the quality. But, unfortunately, that can only be tested by users themselves”.

Igor Danilov, from an interview with CNews

22

23

24