© 2003-2012 Doctor Web. All rights reserved.
This document is the property of Doctor Web. No part of this document
may be reproduced, published or transmitted in any form or by anymeans for any purpose other than the purchaser's personal use without
proper attribution.

TRADEMARKS
Dr.Web, the Dr.WEB logo, SpIDer Mail, SpIDer Guard, CureIt!, CureNet!,AV-Desk are trademarks and registered trademarks of Doctor Web in
Russia and/or other countries. Other trademarks, registered trademarks
and company names used in this document are property of theirrespective owners.

DISCLAIMER
In no event shall Doctor Web and its resellers or distributors be liable forerrors or omissions, or any loss of profit or any other damage caused or
alleged to be caused directly or indirectly by this document, the use of or
inability to use information contained in this document.

Dr.Web Anti-virus for Microsoft ISA Server and Forefront TMG
Version 6.00.1
Administrator Manual
01.11.2012
Doctor Web Head Office
2-12A, 3rd str. Yamskogo polya
Moscow, Russia
125124Web site: www.drweb.com
Phone: +7 (495) 789-45-87
Refer to the official web site for regional and international office
information.

Doctor Web
Doctor Web develops and distributes Dr.Web® information
security solutions which provide efficient protection from malicious
software and spam.
Doctor Web customers can be found among home users from allover the world and in government enterprises, small companies
and nationwide corporations.
Dr.Web antivirus solutions are well known since 1992 forcontinuing excellence in malware detection and compliance withinternational information security standards. State certificates andawards received by the Dr.Web solutions, as well as the globallywidespread use of our products are the best evidence of
exceptional trust to the company products.

We thank all our customers for their support anddevotion to the Dr.Web products!

4

Table of ContentsDocument Conventions and Abbreviations

7

Introduction

9What is Dr.Web Anti-virus

9

Scanned Objects

11

Licensing

12

License Key File

12

Getting License Key File

13

Updating License

14

Principles of Operation of Dr.Web Anti-virus
Dr.Web Anti-virus Filters

15
15

Application filters

16

Web Filter

20

Anti-virus Check Using Filters

22

Dr.Web HTTP Web Filter

23

Dr.Web HTTP Filter

25

Dr.Web FTP Filter

25

Dr.Web SMTP Filter and Dr.Web POP3 Filter

27

Dr.Web Anti-virus Services

27

Installation and Removal

29

System Requirements

30

Install Dr.Web Anti-virus

31

Remove Dr.Web Anti-virus

34

Dr.Web for ISA Web Console

35

Administrator Manual5Groups and Profiles

37

Creating and Configuring Profiles

37

Profile Priority

39

Scanning

40

Anti-spam

42

Office Control

45Filtering

47

Managing Groups

52

Creating a New Group

52

Configuring and Forming Groups

54

Notifications

56

View Statistics

57

View Incidents

60

Quarantine

61

Manage Quarantine via Dr.Web for ISA Web Console

61

Quarantine Manager

63

Updating Virus Databases

67

CMS Administrative Console

68

Changing Administrator Password

70

Adding New Administrator

71

Organizing Clusters

71

Logging

74

Event Log

74

Installation Program Text Log

75

CMS Log75

Trobleshooting

77

Administrator Manual

6
Check Installation

77

Check Updater Functionality

78

Virus Detection Test

79

Spam Detection Test

82

Appendices83

Appendix A. Updater's Command-Line Parameters

83

Appendix B. CMS Platform

86

Database

86

Application Control

87

Statistics

89

Administration

89

Appendix C. Dr.Web SSM Service

91

Appendix D. Remove Dr.Web Anti-virus Manually93

Appendix E. Operation in Central Protection Mode

95

Appendix F. Technical Support

98

Index

99

Administrator ManualDocument Conventions and Abbreviations

Document Conventions andAbbreviations
The following conventions and symbols are used in this document:
Convention

Description

Bold

Names of buttons and other elements of the graphical userinterface (GUI), and required user input that must beentered exactly as given in the guide.

Green
bold

and

Green and
underlined

Names of Dr.Web products and components.
Hyperlinks to topics and web pages.

Monospace

Code examples, input to the command line and application
output.

ItalicPlaceholders which represent information that must be
supplied by the user. For command-line input, it indicatesparameter values.
In addition, it may indicate a term in position of adefinition.

CAPITALLETTERS

Names of keys and key sequences.

Plus sign(«+»)

Indicates a combination of keys. For example, ALT+F1
means to hold down the ALT key while pressing the F1 key.
A warning about potential errors or any other importantcomment.

Administrator Manual7Document Conventions and Abbreviations

The following abbreviations are used in the manual:AD

Active Directory

CPU

Central Processing Unit

HTML
HTTP

Hypertext Mark-up Language
Hypertext Transfer Protocol

FTP

File Transfer Protocol

POP3

Post Office Protocol Version 3

GUI

Graphical User Interface

OS

operating system

RAM

Random Access Memory

SMTP

Simple Mail Transfer Protocol

SP1, SP2, etc.

Service Packs

Administrator Manual8Introduction

Introduction
Thank you for purchasing Dr.Web Anti-virus for Microsoft ISA
Server and Forefront TMG (hereinafter referred to as Dr.Web
Anti-virus). This anti-virus product is a powerful tool against threats
propagated through the HTTP, FTP, SMTP and POP3 protocols andoffers a reliable protection scanning and neutralizing the infected
objects inside a corporate network protected by Microsoft ISA Serveror Microsoft Forefront TMG firewall.
This manual is intended to help administrators of large corporate
networks to install, adjust and manage Dr.Web Anti-virus, andcontains information on all the main features of the software andcontact details for technical support.

What is Dr.Web Anti-virus
Dr.Web Anti-virus is an anti-virus plug-in designed to protect
corporate systems against viruses and spam. It flexibly integrates into
the system and processes all traffic transferred via HTTP, FTP, SMTP
and POP3 protocols in order to detect and neutralize all types ofmalicious objects. The plug-in check the incoming Internet traffic forviruses, dialers, adware, hacktools, jokes and riskware. If a threat is
detected, it is processed according to the application settings.
The application integrates into Microsoft ISA Server and Microsoft
Forefront TMG by implementing its data filters, that give access tothem to the Dr.Web anti-virus engine. Dr.Web Anti-virus operates
on the Dr.Web CMS platform (Dr.Web Central Management
Service), which supports the central configuration of application
settings and components and remote administration via protected
protocol HTTPS. Dr.Web CMS has an inner web server Dr.Web CMS
Web Console with client authentication, thus, only the authorizedadministrators can access the application settings.
Dr.Web CMS services installed on different servers can be organized
in a hierarchy tree by the administrator, to support replication of

Administrator Manual9Introduction

parameters with the Shared attribute of the application working with
Dr.Web CMS. The parameters are copied from the main server to thesub-server one (see Organizing clusters), thus, the servers tree
parameters can be configured on the main host.
Dr.Web Anti-virus can perform the following functions:
Scan all Microsoft ISA Server and Microsoft Forefront TMG
traffic, transferred via HTTP, FTP (including FTP over HTTP),
SMTP and POP3 protocols
Block access to the infected objets for users within the
network protected by Microsoft ISA Server or Microsoft
Forefront TMG firewall
Isolate infected and suspicious objects to Quarantine
Add notifications on virus events to the Event log and to theinternal event database in Dr.Web CMS
Filter spam in the e-mails via SMTP protocol
Add accompanying text to the e-mail messages containing
security threats
Restrict access to web resources using Office Control
Collect statistics
Automatically update virus databases and components of theplug-in
Support the common application settings on a distributed
system of firewalls, including those organized in clusters
Dr.Web Anti-virus uses virus databases, which are constantly
supplemented with new records to assure up-to-date protection. Also,a heuristic analyzer is used for additional protection against unknown
viruses.

Administrator Manual10Introduction

Scanned Objects
Dr.Web Anti-virus scans all objects before they are processed by theclient part.

Scanned objects in HTTP and FTP traffic
Dr.Web Anti-virus scans the HTTP and FTP traffic passing throughMicrosoft ISA Server or Microsoft Forefront TMG firewall in the realtime mode. The resource specified in the client request is scanned.
Microsoft ISA Server and Microsoft Forefront TMG either connect the
specified server and obtain the resources from it or return the resourcefrom its own cache. The application filters intercept the received data(including objects in archives and packed objects) and create
temporary buffer or a file which is subsequently analysed by the antivirus system.

Generally, the anti-virus analysis can be performed only for thewhole file. Therefore, the accumulation and scanning of therequested data may require additional time.

Scanned objects in SMTP and POP3 traffic
Dr.Web Anti-virus scans incoming messages in real-time mode. It
checks the following elements of e-mail messages:
Body of the message
Attachments (including archived and packed files)
Embedded OLE objects and messages

Administrator Manual11

Licensing

Licensing
The use rights for the purchased product are regulated by the license
key file.

License Key File
The license key has the .key extension and contains, among other, thefollowing information:
Licensed period for the product
List of components the user is allowed to use (e.g. the antispam feature can be enabled only in the «Anti-Virus&AntiSpam» version)other restrictions (e.g. users number limitation for the
license)A valid license key file satisfies the following criteria:
License is not expired
The license applies to all components of the productIntegrity of the license key file is not violated
If any of the conditions is violated, the license key file becomes invalid,
Dr.Web Anti-virus stops detecting the malicious programs. License
violation is registered in the Windows Event Log and in the text log ofplug-in.

The key file has a write-protected format and must not be edited.
Editing of the key file makes it invalid. Therefore, it is notrecommended to open your key file with a text editor, which may
accidentally corrupt it.

Administrator Manual12Licensing

Getting License Key File
You can receive a license key file in one of the following ways:
By e-mail in an archived attachment
With the plug-in distribution kit
On separate media as a separate file with .key extension
The key file should be obtained before installing Dr.Web Anti-virus,
as the installer requests the path to a key file.

To acquire a license key file by e-mail1. Launch an Internet browser and go to the site, which is
specified on the product registration card supplied with yourcopy of the product.
2. Fill in the registration form.
3. Enter the serial number that is typed on the registration card.
4. The license key file will be sent as an archived attachment to
the e-mail address you specified in the registration form.
5. Extract the license key file and copy it to the computer where
you plan to install Dr.Web Anti-virus.
For demonstrative purposes you may be provided with a demo license
key file. Demo license allows you to access full functionality of the Dr.
Web Anti-virus for a short-term period. No support is provided
during trial period. On the expiration of the trial license, you will needto purchase a full license to continue working with the product.
To receive a demo license key file by e-mail, fill in the registration form
at http://download.drweb.com/demoreq/.
To buy a license key file, you can either contact the nearest partner ofDoctor Web or use the Doctor Web web store service at http://buy.
drweb.com/.
For more information on licensing and types of license key files, visit
the Doctor Web official web site at http://www.drweb.com.

Administrator Manual13

Licensing

Updating License
When license expires or security of your system is reinforced, you may
need to update the license. The new license then should be registeredwith the product. Dr.Web Anti-virus supports hot license update
without stopping or reinstalling the plug-in.

To update the license key file
1. To update the license key file, replace an old license key filewith the new file in the plug-in installation folder (usually, %DrWeb for ISA Server%).
2. Dr.Web Anti-virus automatically switches to the new license.
For more information on license types, visit the Doctor Web official
web site at http://www.drweb.com.

Administrator Manual14Principles of Operation of Dr.Web Anti-virus

Principles of Operation of Dr.Web
Anti-virus
All Dr.Web anti-virus solutions use the following general componentsthat provide the protection of all operating systems and platforms: thevirus scanning engine drweb32.dll and regularly updated virus
database files (with the .vdb extension), which store virus records that
contain information about the viruses and other malware.
The anti-virus and anti-spam solution Dr.Web Anti-virus integrates
Dr.Web technologies into the Internet traffic processing, carried out
by Microsoft ISA Server and Microsoft Forefront TMG firewall services.
The product has a convenient web interface to facilitate managementof scanning settings and virus events monitoring via Internet browser.
For more information about the settings, see Dr.Web for ISA
Web Console.

Dr.Web Anti-virus Filters
Dr.Web Anti-virus intercepts the data from network connections tocheck for viruses by special filters, which are integrated into Microsoft
Firewall Service (for Microsoft ISA Server) and Microsoft Forefront TMG
Firewall (for Microsoft Forefront TMG).
The filters are ISAPI-based dynamic libraries, launched on theMicrosoft Firewall Service or Microsoft Forefront TMG Firewall start andremaining active until the service stops. On the start, Microsoft Firewall
Service and Microsoft Forefront TMG Firewall check the list ofregistered filters and assign different network events to them forprocessing. The filters can access to the data of the "client-server"
session of the firewall service. If a client request or server response
creates an event a filter is registered for, this filter intercepts andanalyses the traffic data.

Administrator Manual15Principles of Operation of Dr.Web Anti-virus

Dr.Web Anti-virus contains 4 application filters and one web filter,
which analyse the traffic for viruses. Each filter is subscribed to themain service Dr.Web CMS and connects to it when loading to thewspsrv.exe process memory, then becomes visible in the CMS
Administrative Console.

Application filters
Dr.Web Anti-virus contains the application filters (see Figure 1):
FilterPath to the filter library

Dr.Web FTP Filter%DrWeb for ISA Server%\FTPFilter.dll

Dr.Web HTTP Filter%DrWeb for ISA Server%\HTTPFilter.dll

Dr.Web SMTP Filter%DrWeb for ISA Server%\SMTPFilter.dll

Dr.Web POP3 Filter%DrWeb for ISA Server%\POP3Filter.dll

These filters process the protocols' packets. They analyze the data andblock sending them to the input and output completion buffer in casethe security threats are detected. All filters are available for
configuration in Microsoft ISA Server or Microsoft Forefront TMG
console tree (see Figure 1a, Figure 1b):
On the Application Filters tab of the Configuration -> Addins section in Microsoft ISA Server console.
On the Application Filters tab of the System section in
Microsoft Forefront TMG console.

You can disable any filter, if necessary. If a filter is disabled, asign is shown next to the filter name (see Figure 1a).

Administrator Manual16Principles of Operation of Dr.Web Anti-virus

Figure 1a. Dr.Web application filters in Microsoft ISA Server
consoleAdministrator Manual17Principles of Operation of Dr.Web Anti-virus

Figure 1b. Dr.Web application filters in Microsoft Forefront
TMG console
After the application installation and registration, Dr.Web FTP Filter
connects to the FTP protocol events and is displayed on the FTP
protocol properties tab in the Microsoft ISA Server and Microsoft
Forefront TMG console (see Figure 2).

Administrator Manual18Principles of Operation of Dr.Web Anti-virus

Figure 2. Dr.Web FTP Filter on the FTP protocol properties tab

Microsoft ISA Serverand Microsoft Forefront TMG contain FTP
Access Filter. If this filter is disabled, the firewall does not control
the applications interaction on the FTP protocol level. For operationof Dr.Web FTP Filter, FTP Access Filter needs to be enabled anddisplayed on the FTP protocol properties tab (see Figure 2).

After registration, Dr.Web HTTP Filter is displayed on the HTTP
protocol properties tab in Microsoft ISA Server and Microsoft Forefront
TMG console (see Figure 3). On completing the application installation,
Dr.Web HTTP Filter is disabled by default, because it cannot be
activated together with Dr.Web HTTP Web Filter (see Figure 1).

Administrator Manual19Principles of Operation of Dr.Web Anti-virus

Figure 3. Dr.Web HTTP Filter on the HTTP protocol propertiestab

Web Filter
Dr.Web Anti-virus contains Dr.Web HTTP Web Filter(HTTPWebFilter.dll library located in the %Microsoft ISA Server%\DrWeb\ or %Microsoft Forefront Threat Management Gateway%\DrWeb\ folder depending on the firewall used) a filter, which is aruntime extension of Web Proxy Filter, a built-in filter of Microsoft ISA
Server and Microsoft Forefront TMG, and responds to its events. Dr.
Web HTTP Web Filter is displayed in Microsoft ISA Server andMicrosoft Forefront TMG console tree on the Web Filters tab in the
Configuration -> Add-ins branch (see Figure 4a, Figure 4b):On the Web Filters tab in the Configuration -> Add-ins
section of Microsoft ISA Server console
On the Web Filters tab in the System section of Microsoft
Forefront TMG console

Administrator Manual20Principles of Operation of Dr.Web Anti-virus

Dr.Web HTTP Web Filter is not displayed on the HTTP protocol
properties tab.

Figure 4a. Dr.Web HTTP Web Filter in the Microsoft ISA
Server console

Administrator Manual21Principles of Operation of Dr.Web Anti-virus

Figure 4b. Dr.Web HTTP Web Filter in the Microsoft Forefront
TMG console

Anti-virus Check Using Filters
This section describes the anti-virus check using the following filters of
Dr.Web Anti-virus:
Dr.Web HTTP Web Filter
Dr.Web HTTP Filter
Dr.Web FTP Filter
Dr.Web SMTP Filter and Dr.Web POP3 Filter

Administrator Manual22Principles of Operation of Dr.Web Anti-virus

Dr.Web HTTP Web Filter
The operation of Dr.Web HTTP Web Filter is configured by a set ofparameters in CMS Administrative Console, available in the
Application Settings group for HTTPWebFilter_1.0.
The anti-virus check starts within the "client-server" session when theserver sends the data back to the client or obtains the requested datafrom the cache of Microsoft ISA Server or Microsoft Forefront TMG if
the values of the PassCached parameter is false (the default value).
Once the value of the PassCached parameter is changed to true, theapplication stops scanning the objects received from the firewall cache.
Therefore, it is recommended to clear cache before switching to suchoperation mode. To do this, disable the use of cache in the firewall
management console, then delete the cache file (located in the
Urlcache folder on each disk the caching is configured for). After
deleting the file re-enable the use of cache.
As the object to check is a web resource specified in the client's
request, Dr.Web HTTP Web Filter analyzes the packets of the
protocol, compiling the resource as a buffer of 1 MB by default or as atemporary file (if the resource size is large) for further anti-virus
scanning.
It an URL is not blocked by Office Control, it may be in one of thefollowing four states (two of them are known and two unknown):
Unverified
Unknown
Infected
Clean (contains no threats)
Once the anti-virus scanning completes, the resource changes its state
to the known one for the verification period specified by the
ResetCachePeriodInSec parameter and equal to 30 minutes fromthe moment scanning is finished:

Administrator Manual23Principles of Operation of Dr.Web Anti-virus

If the resource is clean, it becomes fully accessible for all the users
protected by the firewall with any address or agent during theverification period.
If the resource is clean, it becomes fully accessible for all theusers protected by the firewall with any address or agent during
the verification period.
If the resource is infected, Dr.Web HTTP Web Filter returns
the string "403 Forbidden. Infected by virus".
If other users start their own cycles of the resource check before
its state becomes known, its state is changed or prolonged forthe verification period after the requested scanning iscompleted. When the verification period expires after the lastscanning, the resource returns to the Unverified state, and a
new request starts a new resource verification cycle.
In case the resource is not requested anymore, all information
about it and the users is deleted from the system after a time
period specified by the CleanupCachePeriodInResetPeriodparameter (in number of verification periods).

Administrator Manual24Principles of Operation of Dr.Web Anti-virus

Dr.Web HTTP Filter
Unlike Dr.Web HTTP Web Filter, which reacts on Web Proxy Filter
events and performs anti-virus scanning only for external server
responses, Dr.Web HTTP Filter is a filter of active data-dumping via
two-way parser and it performs scanning before each transceiving
operation is completed.

Dr.Web HTTP Filter and Dr.Web HTTP Web Filter should not
be activated simultaneously, because they double the data check,that may lead to unstable system operation in case a threat is
detected.

Dr.Web FTP Filter
During the installation of Dr.Web Anti-virus, Dr.Web FTP Filter isregistered as an FTP protocol events handler. Preparing to the antivirus scanning starts when the client establishes connection to the FTP
server. Microsoft ISA Server and Microsoft Forefront TMG create thefilter object to process the data transferred from the client to theserver and vice-versa:
1. Analyzing the client requests, Dr.Web FTP Filter defines thetime of the file download request. The client operates in one of
the following modes: active or passive.
After the request to switch to the active mode is intercepted,
Dr.Web FTP Filter installs a filter on the data connectionof the FTP filter active mode.
In passive mode, Dr.Web FTP Filter is installed on the data
connection of the passive mode.
2. After receiving a request to download a file, Dr.Web FTP
Filter checks if the server IP address belongs to the black andwhite lists of the IP addresses.

Administrator Manual25Principles of Operation of Dr.Web Anti-virus

3. Dr.Web FTP Filter gets the name of the requested file fromthe RETR file download request and sends the SIZE request
to the server to obtain the size of the file. After that, Dr.Web
FTP Filter sends the RETR request, sent by the client
previously. In case the size of the requested file does notexceed the specified limit (1 MB by default), a memory buffer isused to save the data received via the channel. If the limit isexceeded, a file is used for data saving.
4. The filter can operate in one of the following modes:
Preliminary check mode. During the preliminary check, alldata is added portionwise to buffer. When all data iscollected or after a specified timeout (5 seconds by default),
Dr.Web FTP Filter check the received data for viruses. If
the anti-virus check takes a considerable time, the FTP
connection may be closed after a certain time period. To
prevent this situation, Dr.Web FTP Filter transfers the data
to the client by small portions (of 1 byte by default) with thespecified periodicity (every 2 seconds by default). So, theconnection remains open. In the preliminary check mode thesystem performance decreases, but there is no possibility fora malicious object to appear on the client's computer.
Post-check mode. In this mode, the file is partiallytransferred to the client (80% by default). Then the transfer
is paused and Dr.Web FTP Filter check the file. If the filedoes not contain the threats, the rest of it is transferred tothe client, otherwise, the transfer stops. The client does not
obtain the whole file, but the virus signature can appear on
the client's computer. In this mode, the system performanceincreases because it contains only one virus check, but thevirus can possibly enter the client's computer.

If the connection to the FTP server was interrupted because of athreat detection in the dowloaded file, you need to reconnect to theserver to continue working with the FTP protocol.

Administrator Manual26Principles of Operation of Dr.Web Anti-virus

Dr.Web SMTP Filter and Dr.Web POP3 Filter
The antivirus check of the SMTP and POP3 traffic has two stages:
1. The received message is checked by the Anti-spam module
Vade Retro. It analyzes the text of the message and calculates
the probability for the message to be spam. If a message isdetermined as spam, an action specified for the corresponding
spam category in the Anti-spam section of Dr.Web for ISA
Web Console by the administrator is applied to it.
2. The messages that passed the spam check (or were ignored
according to the application settings), are then check formalware. Depending on the scanning results, the scanned
objects (the body of the message or the attachments) are
attributed to one of the categories (Cured, Not cured or
Suspicious), and the corresponding actions specified by theadministrator in the Scanning pane of Dr.Web for ISA Web
Console are performed. Enabling the heuristic analysis inapplication settings allows to detect the objects containing
modified or unknown malicious code, such objects are
identified as Suspicious. A text file with information on thedetected threat and performed actions is attached to themessages with malicious objects.

Dr.Web Anti-virus Services
The operation of Dr.Web Anti-virus is based on the 7 following
services:
Dr.Web Scanning Engine – contains the Dr.Web scanningengine.
Dr.Web CMS
supports the distributed application
components management system, controls and analyzes themodules functionality. This service supports the application
components settings database, the incidents database andcontrols the statistics of components parameters.
Dr.Web CMS Web Console has a built-in server providing
the use of administrative consoles via Internet browser.

Administrator Manual27Principles of Operation of Dr.Web Anti-virus

Dr.Web for MSP Scanning Service
prepares objects
intercepted by application filters to the anti-virus scanning,processes the scanning results.
Dr.Web for MSP Component Hostinstantiates all
additional application components requested during its
operation.
Dr.Web for MSP Requests Queuesupports theasynchronous requests queue of application tasks, which allow
to postpone their run.
Dr.Web SSM
controls the operation of the applications
based on the CMS platform and restarts the main services.
Dr.Web Scanning Engine, Dr.Web CMS and Dr.Web SSM
services are started on completion of the application installation. Other
services start when the application operation requires their start.

When restarting the services manually, it is important to stop the
Dr.Web CMS and Dr.Web SSM services in a right order because
they depend on each other: always stop the Dr.Web SSM service
at first and then the Dr.Web CMS one. After both services are
stopped, you can start only the Dr.Web SSM service to reactivate
the operation of the application.

Administrator Manual28Installation and Removal

Installation and Removal
Before installing or removing Dr.Web Anti-virus, make sure thatthe built-in administrator account is enabled on the computer where
Microsoft ISA Server or Microsoft Forefront TMG is installed!
Otherwise, it is possible that the system installer would not haveenough permissions to create and/or remove application
components. In case you experience problems during the removal
process that lead to the firewall shutdown, refer to appendix
Remove Dr.Web Anti-virus manually.

The Dr.Web Anti-virus software is distributed as a single installation
file (drweb-600-isa-20042006-x86.exe or drweb-600-tmg2010-x64.exe, depending of the firewall version) or a ZIP-archived
folder containing the installation file.
Extract the installation file to a folder on the local drive of the ISA
server/Forefront TMG.

If you are using the Windows Terminal Services component, it isrecommended to use the Add or Remove programs utility to
install and uninstall the Dr.Web Anti-virus software.
Dr.Web Anti-virus is not compatible with other anti-virus
software. Installing two anti-virus programs on one computer may
lead to system crash and loss of important data. If you already havean earlier version of the product or other anti-virus software
installed then it is necessary to uninstall it using the installation fileor standard tools of the OS (see see Remove Dr.Web Anti-virus).
Furthermore, Dr.Web Anti-virus is compatible with only those ofother Dr.Web products for Windows servers that have the sameversion.
In case the server operates under load, it is recommended to stopthe Microsoft Firewall service (or Microsoft Forefront TMG Firewall)
manually. On completing the installation, it will restart automatically.

Administrator Manual29Installation and Removal

To enable logging during the installation/removal
You can configure logging the program installation or removal process
for further examination and application control. To enable logging:
1. In Start -> Run console started as administrator open the
directory where the installation file is located.
2. Run the program installation file using the command with thefollowing parameters:

drweb-600-isa-20042006-x86.exe /V"/lvx*<log_name.log>" (if Microsoft ISA Server is used)
drweb-600-tmg-2010-x64.exe/V"/lvx*<log_name.log>" (if Microsoft Forefront TMG is used),
where log_name.log is the name of the log file.

System Requirements
This section provides system requirements for installation and proper
operation of Dr.Web Anti-virus on your computer.

Hardware requirements
Requirement
Specification

In case Microsoft ISA
Server is used

In case Microsoft
Forefront TMG is used

CPU

733
MHz
or
higherfrequency processor

1.86 GHz or higher
frequency processor

RAM

1 GB or more

2 GB or more
300 MB for installation.

Disk space

MonitorAdditional disk space is needed for temporary data
storage while performing the anti-virus check. The sizeof the disk space depends on the user requests
intensity and the size of the downloaded files.
VGA-compatible monitor

Administrator Manual30

Installation and Removal

Operating system and software requirements
Requirement
Specification

Operating system

In case Microsoft ISA
Server is used

In case Microsoft
Forefront TMG is used

One of the following:

One of the following:

Microsoft®
Windows
Server® 2003 x86 with
Service Pack 1 (SP1)

Microsoft®
Windows
Server® 2008 SP2Microsoft®
Windows
Server® 2008 R2

Microsoft®
Windows
Server® 2003 R2 x86
File system

Firewall

NTFS
Microsoft®
2004

ISA

ServerMicrosoft®
2006

ISA

ServerMicrosoft®
Forefront®
TMG
2010(Standard
EditionorEnterprise
Edition) with SP1 or SP2

Microsoft Windows Installer 3.1 or higher
Additional software

Microsoft .NET Framework 3.5
Internet Explorer 7 or higher or Mozilla FireFox 3.5 orhigher

Install Dr.Web Anti-virus
Before installation it is strongly recommended
To install all critical updates released by Microsoft for the OSversion used on your computer (available on the company’s
updating website at http://windowsupdate.microsoft.com).
To check the file system with the system utilities and remove
the detected defects.
To close all active applications.

Administrator Manual31Installation and Removal

To install Dr.Web Anti-virus
1. Stop the Microsoft ISA Server/Microsoft Forefront TMG firewall
service.
2. Before installation, make sure, that the built-in administrator
account is enabled.
3. Run the application installation file
drweb-600-isa-20042006-x86.exe, if you are using
Microsoft ISA Server.
drweb-600-tmg-2010-x64.exe, if Microsoft Forefront
TMG is used.
The window with a list of installation languages will open. SelectRussian or English as the installation language. Click OK.
4. The InstallShield Wizard will open on the first window of theinstallation process. Click Next to continue.
5. A window with the text of the License Agreement will open. To
continue installation you should read and accept the license by
selecting I accept the terms in the license agreement.
Click Next.
6. Select the licensing type. You can use the key file obtained
from Dr.Web Control Center or a local key file. Click Next.
7. If you have selected to use the local key file on the previous
step, specify the path to it. Click Browse and select thenecessary key file. Click Next.

If you do not have a valid key file then click Get key file
to go to the license key file request page on the
Doctor Web web site at http://www.drweb.com.

8. On the Ready to install page, click Install to begin
installation of Dr.Web Anti-virus on your computer.
9. If the service of the firewall Microsoft ISA Server/Microsoft
Forefront TMG has not been stopped during step 1, the system
attempts to stop it automatically for some. If these attempts
fail, a window prompting to try again or stop the program
installation and roll back all the system changes will open. To
continue installation, stop the Microsoft ISA Server/Microsoft

Administrator Manual32

Installation and Removal

Forefront TMG firewall service manually.
10. Further actions of the InstallShield Wizard do not require userinterference. Once the installation is complete, click Finish.

During the installation you'll be prompted about Microsoft ISA
Server/Microsoft Forefront TMG restart. After the installation
completes, make sure that the Microsoft Firewall Service/Microsoft
Forefront TMG Firewall service is started. If the service is notstarted automatically, you need to start it manually.

To reinstall Dr.Web Anti-virus
1. Stop the Microsoft ISA Server/Microsoft Forefront TMG firewall
service.
2. Uninstall Dr.Web Anti-virus. The application configuration file
cmsdb is not deleted by default on deleting the application.
Therefore, all user settings are saved and may be used after
the next installation of the product. However, if you install anewer version that contains new basic configuration
parameters, you cannot use the saved configuration file "as is",because it can lead to failures in the operation of application. If
you prefer tore-use the saved configuration parameters, pleasecontact Doctor Web technical support to inquire about theDr.Web CMS parameters compatibility in different versions of
the application. Generally, if the newer version contains
additional parameters, it is sufficient to add the new variables
to the existing configuration base and specify their types anddefault values correctly.
3. Delete the cmsdb and cmstracedb files from the %ProgramFiles%\DrWeb for ISA Server folder manually.
4. Install Dr.Web Anti-virus, following the instructions given
above.

Administrator Manual33

Installation and Removal

Remove Dr.Web Anti-virus
To uninstall Dr.Web Anti-virus
1. Stop the Microsoft ISA Server/Microsoft Forefront TMG firewall
service.
2. Before uninstalling the application make sure that the built-in
administrator account is enabled.
3. Run the application installation file
drweb-600-isa-20042006-x86.exe, if you are using
Microsoft ISA Server.
drweb-600-tmg-2010-x64.exe, if Microsoft Forefront
TMG is used.
The InstallShield Wizard will open on the first window of theinstallation process. Click Next.

Alternatively you can use the Add or Remove programs
utility on the Windows Control Panel.

4. Select Remove and click Next.
5. In the opened window, click Remove.
6. Once removal is complete, click Close.

During the program removal you'll be prompted about Microsoft ISA
Server/Microsoft Forefront TMG restart. After the removal
completes, make sure that the Microsoft Firewall Service/Microsoft
Forefront TMG Firewall service is started. If the service is notstarted automatically, you need to start it manually.

If you experience problems related to the firewall operation or errors
have occurred during Dr.Web Anti-virus removal, you canuninstall the program manually.

Administrator Manual

34

Dr.Web for ISA Web Console

Dr.Web for ISA Web Console
Operation of Dr.Web Anti-virus can be configured by means of theDr.Web for ISA Web Console (see Figure 5).

To launch Dr.Web for ISA Web Console
For correct operation of Dr.Web for ISA Web Console use one of
the following browsers:
Internet Explorer 7 or higher
Mozilla Firefox 3.5 or higher
For correct operation of Dr.Web for ISA Web Console in Internet
Explorer you need to additionally allow the use of the AJAX
technology by disabling the enhanced security configuration foradministrators:
In Windows Server 2003: open Control Panel -> Add orRemove Programs -> Add/Remove Windows
Components, clear the Internet Explorer Enchanced
Security Configuration check box, then click Next. ClickDone.
In Windows Server 2008: open Server manager and click
Configure IE ESC, then select the corresponding check box
in the Administrators section.

To launch Dr.Web for ISA Web Console, in an Internet browser
open the following page:https://<ISA Server address>:2080/isa,
where <ISA Server address> is the IP-address of the ISA server/
Forefront TMG.

Administrator Manual

35

Dr.Web for ISA Web Console

To access to the web console page, you need to enter theadministrator login and password. Administrator accounts can be
added, edited or deleted by means of Dr.Web CMS Web Console.
On the first launch of the web console use the login root and thepassword drweb of the default administrator account.

Figure 5. Dr.Web for ISA Web ConsoleInterface
The web console consists of two parts:
1. Web Console tree for navigation between different sections of
the program settings.
2. Details pane, which represents the working area where thesettings of the currently selected section are displayed and canbe adjusted.
At the top of the details pane the Dr.Web for ISA Web Console
language changing option is located. You can select English or Russian
language.

Administrator Manual36

Dr.Web for ISA Web Console

To the right of the language option the option, which opens the help
on the web console, is located.

Groups and Profiles
To simplify management of your local network protected by Microsoft
ISA Server/Microsoft Forefront TMG, Dr.Web Anti-virus provides theability to form groups of clients and assign profiles to them. A profile isa set of adjustable traffic processing settings which determine themanner of protection of your local network. The settings of a profile
can be found in the Profiles section of the Web Console tree and are
divided into the following subsections:
Scanning this section allows you to control the operation ofyour main virus-detection component.
Anti-spam this section allows you to adjust the operation of
the Anti-Spam component (settings in this section are available
only with the «Anti-Virus&Anti-Spam» version of Dr.Web Antivirus, i.e. if you have an appropriate license key file (seeLicense Key File).
Office Control
this section allows you to restrict the user
access to web resources.
Filteringfiltering.

this section allows to configure the Internet traffic

For more information on creating and managing profiles, please refer
to Creating and Configuring Profiles.
Any profile can be assigned to a certain group of clients. These groups
are formed in the Groups section of the Console tree (seeManaging Groups).

Creating and Configuring Profiles
During installation of Dr.Web Anti-virus the Default profile, whichcannot be renamed or deleted, is created automatically. This profile
will remain active for all the traffic as long as you do not create a new

Administrator Manual37

Dr.Web for ISA Web Console

profile and assign it to a certain group of clients. When you create a
new profile, it has current settings of the Default profile.
To manage the existing profiles and create the new ones the Profiles
pane is used. To open it select Profiles in the Web Console tree(see Figure 6).

Figure 6. Profiles pane
For each profile the information on its settings and priority is displayedin the list.

To create a new profile
Click Create profile above the list of available profiles

Alternatively, to create a new profile, you can right-click
Profiles in the console tree and select Create profile.

A new profile named Profile1 will be created and will appear
under Profiles in the console tree. If this name is already used,
it will be named Profile2 and so on.

To change the name of a profile
select the profile on the Profiles pane and click Rename
profileTo delete a profile
Select it on the Profiles pane and click Remove profile

Administrator Manual38

Dr.Web for ISA Web Console

Alternatively, to rename or delete a profile, you can right-click it in
the console tree and select the corresponding item

By default, a new profile has the same settings as those specified forthe Default profile.

To change profile settings
Click the name of the profile in the console tree and selectthe necessary settings section: Scanning, Anti-spam orOffice Control.

Profile Priority
Each profile has a certain priority level set by the administrator. If aclient is a member of several groups with different profiles, then the
profile with the highest priority will be applied when processing thetraffic sent to or by this client.
The priority level is adjusted on the Profiles pane by moving profiles
up and down the list. Use the buttons
andto move the profile.
The higher a profile is on the list, the higher is its priority.

The Default profile always has the lowest priority level and cannot
be moved higher than the lowest position in the list.

Administrator Manual39

Dr.Web for ISA Web Console

Scanning
The scanning process is adjusted in the Scanning section. Changes inthis section affect the types of checked objects and therefore they
determine the protection level. On the other part, increasing of thenumber of identified objects' types leads to decrease in server
performance.

To adjust the settings of the scanning process
1. Click Scanning the Web Console tree. The Scanning pane
will open (see Figure 7).

Figure 7. Scanning pane
2. By default, the heuristic analyzer and scanning of archives andcontainers are enabled. This gives a high level of protection at
the expense of the server performance. To disable thesefeatures, clear the Enable heuristic analysis, Checkarchives and Check containers options at the top of the

Administrator Manual40

Dr.Web for ISA Web Console
Scanning pane.

It is not recommended to disable the heuristic analyzer andscanning of archives in attachments as it considerably
decreases the protection level of the server.

The Timeout field allows to specify the timeout for scanning ofa single file. If this timeout is exceeded during the scanning, thefile is considered as bad object. By default, the timeout is set to10000 ms. If necessary, you can change this value.
The Process encrypted archives as bad objects option
defines whether encrypted archives should be ignored by thescanner or treated by the plug-in as bad objects.
3. In the Malware group box below, select the types of objects
to check messages for.
4. In the Actions section below, use the drop-down lists tochoose the actions for curable, incurable and suspicious
objects. You can choose from the following:
Move to quarantine means that the object will be sent
to the quarantine (see Quarantine).
Delete means that the object will be deleted.
Skip means that such objects will be passed on to therecipient(s) untouched (available only for suspicious
objects).

By default, the Move to quarantine action is set for all
the types of objects.

5. In the Parameters of added attachments group box, you
can change the name suffix for the text file, which will be
attached to an infected e-mail message after the assigned
action is performed over it. In the Text field below, you can
edit the text of the attached text file template, if necessary.
You can add macros from the Macro list while editing the text.
6. When you finish configuring scanning process, click Save.

Administrator Manual

41

Dr.Web for ISA Web Console

Anti-spam
The Anti-spam is configured in the Anti-spam section of the profile
settings and it is available only with the «Anti-Virus&Anti-Spam»version of Dr.Web Anti-virus. If your key file supports the Antispam component then spam filtering should be enabled by default, i.
e. the Enable Anti-spam check box at the top of the Anti-Spampane should be selected.

If all the settings in the Anti-spam section are disabled, it is likelythat your license key file does not support the Anti-spamcomponent (see License Key File). To check whether the Antispam component is supported you can open the key file
(C:\Program Files\DrWeb for ISA Server\drweb32.key) with a text
editor and check the value of the parameter SpamFilter. If
SpamFilter=Yes, then your license supports the Anti-spamcomponent, if SpamFilter=No, then this component is notsupported.
Any editing of the key file makes it invalid! Do not save the filewhen closing the text editor.

The Anti-spam component analyzes the contents of e-mail messages
and defines whether it is spam or not according to the spam-rate value
summed up from various criteria.

To configure the settings of the Anti-spam component
1. Click Anti-spam in the Web Console tree. The Anti-spamsettings pane will open (see Figure 8).

Administrator Manual42

Dr.Web for ISA Web Console

Figure 8. Anti-spam settings pane
2. To disable spam filtering, clear the Enable anti-spam checkbox. Once the check box is cleared, all parameters become
unavailable for editing. Select the check box to enable spam
filtering.
3. In the Subject prefix field, you can change the prefix, which
will be added to the subjects of e-mail messages considered as
spam. The default prefix is *** SPAM ***.

Administrator Manual

43

Dr.Web for ISA Web Console

4. In the fields below, you can define the program actions forthree categories of messages based on the probability level of
their being spam (Certainly spam, Probably spam or
Unlikely spam). To do this, select one of the following
actions for each category:
Add prefix to subject means that the prefix defined in
the Subject prefix field will be added to the message
subject.
Pass throughmeans that the message will be passed
through to the recipient.
5. On the Black/White lists section, you can configure the useof the lists of trusted and distrusted addresses:
Select Enable to enable the use of the lists. You can add email addresses you trust to the white list. In this case,messages from these addresses will not be checked forspam. If you add an address to the black list, all messages
from it will be considered as Certainly spam.
To add an address to the list, enter it in the E-mail field andclick Add on the section of the white or black list. The
address will be added to the selected list.
To delete an address from the list, select it and click
Remove on the section of the list this address is included in.
You can also use the Import and Export buttons to savethe list into a special file with .lst extension or to load thelists from the file and to create or edit the lists manuallyusing a text editor, for example While creating and/or editing
the files of black and white lists manually, you need to add
prefix to the e-mails: «+» to add the e-mail into the white
list, «-» to add the e-mail into the black list, e.g.
+trusted_address@mail.com
anddistrusted_address@mail.com. The created text file
must be saved with .lst extension in Unicode format.

You can use the asterisk («*») to substitute a part of
the address (e.g. *@domain.org stands for any
address in the domain.org domain).

6. When you finish setting up the Anti-spam component, click
Save.

Administrator Manual

44

Dr.Web for ISA Web Console

Office Control
The Office Control component is used to restrict access to web
resources and restrict a user to view undesirable web sites (e.g.
pornography, violence, gambling, etc.) or allow access only to certain
web sites, specified in the Office Control settings.

To configure Office Control
1. Select Office Control in the web console tree. A pane forediting parameters of the Office Control will open (seeFigure 9).

Figure 9. Configure Office Control pane
2. Choose one of the following modes:
Allow access to all sites. There are no restrictions in thismode.
Block the sites specified. In this mode you can select thetypes of blocked web sites. Besides, you can set lists ofblocked and allowed web sites regardless of restrictions by
categories. To configure the list of blocked sites, click Black
list, enter the site name and then click Add. To configure
the list of allowed sites, click White list, enter the site nameand then click Add.

Administrator Manual

45

Dr.Web for ISA Web Console

Lists of web sites in all categories are constantly updated
by the Automatic Updating Module along with virus
databases.

Allow access only to specified sites. In this mode accessto all resources except those in White list will be restricted.
To configure the list of allowed sites, click White list, enter
the site name and then click Add.
3. You can enable an additional list of trusted sites. To use thelist, select the Enable check box on the Trusted sites
section. To edit the list of trusted sites, click Edit, enter the
resource name and click Add.
4. When you finish setting up Office Control, click Save

To create a list of domain names
1. Enter a domain name (or part of it) into the field:
If you wish to add a specific web site, enter its full address(e.g. www.example.com). Access to all resources on thatweb site will be allowed/restricted.
If you wish to allow/restrict access to web sites, whichcontain certain text in their address name, enter that text
into the field (e.g. example means that access to example.
com, example.test.com, test.com/example, test.xample222.
ru, etc. will be allowed/restricted).
If the string contains the "." symbol, it will be considered adomain name. In this case all resources on the domain will befiltered.
If the string also contains the "/" symbol (e.g. example.com/
test), then the part to the left of it will be considered thedomain name and the part to the right will be allowed/restrictedon the domain (e.g. example.com/test11, template.example.
com/test22, etc. will be filtered).

Administrator Manual46

Dr.Web for ISA Web Console

2. Click Add. The address (or part of it) will be added to the list
above.
The address may be converted to a more simple structure (e.g.
http://www.example.com will be converted to www.
example.com).
3. To delete a web resource from the list, select it and click
Delete.

Filtering
The traffic filtering is configured in the Filtering pane (see Figure 10).
Filters are applied according to certain rules which can be added by
the administrator. These rules determine the conditions for the filteringby the properties of messages and their attachments.

Figure 10. Filtering pane

Administrator Manual47

Dr.Web for ISA Web Console

To configure messages filtering
1. Select Enable filtering at the top of the Filtering pane. This
makes the parameters in the section available for editing.
2. Enable one or more filters from the list by selecting thecorresponding check boxes. If the list of filters is empty, you
can create them.
3. Select the actions for the e-mail messages with attachments on
the Attachment settings section.
For the messages, you can select one of the following actions:
Deleteto delete message

Add prefix to subject to pass through the message
and add to its subject a prefix specified in the Subject
prefixFor attachments, the following actions are available:
Move to quarantine
quarantine
Deleteto isolate the attachment into delete the attachment

In the Subject prefix field, specify the prefix added to thesubject of the filtered message. The default prefix is***FILTERED***.
In the File name suffix field, specify the suffix added to thename of the text file attached to the filtered message. The
default suffix is _filtered.txt.
In the File contents field, enter the text of the file added to
the filtered message. While editing the text, you can add macros
from the Macros drop-down list.

To create a filtering rule
1. Click Add under the filters list. A Filter rule window will open
(see Figure 11). You can enter the name of the rule andspecify its conditions in this window.

Administrator Manual48

Dr.Web for ISA Web Console

Figure 11. Configure filtering rule
2. You can add one or more filtering conditions and specify if themessages should comply with all of them or with any of them.
To add a condition, click Add. In the new window, select thecondition type, specify the value and the type of compliancewith the specified value. The types of conditions, complianceand possible values are listed in the table below:
Condition type

Compliance type

Value

Data type

Equal

File

Not equal

Message

Equal

Specified manually

Not equal

In case on of theContains, Not contains,
Matches or Not matchescompliancetypes
isselected, you can use thewildcard characters «*»and «?» to substitute asequence of symbols or
only one symbol in theentered text value whenentering the value.

Data source

Contains
Not contains
Matches
Not matches

Data destination

Equal

Specified manually

Not equal
Contains
Not contains

Administrator Manual49

Dr.Web for ISA Web Console

Condition type

Compliance type

Value

Matches

In case on of theContains, Not contains,
Matches or Not matchescompliancetypes
isselected, you can use thewildcard characters «*»and «?» to substitute asequence of symbols or
only one symbol in theentered text value whenentering the value.

Not matches

Protocol

Equal

HTTP

Not equal

FTP
POP3
SMTP

Numberrecipients

of

Equal

Specified manually

Not equal
Contains
Not contains
Matches
Not matches

File name

Equal

Specified manually

Not equal

In case on of theContains, Not contains,
Matches or Not matchescompliancetypes
isselected, you can use thewildcard characters «*»and «?» to substitute asequence of symbols or
only one symbol in theentered text value whenentering the value.

Contains
Not contains
Matches
Not matches

File size

Equal
Not equalSpecifiedbytes)

manually(inAdministrator Manual

50

Dr.Web for ISA Web Console

Condition type

Compliance type

Value

GreaterNot greater
Less
Not less
Message subject

Equal

Specified manually

Not equal

In case on of theContains, Not contains,
Matches or Not matchescompliancetypes
isselected, you can use thewildcard characters «*»and «?» to substitute asequence of symbols or
only one symbol in theentered text value whenentering the value.

Contains
Not contains
Matches
Not matches

Has attachment

Equal

True

Not equalFalse

3. To delete or edit any of the specified conditions, select it in thelist and click Delete or Edit respectively.
Filtering rule example
To filter files whose size exceeds 20 MB, transferred over the FTP
protocol, the rule (see Figure 12) containing the following
conditions can be used:
Condition type

Compliance type

Value

Data type

Equal

File

Protocol

Equal

FTP

File size

Greater

20000

Administrator Manual51

Dr.Web for ISA Web Console

Figure 12. Example of the filtering rule

To edit or delete an existing filtering rule
Select the rule in the list of filters an click Edit or Delete under
the list.
Click Save when you are done configuring the filtering rules.

Managing Groups
By default, Dr.Web Anti-virus applies the parameters of the Default
profile to all users. If you want to apply parameters of a different
profile to certain users (see Creating and Configuring Profiles for more
information), join such users in a group and assign the profile to it.
Thus you can divide all the clients into different groups, each of themwith its own set of protection parameters.

Creating a New GroupTo manage the existing groups and create the new ones the Groups
pane is used. To open it, click Groups in the Web Console tree (seeFigure 13).

Administrator Manual52

Dr.Web for ISA Web Console

Figure 13. Groups pane

To create a new group
On the Groups pane, click Create group above the list ofavailable groups.

Alternatively, to create a new group, you can right-click
Groups in the console tree and then click Create groupon the context menu.

A new group named Group1 will be created and it will appear
under Groups in the console tree. If this name already exists, itwill be named Group2 and so on. The Default profile is set foreach new group.

To change the name of a group
Select the group on the Groups pane and click Renamegroup

To delete a group
Select it on the Groups pane and click Remove group

Alternatively, to rename or delete a group, you can rightclick it in the console tree and then click the corresponding
item on the context menu.

Administrator Manual53

Dr.Web for ISA Web Console

To configure group settings
Click the name of the group in the web console tree.
You can set up the parameters of the group, such as its typeandtheprofileassignedtoit(see
Configuring and Forming Groups).
When finish creating and/or editing the groups, click Save.

Configuring and Forming Groups
In the information pane that opens by clicking the group name in the
web console tree (see Figure 14), you can set up the parameters of
the selected group, including the manner of forming this group: bylisting the e-mail addresses, the IP addresses or selecting the AD
groups. Select the group type in the drop-down list Type.

Figure 14. Group settings

To create a list of e-mail addresses
1. In the the drop-down list Type, select List of e-mailaddresses.
2. To add an e-mail address to the list, click Add. In the new
window, enter the e-mail address and click Ok.

Administrator Manual54

Dr.Web for ISA Web Console

3. To delete an e-mail address from the list, select it and click
Remove, then confirm the deletion of the selected address.

You can use the wildcard characters «*» and «?» to substitute asequence of symbols or only one symbol in the entered text value.

To create a list of IP addresses
1. In the the drop-down list Type, select List of IP addresses.
2. In the Element list, select the elements type: IP address or IP
addresses range.
3. To add an element to the list, click Add. In the new window,
depending on the selected elements type, enter the IP addressor specify the IP addresses range. Click Ok.
4. To delete an element from the list, select it and click Remove,then confirm the deletion of the selected element.

To create a list of AD groups
1. In the the drop-down list Type, select List of AD groups.
2. To add a new group to the list, click Add. In the new window,
select the group to add and click Ok.
3. To delete a group from the list, select it and click Remove,then confirm the deletion of the selected group.

Creating the list of Ad groups is possible only if the server is indomain. Otherwise, you need to add it to the domain or specify thename and the password of the user with access to AD as the valuesoftheparameters/DrWebADAccessor_1.0/Application
Settings/ADAccUserName and /DrWebADAccessor_1.0/
Application Settings/ADAccPassword respectively using CMS
Administrative Console. By default, the values of theseparameters are empty.

You can select the profile you want to use for the current group in theProfile drop-down list.

Administrator Manual55

Dr.Web for ISA Web Console

When you are done setting up the group parameters, click Save toapply changes.

Notifications
Notifications are added to the operation system event log and are used
to keep the administrator and other users informed about various
events related to operation of Dr.Web Anti-virus (e.g. detection of
infected or suspicious objects, attempts to cure them, filtering of
messages, etc.).

To configure notifications
1. Click Notifications in the Web Console tree. A pane forediting parameters of notifications will open (see Figure 15).

Figure 15. Configure notifications pane
2. In the Notification type list, select the type of event toconfigure notifications for:
Filtered messages
messages filtering.
Filtered files
attachments.
Infected

to configure notifications about
toconfigurenotifications

about

to configure notifications about infected objects.

Administrator Manual56

Dr.Web for ISA Web Console

Spamto configure notifications about spam.

Office control
to configure notifications about web
ressources filtering using Office Control.
Updateto configure notifications with the las update
information.
Expired bases
to configure notifications about virus
databases expiration.
3. By selecting/clearing the Enable option, you can enable/
disable sending notifications of selected type.
4. In the setting group below, you can modify the text template
for the notifications of selected type by entering it in the Text
field. While editing the text, you can use macros.
5. When you are done, click Save.

View Statistics
The Statistics section allows to review the total and average amountsof the objects processed by Dr.Web Anti-virus during a specified
time period (see Figure 16).

To configure the statistics
1. In the Statistics period drop-down list, select the timeinterval to view the statistics information about. You canchoose one of the following intervals:
For all time
to view the total statistics since Dr.Web
Anti-virus started its operation
For last day to view the statistics for the last 24 hours of
Dr.Web Anti-virus operation
For last hourс to view the statistics for the last hour ofDr.Web Anti-virus operation
For last minute to view the statistics for the last minuteof Dr.Web Anti-virus operation

Administrator Manual57

Dr.Web for ISA Web Console

2. In the Type of statistics drop-down list, select the
information type to review. Depending on the selected timeinterval you can review the total or average numbers as well as
the the minimum and maximum values during the specified
time period.

Types of information
Depending on the selected options the Statistics pane can containthe following sections:
Loading. This section allows to review the information on the
total size of the scanned objects and on the average, minimum
and maximum size of the objects scanned during the specified
time period.
Scan results. This section allows to review the total number ofthe scanned objects and the number of the scanned objects ofdifferent types (e.g., filtered, spam messages, suspicious
objects, etc.).
Scan actions. This section contains information on the actions
applied by Dr.Web Anti-virus to the detected malicious
objects.
Infection type. This section contains information on different
types of threats, detected by Dr.Web Anti-virus during thespecified time period.
Url category. This section contains the statistics of theoperation of Office control and the number of blocked
resources of each category.

Administrator Manual58

Dr.Web for ISA Web Console

Figure 16. Statistics
To refresh or clear the statistics, click Refresh or Clear.

Administrator Manual59

Dr.Web for ISA Web Console

View Incidents
The Incidents section allows to review all incidents related to theoperation of Dr.Web Anti-virus (see Figure 17).

Figure 17. Incidents

To view the incidents information
For each incident in the list the following information is displayed:
Date and time of the incident
Web resource nameSource and destination nameName of the threat
Performed action

Administrator Manual60

Dr.Web for ISA Web Console

To manage the incidents list
1. You can specify the time period to review the incidents. Enterthe start and the end date of the interval.
2. You can use filters and filter the incidents according to certain
criteria to customize the way information about them isdisplayed. Select the filter type in the Filter list, enter thedesired value in the Mask field, then click Apply.
3. You can save the incidents list in a text file. To do this, click
Export.
4. To sort the incidents list according to different criteria, click thetitle of the corresponding column.
5. To refresh the list, click Refresh.

Quarantine
Quarantine of Dr.Web Anti-virus anti-virus serves for isolation of
suspicious objects detected while checking the Internet traffic.
In the Quarantine section of the web console, the current
Quarantine information is displayed. You can also use Quarantine
Manager to review and edit the list of objects in Quarantine.

Manage Quarantine via Dr.Web for ISA Web
ConsoleTo view the list of objects moved to Quarantine, click Quarantine in
the web console tree. The Quarantine pane (see Figure 18) willopen.

Administrator Manual61

Dr.Web for ISA Web Console

Figure 18. List of objects in Quarantine

To view the information about the objects in Quarantine
The following information is displayed for each object in the list:
Date and time
File nameSource and destination
Threat name
File size
The following options are available to configure the Quarantine:
1. You can specify the time period to review the objects moved to
Quarantine during this time frame. Enter the start and theend date of the interval.
2. You can use a number of filters to filter the list according tocertain criteria to customize the way information about theobjects in Quarantine is displayed. Select the filter type in theFilter list, enter the desired value in the Mask field, then click

Administrator Manual62

Dr.Web for ISA Web Console

Apply.
3. To sort the list according to different criteria, click the title ofthe corresponding column.
4. To refresh the list, click Refresh.

To process objects in Quarantine
1. To delete an object from the list, right-click it and selectDelete in the context menu. To delete all object, press Ctrl+A,
then select Delete.
2. To restore an object, right-click it and select Restore in thecontext menu. Then specify the path to the folder you would
like to restore the object to.

Quarantine Manager
To start Quarantine Manager (see Figure 19) open Start -> All
Programs -> Dr.Web for ISA Server -> Quarantine.

Figure 19. Quarantine window.

Administrator Manual63

Dr.Web for ISA Web Console

In the center of the window the table with the Quarantine state isdisplayed. The following columns are included by default:
Name name list of the objects in the Quarantine.
Threatmalware classification, which is assigned by Dr.Web
Anti-virus during automatic placing to the Quarantine.
Pathfull path to the object before it was moved to
Quarantine.
In the bottom of the Quarantine window the detailed information
about selected items is displayed. You can display the columns withdetailed information similar to the data in the bottom of the
Quarantine window.

To configure columns
1. To configure the display parameters of the table ofQuarantine, right-click the table header. Select Customize
columns in the context menu.
2. In the opened window, select the items to display in the table.
Clear the check boxes for the items you want to hide. Click
Check all/Uncheck all to select/clear all items.
3. To change the columns order in the table, select thecorresponding column in the list and click one of the following
buttons:
Move up to move the column up in the table (to the headof the settings list and to the left in the objects table).
Move down to move the column down in the table (tothe foot of the settings list and to the right in the objects
table).
4. To save changes, click OK. To close window without saving,click Cancel.
The left pane serves to filter the Quarantine objects to display. Clickthe corresponding option to display all Quarantine objects or justspecified groups: files, mail objects, web pages or all other objects, notclassified.

Administrator Manual64

Dr.Web for ISA Web Console

In the Quarantine window users can see only those files that areavailable by access rights.
To view hidden objects, run the dwqrui.exe Quarantine filefrom the installation folder under an administrative account.

Manage Quarantine
To process the objects in Quarantine
Use the following buttons to manage the Quarantine:
Add to add the file to the Quarantine. Select the necessary
file in the file system browser.
Restore to remove the file from the Quarantine and restore
it in its original location, i.e. restore the file to the folder where it
had resided before it was moved to the Quarantine. The pathto the folder to restore the file is specified in the Path column
on Figure 19. If the path is not specified, the user will beprompted to select the folder to restore the file to.

Use this option only when you are sure that the objects are
not harmful.

The drop-down menu item Restore to allows to restore the fileto the folder specified by the user.
Rescan to scan the file again. If a file is defined as clean after
that, Quarantine will offer to restore the file.
Remove to delete the file from the Quarantine and from thesystem.
To manage several objects simultaneously, select necessary objects in
the Quarantine window, press and hold CTRL or SHIFT and selectnecessary action in the drop-down menu.

Administrator Manual65

Dr.Web for ISA Web Console

In the context menu of the table the Send file(s) to Doctor Web
Anti-virus Laboratory option is available for sending files to Doctor
Web Anti-virus Laboratory for analysis.

Configure Quarantine Properties
To configure Quarantine parameters
1. Click the
button in the Quarantine window.
2. The Quarantine properties window will open. In thiswindow you can change the following parameters:
The Set quarantine size section allows to configure theamount of disk space for Quarantine folder. Move theslider to change the maximum limit for Quarantine size,
which is calculated as percentage of total disk space (forseveral logical drives, this size is calculated for every drivethat includes the Quarantine folder). The 100% valuemeans an unlimited Quarantine folder size.
In the View section, select the Show backup files option
to display backup copies of Quarantine files in the object'stable.
3. To save changes, click OK. To close window without saving,click Cancel.

Administrator Manual66

Updating Virus Databases

Updating Virus Databases
You can review the information about the application version, license,
virus databases and also the date, time and result of the last updateon the Version pane in the web console tree.
An updating task (Dr.Web update for ISA plug-in) is created in the
Windows Task Scheduler (the C:\Windows\Tasks folder) during
installation of Dr.Web Anti-virus. The task runs the updating module
DrWebUpW.exe, which downloads the virus databases andcomponents of the program.
The task can be adjusted by changing its properties (double-click thetask in the list). The operation of the updating module can be adjusted
by specifying certain command-line parameters (see Appendix A) in
the Run field of the task properties.

To configure update without using Internet connection
1. Create a folder on your computer's local drive (e.g. C:\MyDocs\DrWebUpdate).
2. Put the components that need to be updated into this folder.
You can find the list of components that can be updated in thefile drweb32.lst located in the following folder:%AllUsersProfile%\Application Data\Doctor Web\Bases\ if
Microsoft ISA Server is used
%ProgramData%\Doctor Web\Bases\ if you are using
Microsoft Forefront TMG
3. Add the following command-line parameter to the Run field of
Dr.Web update for ISA plug-in: /URL:<path to createdfolder>(for
example,/URL:"C:\MyDocs\DrWebUpdate").

Administrator Manual67

CMS Administrative Console

CMS Administrative Console
CMS Administrative Console is supported by the managing service
Dr.Web CMS Web Console, which is controlled by anothermanaging service Dr.Web CMS.
Dr.Web CMS Web Console connects to the managing service via
administration protocol.

To start CMS Administrative Console
To launch CMS Administrative Console (see Figure 20), open thefollowing page in a browser:

https://<ISA Server address>:2080/admin,
where <ISA Server address> is the IP address of the ISA server/
Forefront TMG.

To access to the CMS Administrative Console page, you need toenter the administrator login and password. Administrator accounts
can be added, edited or deleted by means of Dr.Web CMS Web
Console.
On the first launch of CMS Administrative Console use the login
root and the password drweb of the default administrator account.

Administrator Manual68

CMS Administrative Console

Figure 20. CMS Administrative ConsoleInterface
CMS Administrative Console consists of three parts:
1. Hosts and groups tree.
Displays all connected hosts. Click a group in the variables
window to open the list of variables. Right-click a group to open
a context menu, where you can select one of the following
options:
Create group
Rename group
Delete group
Create variable
Right-click a host to open a context menu, where the following
options are available in addition to listed above:
Add host (adds a connection to a new host to the tree)
Delete hostEnable tracing mode (enables tracing in the real-time mode)
Load events (downloads events for the past periods)
Edit event filter (editing real-time trace filter)

Administrator Manual69

CMS Administrative Console

2. Variables list.
The variables window contains the list of variables for theselected group with their attributes and values. If allowed by theattributes, you can click any field to edit the value. Right-click avariable to open a context menu, where you can select one of
the following options:
Create variable (opens a window to create new variable)
Delete variable (if allowed by the attributes)
Reset statistics variable (if this variable has the Statistics
attribute)
3. Messages tracing window.
When real-time tracing is enabled, the application messages are
displayed in the tracing window. You can set up a filter for themessages. Every message contains the following information:
Event time
Host nameApplication name
Logging level
Message text
To empty the messages list, right-click the list and select thecorresponding option in the context menu.

Changing Administrator Password
On the first launch of Dr.Web for ISA Web Console or CMS
Administrative Console you can log in using the predefinedadministrator account root with password drweb. Then it is strongly
recommended to change the password for this account.

Administrator Manual70

CMS Administrative Console

To change the password of the administrator account
1. In the hosts and groups tree, select the CMS_1.0 -> Security-> Users -> root group.
2. In the variables list of the root group, double-click Value ofthe Password variable. The window Change password
variable value will open.
3. Enter a new password in the Password field, the n confirm itin the Confirm password field.

Adding New Administrator
You can add a number of administrator accounts besides the default
root account.

To add an administrator account
1. In the hosts and groups tree, select the CMS_1.0 -> Security-> Users group.
2. Click the Users group to open a context menu. Select Creategroup.
3. The Enter new group name window will open. Enter thename of the administrator account in the Group name field.
Click OK.
4. To set a password for the administrator account, click thecorresponding group in the hosts and groups tree. SelectCreate variable in the context menu.
5. The Add new variable will open. Enter Password as thename of the variable and select Password for its type. In the
Value field, enter the administrator password. Click Append.

Organizing Clusters
CMS Administrative Console allow creating hosts cluster trees withany nesting level. In a cluster any changes of a variable with attributeShared initiate the same change of variables on all sub-hosts.

Administrator Manual71

CMS Administrative Console

To create cluster
On the sub-host (that is being added to cluster), do the following:
1. Create the group /CMS_1.0/Security/Users/host. This
group specifies the user account used by the main host totransfer the variables with the Shared attribute to a local
server.
2. In the host group, a variable Password of the Password
type will be created automatically to connect to the createdaccount. The default password is drweb. For security reasons,
it is strongly recommended to change it.
On the main host, do the following:
1. Create a group of any name at /CMS_1.0/Shared/. This
group will be the sub-host.
2. In the host group, a variable Address of the String type iscreated automatically. By default, it has an empty value. Thisvariable should contain the IP address of the sub-host MS
connection in the following format: <IP address>:<Port>, e.g.,
192.168.1.1:2056.
3. In the host group, a variable Password of the Password typeis created automatically to connect to the host account on the
sub-host. The default password is drweb. For security
reasons, it is strongly recommended to change it. If thepassword is the same for all the hosts, you can create the
Password variable in the Shared group. It will be used bydefault for all connections.
4. The variables configuring the connection to the sub-hostcannot have the Shared attribute, therefore, the settingscannot be transferred to the sub-hosts. On the attempt tochange the attributes of the connections settings, an accessdenied message will be received.
In the Shared folder, the variable Enabled of the Boolean type iscreated automatically (see Figure 21). This variable enables/
disables the cluster functions. If this variable has the True value,
all the described connections are active, in case of the False value- all connections are interrupted. By default, the variable is createdwith the value True.

Administrator Manual72

CMS Administrative Console

Figure 21. The Enabled variable created in the SharedfolderWhen a host is created in the Shared folder, a variable Enabledof the Boolean type is created there automatically with the default
value False. This variable enables/disables a specific connection.
If the address (the Address variable value) is changed, the active
connection is switched to a new address. Changing the password
does not lead to the connection switching. To switch theconnection with a new password, you need to disable and reenable the connection using the Enabled variable.
In case the connection is created correctly, CMS will automaticallyestablish connection to the sub-host and will propagate it to all
variables with Shared attribute. If the remote host already has avariable with such name, but without Shared attribute, this variable
will be ignored with the MB_RC_SKIPPED code returned.
You can create a list of the sub-hosts on any level.

Administrator Manual73

Logging

Logging
Dr.Web Anti-virus registers the errors and application events infollowing logs:
Windows Event Log
Text log of the installation program
CMS event log
The update information is registered in a separate text file
drwebupw.log, that is located in the %alluserprofile%\AppData\Doctor
Web\Logs\
folder(see
Checking Updater Functionality).

Event Log
Dr.Web Anti-virus registers the following information in the
Windows Event Log:
Plug-in starts and stops
License key file parameters including validity, licensed period
Parameters of the plug-in components including scanner,core, virus databases (information is registered when theplug-in starts or components are updated)
License invalidity notifications if the license key file ismissing, some of the plug-in components are not licensed,
license is blocked or license key file is corrupted (informationis registered when the plug-in checks the license)
License expiration notifications (a message is registered in
30, 15, 7, 3, 2 and 1 days before expiration)
Information on the malicious objects and spam detection(see the Notifications section)

Administrator Manual74

Logging

To view Event Log
1. On the Control Panel, double-click Administrative Tools andthen double-click Event Viewer.
2. In the tree view, select Application.
3. The application Event Log displays in the right pane. The
Source for the plug-in events are the applications Dr.Web®
Scanning Engine, Dr.Web CMS, Dr.Web CMS Web Console, Dr.
Web for MSP Scanning Service, Dr.Web for MSP Component
Host and Dr.Web for MSP Requests Queue.

Installation Program Text Log
The installation program of Dr.Web Anti-virus also keeps a log of
the installation process so that it could be viewed later for bug-tracking
purposes. The log file drweb-isa-setup.log or drweb-tmg-setup.log(depending on the firewall version) is created in the C:\Windows\Temp
folder, or can be found by environment variable %temp%, i.e. byexecuting the %temp% command in Start -> Run console.

CMS Log
The managing service logs the application events of different types:
Value

Description

Audit

The records of this type are logged by the managing
service and contain the information on administrator
actions (e.g., changing the variables values).

Incident

The security events logged by external applications (e.g.,virus detection)

Fatal

Events resulting in application crushes

Error

Errors that admit the return to the normal operation

Warning

Messages about different events for administrator

Information

Information messages

Administrator Manual75

Logging

Value

Description

Debug

Debug records

The list of events is recorded by the managing service into a separate
database.
The managing service can display the registered events in the realtime mode filtered by different criteria. It also allows to review the past
events for a specified time interval.
By modifying the value of LogLevel (UInt32) variable in the Settingsgroup, you can set up the application logging level:
Value

Description0

Error, Fatal, Incident, Audit messages are registered1

Warning messages are added to all previous types

2

Information messages are added to all previous types

3

Debug messages are added to all previous types

The default log level set for all applications subscribed to Dr.Web
CMS service is 2. If the Debug Traces option is selected in thecontext menu when right-clicking the root element of the CMS
Administrative Console tree, the log level changes to 3 for all
subscribed applications. However, enabling this option may cause thesystem overload and it is not recommended to enable the 3 log level
for all the application at one time. If you managed to localize theproblem of a specific module, you can change the log level only for
one application to explore it.

When setting the logging level to 3 in CMS Administrative
Console opened in Internet Explorer and then enabling the View
Traces option to monitor the events in real-time mode, you need tocontrol the memory size allocated for the iexplorer.exe process
corresponding to the console window. This process in suchmonitoring mode starts using all the available memory, that may
considerably decrease the system performance.

Administrator Manual76Troubleshooting

Trobleshooting
To check whether Dr.Web Anti-virus is installed and configured
properly, use the following tests described in this chapter:
Application installation check
Updater check
Viruses and spam detection capabilities check

Check Installation
Dr.Web Anti-virus must be installed to the following folders:
1. In case Microsoft ISA Server is used:%ProgramFiles%\DrWeb for ISA Server%Microsoft ISA Server%\DrWeb%ProgramFiles%\Common Files\Doctor Web%Documents
andData\Doctor Web

Settings%\All

Users\Application

Hidden folder %DrWeb Quarantine%
2. In case Microsoft Forefront TMG is used:%ProgramFiles(x86)%\DrWeb for ISA Server%ProgramFiles(x86)%\Common Files\Doctor Web\Scanning
Engine%ProgramFiles%\DrWeb for ISA Server%Microsoft\DrWeb

Forefront

ThreatManagement

Gateway%

Hidden folders %ProgramData%\Doctor Web and %DrWeb
Quarantine%
Make sure that these folders have been created during installation andcontain program files.

Administrator Manual77Troubleshooting

After that open the Windows Event Viewer and make sure that there
are no errors associated with Dr.Web Anti-virus in it.
Finally, make sure that the following local services are started:
Dr.Web Scanning Engine (DrWebEngine)
Dr.Web CMS
Dr.Web SSM
Dr.Web CMS Web Console
Dr.Web for MSP Scanning Service
Dr.Web for MSP Component Host
Dr.Web for MSP Requests Queue

Check Updater Functionality
The updating module DrWebUpW.exe automatically starts after the
installation of Dr.Web Anti-virus. It updates the anti-virus engine
drweb32.dll, the anti-spam engine vrcpp.dll and the virus
databases.

To make sure that an update was successful:
1. Depending on the version of the operating system, run theTasks command to open the C:\WINDOWS\Tasks folder oropen the Task Scheduler.
2. Check that a task for Dr.Web Anti-virus has been created
and it is working correctly (the return code in the Last Result
field must be 0x0).
3. Open the updater log file %AllUsersProfile%\Application
Data\Doctor Web\Logs\drwebupw.log (if Microsoft ISA
Serverisused)or%ProgramData%\Doctor
Web\Logs\drwebupw.log (if you are using Microsoft
Forefront TMG) and make sure that there are no errors in it.

Administrator Manual78Troubleshooting

Virus Detection Test
To check the functionality of the plug-in’s virus detection capabilities
and its default configuration, it is recommended to use the EICAR(European Institute for Computer Antivirus Research) test file. The test
script is not a virus, it cannot replicate and does not contain any
payload, however, it is recognized by anti-virus software as a virus.
You can download the test file from the EICAR website at http://eicar.
org/ or create it yourself.

To create the EICAR test file:
Open the Notepad text editor and copy the following string
to it:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICARSTANDARD-ANTIVIRUS-TEST-FILE!$H+H*
To check the virus detection capabilities of Dr.Web Anti-virus for
SMTP and POP3 protocols, save the file with a .com extension (youcan use any name, e.g. eicar.com), attach it to an e-mail message
and send it to any test e-mail address. The received message should
contain an attached text file with the _infected.txt suffix and thefollowing contents:
File eicar.com was infected with a virus and has been
moved to quarantine by Dr.Web for ISA Server.
Viruses: EICAR Test File (NOT a Virus!).
To check the virus detection capabilities of Dr.Web Anti-virus for
HTTP protocol, download the EICAR test file via this protocol (e.g.,
from the page at http://www.eicar.org/85-0-Download.html).

Administrator Manual79Troubleshooting

The file download should be blocked. The following message should be
displayed in the browser window:
Forbidden
URL is blocked by anti-virus
Reason: Infected by virus
In both cases the application log should contain the Warning eventwith the following description (if the Move to quarantine action is
selected in the scanning settings):
Infection detected. Dr. Web for ISA Server has
detected that File is infected with a virus and it isincurable. The File is now moved to quarantine.
The Incidents pane of the Dr.Web for ISA Web Console should
contain the corresponding notifications (see Figure 22).

Figure 22. Notifications about EICAR files download in the
Incidents pane.
If moving malicious objects to Quarantine is enabled, theQuarantine pane should contain the records on the added objects(see Figure 23).

Administrator Manual

80Troubleshooting

Figure 23. The list of downloaded EICAR files in the
Quarantine pane.

Do not use real viruses to check the functionality of anti-virus
software!

Administrator Manual81Troubleshooting

Spam Detection Test
The Anti-spam component works only with the «Anti-Virus&AntiSpam» version of Dr.Web Anti-virus, i.e. if you have anappropriate license key file (see License Key File).

To test the functionality of your Anti-spam component, it isrecommended to use an e-mail message with a special test string.

To create a test spam message:
Copy the following string to the body of a new e-mailmessage:Start enjoying the benefits of Generic
Medic1ne. Order quickly and easily, andsave a ton of money. Try them out,
they're 100% m0ney back guarantee.
Send the message to a test e-mail address via SMTP. Then open the
Windows Event Viewer -> Application utility and find theinformation that Dr.Web Anti-virus has detected spam.

Administrator Manual82Appendices

Appendices
Appendix A. Updater's Command-Line
Parameters
Below is a list of command-line parameters that can be added to the
Run entry field of the updating task (C:\Windows\Tasks\ Dr.Web
update for ISA plug-in) in order to adjust the operation of the
updating module.
Parameter

Description/DBG

Detailed log.

/DIR:<directory>

Change the name of the folder where the updated files
are placed; by default, the folder, from which theAutomatic Updating Utility was launched is used.

/INI:<path>

Use alternative configuration file with the specified
name or path.

/NI

Do not use parameters specified in the drweb32.ini
configuration file.

/GO

Package operation mode, without dialogs.

/LNG:<filename>Name of the language resources file (English is used ifother is not specified).

/PASS:<user

User password for the updating server.

password for HTTP
server>/USER:<username forserver>User name for the updating server.

HTTP/PPASS:<proxy

User password for the proxy server.

user password>/PUSER:<proxy

User name for the proxy server.

user name>

Administrator Manual83AppendicesParameter

Description/PURL:<proxy

Address of the proxy server.

address>/URL:<URL of the Only UNC names are accepted.
updating server>/QU

Compulsory close the Automatic Updating Utility after
the updating is finished, regardless whether it was
successful or not. The success of the updating can bechecked via the drwebupw.exe return code, e.g.
from the BAT file by the errorlevel variable value:
0 = successfulother values = unsuccessful/REG

Launch the updater for registration and to receive thelicense key file.

/UPD

Regular updating; used together with the /REG
parameter to run the updating session itself during theregistration.

/RP<file_name> or Log to a file, the name of which is specified in the/RP+<file_name> parameter. If no name is specified log to a file withthe default name. If the + character is present the fileis appended; if there is no + character a new file iscreated.

/NR

Do not create a log file.

/SO

Enable sounds (only when errors occur).

/ST

Run the updater in invisible mode (stealth mode).

/UA

Download all files specified in the updating list
regardless the used OS and the installed components.
This mode is designed to receive the full local copy of
the Dr.Web server updating area; this mode cannot
be used for updating the anti-virus installed on acomputer.

/UVB

Update the virus databases and drweb32.dll (theanti-virus engine) only (disables /UA, if it is set).

Administrator Manual84AppendicesParameter

Description/UPM:<proxyMode of using a proxy server; it can have thefollowing values:mode>

direct – do not use proxy server
ieproxy – use system settings
userproxy – use settings specified by the user(the /PURL, /PUSER and /PPASS
parameters)/URM:<mode>

Restart after the updating is finished. It can have thefollowing values:
prompt – prompt whether a reboot is needed
after the updating session is finishednoprompt –promptingifnecessary

rebootwithout

force – always reboot (regardless whether it isrequired after the updating or not)disable – do not reboot

Administrator Manual85Appendices

Appendix B. CMS Platform
CMS (Central Management System) is a cross-platform distributed
application management system (hereinafter any module subscribed tothe main managing service is considered as application). In the centerof the system lies the managing service Dr.Web CMS. This service
controls the applications operation, manages the applications and their
settings and logging.
The applications interact by means of the TCP protocol. They caninteract with the managing service in the following ways:
The controlled application uses the MB (Management Base)
protocol to interact with the managing service.
The managing (administrator) applications use the MS(Management System) protocol to interact with the managing
service.
Dr.Web CMS service uses an arborescent database to store theinformation on the application data.

Database
Dr.Web CMS managing service database is a tree consisting ofgroups and variables. Variables are of different (data) types and havedifferent attributes.
Data types of managing service variables:
Data type

Comment

Int32

32-bit integer

UInt3232-bit unsigned integer

Int64

64-bit integer

UInt6464-bit unsigned integerFloat

32-bit real number

Double64-bit real number

Administrator Manual86Appendices

Data type

Comment

StringString of unlimited length

BooleanLogical value (true or false)

Time

Date and time

BinaryBinary data of unlimited length

Password

Data type for passwords storage

Variables can have the following attributes:
Attribute

Comment

Default

Simple variable

SharedShared variable

Statistics

Statistics variable

SystemSystem variable

HiddenHidden system variable

Readonly

Variable, which can not be modified

Application Control
The application control via CMS starts by registering its name in the
managing service database. Dr.Web CMS service assigns a uniquename to the application. This name contains the name of theapplication and its version. Then, the service creates a group with thename if the registered application. By default, a group has two service
subgroups named Application Status and Settings. During theoperation of the application, the managing service collects statistics forthe protocols. The statistical information is located in the Application
Statistics/Connections group, the MB and MS subgroups containthe interaction protocols statistics. The load on the services andapplications can be evaluated using this statistical information.

Administrator Manual87AppendicesApplication Status group
This group contains information on the registered application as thevalues of the variables of different types:
Variable (its type isindicatedinparentheses)

Comment

Active (Boolean)

Indicates the application activity. The true valuemeans that the application is active.

Crash (Boolean)

Indicates the correctness of the application stop.
The true value means that the application
stopped incorrectly.

HomeDir (String)

Application directory in the file system

InstanceName (String)

Name the application instantiated for

LogicCrash (Boolean)

Application logics state. The true value meansthat the application operates incorrectly.

ModuleName (String)

Application executable file name. If thesubscribed application is a *.dll library, the value
contains the name of the process it was
instantiated by.

ModulePath (String)

Path to the application executable file in the filesystemPID (UInt32)

Application process number in the operating
systemStartedOn (Time)

Last application start time

StoppedOn (Time)

Last application stop time

Version (String)

Application version

VersionBuild (UInt32)

Application build number

VersionMajor (UInt32)

Application major version

VersionMinor (UInt32)

Application minor version

VersionRevision(UInt32)

Application revision number

WorkDir (String)

Application working directory in the file system

Administrator Manual88AppendicesSettings group
This group contains the general settings of the registered application.

Statistics
The system allows collection the application statistics for time intervals.
The applications allow creating the statistics variables to register theapplications events and return the statistical information intime
intervals specified by the statistic variables settings.
In the Dr.Web CMS managing service database, such variable have
the Statistics attribute. The variables with this attribute aretemporary, they are not saved to the constant database and exist only
when the managing service is active. After restarting the managing
service, these variables are lost.

Administration
The system in managed via the administration protocol. This protocol
allows to modify the values of the variables, reset the statistics, track
the system operation in the real-time mode with filtering the traces,
review the past messages and filter them.

Changing the variables values
The values of the variables are changed synchronously. All registeredapplications receive notifications about changing the values of thevariables or disable such changes. Once the variable value is changed,
all applications that use it, obtain its new value.

Reset statistics
The administration protocol allows to reset the collected statistics forthe variable settings, so the statistics is recollected from zero.

Administrator Manual89Appendices

Restrictions
Using variable has the following restrictions:
The variables with Hidden attribute exist in the database, but
are not available for review and editing. They are created by the
managing service for internal use.
The variables with System attribute are created by the
managing service to display the service information foradministrator. Such variable cannot be modified or deleted.
The variables with Statistics attribute are created by theapplication. These variables cannot be deleted.
The variables with Readonly attribute are created by theapplication to inform the administrator. These variables cannot
be modified.
The variables with Default attribute are ordinary variables, andallow any action to be applied.
The variables with Shared attribute are the distributed
variables. Their values are modified synchronously within the
distribution system.
The variables, which cannot be modified, cannot be deleted aswell. However, the groups containing such variables can bedeleted with all their variables, if the application related to thisgroup, is not launched.

Security
To access to the system, you need to enter a user name and apassword. The default user of the system has the user name root andthe password drweb. It is strongly recommended to change thepassword after system installation. Or you can also add new users.
The users and their passwords are stored in the Security -> Users
subgroup of the managing service group, i.e. /CMS_1.0/Security/
Users. The name of the group is the name of the user. The password
is stored in the Password variable.

Administrator Manual90Appendices

Appendix C. Dr.Web SSM Service
The Dr.Web SSM (Dr.Web Start/Stop Manager) service controls
the applications operation based on the CMS platform and performs
the following functions:
Dr.Web CMS service operation maintenance in the automatic
mode
Automatic start of the applications registered by the service(having the SSM group of variables in CMS Administrative
Console) in case of failures
Forced start of the applications even if they terminated theiroperation correctly
Applications launch using Windows Service Manager
Starting services as applications developed using CService from
CommonComponents
Starting services using the assigned scripts
Applications start and stop in manual mode by user commands
The parameters of the Dr.Web SSM service operation are defined by
the SSM variables group in the CMS Administrative Console. The
SSM group can contain the following variables:
Variable (its type isindicatedinparentheses)

Comment

Enabled (Boolean)Signifies whether the SSM control is enabled ornot

Run (Boolean)

Allows to start/stop the application

KeepAlive (Int32)

Signifies the application operation maintenancetype:
0

the application is disabled

1

The application is active

2 forced maintenance, the application isenabled even if it stopped correctly

Administrator Manual91Appendices

Variable (its type isindicatedinparentheses)

Comment

StartType (Int32)

Signifies the application start method:0

as a Windows service1

as a CService application

2

start using a script

StartScript (String)Contains the script to start the application

StopScript (String)Contains the script to stop the application

Restart (Boolean)

Restarts the application

Timeout (UInt32)

The timeout for application reaction (in seconds).
By default, the timeout is 10 seconds.

ServiceName (String)

the service name in Windows Service Manager.
By default, the name of the variable /Application
Status/InstanceName is used.

The Dr.Web SSM service setting may include the following:
KeepAlivePeriod (UInt32) the time to check the service (inseconds). By default, the value 60 is set.
RestartCMSPause (UInt32) the delay before restarting the
CMS (in seconds). By default, the value 5 is set.

Administrator Manual92Appendices

Appendix D. Remove Dr.Web Anti-virus
Manually
If you experience firewall failures, you can remove Dr.Web Antivirus manually. To do this:
1. Run the command-line tool with administrator rights.
2. Unregister the application filter using the following commands:

regsvr32 /u /s "C:\Program Files\DrWeb
for ISA Server\FTPFilter.dll"
regsvr32 /u /s "C:\Program Files\DrWeb
for ISA Server\HTTPFilter.dll"
regsvr32 /u /s "C:\Program Files\DrWeb
for ISA Server\POP3Filter.dll"
regsvr32 /u /s "C:\Program Files\DrWeb
for ISA Server\SMTPFilter.dll"
3. Unregister the web filter using the command:

regsvr32/u/s"C:\Program
Files\Microsoft
Forefront
ThreatManagement Gateway\DrWeb\HTTPWebFilter.
dll" (if you are using Microsoft Forefront TMG);
regsvr32/u/s"C:\Program
Files\Microsoft
ISA
Server\DrWeb\HTTPWebFilter.dll" (if you areusing Microsoft ISA Server);4. Stop the application services in the following order:

net stop "Dr.Web SSM"
net stop "Dr.Web for MSP Scanning
Service"
net stop "Dr.Web for MSP Components
Host"
net stop "Dr.Web for MSP Requests Queue"
net stop "Dr.Web CMS Web Console"
net stop "Dr.Web CMS"

Administrator Manual93Appendices5. Start the standard utility Windows Installer Cleanup Utility(msicuu.exe) to delete the application from the system.
6. Delete the application services:sc delete "Dr.Web SSM"
sc delete "Dr.Web for MSP Scanning
Service"sc delete "Dr.Web for MSP Components
Host"
sc delete "Dr.Web for MSP Requests
Queue"
sc delete "Dr.Web CMS Web Console"
sc delete "Dr.Web CMS"
7. Delete the following folders:in case you use Microsoft ISA Serverrd /S /Q "C:\Program Files\DrWeb for ISA
Server"rd /S /Q "C:\Documents and Settings\All
Users\Application Data\Doctor Web"rd /S /Q "C:\Program Files\DrWeb for ISA
Server\DrWeb"
in case Microsoft Forefront TMG is usedrd /S /Q "C:\Program Files\DrWeb for ISA
Server"rd /S /Q "C:\Program Files (x86)\DrWeb
for ISA Server"
rd /S /Q "C:\ProgramData\Doctor Web"rd /S /Q "C:\Program Files\Microsoft
Forefront
ThreatManagement
Gateway\DrWeb"

Administrator Manual94Appendices

Appendix E. Operation in Central
Protection Mode
Dr.Web Anti-virus can operate in the central protection mode in a
network managed by Dr.Web Control Center. Central protection
helps automate and simplify configuring and managing information
security of computers within logical structures (for example, company
computers that access each other from both inside and outside ofcompany's local networks). Protected computers are united in one
anti-virus network, which security is monitored and managed from
central server (Dr.Web Control Center) by administrators.
Connection to centralized anti-virus systems guarantees high level ofprotection while requiring minimum efforts from end-users.

Logical Structure of Anti-virus Networks
Solutions for central protection from Doctor Web use client-server
model (see Figure 24).
Workstations and servers are protected by local anti-virus components(clients; herein, Dr.Web Anti-virus) installed on them, which
provides for anti-virus protection of remote computers and ensureseasy connection to central protection server.
Local computers are updated and configured from central server. The
stream of instructions, data and statistics in the anti-virus network
goes also through the central protection server. The volume of traffic
between protected computers and the central server can be quite
sizeable, therefore solutions provide options for traffic compression. To
prevent leak of sensitive data or substitution of software downloaded
onto protected computers, encryption is also supported.

Administrator Manual95AppendicesFigure 24. Logical structure of anti-virus network.
All necessary updates are downloaded to central protection server
from Dr.Web Global Update System servers.
Local anti-virus components are configured and managed from central
protection server according to commands from anti-virus network
administrators. Administrators manage central protection servers andtopology of anti-virus networks (for example, validate connections tocentral protection server from remote computers) and configure
operation of local anti-virus components when necessary.

Administrator Manual96Appendices

Operation of Dr.Web Anti-virus in Central
Protection Mode
For operation of Dr.Web Anti-virus in central protection mode,version 6 or higher of Dr.Web Agent is required to be installed andoperate correctly on the same operating system.

The version 6.00.1 of Dr.Web Anti-virus is not compatible with
Dr.Web Agent version 5.

Dr.Web Anti-virus operating in the central protection mode provides
the following possibilities:
Recording the start events of Microsoft ISA Server or Microsoft
Forefront TMG with the installed plug-in Dr.Web Anti-virus.
Start events are displayed in the Start/Stop table of Dr.Web
Control Center. Stop time of Microsoft ISA Server or Microsoft
Forefront TMG is not recorded.
Sending statistics of Dr.Web Anti-virus operation. The
statistics is displayed in the Statistics and Summary
statistics tables of Dr.Web Control Center.
Sending notifications on detected viruses with information on
the infections and performed actions. These events are
displayed in the Infection table of Dr.Web Control Center.
Virus databases and anti-virus engine updates from Dr.
Web Control Center repositories. This action allow disabling
the standard updater of Dr.Web Anti-virus, which starts bydefault according to a schedule. In this case components updatestarts from Dr.Web Control Center repositories according to
its schedule.
Using a license key file for Dr.Web Anti-virus that is registeredat the anti-virus network. If the Enterprise mode was selectedduring the installation, the license key file for the station in theanti-virus network will be used on the start of Microsoft ISA
Server or Microsoft Forefront TMG with the installed plug-in Dr.
Web Anti-virus. If this key is invalid, the anti-virus check is not
performed.

Administrator Manual97Appendices

Appendix F. Technical Support
Support is available to customers who have purchased a commercial
version of Doctor Web products. Visit Doctor Web technical support
site at http://support.drweb.com/.
If you encounter any issues installing or using company products, takeadvantage of the following Doctor Web support options:
Download and review the latest manuals and guides at
http://download.drweb.com/
Readthefrequently
asked
questionsathttp://support.drweb.com/
Look for the answer in Dr.Web knowledge
databaseat
http://wiki.drweb.com/
Browse the Dr.Web official forum at http://forum.drweb.com/
If you have not found solution for the problem, you can request direct
assistance from Doctor Web Technical Support by filling in the
web-form in the corresponding section of the support site at
http://support.drweb.com/.
For regional office information, refer to the Doctor Web official
website at http://company.drweb.com/contacts/moscow.

Administrator Manual

98

99

Index
A
abbreviations

7
71

37

78

CMS administrative console
adding administrator

CMS console

68

CMS platform

89

CMS application control
CMS database35

CMS log

administration web console
administration console

profiles37

87

application statistics

70

89

86

configurefiltering47

configuringanti-spamanti-spam

42

parameters42

anti-virus filters

1542

notifications

56

office control
quarantineBscanning
45

debug log

central protection

45
61

40

D

C
95

check
filters

89

application control

adminstration
37

87

86

administration
42, 45,7075

databasegroups68

86

CMS platform

35

administration web console
47, 56, 57, 60, 61
administrator password

40

79

71

administrator password

52

web console

black list

82

virus detection capabilities

administration

license77

updateradministartion

groups77

installation

spam detection capabilities

adding administrator
profilesfunctionality

75

document conventions
Dr.Web Anti-virus

7922, 23, 25, 27

Administrator Manual

100

Index
Dr.Web Anti-virus

9

Dr.Web CMS Web Console

35

adding administrator

administration
central protection

95

administrator password

CMS administrative console
70, 71

68,

Dr.Web for ISA Web Console

35

Dr.Web FTP Filter

25

Dr.Web HTTP Web Filtergroups37

profiles37

Dr.Web FTP Filter
23

25

27

Dr.Web HTTP Web Filter

Dr.Web SMTP Filter

27

Dr.Web POP3 Filter

27

Dr.Web SMTP Filter

27

74

filters

15, 16, 20, 22, 23, 25, 27

Dr.Web SSM

groups52

install

29, 31E

license12

main features

9

principle of operation
profiles37

remove29, 34

remove manuallyscanned objects
services
statistics

79

56

CMS log

15

75

installation program log
system log
events93

74

57

events logging

27

CMS log57

system requirements
technical support98

troubleshooting

77

74
75

installation program log

30

75

60

statistics

11

23

91

EICAR test file
event log

35,

25

Dr.Web HTTP Filter

Dr.Web POP3 Filter

events logging

70

Dr.Web for ISA Web Console
40, 42, 45, 47, 56, 57, 60, 61

25

Dr.Web HTTP Filter

68
71

system log

74

47

75

F

uninstall

29, 34filtering rules

update67

filters

Administrator Manual

101

Index
validity

filters
application
check

16

L

22, 23, 25, 27

web filter

12

license20

acquisitionG

13

anti-spam support

groups37, 52

key file

12

52

update1454

validity

12

createforming
types

54

42

N

GTUBE test message

82
notifications

H
heuristic analyzer

40

event log

56

settings

56

types

I
incidentsO

60

install Dr.Web Anti-virus
check

29, 3077

obtaining key file31

installation program

adresses lists
31

31

settings

events logging

75

install anti-virus

31

installation program log

13

update

14

13

45
95

P
profiles37

configure75

37

create37

priority

39

quarantine

61K
acquisition

45

operation mode

installation program

key file

13

office control

installation fileinstallation file56

Q

Administrator Manual

102

Index
quarantine

61

actionsU61, 65

configuring properties
managing

66

65

command-line parameters

63, 65, 66

license61

quarantine manager

updater

29, 34

updater
check

30

S

78

78

virus databases

remove Dr.Web Anti-virus

83

14

troubleshooting

63, 65, 66

R
requirements

29, 34

updatequarantine manager
settings

uninstall Dr.Web Anti-virus

67

67, 8378

Vscanned objects

11

view statistics

scanning

virus databases

actions40

settings

40

services

57
67

W
white list

27

Dr.Web CSM

68

Dr.Web SSM

91

45

statistics
application
events
view

89

57
57

system requirements

30

T
technical support98

troubleshooting

77, 79, 82

Administrator Manual© 2003-2012 Doctor Web