DEFEND WHAT YOU CREATE
Made in Russia

Dr.Web CureNet!
for Windows
Quick Start

https://www.drweb.com

A solution for the remote, centralised
curing of Windows PCs and servers,
including those running different
anti-virus software, regardless of local
network size Included in the Register of RussianComputer Programs and Databases Does not rely on an Internet
connection
 Can be launched from any external
media or from iPhone/iPod touch© Doctor Web,
2003–2020

Dr.Web CureNet! Quick Start
With Dr.Web CureNet!, you can perform centrally managed remote anti-virus scanning on yournetworked computers without installing anti-virus software on the target machines. Dr.Web
CureNet! scans personal computers and servers running Microsoft® Windows® in networks of any
topology.
Important! Dr.Web CureNet! does not provide resident end-point security. Between scans,computers can get infected by any malicious program. To establish reliable and constant anti-virus
security, use software products such as Dr.Web Security Space or Dr.Web Enterprise Security
Suite.
Download Dr.Web CureNet!
To download a distribution file, register your serial number at http://products.drweb.com/register.

Your individual distribution file will be generated once you complete the registration procedure.

Download the created distribution file from your personal account area. From then on, for as long as
your license is valid, you will be able to download the latest version of the utility’s distribution fromyour personal account area.

You can get to your personal account area either from the program itself or after entering your serial
number at https://support.drweb.com/get+cabinet+link.
If you have already registered your serial number for Dr.Web CureNet!, simply log in to yourpersonal area and download the latest version of the distribution file.
System requirements
To use Dr.Web CureNet! to scan computers remotely:!

the target machines must be connected to the network;

there must be an account with the necessary administrative privileges that Dr.Web CureNet!
can use to connect to the remote computers;!
!

ports 139 and 445 must be open in the target systems.

You must have administrator privileges on the applicable PCs and servers to scan your network with
the Dr.Web CureNet! anti-virus utility. Remote scanning does not require any additional
configuration of your computers provided that they are members of a domain and a domain
administrator account is used on them. If a remote computer is not a domain member or a local
account is used, for some versions of Windows, remote computers require additional configuration.
Detailed configuration information for Windows is described below. You can also watch the video
tutorials.
Since changing certain system parameters for remote scanning can lower a remote host's security, it
is strongly recommended that you learn how adjusting these parameters affects the system.
Otherwise, you should reject the use of remote scanning and launch the anti-virus scanner on themachine locally.
Configuring Windows to launch the Wizard
The Wizard incorporated into Dr.Web CureNet! is compatible with the following versions ofWindows:!

Windows XP (Professional Service Pack 2 or later)!

Windows Server 2003 Service Pack 1 or later!

Windows Vista (Business, Ultimate, and Enterprise editions) Service Pack 1 or later!

Windows Server 2008!

Windows 7 (Professional, Ultimate, and Enterprise editions)!

Windows Server 2008 R2!

Windows 8 and 8.1 (Professional and Enterprise editions);!

Windows Server 2012!

Windows 10

For the Wizard to be able to operate normally, you must ensure that you have:
1.

An Internet connection so that the virus databases and Dr.Web components can be updated.

2.

A TCP/IP connection to all the target hosts.

Brief information about Windows’ configuration requirements can be found in the letter that wassent to the email address you provided during registration. The full list of requirements is specified
in the documentation.

Configuring Windows to remotely run Dr.Web scanner
General configurations for Windows XP — 10, Windows Server 2003/2008/2012
The system requirements for stations coincide with the requirements for the computer on which theWizard is run, except for the list of supported operating systems: Windows XP Professional SP2 andlater versions, except those listed below for 64-bit systems: Windows Server 2003 x64 Edition andWindows XP Professional SP2 x64 Edition.
!

Windows XP
Supported edition — Windows XP Professional. Service Pack 2 or 3 must be installed for Windows
XP.
Download Service Pack 2 for Windows XP:
http://www.microsoft.com/en-us/download/details.aspx?id=28
Download Service Pack 3 for Windows XP:
http://www.microsoft.com/en-us/download/details.aspx?id=24
Versions not supported:!

!

Windows XP Starter!

Windows XP Home Edition

Windows 2003
Service Pack 1 or 2 must be installed for Windows 2003.
Download Service Pack 1 for Windows 2003:
http://www.microsoft.com/en-us/download/details.aspx?id=11435
Download Service Pack 2 for Windows 2003 (recommended):
http://www.microsoft.com/en-us/download/details.aspx?id=41!

Windows Vista
Service Pack 1 or 2 must be installed for Windows Vista.
Supported versions:!

Windows Vista Business!

Windows Vista Enterprise!

Windows Vista Ultimate

Versions not supported:!

Windows Vista Starter!

Windows Vista Home Basic!

Windows Vista Home Premium

Download Service Pack 1 for Windows Vista:
http://www.microsoft.com/en-us/download/details.aspx?id=910
Download Service Pack 2 for Windows Vista (recommended):
http://www.microsoft.com/ru-ru/download/details.aspx?id=15278!

Windows Server 2008
Service Pack 2 must be installed for Windows Server 2008.
Download Service Pack 2 for Windows 2008:http://www.microsoft.com/ru-ru/download/details.aspx?id=15278!

Windows 7
Important! Supported versions:!

Windows 7 Professional!

Windows 7 Enterprise!

Windows 7 Ultimate

Since the following editions do not support the remote execution of programs, they cannot be used
to run Dr.Web CureNet!:!

!

Windows 7 Starter!

Windows 7 Home Basic!

Windows 7 Home Premium

Windows Server 2008 R2
Service Pack 2 must be installed for Windows 2008.
Download Service Pack 2 for Windows 2008:
http://www.microsoft.com/ru-ru/download/details.aspx?id=15278!

Windows 8, 10, Windows 8.1, Windows Server 2012

Stations do not have to be connected to the Internet.
Make sure that the shared network folder is accessible from the computer. To do this, navigate to the
network folder admin$ on the remote computer. Depending on the Windows settings, you may need toenter an administrator login and password. This should open the network folder (see Fig. below).

If the folder is inaccessible, change the system settings as follows:
In the registry editor (regedit), go to[HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\LANMANSERVER\PARAMETERS]Create the 32-bit DWORD value AutoShareWks and assign it a value of 1. Restart the system. The
shared folder will become accessible.
To scan stations, the following conditions must be met simultaneously:!
The Network discovery option must be enabled on the station on which the Wizard islaunched if you want to use this method to search for stations in the network;!

the station should be accessible over the network;!

the account used for the connection must exist and have sufficient privileges;!
if a firewall is being used to protect the remote computer, you need to specify the additionalsettings described below;!
UAC restrictions must be disabled if the station is running Windows Vista or a later versionof the operating system. If you are using a built-in administrator account, skip this configuration
step;!

all the services necessary for the network’s operation must be installed and configured.

Viewing network settings
1.

Start the Control Panel on the station, using any of the methods described below:

!
for Windows XP/2003Vista, click on Start and go to Control Panel → Network
Connections (if this section is not available, click on Switch to standard view). Click on the
network connection icon. In the drop-down menu, select Properties.

Go to the General tab.

!

for Windows Vista, click on Start and go to Control Panel → Network and Internet →Network and Sharing Center → Network management. Click on the network
connection icon. In the drop-down menu, select Properties.

!

for Windows 7 or Windows Server 2008, click on Start and go to Control Panel →Network and Internet → Network and Sharing Center → Change adapter settings.
Right-click on the network connection icon. In the drop-down menu, select Properties.
Make sure that the following components are enabled:

2.

3.

!

for Windows 8, Windows 10 or Windows Server 2012, click on Windows + X. In thecontext menu, go to Control Panel → Network and Internet → Network and Sharing
Center → Change adapter settings. Right-click on the network connection icon. In thedrop-down menu, select Properties.

!

for Windows 10, in the Network and Internet category, go to any of the following tabs:
VPN, Ethernet or Dial, and select Network and Sharing Center → Change adapter
settings.

Make sure that the following services are installed and configured for the connection:•

Client for Microsoft networks;•

File and Server sharing for Microsoft networks;•

Internet Protocol Version 4 (TCP/IPv4) or Internet Protocol Version 6 (TCP/IPv6).

Confirm the changes and close the configuration window.

•

The sharing parameters should support the advanced configuration described below.

•

The standard model of sharing and security should be used for local accounts. Its configuration
process is described below.

•

If your organisation uses the Active Directory domain controller, you need to configure file-sharing
and printer-sharing parameters and security settings. You can create a new Group Policy Object(GPO) to apply these settings or change the settings of an existing object.
Creating a new Group Policy Object
1.

In the command prompt, enter gpmc.msc in the text field and run the Group Policy
Management Console (GPMC).

2.

Create a new GPO, for example, GPO-CureNet. To do this, in the GPMC console tree, rightclick on GPOs in the appropriate forest and domain. Click on Create. In the newly appeared
dialogue, specify a new object name and click on OK.

3.

Bind the created object to the required domain.

4.

Right-click on the newly created object, select Change and adjust the necessary settings as
described below.

If you choose not to create a new object, but to change the parameters of an existing object, open thewindow with the corresponding settings.
1.

On the computer where you installed GPMC, click on Start → Administration → Group
Policy Management.

2.

If you see the UAC dialogue, check the data, and then click on Proceed.

3.

In the navigation pane, find and expand the node Forest: Forest name. Then expand GPOs
and right-click on the name of the object for which you want to set the permission.

4.

In the newly appeared menu, select Change.

Configuring file and printer sharing
Allow incoming requests from client computers to access files. Enabling this firewall exception
opens UDP ports 137 and 138, and TCP port 445 for the IP addresses specified in this rule.
Enabling file and printer sharing
1.

In the navigation area of the newly appeared window, expand the following nodes: Computer
Configuration → Policies → Administrative Templates → Network → Network
connections → Windows Firewall → Domain profile.

2.

In the details pane, double-click on the Windows Firewall settings: Allow inbound file andprinter sharing exception and enable this rule in the settings tab.

3.

In the Allow unsolicited incoming messages from these IP addresses, select the range.

4.

To save the changes, click on OK.

Changing security settings
Configure the policy Network access: Sharing and security model for local accounts in such a
way that when signing in to the network using local account credentials, the authentication will be
carried out using those credentials.
Allowing network access for user accounts
1.

In the navigation area of the newly appeared window, expand the following options:
Computer Configuration → Policies → Windows Configuration → Security Options →Security settings.

2.

For the policy Network access: Model Sharing and security for local accounts, select theClassic — local users authenticate as themselves mode.

Applying changes in the domainIn order to apply the changes of the domain group policies, in both cases (both when creating a new
object and when changing the policies of a pre-existing object), specify the gpupdate /force
command in the command prompt window.
Creating an account that will be used for the connection
The account used for the connection must exist and have the necessary privileges.
!
Windows XP, Windows 2003
Click on Start and go to Control Panel → Administrative Tools → Computer
Management → Local Users and Groups → Users.

Further adjustments can be made using the standard Administrator account, but it isrecommended that you create an alternative administrator account. To do this, right-click in
the right pane and in the context menu, select New User.

Enter the user name DrWebCurenet. In the Password and Confirm password fields, enter astrong password. Disable the User must change password at next logon option. Enable theoption Password never expires. Click on Create and then click on Close.

Double-click on the created DrWebCurenet account icon. The DrWebCurenet properties
window will appear. Go to the Member Of tab.

In the Member Of tab, select Users and click on Remove. Then click on Add. The SelectGroups window will open. Click on Advanced and then click on Find Now. On the resulting
list, select Administrators, click on OK, and then click on OK one more time in the SelectGroups window.

In the Dr.WebCureNet properties window, click on Apply and OK.
!

Windows Vista and Windows Server 2008
Click on Start and go to Control Panel → System and Maintenance → Administrative
Tools → Computer Management → Local Users and Groups → Users. Further
adjustments can be made using the standard Administrator account, but it is recommended thatyou create an alternative administrator account. Right-click in the middle pane and select New
User in the context menu.

Enter the user name — DrWebCurenet. Enter a strong password in the Password and Confirm
password fields. Clear the User must change password at next logon check box. Check the
Password never expires box.

Click in sequence on the Create and Close buttons. Double-click on the created DrWebCurenet
account and go to the Member Of tab.

Select Users and click on Remove. Then click on Add. The Select Groups window will open.
Click on Advanced and then click on Find Now. In the search results, select Administrators andclick on OK.

In the Select Groups window, also click on OK.

Click in sequence on Apply and OK in the Properties:DrWebCurenet window.
!

Windows 7, Windows 2008 R2

Click on Start and go to Control Panel → System and Security → Administrative Tools →Computer Management → Local Users and Groups → Users. Further adjustments can be madeusing a standard Administrator account, but it is recommended that you create an alternative
administrator account. Right-click in the middle pane and select New User in the context menu.

Enter the user name — DrWebCurenet. Enter a strong password in the Password and Confirm
password fields. Clear the User must change password at next logon check box. Check the
Password never expires box. Click in sequence on the Create and Close buttons.

Double-click on the created DrWebCurenet account and go to the Member Of tab. Select Usersand click on Remove.

Then click on Add. The Select Groups window will open. Click on Advanced and then click on
Find Now. In the search results, select Administrators and click on OK.

In the Select Groups window, also click on OK.

In the DrWebCurenet properties window, click in sequence on Apply and OK.
!

Windows 8, 10, Windows 8.1 Windows Server 2012

Click on the Windows + X buttons. In the newly appeared context menu, select Control Panel →System and Security → Administration → Computer Management → Local Users andGroups → User. Further adjustments can be made using a standard Administrator account, but it
is recommended that you create an alternative administrator account. Right-click in the middle paneand select New User in the context menu.

Enter the user name — DrWebCurenet. Enter a strong password in the Password and Confirm
password fields. Clear the User must change password at next logon check box. Check the
Password never expires box.

Click on the Create and Close buttons.
Double-click on the created DrWebCurenet account and go to the Member Of tab.

Select Users and click on Remove.
Then click on Add. The Select group window will open. Click on Advanced and then click on
Find Now. In the search results, select Administrators and click on OK.

In the Select Groups window, also click on OK.

In the DrWebCurenet properties window, click in sequence on Apply and OK.
Configuring file sharing!

Windows XP

This configuration is not required for Windows 2003.
Click on Start and go to Control Panel → Classic view → Folder Options. The Folder Options
window will open. Go to the View tab. Clear the Use simple file sharing check box. Click on
Apply and OK.
You can also configure this setting in the Control Panel. Select Windows Firewall (if the item is
not available, click on Switch to standard view). Go to the Exceptions tab and enable File andPrinter Sharing.

!

Windows Vista, Windows Server 2008

Click on Start and go to Control Panel → Network and Internet → Network and Sharing
Center. Check the File Sharing box in the Sharing and Discovery section. Click on Apply.

!

Windows 7, Windows Server 2008 R2

Click on Start and go to Control Panel → Network and Internet → Network and Sharing
Center → Change advanced sharing settings. In the appropriate network profile, enable Network
discovery and Turn on file and printer sharing.

Click on Save changes.
If you configure Windows 2008 or Windows 2008 R2, do not use the Turn on network discovery
option.
!

Windows 8, 10, Windows 8.1, Windows Server 2012

Click on the Windows + X buttons.

In the newly appeared context menu, select Control Panel → Network and Internet → The
Network and Sharing Center → Change advanced sharing settings. In the network profile,select Turn on file and printer sharing.

Click on Save changes.
Configuring User Account Control (UAC)
Restrictions should be disabled if the station is running Windows Vista or later versions of theoperating system. If you are using a built-in administrator account, skip this configuration step.
!

Windows VistaOpen the Registry Editor on all the stations to be checked.
Click on the Windows + R buttons.

In the newly appeared window, enter Regedit. Windows Registry Editor will open. Navigate to thefollowing registry branch:[HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\PO
LICIES\SYSTEM]
If the LocalAccountTokenFilterPolicy key does not exist, create it:
Go to the right pane of the Registry Editor window, right click your mouse and in the context menu,
select the option New → DWORD (32-bit) Value.

Set the name of the parameter LocalAccountTokenFilterPolicy. Double-click on the newly createdparameter. The Edit DWORD (32-bit) Value window will appear. Set the value to 1 and click onОК.

Close the Windows Registry Editor. Change the remaining settings and restart the system.
!

Windows 7

Click on the Windows + R buttons.

In the newly appeared window, enter Regedit. The Windows Registry Editor will open. Navigate to
the following registry branch:[HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\PO
LICIES\SYSTEM]
In the right pane of the Registry Editor window, right click on your mouse, and in the context menu,
select DWORD (32-bit) Value.

Set the name of the parameter LocalAccountTokenFilterPolicy. Double-click on the newly createdparameter. The Edit DWORD (32-bit) Value window will appear. Set the value to 1 and click onОК.

Quit the Registry Editor. Change the remaining settings and restart the system.
!

Windows 8, 10, Windows 8.1, Windows Server 2012

Click on the Windows + R buttons.

In the newly appeared window, enter Regedit. The Windows Registry Editor will open. Navigate to
the following registry branch:[HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\PO
LICIES\SYSTEM]
In the right pane of the Registry Editor window, right click on your mouse and select DWORD (32bit) Value.

Set the name of the parameter LocalAccountTokenFilterPolicy. Double-click on the newly createdparameter. The Edit DWORD (32-bit) Value window will appear. Set the value to 1 and click onОК.

Quit the registry editor. Change the remaining settings (as described in sections 2-6) and restart thesystem.
Configuring the Firewall
If a firewall is being used to protect the remote computer, additional configuration, as described
below, is required.
If you use Windows Firewall, in its settings tab, go to Advanced options, select Inbound Rules,
and enable the following exceptions: Netlogon service (NP-In) and File sharing and printersharing (SMB-In).
Exceptions must be enabled for the Private firewall profile. If the station is in a domain, exceptions
must be enabled for the Domain profile.
If you are using other firewalls, you must open port 445.
An example of File and Printer Sharing settings if the Windows Firewall is used:!

Windows XP, Windows 2003

Go to Start → Control Panel → Windows Firewall. The Windows Firewall window will open.
Go to the Exceptions tab. Select the File and Printer Sharing option. Click on OK.

!

Windows Vista, Windows Server 2008

Go to Start → Control Panel → Security →Windows Firewall. Click on Turn Windows
Firewall on or off. In the Windows Firewall window, go to Exceptions. Check the File andPrinter Sharing box.

Click on OK.
!

Windows 7, Windows Server 2008 R2

Click on Start and go to Control Panel → System and Security → Windows Firewall → Allow
programs to communicate through Windows Firewall. Click on Change settings. Check theFile and Printer Sharing box.

Click on OK.
!

Windows 8, 10, Windows 8.1 Windows Server 2012

Click on the Windows + X buttons. In the newly appeared context menu, select Control Panel →System and Security → Windows Firewall → Allow programs to communicate throughWindows Firewall. Click on Change settings. Check the File and Printer Sharing box.

If you have installed another firewall, this group of settings will be blocked.

Click on OK.
Configuring Local Security Policy.
The sharing and security model should be used for local accounts.
By default, the connection to the remote computer cannot be established if the account used
contains a blank password. To connect, specify a non-empty password.
!

Windows XP, Windows 2003

Go to Control Panel → Administration (if this section is missing, click on Switch to standardview) → Local Security Policy → Local policies → Security settings.
Double-click on the policy Network access: sharing and security model for local accounts. The
Properties window will open. Select Classic — local users authenticate as themselves.
To start the local security policy configuration utility, you can also type the command secpol.msc in
the Windows search field and click on ENTER.

Successively click on Apply and OK. Close the Local Security Settings window.
Right-click on the network connection. In the context menu, select Properties. The network
connection properties window will open.
Click on OK.
!

Windows Vista, Windows Server 2008

Click on Start and go to Control Panel → System and Maintenance → Administration →Local
Security Policy → Local Policies → Security Options. Double-click on Network access: sharing
and security model for local accounts. The Properties window will open. Select Classic — local
users authenticate as themselves, and click on OK.

!

Windows 7, Windows Server 2008 R2

Click on Start and go to Control Panel → System and Security → Administration → Local
Security Policy → Local Policies → Security Options. Double-click on Network access: sharing
and security model for local accounts. The Properties window will open. Select Classic — local
users authenticate as themselves, and click on OK.

!

Windows 8, 10, Windows 8.1, Windows Server 2012

Click on the Windows + X buttons. In the context menu, select Control Panel → System andSecurity → Administration → Local Security Policy → Local Policies → Security Options.
Double-click on Network access: sharing and security model for local accounts. The Properties
window will open. Select Classic — local users authenticate as themselves, and click on OK.

Launching Dr.Web CureNet!
1.

Launch the CureNet!.exe file you downloaded, and, if necessary, confirm its launch.

Important! The procedure for starting Dr.Web CureNet! after the first launch will be described
below.
Important! Even though Dr.Web CureNet! is compatible with anti-virus solutions from othervendors, it is recommended that you disable them while you are scanning systems with
Dr.Web CureNet! to accelerate the scanning process.
2.

Click on Install to continue.

3.
If you want to specify a location to store the Dr.Web CureNet! file for further use rather thansave it to the default directory, click on Browse.
CureNet!.exe is a self-extracting archive and does not require installation. All you need to do isselect the location to which the archive's contents will be extracted. The default folder’s name is
CureNet!, but you can change it to whatever name you like. If you extract the archived files onto a
USB flash drive or any other removable data-storage device, you will be able to carry Dr.Web
CureNet! with you wherever you go so it is always at hand should any emergency situations arise.
The product’s repository files and the key file will be extracted to the destination folder.

To continue the installation, click on Install.

4.
Click on the button in the upper-right corner
language.

of the next window to select the localisation

Important! If you are using the English language version of your operating system, make sure thatit has all the components needed to display English characters.
If you have a configuration file saved from previous scanning sessions and you would like to use it,click on the Default profile button in the upper-right corner to load it.

If you have any questions, click on the
button. Select Help in the context menu to view theUser manual. Selecting My Dr.Web Portal will direct you to your personal page from which you
can submit support requests.
Furthermore, on the personal page you can also select About to view information about yourlicense.

Click on Next to continue.

Click on the Update button to update the virus databases.

Important! Success in detecting and neutralising viruses depends greatly on the virus definitions in
the database. Therefore, it is strongly recommended that you update the databases whenever you
launch Dr.Web CureNet!
If you want to change the default settings, click on the Settings button.

In the Actions tab, you can select the actions to be performed with different types of malicious
objects. Move is set as the default action that is to be performed when most types of malicious
objects are detected.
It should also be noted that different types of malicious objects have different lists of applicableactions. For example, while the list for infected files contains the Report, Cure, Delete, Rename,and Move options, Cure is not available for incurable objects.
Important! A system restart is necessary to cure many viruses. However, the Restart station
option (the General tab) is disabled by default since forced rebooting may interfere with the user
experience. Therefore, if a virus is detected in your system, you should notify all users and scan all
networked machines.

By default, random names are generated for Dr.Web files when you copy them to a scanned station.
If the station has an anti-virus with a firewall installed on it, the administrator may need to set
exceptions for it during each scanning session. In such a situation, it is recommended that you
enable Use standard names for anti-virus processes in order for Dr.Web files to be copied to thestation under their own names. And, in this case, the administrator will only need to specify afirewall exception on the station that’s being scanned once.
The scan parameters are selected in the Network tab.

In the Exclusions tab, specify any files and folders that should be excluded from scanning and also
indicate that packed and composite objects need to be scanned.

To save the settings, select the Default profile and choose Save in the newly appeared menu.

Important! It is recommended that you use the default settings since all Doctor Web products
come with settings that ensure optimal performance.
If you have saved profiles, click on the Default profile and choose the profile you need.

Select Next to continue.
5.

In the newly opened window, you need to create a list of the networked computers that are to
be scanned for viruses.

Click on Search to search for computers in the network.

If you select Network discovery, searching all the stations can take a long time. At any moment,
you can click on Stop search. All the stations found up to this point will be added to the list. If,
while searching, a station was not found, add it manually.
If you wish to create the list manually, click on the Add button and enter the address of anindividual machine or a range of addresses to be searched for within the system.

In the list, select the stations you need by checking the box next to its name or IP address in the list,
or by clicking on Select All. Stations added to the list manually are automatically selected forfurther work with them.
If the network you are checking does not have a domain structure, click on Credentials, and in the
newly opened window, enter the passwords used to access the respective target machines.
Once you have finished making your selections, create a list of the accounts under which Dr.Web
will connect to these stations. By default, a connection is established using the privileges of theaccount under which the Wizard is running. If a connection cannot be established under thisaccount, use the information specified in the list.

Click on Next to continue.
6.

In the newly opened window, choose the scan type: Express, Full or Custom.

Important! Choosing the Express scan will instruct the anti-virus to scan only system directories
and running processes, which does not guarantee that your computer will be fully cured if an
infection is detected. For example, some viruses running in a system can infect clean files that havealready been scanned.

If you choose Custom scan, specify the list of objects to be scanned.

Click on the Start button to continue.

This window displays the scanning progress taking place on the remote computers and the scan
results. The statistics that are provided do not depend on the quality of the connection between thecomputers. Even if the connection is interrupted, Dr.Web CureNet! will update the statistics oncethe connection is re-established.
Important! It is not recommended to stop scanning prematurely.
The running processes involved in the scanning utilise self-defence mechanisms that protect themagainst malware.

Using the context menu, you can stop or continue the scanning process, add a station in real time orchange credentials.

Important!
!

Actions cannot be executed immediately for some infected or suspicious objects (e.g.,registry keys and files used by other Windows applications). When detected, such files aremarked as to be processed (depending on the action specified) after a station restart. For
the correct processing of these objects, you can allow the operating systems of the scanned
stations to be restarted if needed or turn them off automatically after scanning is complete.
The user will be prompted with a warning and have time to complete their current workand save their information.

!

When viruses are detected in the Master Boot Record (MBR), Dr.Web Scanner forces a
reboot of the station immediately after a virus is discovered and the boot record (hardreboot) is restored. The system will be restarted regardless of whether or not the Restart
station option is enabled.

The station scanning process does not depend on whether or not the Wizard is launched. To exit the
Wizard, click on Cancel. When you do that, the scanning process does not stop, but statistics are nolonger available.
By clicking on Details, you will see detailed statistics.

After clicking on the drop-down menu, you can select the display mode.

Click on the Generate report button to create a network scanning report.

Click on Exit to close the program.
For detailed information about the product, its configuration, scanning, and the use of profiles, referto the Dr.Web CureNet! administrator manual
Using Dr.Web CureNet!
It is recommended that you perform regular anti-virus scans of your system. In particular, files on
the disks scanned by the file monitor may contain viruses that were not known to the anti-virus
when it scanned the files.
To perform a scan:
1.

Open the folder where the Dr.Web CureNet! files were saved when it was first launched (bydefault, this is the CureNet folder in the directory where you ran the utility’s installation file,or Desktop if you saved the installation file on it) and run the CureNet file.

If you are using UAC, you will need to click on Yes to confirm that you want the program to start.
Once you have launched Dr.Web CureNet! you may proceed with scanning as described above.

Product operation testing
1.

To

get

a

test

virus,

open

your

2.

Scroll down the page until your reach the following text

browser

and

go

to

Select any of the files available for downloading, e.g., choose the first one — eicar.com.
3.

Save the downloaded file on the desktop of the target machine.
Important! If you use Dr.Web CureNet! to supplement your other (non-Dr.Web) anti-virus,
disable the anti-virus prior to saving the file.

4.

Run Dr.Web CureNet! and perform an anti-virus scan.

Malware analysis by Doctor Web security researchers
No automated routine can ever replace the experience and knowledge of a security researcher. If Dr.Web
vxCube returns a “safe” verdict on your analysed file, but you still have your doubts about this result,Doctor Web's security researchers, who have a wealth of experience analysing malware, are ready toassist you.
With this service, a malicious file of any complexity can be analysed. The resulting report includes:•

Information about the malware’s basic principles of operation and that of its modules;•

An object assessment: downright malicious, potentially dangerous (suspicious), etc.;•

An analysis of the malware's networking features and the location of its command and control
servers;•

The impact on the infected system and recommendations on how the threat can be neutralised.

You can submit an anti-virus research request here: https://support.drweb.com
Virus-related computer incident (VCI) expert consultations
If malware has wreaked havoc in your corporate infrastructure and you require the expertise of security
researchers to investigate the incident, Doctor Web's information security task force is at your service.
VCI consultations include:•

A preliminary estimate of the incident, the scope of the investigation, and the measures required toneutralise the incident’s consequences.

•

An examination of the computer and other related items (hard disks, and text, audio, photo, andvideo materials) that are presumably related to the VCI.

•

Exclusive! A psychological evaluation of individuals (company personnel) to identify possible
accomplices involved in/assisting with/covering up or supporting illegal activities against thecustomer (a comprehensive risk assessment) as well as facts related to inaction or dereliction of
duty.

•

Recommendations on the deployment of an anti-virus protection system that would prevent VCIs
or reduce them to a minimum in the future.

Useful links
About VCI consultations: https://antifraud.drweb.com/expertise
Submit your consultation request here: https://support.drweb.com/expertise
About Doctor Web
Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web products have beendeveloped since 1992. All rights to Dr.Web technologies are reserved by Doctor Web. The company is
one of the few anti-virus vendors in the world to have its own technologies for detecting and curingmalware. Doctor Web has its own anti-virus laboratory, global virus-monitoring service, and technicalsupport service located in Russia.
Doctor Web is a key player on the Russian market for software that meets the fundamental need of any
business — information security. Russia's State Duma, Central Election Committee, Ministry of Defence,
Supreme Court, Federation Council, Central Bank, and many other government institutions and large
companies have chosen to rely on Dr.Web products.
Here are just some of our customers: https://customers.drweb.com.

Dr.Web products are included in the Unified Register of Russian Computer Programs andDatabases of the Ministry of Digital Development, Communications and Mass Media of the RussianFederation.
When customers use Russian-made Dr.Web anti-virus software they are protected from the risks
associated with a changing international situation. For example, they do not need to worry about being
denied the ability to use, renew, or receive the software or to receive updates, and they are protected fromthreats that have been created to engage in targeted attacks against Russian organisations and citizens.
Products awarded the quality mark!

Doctor Web possesses certificates that allow Dr.Web software to be used in companies with highsecurity requirements.

!

Dr.Web is certified to contain no undeclared features — control level 2, compliance with "Antivirus protection requirements", approved by FSTEC Russia No. 28 on March 20, 2012, andcompliance with FSB Russia’s requirements for anti-virus solutions.

!

Dr.Web software protects information (including classified information constituting State secrets,
personal data, etc.) in the most diverse IT environments.

!

Using Dr.Web software ensures proper compliance with the standard requirements of the laws of
the Russian Federation on applying measures to protect:!

sensitive information (state secrets, personal information, etc.);!

certain categories of citizens from information that can inflict damage.

FSTEC Russia
certificates

Russian Defence
Ministry certificates

Certificates of the
All certificates andFederal Security Service trademarks(FSB)

Doctor Web has received state certificates and awards; our satisfied customers spanning the globe areclear evidence that the quality of our products, created by a talented team of Russian programmers, isundisputed.
© Doctor Web 2003-2020
3rd street Yamskogo polya 2-12А, Moscow, Russia, 125040
Phone: +7 (495) 789-45-87 (multichannel)
Fax: +7 (495) 789-45-97
www.drweb.com