Anti-virus
for UNIX Internet gateways© 2011 Doctor Web

Dr.Web, SpIDer Mail, SpIDer Guard, CureIt!, CureNet!, AV-desk,
Dr.WEB
Doctor Web

Doctor Web

Dr.We® for Unix Internet gateways
6.0.1
27.10.2011
2-12A, 3rd str. Yamskogo polya
Moscow, Russia
125124www.drweb.com+7 (495) 789-45-87

Doctor Web
Dr.WebR

Dr.WebDr.Web

1992

4

8
9
10
11
12

15
distribution package for UNIXsystems

15

distribution package for UNIXsystems

18

distribution package for UNIX systems

19

GUI

19

GUI

26
29
33
35

Dr.Web for UNIX Internet Gateways

40

Linux and Solaris

40

FreeBSD

40

SELinux OS

41

43
Dr.Web Updater

45
45

Cron

47

5
47
48
52

Dr.Web Control Agent

54
54
54
55

[Logging]

55[Agent]56[Server]

57[EnterpriseMode]

58[StandaloneMode]

59[Update]61

Dr.Web Unix Control Agent

62
63
64

Dr.Web Monitor

69
69
70
71

[Logging]

71[Monitor]

72

Dr.Web Unix Monitor

75
76

Dr.Web Scanner

77
77

6
81
Dr.Web Scanner

94

Dr.Web Daemon

96
96
97

Dr.Web Daemon

107
108

Dr.Web Daemon

109
112

Dr.Web ICAP

114

Dr.Web ICAP Squid

114

Dr.Web ICAP SafeSquid

116

Squid

118

FTP

119
119
120
120
133
Agent Monitor

140
141

Dr.Web ICAP

141

Squid SafeSquid projects

142

Dr.Web UNIX Internet gateways

143
144
147
147

7
148
155
156

157
158
Internet gateways

158

8

Dr.Web for UNIX Internet gateways

Dr.Web for UNIX Internet gateways

Dr.Web for UNIX Internet gateways

Unix

OS

Dr.We® for Unix Internet gateways for Linux
Dr.We® for Unix Internet gateways for FreeBSD
Dr.We® for Unix Internet gateways for Solaris
3
HTTP
FTP
URL
Dr.Web Enterprise Security Suite Control Center Web

Dr.Web for UNIX Internet gateways

3

Dr.Web Scanner
Dr.Web Daemon
Dr.Web ICAP

ICAP

9

Dr.Web Updater
Dr.Web Control Agent
Dr.Web Monitor
Dr.Web Scanner
Dr.Web Daemon
Dr.Web ICAP
Dr.Web console for UNIX Internet gateways(GUI)
Doctor Web
Web

('+')

: ALT+F1%bin_dir, %etc_dir, %var_dir
OS

ALT

F1

10

Linux, Solaris:%bin_dir = /opt/drweb/%etc_dir = /etc/drweb/%var_dir = /var/drweb/
FreeBSD:%bin_dir = /usr/local/drweb/%etc_dir = /usr/local/etc/drweb/%var_dir = /var/drweb/

Dr.Web for Unix Internet gateways

OS
Linux
2.6
FreeBSD 6Intel x86
Solaris 10 Intel x86

32bit/64bit x86_64

64bit

Dr.Web Daemon drwebd

32bit

4.33

Squid 3.0.STABLE1
SafeSquid 3.0
Solaris 10
libstdc++.so.4

libstdc++.so.4
drweb-icapd

gcc-3.3.2

libgcc-3.3.

libstdc++.so.4
libstdc++.so.4
LD_LIBRARY_PATH# export LD_LIBRARY_PATH="/usr/local/lib"11

libglade2
libgtk2
libstdc++6
base64
unzip
crond
GUI
Window System

X
X Window System

512MB
205MB

Dr.Web for Unix Internet gateways%bin_dir, %etc_dir, %var_dir%bin_dir - Dr.Web for Unix Internet gateways
Dr.Web Updater update.pl%bin_dir/lib/
drweb32.dll%bin_dir/agent/ - Dr.Web Agent%etc_dir/monitor/ - Dr.Web Monitor%var_dir/bases/*.vdb %etc_dir - Dr.Web for Unix Internet gateways: drweb32.ini, agent.conf, monitor.conf,
drweb-icapd.ini,
drwebd.enable,
drwebmonitor.enable12%bin_dir/lib/ru_scanner.dwl - Dr.Web Scanner%bin_dir/doc/ %bin_dir/web/ - Dr.Web for Unix Internet gateways
Web
Webmindrwebicapd-web.wbm.gz%var_dir/infected/ -Dr.Web for Unix Internet gateways--- beginning of the file --[Section 1 name]Parameter1 = value1, ..., valueK...
ParameterM = value1, ..., valueK...
[Section X name]Parameter1 = value1, ..., valueK...
ParameterY = value1, ..., valueK--- end of the file --";""#"

Dr.Webgateways

for

Unix

Internet

13

Dr.Web for Unix Internet gateways::

Names = XXXXX, YYYYY:

Names = XXXXX
Names = YYYYYParameterName = {xxxx}

numerical value - 0time 0smhd: 30s, 15m

size b
k

0

14

m
g
: 20b, 15k

permissions : 755 (-rwxr-xr-x), 644 (-rw-r--r--)path to file/directory actions -()

address - Dr.Web for Unix Internet gatewayso inet - TCP
PORT@HOST_NAME
HOST_NAME
IP:

Address = inet:3003@127.0.0.1
o local -UNIX:

Address
drwebd=o PID - PID

text value string value -local:/var/drweb/run/.

15

Dr.Web for Unix Internet gateways
root

Dr.Web for Unix Internet gateways
ESP Package Manager EPM
X Window System
X Window

EPM

GUI
SystemGUI

distribution package for UNIXsystems
Dr.Web for Unix Internet gateways

drweb-internet-gateways_[version number]~[OS name].run

drweb-common:

drweb32.ini
drweb

drweb-bases:
rweb-common
drweb-libs:
drweb-epm6.0.0-libs: GUI

drweb
d

16

drweb-libs
drweb-epm6.0.0-uninst: GUI
drweb-epm6.0.0-libs
drweb-boost144: Dr.Web Agent Dr.Web Monitor
drweb-libs
drweb-updater:
drweb-common, drweb-libs
drweb-agent: Dr.Web Agentdrweb-common, drweb-boost144
drweb-monitor: Dr.Web Monitor
drweb-common, drweb-boost144
drweb-daemon: Dr.Web Daemon
drweb-bases, drweb-libs
drweb-scanner: Dr.Web Scanner
drweb-bases, drweb-libs
drweb-icapd:
Dr.WebICAP
drweb-common, drweb-icapd-dws, drweb-libs
drweb-icapd-dws:
drweb-common

URL

drweb-icapd-web:

Dr.Webfor

Unix

Internet

gateways Web

drweb-internet-gateways-doc: Dr.Web for Unix
Internet gateways
64bit

drweb-libs drweb-libs32
64bit

32bit

17

Dr.Web for Unix Internet gateways
CLIGUI# chmod +x drweb-internet-gateways_[version number]~[OS name].run# ./drweb-internet-gateways_[version number]~[OS name].run
drweb-internet-gateways_[version number]~[OS name]
GUI
root
GUI

root
CLI

-noexec# ./drweb-internet-gateways_[version number]~[OS name].run --noexec
GUI# drweb-internet-gateways_[version number]~[OS name]/install.sh
CLI# drweb-internet-gateways_[version number]~[OS name]/setup.sh

18%etc_dir/software/conf/[configuration_file_name].N[file_name].O

distribution package for UNIXsystems
Dr.Web for Unix Internet gateways# drweb-internet-gateways_[version number]~[OS name]/remove.sh
root

root

GUI

CLI

drweb

drweb

%etc_dir/software/conf/

Dr.WebO[file_name].

19

distribution package for UNIXsystems
Dr.Web for Unix Internet gatewaysGUI1.

# drweb-internet-gateways_[version number]~[OS name]/install.shGUI
1. GUI"Next""Cancel"20

2.

"Dr.Web
Internet Gateways"
2.

Dr.Web"Custom Configuration""Next"

for

21

3.

Custom Configuration

DrWeb anti-virus Daemon
Bases DrWeb Common Files"Select
All""Select None"3.

"Next"

DrWeb

22

4.

4.
"Accept and install""Next""Cancel installation"
5.

5.

4

"Next"

23

6.

drweb-internet-gateways_[version number]~[OS name]install.log"Run interactive postinstall script""Next"
Dr.Web for Unix Internet gateways

24

7.

Interactive post-install script

Dr.WebInternet

gateways

for

Unix

25

8.

6.
9.

26

7. "Close"

GUI

GUI
1.

# drweb-internet-gateways_[version number]~[OS name]/remove.shGUI
10. GUI"Next""Cancel"2.
Doctor Web
EPM-packages
Dr.Web for Unix Internet gateways
Doctor
Web

27

11.

"Select
All""Select None"3.

"Next"

28

12.

4.

13.

5. "Close"

GUI

29

GUI

# drweb-internet-gateways_[versionname]/setup.sh

number]~[OS30

Dr.Web for Unix Internet gateways
Yes
N

Y
No

31

”Custom Configuration"

32

Y

Yes

33

Dr.Web for Unix Internet gateways
Dr.Web for Unix Internet gateways

GUI

34

Y

Yes

35

Dr.Web for UNIX Internet gateways
Solaris FreeBSD

Dr.WebLinux

http://officeshield.drweb.com/

drweb/

Dr.Web

Debian Ubuntu (apt)
Debianwget -O - http://officeshield.drweb.com/drweb/
drweb.key | apt-key add -curl http://officeshield.drweb.com/drweb/drweb.
key | apt-key add /etc/apt/sources.list
deb http://officeshield.drweb.com/drweb/debian stablenon-freeDr.Web for UNIX Internet gateways

36

apt-get update
apt-get install drweb-internet-gateways
Dr.Web for UNIX Internet gateways

apt-get remove drweb-internet-gateways
Synaptic

ALT Linux PCLinuxOS (apt-rpm)/etc/apt/sources.list
32-bit:rpm http://officeshield.drweb.com/drweb/
altlinux stable/i386 drweb
64-bit:rpm http://officeshield.drweb.com/drweb/
altlinux stable/x86_64 drweb
Dr.Web for UNIX Internet gateways

apt-get update
apt-get install drweb-internet-gateways
Dr.Web for UNIX Internet gateways

apt-get remove drweb-internet-gateways
Synaptic

37

Mandriva (urpmi)

rpm --import http://officeshield.drweb.com/
drweb/drweb.key

http://officeshield.drweb.com/drweb/drweb-i386.urpmi-media

http://officeshield.drweb.com/drweb/drweb-x86_64.urpmi-media

urpmi.addmedia drweb http://officeshield.drweb.
com/drweb/mandriva/stable/i386/

urpmi.addmedia drweb http://officeshield.drweb.
com/drweb/mandriva/stable/x86_64/
Dr.Web for UNIX Internet gateways

urpmi.update drweb
urpmi drweb-internet-gateways
Dr.Web for UNIX Internet gateways

urpme drweb-internet-gateways
rpmdrake

38

Red Hat Enterprise Linux Fedora CentOS (yum)/etc/yum.repos.d
32-bit:[drweb]name=DrWeb - stablebaseurl=http://officeshield.drweb.com/drweb/
el5/stable/i386/
gpgcheck=1
enable=1
gpgkey=http://officeshield.drweb.com/drweb/
drweb.key
64-bit:[drweb]name=DrWeb - stablebaseurl=http://officeshield.drweb.com/drweb/
el5/stable/x86_64/
gpgcheck=1
enable=1
gpgkey=http://officeshield.drweb.com/drweb/
drweb.key
Dr.Web for UNIX Internet gateways

yum install drweb-internet-gateways
Dr.Web for UNIX Internet gateways

yum remove drweb-internet-gateways
PackageKit Yumex

39

Zypper package manager (SUSE Linux)

zypper ar -t YUM http://officeshield.drweb.com/
drweb/el5/stable/i386/ drweb

zypper ar -t YUM http://officeshield.drweb.com/
drweb/el5/stable/x86_64/ drweb
Dr.Web for UNIX Internet gateways

zypper refreshzypper install drweb-internet-gateways
Dr.Web for UNIX Internet gateways

zypper remove drweb-internet-gateways
YaST

FreeBSDFreeBSD
Dr.Webofficeshield.drweb.com/drweb/freebsd/ports/

http://

make install
SolarisSolarisFTP
drweb/unix/release/Solaris/packages

ftp://ftp.drweb.com/pub/

pkgaddDr.Web for UNIX Internet Gateways

Dr.Web for UNIX Internet
Gateways

Linux and Solaris
Dr.Web for Unix Internet gateways
1. %bin_dir

drweb32.key

2. %etc_dir drwebd.enable"1"
Dr.WebDaemon"0"
3. %etc_dir drweb-monitor.enable"1"
Dr.Web Monitor
4. init
Dr.Web Daemon Dr.Web Monitor# /etc/rc.d/init.d/drwebd start# /etc/rc.d/init.d/drweb-monitor start
5.

FreeBSD
Dr.Web for Unix Internet gateways
1. %bin_dir
drweb32.key
2.
/etc/rc.conf

drwebd_enable="YES" - Dr.Web Daemon

40

Dr.Web for UNIX Internet Gateways

drweb_monitor_enable="YES"-

Dr.WebMonitor3. init

Dr.Web Daemon Dr.Web Monitor

4.

SELinux OS
SELinux

OS

Dr.Web Scanner Dr.Web Daemon

drweb-scanner drweb-daemon

policygentool

SELinxLinux:# policygentool drweb-scanner
real- Dr.Web Scanner%bin_dir/drweb.

# policygentool drweb-daemon
real- Dr.Web Daemon%bin_dir/drwebd.

3[module_name].te[module_name].fc[module_name].if[module_name].te
checkmodule -M -m -o module-name [module_name].
techeckpolicy

41

Dr.Web for UNIX Internet Gateways

semodule_package -o [module_name].pp -m modulename

semodule -i [module_name].pp

42

43

Dr.Web for Unix Internet gateways

Dr.Web for Unix Internet gateways

Dr.Web for Unix".key"
Internet gateways %bin_dir

Dr.Web for Unix Internet
Doctor Web

gatewayszip".key"

zip
Doctor Web Web".key"

Web

http://products.drweb.co.jp/register/44

Dr.Web for Unix Internet gateways

2525
http://support.drweb.com/

request/drweb32.ini:

Key = %bin_dir/drweb32.key

2

Dr.WebDaemonDr.Web Scanner

Daemondrweb32.ini [Daemon]
MailCommand

Key

Dr.Web Updater

Dr.Web Updater
Dr.Web Updater
URL
Perl

Dr.Web for Unix Internet gateways
update.pl

update.pl

Dr.Web for Unix Internet gateways %bin_dir

Dr.Web

Updater%etc_dir/drweb32.ini[Updater]
update.pl$ %bin_dir/update.pl [parameters]

Dr.Web for Unix Internet gateways
URL".vdb"

drwXXXYY.vdb

drwtoday.vdb
XXX

YY 00

:

drw60000.vdb

drwtoday.vdb
drwXXXYY.vdb

drwtoday.vdb
drwtoday.vdb

Dr.Web for Unix Internet

gateways %45

Dr.Web Updater

var_dir/bases/
drwrisky.vdb, drwnasty.vdb 2-

drwebase.vdb drwXXXYY.vdb drwtoday.vdb
drwtoday.vdb drwnasty.vdb dwnXXXYY.vdb dwntoday.vdb

dwntoday.vdb drwrisky.vdb dwrXXXYY.vdb dwrtoday.vdb

dwrtoday.vdb URL".dws"
dwfXXXNN.dws
mlw malware

XXX

3

NN

white_dwfXXX.dws XXX

prn porno

mlw malware

3
lzma

prn porno

46

Dr.Web Updater

Cron
Linux

:

/etc/cron.d/

FreeBSD

Solaris: cronFreeBSD

drweb

crontab*/30 * * * * /usr/local/drweb/update.pl
Solaris# crontab -e drweb# 0,30 * * * * /opt/drweb/update.pl

Dr.Web Updater--ini=path_to_configuration_file--what=component_to_be_updated
Component_to_be_updated

scanner

daemonUpdater--not-need-reload--not-need-reload
update.pl--not-need-reload:

47

Dr.Web Updater$%bin_dir/update.plreload=drwebd--not-need-

Updater
Updater:%etc_dir/drweb32.ini[Updater] section
UpdatePluginsOnly{Yes | No}=

Yes
DaemonScanner:
UpdatePluginsOnly = No
Section = {Daemon |Scanner}

Daemon Scanner--what--what:Section = Scanner

ProgramPath = {pathto file}DaemonScanner
Web Updater

Dr.
API

:
ProgramPath = %bin_dir/drwebd
SignedReader{path to file}=:
SignedReader
read_signed=%bin_dir/48

Dr.Web Updater

LzmaDecoderPath{path to file}

=

lzma
:
LzmaDecoderPath = %bin_dir

LockFile = {path to
file}

Dr.Web Updater:
LockFile=
update.lock

CronSummary
| No}

=

{Yes

Yes

%var_dir/run/

Dr.Web Updater
Updatercron:
CronSummary = Yes
DrlFile
file}

=

{path

to
URL
Dr.Web Updater
Dr.Web:
DrlFile=update.drl

CustomDrlFile{path to file}=drl
Dr.Web%var_dir/bases/(*.drl):CustomDrlFile=
bases/custom.drl%var_dir/49

Dr.Web Updater

FallbackToDrl{Yes | No}

=

*.drl
Yes
Updater
CustomDrlFile
DrlFile:FallbackToDrl = Yes

DrlDir = {pathdirectory}URL

toDr.Web
:
DrlDir = %var_dir/drl/

Timeout={numerical value inseconds}:
Timeout = 90

Tries =
value}{numerical

Dr.Web Updater:
Tries = 3

ProxyServer{proxy server
or IP}

=
name

IP
:
ProxyServer =ProxyLogin = {proxy
server user login}:
ProxyLogin =50

Dr.Web Updater

ProxyPassword{proxy server
password}=
user:
ProxyPassword =syslog

LogFileName = {pathto file or syslog}:

LogFileName = syslog
SyslogFacility={Daemon | Local0 ..
Local7|
Kern|
User | Mail}
LogLevel = {Debug |Verbose | Info |Warning | Error |Quiet}
LotusdPidFile{path to file}=syslog:
SyslogFacility = Daemon:
LogLevel = Info
Lotus Daemon PID:
LotusdPidFile =drweblotusd.pid

MaildPidFile{path to file}=%var_dir/run/drweb-maild PID:
MaildPidFile =drweb-maild.pid

IcapdPidFile{path to file}=

drweb-icapd PID:%var_dir/run/51

Dr.Web Updater

IcapdPidFile =drweb_icapd.pid
BlacklistPath={path to directory}%var_dir/run/.dws:BlacklistPath = %var_dir/dws

AgentConfPath{path to file}

=

Agent
:
AgentConfPathagent.conf

PathToVadeRetro{path to file}==libvaderetro.so:
PathToVadeRetro=lib/libvaderetro.so

ExpiredTimeLimit{number}%etc_dir/%var_dir/=:ExpiredTimeLimit = 14

ESLockfile
to file}={path
Dr.Web Updater cron:
ESLockfile=
es_updater.lock

1. Dr.Web Updater%var_dir/run/52

Dr.Web Updater

2. Dr.Web Updater [Updater]
EnginePath, VirusBase, UpdatePath, PidFile
3. Dr.Web

Updaterlzma

lzma[Updater]

*.vdb
*.dws
LzmaDecoderPathlzma

4. Updating Virus Databases%var_dir/bases/

53

Dr.Web Control Agent

Dr.Web Control Agent
Dr.Web Control Agent Agent
Dr.Web for Unix Internet
gateways
Dr.Web for Unix Internet gateways
Dr.Web Enterprise Security Suite

Enterprise
Dr.Web Enterprise Security Suite
Dr.Web for Unix Internet gateways
AgentStandalone Standalone
Agent
Enterprise Enterprise
Dr.Web for Unix Internet gateways
Dr.Web ESS
Dr.Web ESS

Agent-h, --help -v, --version - Agent-u, --update-all -f, --update-failed -C, --check-only -p, --newpwd - Dr.Web ESS

54

Dr.Web Control Agent-d, --droppwd - Dr.Web ESS
Dr.Web

ESS-c <path to file>, --conf <path to file> -s <path to file>, --socket <socket> -P <path to file>, --pid-file <path to
file> - Agent PID-e <path to file>, --export-config <path
to file> - Dr.Web ESS

Dr.Web Agent%etc_dir/agent.conf[Logging]
Dr.Web Agent[Logging][Logging] section
Level = {Quiet |Error | Alert |Info | Debug}

Agent:
Level = Info

IPCLevel = {Quiet |Error | Alert |Info | Debug}

IPC:
IPCLevel = Error

SyslogFacility =syslog55

Dr.Web Control Agent{Daemon | Local0 ..
Local7 | Kern |User | Mail}
FileName = {path to
file or syslog}:
SyslogFacility = Daemon

syslog:FileName = syslog[Agent][Agent]Dr.Web Agent[Agent] section
MetaConfigDir ={path to directory}

drweb-agent
configuration files
Agent Dr.Web

meta-

Dr.Web:
MetaConfigDir = %bin_dir/
agent/
UseMonitor = {Yes |No}

YesMonitorInternet gateways
drweb-agent

Dr.Web for Unix:
UseMonitor = Yes
MonitorAddress ={address}

Agent Monitor
Monitor
Address56

Dr.Web Control Agent:
MonitorAddress = local:%
var_dir/ipc/.monitor
MonitorResponseTime= {time in seconds}

drweb-monitor
MonitorAgent
drweb-monitor
Monitor:MonitorResponseTime = 5

PidFile = {path to
file}

Agent PID:
PidFile = %var_dir/run/drwebagent.pid[Server]Dr.Web for Unix Internet gateways[Server]Dr.Web Agent[Server] section
Agent

Address = {socket
address}:

Address = local:%var_dir/ipc/.
agent
Threads ={numerical value}

drweb-agent
Agent

57

Dr.Web Control Agent:
Threads = 2
Timeout = {time inseconds}

Agent

Dr.Web:Timeout = 15

[EnterpriseMode]
Agent Enterprise[EnterpriseMode][EnterpriseMode] section
UseEnterpriseMode ={Yes | No}Yes
drweb-agent"Enterprise mode""Standalone mode"No:
UseEnterpriseMode = No
ComputerName ={text value}

Dr.Web ESS:
ComputerName =VirusbaseDir ={path to directory}:
VirusbaseDir = %var_dir/bases
PublicKeyFile ={path to file}

Dr.WebESS:

58

Dr.Web Control Agent

PublicKeyFile = %bin_dir/
drwcsd.pub
ServerHost = {IPaddress}

Dr.Web ESS

IP:
ServerHost = 127.0.0.1

ServerPort = {portnumber}Dr.WebESS:

ServerPort = 2193
CryptTraffic = {Yes
| Possible | No}

Dr.Web

ESS

Agent

:
CryptTraffic = possible
CompressTraffic ={Yes | Possible |No}

Dr.Web

ESS

Agent

:
CompressTraffic = possible
Dr.Web ESS

CacheDir = {path todirectory}:

CacheDir = %var_dir/agent[StandaloneMode][StandaloneMode]

Agent Standalone[StandaloneMode] section

59

Dr.Web Control AgentIP

StatisticsServer ={server address}:

StatisticsServer = stat.drweb.
com:80/update
StatisticsUpdatePer
iod = {time inminutes}:
StatisticsUpdatePeriod = 10

StatisticsProxy ={proxy server
address}

IP:
StatisticsProxy
localhost:3128=:
StatisticsProxy =StatisticsProxyAuth= {text value}:
StatisticsProxyAuth
testpwd

=

test:

:
StatisticsProxyAuth =UUID = {identifier}
UUID

http://stat.drweb.com/
UUID
UUID

:
UUID =

60

Dr.Web Control Agent

LicenseFile = {pathto file}Dr.Web:
LicenseFile = %bin_dir/drweb32.key

ProtectedEmails ={lookups}:
ProtectedEmails = file:%
etc_dir/email.ini[Update]Dr.Web[Update]Internet

ESS

Dr.WebforUnix

gateways[Update] section
CacheDir = {path todirectory}

Agent:
CacheDir = %var_dir/agent/cache

RegFile = {path tofile}:
RegFile = %var_dir/agent.reg
Timeout = {time inseconds}

Agent:
Timeout = 120

61

Dr.Web Control Agent

RootDir = {path todirectory}:
RootDir = /UpdaterFile = {pathto directory}:
UpdaterFile = /opt/drweb/
update.pl

Dr.Web ESS

Dr.Web Unix Control Agent"Configuration Services"

Yes

Dr.Web Agent

Agent
1.
Agent
2. [EnterpriseMode][Standalone]

3. Agent Dr.Web
Agent

Enterprise

:

Agent
Dr.Web Enterprise Security Suite
Dr.Web Enterprise Security Suite
Agent
Agent

Dr.Web Enterprise Security Suite

62

Dr.Web Control Agent:
Agent Dr.Web

meta-configuration
meta-configuration[Agent]MetaConfigDir

meta-configuration

Agent

Agent metaconfiguration

amc-files

Application
EndApplication

id: Dr.Web ESS
ConfFile:
Components:

Dr.Web ICAP for LinuxID

EndComponents

amc-file:

Application "ICAPD"
id

49

ConfFile
icapd.ini""/etc/drweb/drweb-

Components
drweb-icapd_I=Icapd
EndComponents
EndApplication/

63

Dr.Web Control Agent

Agent
drweb.com/
Agent

Dr.Webhttp://stat.

Enterprise

Agent

Dr.Web Dr.Web ESS

UUID
MD5

UUID
UUID
UUID

Dr.WebAgent

http://stat.drweb.com/

http://stat.drweb.com/

Dr.Web64

Dr.Web Control Agent

14.

:
1. Mail
2. Start date
3. Top4.

Files
End date
TOP:10 TOP:20
Plot graph65

Dr.Web Control Agent

5. QueryHTMLXML
http://info.drweb.com/export/xml/top

XML:<drwebvirustop
period="24"
top="5"vdbaseurl="http://info.drweb.com/
virus_description/"
updatedutc="2009-06-09
09:32:02"><item><vname>Win32.HLLM.Netsky</vname><dwvlid>62083</dwvlid><place>1</place><percents>34.201062139103</percents></item><item><vname>Win32.HLLM.MyDoom</vname><dwvlid>9353</dwvlid><place>2</place><percents>25.1303270912579</percents></item><item><vname>Win32.HLLM.Beagle</vname><dwvlid>26997</dwvlid><place>3</place><percents>13.4593034783378</percents></item><item><vname>Trojan.Botnetlog.9</vname><dwvlid>438003</dwvlid>

66

Dr.Web Control Agent<place>4</place><percents>7.86446592583328</percents></item><item><vname>Trojan.DownLoad.36339</vname><dwvlid>435637</dwvlid><place>5</place><percents>7.31494163115527</percents></item></drwebvirustop>XML

period top updatedutc vname place percents period

com/view/<UID><UID>

http://stat.drweb.
MD5

http://stat.drweb.com/xml/<UID>
XML
<UID>
MD5
:

<drwebvirustop period="24" top="2" user="<UID>"
lastdata="2005-04-12 07:00:00+04"><item>

67

Dr.Web Control Agent<caught>69</caught><percents>24.1258741258741</percents><place>1</place><vname>Win32.HLLM.Netsky.35328</vname></item><item><caught>57</caught><percents>19.9300699300699</percents><place>2</place><vname>Win32.HLLM.MyDoom.54464</vname></item></drwebvirustop>XML

period top user lastdata vname place caught percents period

68

Dr.Web Monitor

Dr.Web Monitor
Dr.Web Unix Monitor
Dr.Web Unix Monitor

Dr.Web for Unix Internet gateways
MonitorMonitorMonitorMonitorMonitorDr.Web Enterprise Security Suite
Internet gateways

Dr.Web for UnixEnterprise

MonitorStandalone Standalone
MonitorEnterprise Enterprise
Dr.Web for Unix Internet gateways
Dr.Web ESS
Dr.Web ESS

Enterprise1.
2. Monitor

conf

UseEnterpriseMode%etc_dir/monitor.
Yes

69

Dr.Web Monitor

Dr.Web for Unix Internet gateways
Agent
EnterpriseStandalone
1. Monitor%etc_dir/monitor.

conf
Monitor[Monitor]
2. [Monitor]

RunAppList

UseEnterpriseMode

No

Dr.Webfor Unix Internet gateways

Dr.Web Monitor-h, --help -v, --version - Monitor-u, --update -C, --check-only -A, --check-all -c <path to file>, --conf <path to file> -r, --run component1[,component2]-

70

Dr.Web Monitor:-r AGENT

Dr.Web Monitor%etc_dir/monitor.conf[Logging]
Dr.Web Monitor[Logging][Logging] section
Level = {Quiet |Error | Alert |Info | Debug}

Monitor:Level = Info

IPCLevel = {Quiet |Error | Alert |Info | Debug}

IPC:
IPCLevel = Error

SyslogFacility ={Daemon | Local0 ..
Local7 | Kern |User | Mail}
FileName = {syslog| path to file}syslog:
SyslogFacility = Daemon

syslog:FileName = syslog

71

Dr.Web Monitor[Monitor][ Monitor]

Monitor[Monitor] section
RunForeground{Yes | No}=

MonitorYesNo
daemontools
Yes:
RunForeground = No
User = {text value}

Monitor:
User = drweb

Groupvalue}={text

Monitor:Group = drweb

PidFileDir = {pathto directory}

Monitor PID:
PidFileDir = %var_dir/run/

ChDir = {path todirectory}

MonitorMonitor:
ChDir = /72

Dr.Web Monitor

MetaConfigDir ={path to directory}meta-configuration files
Monitor Dr.
Web
Dr.Web:
MetaConfigDir = %etc_dir/
monitor/
Address = {socket
address}

Monitor:
Address = local:%var_dir/ipc/.
monitor

Timeout = {time inseconds}

MonitorDr.Web:Timeout = 5
TmpFileFmt = {textvalue}

path_to_file.XXXXXX X :TmpFileFmt = %var_dir/msgs/
tmp/monitor.XXXXXX

RunAppList = {textvalue}

MonitorDr.Web:73

Dr.Web Monitor

RunAppList = AGENT
UseEnterpriseMode ={Yes | No}

Enterprise
YesEnterprise
Monitor
RunAppList
Agent
No

Standalone:

UseEnterpriseMode = No
RecoveryTimeList={time in seconds}
1

2:
RecoveryTimeList = 0,30,60
InjectCmd ={string}:
InjectCmd = "/usr/sbin/
sendmail -t"
AgentAddress ={socket address}

Monitor Agent
Agent
Agent

Dr.WebAddress:
AgentAddress = local:%var_dir/
ipc/.agent

74

Dr.Web Monitor

AgentResponseTime ={time in seconds}

drweb-agent
Agent
Monitor drweb-agent
Agent:
AgentResponseTime = 5

Dr.Web Unix Monitor"Configuration Services"

Yes

Dr.Web Monitor

Monitor
1. Monitor
2. daemon
3.

Monitor

4. PIDPID

5. drweb-monitor
MonitorDr.Web Monitor%etc_dir/drweb-monitor.enable
Linux

Solaris/etc/rc.conf
drweb_monitor_enable="YES"FreeBSD"1"75

Dr.Web Monitor

mmc-files

mmc-files

Dr.

Web Monitor

Application
EndApplication

FullName Path Depends DAEMON

.

AGENT

Components
EndComponents-

Dr.Web Daemon for Linux mmc-file:

Application "DAEMON"
FullName"Dr.Web (R) Daemon"Path"/opt/drweb/"

Depends"AGENT"

Components# namemaxStopTime

args
maxStartTime
NotifyType UserGroupdrwebd "-a=local:/var/drweb/ipc/.agent--foreground=yes" 30 10 MAIL drweb:drweb
EndComponents
EndApplication

76

Dr.Web Scanner

Dr.Web Scanner
Dr.Web Scanner

Dr.Web Scanner$ %bin_dir/drweb <path> [parameters]<path>
Scanner/path/file infected [virus] VIRUS_NAME

Report for "/opt/drweb/tmp":
Scanned: 34/32

Cured

Infected

: 0

: 5/5

Removed : 0

Modifications : 0/0

Renamed : 0

Suspicious

Moved

: 0

Speed

: 5233: 0/0

Scanning time : 00:00:02
KB/s

eicar.rus
eicar.rus
eicar.com
Dr.Web Scanner eicar.com

77

Dr.Web Scanner%bin_dir/doc/eicar.com infected by Eicar
Test File (Not a Virus!)
Eicar Test File68
Scanner-ar

Scanner("- ")-?, -h, -help$ %bin_dir/drweb -h:path @[+]<file> sd fl :alar[d|m|r][n]ARJ, CAB,GZIP, RAR, TAR, ZIP etc
cn[d|m|r][n]check files in containers HTML, RTF,
PowerPoint etc

ml[d|m|r][n]78Dr.Web Scanner

LZEXE, DIET, PKLITE,

upn
EXEPACK

FilesTypes

ex
ha
d
m
r
n
:

cu[d|m|r]
ic[d|m|r]sp[d|m|r]adw[d|m|r|i]dls[d|m|r|i]jok[d|m|r|i]
rsk[d|m|r|i]hck[d|m|r|i]
d
m
r
i
:

v, version

Scannerki
foreground[yes|no]
ot
oq
ok

UTF8
Scanner"Ok"

79

Dr.Web Scanner

log=<path to file>
ini=<path to file>
lng=<path to file>-a=<Agent address> - Scanner--only-key

-

Agent

Scanner"-"-ar -cu -ha -ic -fl -ml -ok -sd -sp:$ drweb <path> -haScanner-ar -ha -fl- -ml -sd

cu
icd
spm
spr

80

Dr.Web Scanner

cu

Scanner

ScannerdScanner

Scannerr
eicar. #om"#"

Scannerm:%var_dir/infected/:$ drweb <path> -cu -icd -spm -ar -ha -fl-ml -sd# chmod a+x [file name]Scanner

Scanner
Scanner:%etc_dir/drweb32.ini
-ini

81

Dr.Web Scanner

Scanner$ %bin_dir/drweb -ini=%bin_dir/etc/drweb.
ini[Scanner] section
drweb32.dll

EnginePath = {pathto file}:EnginePathdrweb32.dll
VirusBase = {pathto file}=%var_dir/lib/

"*"

","

:
VirusBase = %var_dir/bases/*.
vdb
UpdatePath = {pathto directory}

Updater

update.pl:

UpdatePath = %var_dir/updates/
TempPath = {path todirectory}:
TempPath = /tmp
LngFileName = {pathto file}:LngFileName = %bin_dir/lib/

82

Dr.Web Scanner

ru_scanner.dwl
Key = {path to
file}:
Key = %bin_dir/drweb32.key

OutputMode ={Terminal | Quiet}

drweb
Terminal -Quiet -:
OutputMode = Terminal
HeuristicAnalysis ={Yes | No}:
HeuristicAnalysis = Yes
ScanPriority ={value}Scanner–20 ~ 19 Linux

20 Linux:
ScanPriority = 0
FilesTypes = {ext}

ScanFiles"*" "?":

ByType83

Dr.Web Scanner

FilesTypes = EXE, COM, SYS,
OV?, BAT, BIN, DRV, PRG, BOO,
SCR, CMD, VXD, 386, DLL, FON,
DO?, XL?, WIZ, RTF, CL*, HT*,
VB*, JS*, INF, AR?, ZIP, R??,
PP?, OBJ, LIB, HLP, MD?, INI,
MBR, IMG, CSC, CPL, MBP, SHS,
SHB, PIF, SO, CHM, REG, XML,
PRC, ASP, LSP, MSO, OBD, THE*,
NWS, SWF, BMP, MPP, OCX, DVB,
CPY, MSG, EML
FilesTypesWarnings= {Yes | No}
ScanFiles

ByType:FilesTypesWarnings = Yes
ScanFiles = {All |ByType}All
ByTypeFileType:
ScanFiles = All

ScanSubDirectories= {Yes | No}:
ScanSubDirectories = Yes
CheckArchives ={Yes | No}

84

Dr.Web Scanner

ZIP, RAR, ARJ, TAR, GZIP, CAB:
CheckArchives = Yes
CheckEMailFiles ={Yes | No}:
CheckEMailFiles = Yes
ExcludePaths ={path to directory}:
ExcludePaths = /proc,/sys,/dev

FollowLinks = {Yes
| No}:
FollowLinks = No
RenameFilesTo ={mask}
"#??"
"#"

"#"

??"
eicar.com
eicar.#om".#":
RenameFilesTo = #??
MoveFilesTo = {pathto directory}:
MoveFilesTo = %var_dir/
infected"

85

Dr.Web Scanner

EnableDeleteArchive
Action = {Yes | No}

multipart, html,mbox:
EnableDeleteArchiveAction = No
InfectedFiles ={Report | Cure |Delete | Move |Rename | Ignore}

Report Cure Delete Move Rename Ignore Delete, Move, Rename:
InfectedFiles = Report
SuspiciousFiles ={Report | Delete |Move | Rename |Ignore}Report Delete Move Rename Ignore :SuspiciousFiles = Report86Dr.Web Scanner

IncurableFiles ={Report |Delete |Move | Rename |Ignore}Report Delete Move Rename Ignore :IncurableFiles = Report

ActionAdware ={Report | Delete |Move | Rename |Ignore}Report Delete Move Rename Ignore :ActionAdware = Report

ActionDialers ={Report | Delete |Move | Rename |Ignore}Report Delete Move Rename Ignore :ActionDialers = Report

ActionJokes ={Report | Delete |Move | Rename |Ignore}Report Delete Move -87

Dr.Web Scanner

Rename Ignore :ActionJokes = Report
ActionRiskware ={Report | Delete |Move | Rename |Ignore}Report Delete Move Rename Ignore :ActionRiskware = Report

ActionHacktools ={Report | Delete |Move | Rename |Ignore}Report Delete Move Rename Ignore :ActionHacktools = Report

ActionInfectedMail= {Report | Delete| Move | Rename |Ignore}Report Delete Move Rename Ignore :88

Dr.Web Scanner

ActionInfectedMail = Report
ActionInfectedArchive = {Report |Delete | Move |Rename | Ignore}

Report Delete Move Rename Ignore :ActionInfectedArchive = Report

ActionInfectedConta
iner = {Report |Delete | Move |Rename | Ignore}

Report Delete Move Rename Ignore :ActionInfectedContainer =ReportLogFileName = {filename or syslog}

syslog
SyslogFacility SyslogPriority:
LogFileName = syslog

SyslogFacility ={Daemon | Local0 ..
Local7 | Kern |syslog:
SyslogFacility = User

89

Dr.Web Scanner

User | Mail}
SyslogPriority ={Alert | Warning |Notice | Info |Error}
LimitLog = {Yes |No}syslog:
SyslogPriority = Info

LogFileName = syslog(yes)

Scanner.bak
MaxLogSize:
LimitLog = No
MaxLogSize ={value}LimitLog = Yes
0:
MaxLogSize = 512

LogScanned = {Yes |
No}

Yes
:
LogScanned = Yes

LogPacked = {Yes |No}

DIET, PKLITE

Yes:

LogPacked = Yes?

90

Dr.Web Scanner

LogArchived = {Yes
| No}

Yes
:
LogArchived = Yes

LogTime = {Yes |No}

Yes
LogFileName=

syslog:
LogTime = Yes
LogStatistics ={Yes | No}

Yes:
LogStatistics = Yes

RecodeNonprintable= {Yes | No}:
RecodeNonprintable = Yes
RecodeMode ={Replace |QuotedPrintable}

RecodeNonprintable = Yes
Replace

RecodeChar
quoted-QuotedPrintable
printable:

RecodeMode = QuotedPrintable
RecodeChar = {"?" |"_" | ...}

RecodeMode:=

Replace91Dr.Web Scanner

RecodeChar = "?"MaxCompressionRatio= {value}:
MaxCompressionRatio = 5000
CompressionCheckThreshold = {value}:CompressionCheckThreshold
500000(

MaxFileSizeToExtract = {value}:
MaxFileSizeToExtract = 500000
MaxArchiveLevel ={value}:MaxArchiveLevel = 8

=

)

92

Dr.Web Scanner

MaximumMemoryAlloca
tionSize = {valuein Mbytes}"0":
MaximumMemoryAllocationSize =0ScannerScanTimeout= {time in seconds}"0":
ScannerScanTimeout = 0
MaxBasesObsolescenc
ePeriod = {time inhours}"0":
MaxBasesObsolescencePeriod =24
ControlAgent ={Agent socket
address}

Agent
inet - TCP

local
UNIX

, unix -:ControlAgent =inet:4040@127.0.0.1,local:%
var_dir/ipc/.agent:
ControlAgent = local:%var_dir/
ipc/.agent

93

Dr.Web Scanner

OnlyKey = {Yes |
No}

Yes

Scanner

Agent

No

Scanner

Agent:
OnlyKey = No

Dr.Web Scanner
Dr.Web Scanner$ %bin_dir/drweb%bin_dir"drweb"Dr.Web Scanner

PATH
Dr.Web Scannerroot

ScannerDr.Web (R) Scanner for Linux, v6.0.1 (February
19, 2010)
Copyright (c) Igor Daniloff, 1992-2010
Support service: http://support.drweb.com/
To purchase: http://buy.drweb.com/
Program version: 6.0.1.10060 <API:2.2>
Engine version: 6.0.1.9170 <API:2.2>
Loading /var/drweb/bases/drwtoday.vdb
virus records: 1533

-

Ok,

94

Dr.Web Scanner

Loading /var/drweb/bases/drw60012.vdb
virus records: 3511-

Ok,-------------------------------------------Loading /var/drweb/bases/drw60000.vdb
virus records: 1194-

Ok,

Loading /var/drweb/bases/dwn60001.vdb
virus records: 840-

Ok,

Loading /var/drweb/bases/drwebase.vdb
virus records: 78674-

Ok,

Loading /var/drweb/bases/drwrisky.vdb
virus records: 1271-

Ok,

Loading /var/drweb/bases/drwnasty.vdb
virus records: 4867-

Ok,

Total virus records: 538681
Key file: /opt/drweb/drweb32.key
Key file number: XXXXXXXXXX
Key file activation date: XXXX-XX-XX
Key file expiration date: XXXX-XX-XX

Scanner95

Dr.Web Daemon

Dr.Web Daemon
Dr.Web Daemon

Dr.WebDr.WebDaemonDr.Web Daemon

Dr.Web for Unix Internet gateways
Daemon ICAP

Dr.Web ICAP Dr.Web

Dr.Web Daemon"-"-?, -h-help$ drwebd -hDr.Web Daemon-ini=<path to file>--foreground=<yes|no>"Yes"
DaemonDaemon--check-only <commandchecking>

line

"No"

parameters

for

96

Dr.Web Daemon-a=<Agent address>--only-key

Daemon
Agent

Agent

Dr.Web Daemon
Daemon(:%etc_dir/drweb32.ini)-ini[Daemon] section
EnginePathto file}=drweb32.dll{path:
EnginePathdrweb32.dll

VirusBase ={listof files or masks}=%var_dir/lib/

"*"

","

=

%var_dir/bases/*.

:
VirusBasevdb
UpdatePath =to directory}{path

Updater update.pl:
UpdatePath = %var_dir/updates/

97

Dr.Web Daemon

TempPath = {path todirectory}
TempPath = %var_dir/spool/
Key
=
file}

{path

to
:
Key = %bin_dir/drweb32.key

MailAddressesList{path to file}

=
15

30

:
MailAddressesList
email.ini
OutputMode={Terminal | Quiet}=%etc_dir/drweb
Terminal -Quiet -:
OutputMode = Terminal
RunForeground{Yes | No}=

DaemonYesNodaemontools:
RunForeground = No
User = {user name}

Daemon:User = drweb

98

Dr.Web Daemon

PidFile
file}

=

{path

to

Daemon PID:
PidFile = %var_dir/run/drwebd.
pid

BusyFile = {path tofile}

DaemonPID/var/run/drwebd.
bsy.123456:
BusyFile
drwebd.bsy

ProcessesPool ={process poolsettings}=%var_dir/run/auto N -1

N-M - 1N
M
timeout=
seconds} -

{time

in

N

stop_timeout
seconds} -

=

{time

in

:
ProcessesPool = auto,timeout =120, stat = no, stop_timeout =99

Dr.Web Daemon

1
OnlyKey
No}

=

{Yes

|

Yes

Agent

No

Agent
:

OnlyKey = No
ControlAgent{socket address}

=

Agent
inet - TCP
unix - UNIX

local
:

ControlAgent
inet:4040@127.0.0.1,local:%
var_dir/ipc/.agent=:
ControlAgent = local:%var_dir/
ipc/.agent
MailCommand{command}=DaemonUpdater:

MailCommandsendmail -i
root"
NotifyPeriod{value}=-bm"/usr/sbin/-f drweb --

=
"0"

:
NotifyPeriod = 14100

Dr.Web Daemon

NotifyFile
to file}

=

{path

:
NotifyFile = %var_dir/.notify
NotifyType = {Ever| Everyday | Once}
Once - 1
Everyday Ever - Daemon:
NotifyType = Ever
FileTimeout={value in seconds}

1:
FileTimeout = 30
1

StopOnFirstInfected= {Yes | No}:
StopOnFirstInfected = No
ScanPriority{value}=Daemon–20 ~ 19 (Linux)

20 (Linux:
ScanPriority = 0
FilesTypes = {listof file extensions}

ScanFiles"*""?"

ByType)101

Dr.Web Daemon:
FilesTypes = EXE, COM, SYS,
OV?, BAT, BIN, DRV, PRG, BOO,
SCR, CMD, VXD, 386, DLL, FON,
DO?, XL?, WIZ, RTF, CL*, HT*,
VB*, JS*, INF, AR?, ZIP, R??,
PP?, OBJ, LIB, HLP, MD?, INI,
MBR, IMG, CSC, CPL, MBP, SHS,
SHB, PIF, SO, CHM, REG, XML,
PRC, ASP, LSP, MSO, OBD, THE*,
NWS, SWF, BMP, MPP, OCX, DVB,
CPY, MSG, EML
FilesTypesWarnings= {Yes | No}
ScanFiles

ByType:FilesTypesWarnings = Yes
ScanFiles
ByType}

=

{All

|
All
ByTypeFileType:
ScanFiles = All

CheckArchives{Yes | No}=
ZIP, RAR, ARJ, TAR, GZIP, CAB:
CheckArchives = Yes

102

Dr.Web Daemon

CheckEMailFiles{Yes | No}=:
CheckEMailFiles = Yes

ExcludePaths{path}=:
ExcludePaths = /proc,/sys,/dev

FollowLinks
| No}

=

{Yes
:
FollowLinks = No

RenameFilesTo{mask}

=
"#??"
"#"

"#"
"

??"
eicar.com
eicar.#om".#":
RenameFilesTo = #??
MoveFilesTo = {pathto directory}:
MoveFilesTo
infected/=%var_dir/Cure

BackupFilesTo={path to directory}
.
:

103

Dr.Web Daemon

BackupFilesTo
infected/
LogFileName = {filename or syslog}=%var_dir/syslog
SyslogFacility SyslogPriority:
LogFileName = syslog

SyslogFacility={Daemon | Local0 ..
Local7|
Kern|
User | Mail}syslog

SyslogPriority{Alert | Warning
Notice|InfoError}=||

syslogLimitLog
No}

|

=

{Yes

:
SyslogFacility = Daemon:
SyslogPriority = Info:
LimitLog = No

MaxLogSize = {valuein Kbytes}

LimitLog = Yes
0:
MaxLogSize = 512

LogScanned = {Yes |
No}

Yes
:
LogScanned = Yes

104

Dr.Web Daemon

LogPacked
No}

=

{Yes

|

DIET, PKLITE

Yes

?

:
LogPacked = Yes
LogArchived
| No}

=

{Yes

Yes
:
LogArchived = Yes

LogTime
No}

=

{Yes

|

Yes
LogFileName=

syslog:
LogTime = Yes
LogProcessInfo{Yes | No}

=

PID

Yes
IP
:
LogProcessInfo = Yes

RecodeNonprintable= {Yes | No}:
RecodeNonprintable = Yes
RecodeMode{Replace
QuotedPrintable}=|

RecodeNonprintable = Yes
Replace

RecodeChar

QuotedPrintable
printable:

quoted-105

Dr.Web Daemon

RecodeMode = QuotedPrintable
RecodeChar = {"?" |"_" | ...}

RecodeMode=

Replace:
RecodeChar = "?"Socket=address}{socketinet - TCP
unix - UNIX

local

Socket = inet:3000@127.0.0.1,local:%
var_dir/.drwebd

Socket = 3000 127.0.0.1, 192.168.0.100

Socket = %var_dir/.drwebd 0660

Socket3000 0.0.0.0:
Socket = %var_dir/run/.daemon
Socket = 3000, localhost
SocketTimeout={value in seconds}:
SocketTimeout = 10

106

Dr.Web Daemon

MaxCompressionRatio= {value}:
MaxCompressionRatio = 500
CompressionCheckThreshold = {value in
Kbytes}:CompressionCheckThreshold
1024

MaxFileSizeToExtract={valuein
Kbytes}:MaxFileSizeToExtract = 40960
MaxArchiveLevel{value}=:MaxArchiveLevel = 8

Dr.Web Daemon
Daemon=107

Dr.Web Daemon-ini%etc_dir/drweb32.ini
Daemon/var/log/
User
LogFileName

DaemonUser

drweb
Engine drweb32.dll

EnginedaemonDaemonDr.Web for Unix Internet gateways

Daemon PID

Dr.Web Daemon

SIGHUPSIGTERM
SIGKILL

DaemonDaemonPID

108

Dr.Web Daemon

Dr.Web Daemon
Daemon$ netstat -a

TCP:--- cut --Active
Internetestablished)
Proto Recv-Q
Address State

connections

Send-Q

tcp

0

0

raw

0

0 *:icmp

*:*

raw

0

0 *:tcp*:*

Local Address

localhost:3000

*:*

and

Foreign

LISTEN

7
7

ActiveUNIX
established)domain

Proto

Flags

RefCnt(servers

sockets
Type

State

and

I-Node Path

unix 0gpmctl[ ACC ]

unix

0

[ ]

STREAM

CONNECTED

190 @0000001b

unix

1

[ ]

STREAM

CONNECTED

1091 @00000031

unix 0 [ ACC ]font-unix/fs7100
unix

4

[ ]

STREAM(servers

STREAM

DGRAM

293

unix
1
gpmctl[ ]STREAM

unix

0

[ ]

DGRAM

450

unix

0

[ ]

DGRAM

433

unix

0

[ ]

DGRAM

416

unix

0

[ ]

DGRAM

308

LISTENING

LISTENING

384 /dev/

403 /tmp/.

/dev/log
CONNECTED

1092 /dev/

109

Dr.Web Daemon--- cut --UNIX:--- cut ---ActiveInternetestablished)
Proto Recv-Q
Address State

connections

Send-Qraw

0

0 *:icmp

*:*

raw

0

0 *:tcp*:*

Local Address

andForeign

7
7

ActiveUNIX
established)domain

Proto

Flags

RefCnt(servers

sockets
Type(servers

State

STREAM

and

I-Node Path

unix 0gpmctl[ ACC ]

LISTENING

384 /dev/

unix

0

[ ]

STREAM

CONNECTED

190 @0000001b

unix

1

[ ]

STREAM

CONNECTED

1091 @00000031

unix 0 [ ACC ] STREAM
drweb/run/drwebd.skt

LISTENING

1127 /opt/

unix 0 [ ACC ]font-unix/fs7100

LISTENING

403 /tmp/.

unix

4

[ ]

STREAM

DGRAM

293

unix
1
gpmctl[ ]STREAM

unix

0

[ ]

DGRAM

450

unix

0

[ ]

DGRAM

433

unix

0

[ ]

DGRAM

416

unix

0

[ ]

DGRAM

308

/dev/log
CONNECTED--- cut --Daemon
Daemondrwebdc

1092 /dev/

110

Dr.Web Daemon

TCP:$ drwebdc -nHOSTNAME -pPORTNUM -sv -sb
UNIX:$ drwebdc -uSOCKETFILE -sv -sb--- cut --- Version: DrWeb Daemon 6.00
- Loaded bases:
Base /var/drweb/bases/drwtoday.vdb
records.

contains

5

Base /var/drweb/bases/drw50003.vdb contains 409
records.
Base /var/drweb/bases/drw50002.vdb contains 543
records.
Base/var/drweb/bases/drwebase.vdb
51982 records.

contains

Base /var/drweb/bases/drw50001.vdb contains 364
records.
Total 53303 virus-finding records.
--- cut --drwebdc
TCP:$ drwebdc -nHOSTNAME -pPORTNUM -sv -sb -v
UNIX

:

111

Dr.Web Daemon$ drwebdc -uSOCKETFILE -sv -sb -v--- cut --dwlib: fd:
refusedconnect()

faileddwlib:
failedconnecting

to

tcp:

-

Connection

127.0.0.1:3300-

dwlib: cannot create connection with a DrWeb
daemonERROR: cannot retrieve daemon version
Error -12--- cut --Demonreadme.eicar
readme.eicar
eicar.com

TCP:$ drwebdc -nHOSTNAME -pPORTNUM -f eicar.
com
UNIX

:

$ drwebdc -uSOCKETFILE -f eicar.com--- cut ---Results: daemon return code 0x20
(known virus is found)--- cut ---Dr.Web Daemon

112

Dr.Web Daemon

DaemonDaemonDaemonDaemon113

Dr.Web ICAP

Dr.Web ICAP
Dr.Web ICAP

Squid

drweb-icapd

ICAP

SafeSquid

Dr.Web ICAP
HTTP
FTP
Dr.Web Daemon
Dr.Web ICAP
Dr.Web Daemon
URL
Dr.Web ICAP

Dr.Web ICAP Squiddrweb-icapd
15. HTTP

HTT

114

Dr.Web ICAP

ICAP

Dr.Web ICAP
ICAP
Dr.Web ICAP
Dr.Web Daemon
Dr.Web ICAP
ICAP
HTTP

FTP

Squid Dr.Web

FTP
Setting up FTP-traffic scanning with Squid

ICAP

Squid

squid.conf

ICAP

:

icap_enable on
ICAP:# ICAP service description:# icap_service <name> <type> <pass> <url>#<name> ? name of service#<type> ? type of service#<pass> ? can content be passed (1) past

# ICAP server or not (0)#<url> - url of service

icap_service service_1 respmod_precache 0
icap://localhost:1344/respmod:

icap_class class_1 service_1:

icap_access class_1 allow all

115

Dr.Web ICAP:

icap_preview_enable on:

icap_preview_size 0IP:

icap_send_client_ip on
drweb-icapd Squid HTTP
connection:

Keep-Alive persistenticap_persistent_connections on

Squidrespmod-postcache

Dr.Web ICAP SafeSquid
Dr.Web ICAP SafeSquidconfig.xml SafeSquid
Web
ICAP

Web

ICAP

Add

Enabled = true;
Host =(

drweb-icapd
localhost)IP;

File = /respmod;
Port
=
1344)
;

drweb-icapd

Applies to = responses;
Submit(116

Dr.Web ICAP

config.xml<safesquid><icap><enabled>true</enabled><icap><enabled>true</enabled><comment>Dr.Web icap server</comment><profiles></profiles><host>localhost</host><file>/respmod</file><port>1344</port><which>responses</which></icap></icap>117

Dr.Web ICAP

Squid

FTP

Squid

drweb-icapd
16. HTTPHTTP
Squid-1
Squid-2
Squid-1

HTTP

FTP

FTP

FTP

Squid-2
FTP

HTTP

Squid
1. 2
Squid
2. Squid-1
http_port
3. Squid-2

drweb-icapd

4. Squid-2

Squid-1

3129
Squid-2

118

Dr.Web ICAP

cache_peer localhost parent 3129 3130
default connect-timeout=80000
31299

Squid-1

localhost Squid-1
80000
Squid-2

Squid-1
5. Squid drweb-icapd
6. HTTPFTP

Squid-2

Allowpreview_size
icap_preview_size 0
Squid 2.x

drweb-icapd Squiddrweb-icapd:
Squid:Allow

UsePreview = No
icap_preview_size -1

SafeSquid

Dr.Web ICAP

URL

URL

11
Dr.Web Updater
Porno -

204

119

Dr.Web ICAP

Violence Weapon Gamble Drugs Obscenity Chats Terrorism Email SocialNetwork - SNS
MalwareLinks -BlockNAME*.dws

drweb-icapd-h--help --v--version - drweb-icapd-d -f <path to file | path to Agent socket> Agent

Agent-m - drweb-icapd Dr.Web Monitor

Dr.Web ICAP

120

Dr.Web ICAP

Dr.Web ICAP:

%etc_dir/drweb-icapd.ini
Logfile = {filename or syslog}

syslog
SyslogFacility SyslogPriority:
Logfile = syslog

SyslogFacility ={Daemon | Local0 ..
Local7 | Kern |User | Mail}syslog

SyslogPriority{Alert | Warning
Notice | Info}syslog=|:
SyslogFacility = Daemon:
SyslogPriority = Info

Loglevel = {numericvalue}-1 01 - INFO

24816 32 :Loglevel = 1

121

Dr.Web ICAP

MaxLogSize = {valuein Mbytes}

LimitLog = Yes
0
Daemon0:
MaxLogSize = 1m
Hostmaster ={address}:
Hostmaster = root@localhost

Infected = {Cure |Move | Truncate |Report}Cure HTMLMove Truncate
ReportHTML-:
Infected = Cure
Incurable = {Move |Truncate | Report}
HTML

Move Truncate
Report

-

HTML

122

Dr.Web ICAP:
Incurable = Report
Suspicious = {Move| Pass | Truncate |Report}Pass HTMLMove Truncate
ReportHTML-:
Suspicious = Report
Adware = {Move |Pass | Truncate |Report}Pass HTMLMove Truncate
ReportHTML-:
Adware = Report
Dialers = {Move |Pass | Truncate |Report}Pass HTMLMove Truncate-

123

Dr.Web ICAP

ReportHTML-:
Dialers = Report
Jokes = {Move |Pass | Truncate |Report}Pass HTMLMove Truncate
ReportHTML-:
Jokes = Pass
Riskware = {Move |Pass | Truncate |Report}Pass HTMLMove Truncate
ReportHTML-:
Riskware = Pass
Hacktools = {Move |Pass | Truncate |Report}Pass Move -

HTML

124

Dr.Web ICAP

Truncate
ReportHTML-:
Hacktools = Pass
ArchiveRestriction= {Move | Pass |Truncate | Report}

Pass HTMLMove Truncate
ReportHTML-:
ArchiveRestriction = Report
DaemonError = {Move| Pass | Truncate |Report}DaemonPass HTMLMove Truncate
Report--:DaemonError = Report
SkipObject = {Move| Pass | Truncate |Report}Pass -

HTML

125

Dr.Web ICAPHTMLMove Truncate
ReportHTML-:
SkipObject = Pass
LicenseError ={Move | Pass |Truncate | Report}
Pass HTMLMove Truncate
Report

-

-

HTML

:
LicenseError = Report
Heuristic = {Yes |No}:
Heuristic = Yes
LocalScan
No}

=

{Yes

Yes

|
Daemon:LocalScan = Yes

126

Dr.Web ICAP

User = {user name}

Dr.Web ICAP
Dr.Web Daemon
Dr.Web ICAP:
User = drweb

Cache = {path todirectory}:
Cache = %var_dir/cache/*.dws

DwsDirectory ={path to directory}:

DwsDirectory = %var_dir/dws
BlockPorno = {Yes |No}:
BlockPorno = Yes
BlockViolence ={Yes | No}:
BlockViolence = Yes

BlockWeapon = {Yes
| No}:
BlockWeapon = Yes
BlockGamble = {Yes
| No}
:

127

Dr.Web ICAP

BlockGamble = Yes
BlockDrugs = {Yes |No}:
BlockDrugs = Yes

BlockObscenity ={Yes | No}:
BlockObscenity = Yes
BlockChats = {Yes |No}:
BlockChats = No
BlockTerrorism{Yes | No}=:
BlockTerrorism = Yes

BlockEmail = {Yes |No}:
BlockEmail = No
SNS

BlockSocialNetwork= {Yes | No}:
BlockSocialNetwork = No

BlockMalwareLinks{Yes | No}=:
BlockMalwareLinks = Yes

128

Dr.Web ICAP

BlockAll = {Yes |No}:
BlockAll = No
WhiteDwsFiles ={list of files}

host1
host2
...
:
WhiteDwsFiles =SendUrlsWithViruses= {Yes | No}

URL
Dr.WebWeb Agent:
SendUrlsWithViruses = No

Templates = {pathto directory}:
Templates = %etc_dir/
templates/icapd
PidFile = {path to
file}

Dr.Web ICAP PID:
PidFile = %var_dir/run/drweb_icapd.pid

Dr.

129

Dr.Web ICAP

Key = {path to
file}:
Key = %bin_dir/drweb32.key

BlackHosts = {listof files}IP:
BlackHosts =WhiteHosts = {listof files}IP:
WhiteHosts =MaxBlocksize ={size in Mbytes}

drweb-icapd:
MaxBlocksize = 10m
BindPort = {portnumber}drweb-icapd:
BindPort = 1344

BindAddress = {hostaddress}

drweb-icapd

IP:
BindAddress = 127.0.0.1

130Dr.Web ICAP

DrwebAddress ={FAMILY : ADDRESS}

Dr.Web Daemon

inet - TCP@
local - UNIXpid -Daemon PID

PID:
DrwebAddress =inet:3000@localhost
DrwebAddress = local:/usr/
local/drweb/run/drwebd.skt
DrwebAddress = pid:/usr/local/
drweb/run/drwebd.pid:
DrwebAddress = pid:%var_dir/
run/drwebd.pid
PathToQuarantine ={path to directory}:
PathToQuarantine = %var_dir/
infected

QuarantineFilesMode= {accesspermissions}:
QuarantineFilesMode = 0660

Timeout = {value inseconds}

Daemon:Timeout = 300

131

Dr.Web ICAP

SendMail = {Yes |No}

Hostmaster:
SendMail = No
SendMailDwsBlock ={Yes | No}
Hostmaster:
SendMailDwsBlock = No
MailCommand{command}=

SendMail

Yes:
MailCommand = "/usr/sbin/
sendmail -i -bm -f drweb -- %s"
MailCache ={numeric value}

SendMail

Yes

0:
MailCache = 60
AclList = {list of
files}

drweb-icapd

drweb-icapd

IP

132

Dr.Web ICAP:
AclList =Agent

SendStat = {Yes |No}:
SendStat = No

KeepAlive

KeepAlive = {Yes |No}:
KeepAlive = Yes
UsePreview = {Yes |No}[MimeStart
MimeEnd]No:
UsePreview = Yes

Dr.Web for Unix Internet gateways

BlockPorno
BlockViolence

133

Dr.Web ICAP

BlockWeapon
BlockGamble
BlockDrugs
BlockObscenity
BlockChats
BlockTerrorism
BlockEmailBlockSocialNetwork
BlockMalwareLinks
BlockAlldrweb-icapd.ini [match]request_url

string[def]

URLrequest_userna stringme
X-ClientUsername

request_ip

IP
CIDR

IP
X-Client-IP

system_time

time

134

Dr.Web ICAP

BOOL_EXPR:
func_name()
COMPARE( BOOL_EXPR )! BOOL_EXPR
BOOL_EXPR && BOOL_EXPR
BOOL_EXPR || BOOL_EXPR
&&
||
!

AND
OR
NOT

func_name() function
function

COMPARE
[def]

CIDR

string_var
cidr_var
time_var
TIME"HH: MM""H: MM":

STRING
REGEX

POSIX

FILE_NAME
CIDR

IPv4
/32

135

Dr.Web ICAP

string_var== STRING
string_var= STRING!

string_var
REGEX

~

string_var==
file:
FILE_NAME
string_var
file:
FILE_NAME

~

<<=

IP

cidr_var <<=file:
FILE_NAME

IP

cidr_var
CIDR

time_var
TIME>

time_var
TIME>=

time_var
TIME<

time_var
TIME<=

1. ! NOT136

Dr.Web ICAP

2. <

, <=

3. ==

, !=

,>

, >=

,~

, <<=

4. && AND
5. || OR

Functions: [def][def]function:

func_name_1 = { BOOL_EXPR }BOOL_EXPR:

is_localhost local_ip function

IP

IP

[def]
is_localhost = { request_ip <<= "127.0.0.0/8" }local_ip = {request_ip <<= "127.0.0.0/8"|| request_ip <<= "192.168.0.0/16"|| request_ip <<= "172.16.0.0/12"||
request_ip
other_local_ips.txt"<<=

file:"/tmp/icapd/}
function
14:00
18:15

worktime()
13:00

[def]

9:30

137

Dr.Web ICAP

worktime={(system_time>="9:30"&&
system_time<="13:00") || (system_time>="14:00"&& system_time<"18:15") }[match]drweb-icapd.ini [match]:

if BOOL_EXPR {configuration section}
BOOL_EXPR

configuration section

:
IP

Porno

Email

[match]if(local_ip()||
request_ip"87.249.57.20") && worktime() {<<=BlockPorno = yes
BlockEmail = yes
}
:
23:00

8:00

IP

Terrorism[match]if(request_ip<<="93.185.182.46"
request_ip <<= "195.98.93.66")||&&(system_time>="23:00"
system_time<="8:00")

||

138

Dr.Web ICAP{
BlockTerrorism = yes
}
:
"edx"

worktime()[match]if request_username=="edx" && !worktime(){
BlockAll = yes}:URL[match]if(request_username ~ "john .*"|| request_username
users_re_block.txt"~

file:"/tmp/icapd/|| request_username ==users_block.txt")

file:"/tmp/icapd/&&(request_url=="http://example.com/
mega_music.mp3"){
BlockAll = yes}

local_ip()

worktime()

[def]

139

Dr.Web ICAP

Squidrequest_username

request_ip
squid.conf

Squidrequest_ip:# request_ip
icap_send_client_ip onrequest_username:# request_username
icap_send_client_username on
icap_client_username_header X-Client-Username
icap_client_username_encode off

Agent Monitor
drweb-icapd

Agent

Monitordrweb-icapd Agentdrweb-icapd Agentdrweb-icapd.ini
Key
Agent
%etc_dir/agent.conf
drweb-icapd
Agentdrweb-icapd.ini SendStat
Agent

Doctoragent.conf

UUID

Web Webmd5

140

Dr.Web ICAP

http://stat.drweb.com/view/
md5sum/md5sum-f

drweb-icapd

UUID
Agent

Agent

Monitordrweb-icapd

drweb-

icapd

MonitorMonitordrweb-icapd
Monitor%etc_dir/monitor.conf RunAppList
Monitor
-r
ICAPD

ICAPD

Agent

MonitorDr.Web Daemon
Dr.Web ICAP

Dr.Web ICAP
drweb-icapd
1. drweb-icapd.ini

Incurable

Infected,
ReportSuspicious,

141

Dr.Web ICAP

2. http://www.eicar.org/download/eicar.com

HTTP

drweb-icapd.ini

drweb-icapd
Template%etc_dir/templates/icapd/

Squid SafeSquid projects
Squid project:
http://squid-cache.org/.
ICAP support for Squid:
http://squid.sourceforge.net/icap/http://squid.sourceforge.net/
projects.html#icap
SafeSquid project:
http://safesquid.com/.

142

Dr.Web UNIX Internet gateways

143

Dr.Web UNIX Internet
gateways
Dr.Web for Unix Internet gateways Dr.Web console for UNIXInternet Gateways
Web
Web
WebminWebminwww.webmin.com/).

Webmin(http://

Dr.Web console for UNIX Internet Gateways:

Perl

XML::Parser - XML
XML::XPath - XPath
CGI - CGI
CGI::Carp - HTTPD
Cwd Data::Dumper Encode
Encode::Detect perl-devel

Unix

libperl-dev
Perl

File::Basename File::Stat POSIX - POSIXJSON - JSON

stat()JavaScript

Notation

Encode::CN Encode::HanExtr Webmin

Web

Web

ObjectDr.Web UNIX Internet gateways

144

Dr.Web console for UNIX Internet gateways
WebminWebminInternet gateways

Dr.Webconsolefor%bin_dir/web/

WebminWebmin Web
17. Webmin

WebminWebminUNIX

Dr.Web UNIX Internet gateways

145

18. Webmin

1. Webmin
Browse2.

%bin_dir/web/
Web console for UNIX Internet gatewaysDr.

Dr.Web UNIX Internet gateways

146

19. Webmin

3.
4.

Dr.Webconsole for UNIX Internet gateways
20. Dr.Web console for UNIX Internet gateways

Dr.Web UNIX Internet gateways

Dr.Web console for UNIX Internet gateways
init
1
21. Module configuration

Quarantine 1
Quarantine Management
Information

Files per page inShow debug

Dr.Web console for UNIX Internet Gateways
Back

147

Dr.Web UNIX Internet gateways

148

22. Dr.Web console for UNIX Internet gateways

Dr.Web ICAP Dr.Web for Unix Internet gateways
Web
,

,

3

3

Dr.Web Icapd
Icapd

Configuration

5

Dr.Web

Dr.Web UNIX Internet gateways

Actions Applied to Threats Content Filter - URL
System settings Traffic Filtering Rules - MIME
Logging -Preview

Continue Editing
CancelApply and Save

Save

23.

149

Dr.Web UNIX Internet gateways

24.

150

Dr.Web UNIX Internet gateways

25.

Use
BrowseURL

syslog151

Dr.Web UNIX Internet gateways

26.

Yes

No

DwsDirectory
Browse152

Dr.Web UNIX Internet gateways

27.

BlackHosts

153

Dr.Web UNIX Internet gateways

Figure 28. Creating user-defined list

WhiteHosts

WhiteHosts
WhiteDwsFilesWhiteDwsFiles

URL

MIME

TYPE/Format
zip audio/mpeg

multipart/x-

154

Dr.Web UNIX Internet gateways

29. Traffic Filtering Rules

URL, Size, Date
30.

Delete155

Dr.Web UNIX Internet gateways

31.

ERR_FAILED_CHECK ERR_DOWNLOAD_BLOCK - URL

ERR_ACCESS_DENIED

email.templ -

-

Web

156

157

Dr.Web for Unix Internet gateways
web

http://www.drweb.com/:
http://buy.drweb.com/:
http://support.drweb.com/

OS
Dr.Web for Unix Internet gateways

158

Dr.We® for Unix Internet gateways«universal»«economy» Dr.Web for Unix Internet gateways

1 2

3

Doctor Web
Doctor Web
http://partners.drweb.com/
Dr.Web Global Updating
Doctor Web

Internet gateways
Dr.Web for Unix Internet gateways
HTTP FTP
SafeSquid
Dr.Web for Unix Internet gateways
25

ICAP
Squid

© 2011 Doctor Web