A "Dr. Web" warning.... - Page 1
Forum section: electronics / general

author: GlennSprigg
author_rank: Super Contributor
timestamp: July 18, 2021, 11:25:29 am
content: I used to only use 'AVAST' anti-virus, but they got too sneaky, and with underlying tricks.NOW i use 'Comodo', which is not for the feint-hearted, but very powerful, intricate & accurate.Anyway, I recently temporarily perused 'Dr. Web', and quickly decided to delete it completely. (Or so I thought).After re-booting, COMODO warned me that an executable called 'dwservice.exe' was trying to access an online server.I blocked it permanently, but after research, found out it was to do with 'Dr. Web'. The report says..."DWService enables remote access to systems via just a standard web browser." Hmmm...We've all of course heard of the likes of 'TeamViewer' etc etc, but this was a new one on me!!I'll never trust those pricks again, as far as I can kick them !!

author: wraper
author_rank: Unknown
timestamp: July 18, 2021, 11:36:41 am
content: QuoteDWService you googled has nothing to do with any files from Drweb which may be named similarly. Doesn't it hit you that quote comes from a completely unrelated website?https://www.dwservice.net/en/overview.htmlQuoteRather don't trust your judgment skills.

author: GlennSprigg
author_rank: Super Contributor
timestamp: July 18, 2021, 12:18:55 pm
content: Quote from: wraper on July 18, 2021, 11:36:41 am'wraper'... we all have varying degrees of 'knowledge', and am sorry if you do not trust me... No loss or gain!Anyway, prior to my obviously ill-informed rant, I didnumerouslook-ups regarding that executable.Here is yet 'another' one unrelated to my past queries...It's strange that I had just installed/deleted/rebooted 'Dr. Web' just prior to 'Comodo's finding. Yes, there is a Siteattributed to that executable also, but maybe Dr. Web UTILIZE their services?? Not to mention the .exe starting with 'DW'.Please don't just feel I'm some trouble making retard, in your sights from such Ivory towers....

author: Mr. Scram
author_rank: Super Contributor
timestamp: July 18, 2021, 08:12:55 pm
content: Quote from: evb149 on July 18, 2021, 06:11:44 pmValid advice yet wholly useless to most. Suggesting Linux in response to any and all Windows issues isn't helpful. I wish the evangelical sort would realise this as they're doing more harm to the Linux community than good.

author: GlennSprigg
author_rank: Super Contributor
timestamp: July 21, 2021, 11:34:08 am
content: Quote from: Mechatrommer on July 18, 2021, 06:09:27 pmFirstly, I was told by 'wraper'that this .exe. is not necessarily to do with Dr. Web... Which was wrong.When you say... "have you checked your RCA is "already enabled"? or is it that Comodo only playing sentimental with you."...Obviously, it IS a part of Dr. Web then. And I never noticed any warning/option to have such a 'module/function' enabled.In my limited capacity, I don't understand the 'snydness' of... "Comodo only playing sentimental with you." ??When you say... "malicious file is attempted into my system, avast will immediately block it before it even get copied, not after reboot"...Well, obviously, when 'Dr. Web' was first installed, and I gave itPermissionto run & install, all such modules were 'Allowed' to bepresent in my system. However, after supposedly totallyUN-installingit, (not completely though as it should have!), there wereREMNANTSleft, as in that.exefile, that Comodo NOW rightly detected and blocked!! (Not sitting on it's laurels before-hand!!)Now a lot of 'trusted' software will, during a re-boot, COMPLETE it's total un-installation THEN, if it could not do so fully while the System wasrunning.However, my main/initial complaint,is that it left this Module behind, and actively running after a re-boot!!! How can I be clearer!!To those even 'less' initiated than my mere self, this is not acceptable, and deserves reporting as such!In GENERAL though, regarding what you say about AVAST... YES, for many years it has been a 'leader' for those in the know, as a seriouscontender, and quite thorough, with a very low footprint on your system. That's why I used them for YEARS! However!, because they area Business and not a charity, their current emphasis is vastly towards constant nagging & pushing for upgrades, beyond what I would labelas friendly/unobtrusive... They CONSTANTLY now throw 'warning' messages to 'scare' the uninitiated, almost declaring their systems totallycorruptible and open to attacks, if they do not immediately upgrade!!! (And quoting tons of false virus/threat warnings!).'Comodo', (with whom I have zero affiliation with!), ARE a very high end organization. As I stated, it is not for the feint-hearted, as the setupfine-tuning and utilization can be daunting at first, and not for someone 'new' to computers in general at first. From the start, it never 'Assumes'anything, and it 'learns' as you go along, regarding YOUR choices & understanding, of what's going on continuously. Assuming you 'know'...Eventually, you hear less & less from it, and it's all back to 'normal', and although 'in control', it will not let you make a mistake!!!

author: Kleinstein
author_rank: Super Contributor
timestamp: July 21, 2021, 11:57:36 am
content: There is still chance the dwservice.exe file is actually not really from Dr. Web, but only pretends so. Malware may not be honest about the creator.It is still suspicious to have this file left behind and active.If it is a 3rd party malware than DrWeb should have complained before - so anyway is the fault of DrWeb. Likely in leaving behind some active service (even if not really active). Anti virus products are prime canditates for adding additional backdoors to the system, as they need some access to low level services and often there is no 2nd system to check.

author: wraper
author_rank: Unknown
timestamp: July 21, 2021, 12:27:08 pm
content: Quote from: GlennSprigg on July 21, 2021, 11:34:08 amI told that what you googled is completely unrelated with the file you had. dwservice.exe from Dr.Web (I guess acronym ofDr.Web service) you had on your computer has nothing to do with remote access program called DWService. Is it that hard to understand? When I ever claimed that dwservice.exe file is unrelated to Dr.Web?DWService you googled does not even have any files with such name. It uses dwagent.exeQuoteAs I read it, your main complaint was that it left a remote access backdoor, which it did not. BTW Dr.Web has a removal tool if antivirus did not uninstall properly. Also It's entirely possible that Dr.Web did not uninstall properly because you had 2 antiviruses installed simultaneously (Dr.Web+Comodo), which is a big no-no.QuoteThere isn't.QuoteLMAOQuoteThe same way asterrarium andterrorism.

author: GlennSprigg
author_rank: Super Contributor
timestamp: July 22, 2021, 11:32:30 am
content: Quote from: wraper on July 21, 2021, 12:27:08 pm? We are obviously not on the same page, and reading/re-reading your comments just leaves me confused & utterly flummoxed !!Obviously I'm not getting what you are saying, but neither are YOU piecing together anything 'I' am trying to say either???...We can go round & round in circles, or simply justSTOP!I'm sure the other 230 odd readers of this post can grasp what I'm saying!

author: wraper
author_rank: Unknown
timestamp: July 22, 2021, 11:52:00 am
content: Quote from: GlennSprigg on July 22, 2021, 11:32:30 amName_of_the_file.exe from one application being the same as the name of some other program (which is calledName_of_the_filewithout .exe) does not mean they have anything in common. Capish?

author: GlennSprigg
author_rank: Super Contributor
timestamp: July 22, 2021, 12:18:43 pm
content: Quote from: wraper on July 22, 2021, 11:52:00 am'Capish'... Now you are resorting to Italian in order to 'belittle'... sigh...You NOW just reversed everything that you said... AGAIN!!!... 'Mama-Mia!!'Go away....

author: wraper
author_rank: Unknown
timestamp: July 22, 2021, 12:35:24 pm
content: Quote from: GlennSprigg on July 22, 2021, 12:18:43 pmFrom the beginning I said that your file has nothing to do with what you googledQuote from: wraper on July 18, 2021, 11:36:41 amHow this is any different from what I said in other posts?QuoteWell, the second part of my initial post turned out to be especially true.

author: GlennSprigg
author_rank: Super Contributor
timestamp: July 24, 2021, 05:59:52 am
content: Once again...Simply GO AWAY !!!!!Can't you find some Ants to burn with a Magnifying Glass...Or some local little kids to bully or something???Or maybe some Moderator can simply block this post/thread !

author: wraper
author_rank: Unknown
timestamp: July 24, 2021, 07:38:38 am
content: Quote from: GlennSprigg on July 24, 2021, 05:59:52 amCheck the authority of your "Ivory towers", or find a safe space. It's very popular these days.QuoteNobody is bullying you. I'm simply a bit astonished you cannot understand or read a few simple sentences. It's like a mishmash in your brain. You fail to filter what google shows you (not nearly everything it shows is relevant). You repeatedly failed to understand what I explained. And you are overly defensive. My first post might be a bit harsh and uncalled in the end, and I should not have written it that way. At that moment to me it seemed extremely lame that you took a first thing google showed, made no mental action to check it's relevance, and made very far reaching conclusions. But your further action is way worse IMHO.