© 2003-2009 Doctor Web. All rights reserved.

Dr.Web® CureIt!®Version 5.0.0User Manual19.11.2009

Doctor Web Head Office2-12A, 3rd str. Yamskogo polyaMoscow, Russia125124

Web site: www.drweb.comPhone: +7 (495) 789-45-87

Refer to the official web site for regional and international officeinformation.

This document is the property of Doctor Web. No part of this documentmay be reproduced, published or transmitted in any form or by anymeans for any purpose other than the purchaser's personal use withoutproper attribution.

TRADEMARKSDr.Web, the Dr.WEB logo, SpIDer Mail, SpIDer Guard, CureIt!, theDr.WEB INSIDE logo are trademarks and registered trademarks ofDoctor Web in Russia and/or other countries. Other trademarks,registered trademarks and company names used in this document areproperty of their respective owners.

DISCLAIMERIn no event shall Doctor Web and its resellers or distributors be liable forerrors or omissions, or any loss of profit or any other damage caused oralleged to be caused directly or indirectly by this document, the use of orinability to use information contained in this document.

Doctor Web

We thank all our customers for their support anddevotion to the Dr.Web products!

Doctor Web develops and distributes Dr.Web® informationsecurity solutions which provide efficient protection from

malicious software and spam.

Doctor Web customers can be found among home users from allover the world and in government enterprises, small companies

and nationwide corporations.

Dr.Web antivirus solutions are well known since 1992 forcontinuing excellence in malware detection and compliance

with international information security standards. State certificatesand awards received by the Dr.Web solutions, as well as the

globally widespread use of our products are the best evidence ofexceptional trust to the company products.

User Manual

4

Table of Contents

5Document Conventions

6Dr.Web® CureIt!®

7Dr.Web® CureIt!® Update

8Dr.Web Products

10Anti-virus Scans

12Actions Upon Virus Detection

15Scan Tab

16Statistics Tab

17Detection Methods

19Scanner Settings

19Scan Tab

21File Types Tab

22Actions Tab

24Advanced Cure Settings

25Log File Tab

26General Tab

28Command Line Parameters

28Scanner Command Line Switches

User Manual

5Document Conventions

Document Conventions

This guide utilizes the following content conventions and signs (seeTable 1).

Table 1. Document Conventions and Signs

Convention Description

Bold Names of buttons and other elements of the graphicaluser interface (GUI), and required user input that mustbe entered exactly as given in the guide.

Green and bold Names of Doctor Web products and components.

Green andunderlined

Hyperlinks to topics and web pages.

Monospace Code examples, input to the command line andapplication output.

Italic Placeholders which represent information that must besupplied by the user. For command-line input, itindicates parameter values.

In addition, it may indicate a term in position of adefinition.

CAPITAL LETTERS Names of keys and key sequences.

Plus sign ('+') Indicates a combination of keys. For example, ALT+F1means to hold down the ALT key while pressing the F1key.

Exclamation mark A warning about potential errors or any other importantcomment.

User Manual

6Dr.Web® CureIt!®

Dr.Web® CureIt!®

Dr.Web® CureIt!® is an anti-virus scanner based on the standardDr.Web Scanner for Windows. Although Dr.Web CureIt! haslimited performance capabilities in comparison with Dr.Web anti-virusfor Windows (no resident monitor, no command line scanner, noupdating utility etc.), it is nevertheless able to effectively scan thesystem and perform necessary actions for detected threats.

You can use Dr.Web CureIt! free of charge to scan your personalcomputer. For any commercial use of Dr.Web CureIt!, however, alicense is required. For details on licensing and purchasing the product,visit the Dr.Web CureIt! official website.

Dr.Web CureIt! detects and neutralizes the following types ofmalicious programs:

· Worms

· Viruses

· Trojans

· Rootkits

· Spyware

· Dialers

· Adware

· Hacktools

· Jokes

· Riskware

Dr.Web CureIt! is the ideal solution for situations when installation ofan anti-virus is impossible due to virus activity or some other reason,because it does not require installation, operates under Microsoft®Windows® and Microsoft® Windows Server® operating systems (fromMicrosoft Windows 95 and to Microsoft Windows 7) and is constantlysupplemented with the latest virus databases to ensure its effectivenessagainst all virus threats and other malicious programs. Also, itautomatically defines the language used by your OS.

User Manual

7Dr.Web® CureIt!®

If your language is not supported, then Dr.Web CureIt! will useEnglish by default.

Dr.Web® CureIt!® Update

Dr.Web CureIt! does not include an updating module, therefore itremains fully efficient only until the next database update (which occursapproximately every hour). After that, to ensure the ultimate anti-virusoperation efficiency, the latest version of Dr.Web CureIt! should bedownloaded again.

The latest Dr.Web CureIt! version is always available for downloadfrom the Dr.Web CureIt! official Web site. Once you download theprogram, it acts as a very effective scanner with the latest databasesand the most advanced virus detection engine.

To download latest Dr.Web CureIt!

1. Start Dr.Web CureIt!.

2. In the first window, click Update.

This opens the Dr.Web CureIt! official website with thedefault Internet browser, where you can download the latestversion of the Dr.Web CureIt!.

User Manual

8Dr.Web® CureIt!®

Figure 1. First window

Dr.Web Products

You can download the latest version of the full Dr.Web Anti-virus forWindows using Dr.Web CureIt!. Demo licenses allow you to use theanti-virus for one month free of charge.

User Manual

9Dr.Web® CureIt!®

Figure 2. Last window

On the Doctor Web official Web sites you can also read the historyof Dr.Web CureIt! development and learn about other Dr.Web solutionsfor continuous protection of your computers.

User Manual

10Anti-virus Scans

Anti-virus Scans

When using Windows Vista or later operating systems, it isrecommended to run the Dr.Web Scanner under an account withadministrator rights to ensure utmost scan efficiency, otherwise filesand folders to which unprivileged users have no access (includingsystem folders) are not scanned.

The license agreement of Dr.Web anti-virus for Windows alsoallows you to checks e-mail messages. The Dr.Web CureIt! licenseagreement does not allow e-mail checks.

As soon as Dr.Web CureIt! starts with default settings, it scans RAMand Windows startup objects for viruses. Other objects of the filesystem are scanned on your demand using Dr.Web Scanner.

Dr.Web Scanner performs anti-virus scanning of files, archives of allcommon types (Zip, Arj, Lha, Rar etc), and file containers (PowerPoint,RTF etc). The scanning is performed using all virus detection methods.At scanning executable files processed with special compression utilitiesare unpacked. When an object infected with a known virus is detected,Dr.Web Scanner attempts to cure it. If curing fails, the infectedobject will be moved to the quarantine. Suspicious files are displayed inthe special report field in the bottom part of the main window.

To start anti-virus scan

1. Start Dr.Web CureIt!.

2. In the first window, click Start. This starts Dr.Web Scanner.

3. Be default, Dr.Web Scanner performs express scan. Tomanage scanning process, use the following options:

· To scan the objects selected, click Start in the right partof the pane

· To suspend scanning, click Pause . To continue with the

check, click Start again

· To terminate scanning, click Stop

User Manual

11Anti-virus Scans

· Нot keys

4. If necessary, stop the quick scan and on the Scan tab of themain Dr.Web Scanner window, select one of the followingscanning modes:

· Express scan

· Complete scan

· Custom scan

5. Scan results display in the bottom pane of the tab and on theStatistics tab.

Scan Modes

Express Scan

In this mode the following objects are scanned:

· Random access memory

· Boot sectors of all disks

· Startup objects

· Boot disk root folder

· Disk root storing the Windows installation folder

· Windows system folder

· User documents folder ("My documents")

· System temporary files

· User temporary files

Complete Scan

In this mode all hard drives and removable media (including bootsectors of all disks) are scanned.

Custom Scan

This mode allows you to select folders and files to be scanned.

When this mode is selected, the file system tree appears in the centerof the Scan pane. If necessary, you can expand the tree objects downto the level of any folder or file included.

User Manual

12Anti-virus Scans

Select objects to be scanned in the file system tree. Boot sectors of alldisks will be checked along with the selected objects.

The picture below illustrates a case when in the Custom mode the Clogical disk and a folder on the D logical disk are selected for scanning(their icons are marked with red dots).

Figure 3. Scanner main window. Anti-virus check of a filesystem

Actions Upon Virus Detection

When an object infected with a known virus is detected, Dr.WebScanner attempts to cure it. If curing fails, the infected object will bemoved to the quarantine. Suspicious files are displayed in the specialreport field in the bottom part of the main window.

User Manual

13Anti-virus Scans

Figure 4. Scanner main window. Anti-virus check of a filesystem

The table of the report list includes the data on infected or suspiciousobjects detected during the scanning, and the actions made by theprogram. If these objects are detected in file containers, the table liststhese infected objects and the containers containing them.

The Object table column lists names of an infected file or a bootsector.

The Path table column contains the path to the infected object.

The Status table column lists the name of a virus (for files and bootsectors), or information on the infected archive.

The Action table column contains information on the actions made(curing, deletion, renaming, removing of an object).

User Manual

14Anti-virus Scans

If an infected or suspicious file used by another 32-bit Windowsapplication is found, the action specified by you cannot be appliedimmediately. The string "Will be cured after reboot" or "

Will be deleted after reboot", i.e. depending on the

action specified, will appear in the Action column of the Dr.WebScanner report field. The necessary action will actually be taken afterthe next reboot. That is why, if such objects are found, it isrecommended to reboot the system immediately after the scanning.

You can set the program to remove a detected virus threat listed in thereport by right clicking the line of the report list with the description ofthe infected object. To select objects in the report list the following keysand combinations of keys are additionally used:

· INSERT select an object and move the cursor to next position

· CTRL+A select all

· the * button on the numeric keyboard invert selection

To perform an action, right-click an object and select the action toperform or select an object and click the corresponding button belowthe report field:

· To restore the state of the object before infection, select or clickCure. (This action is available for known viruses only and is notalways avaliable.)

· To delete the infected object, select or click Delete.

· To change the extension of a filename specified by programssettings, select or click Rename.

· To move an infected file to a special directory (quarantine),select or click Move. The path to quarantine is specified by theprograms settings.

If the Cure option is selected, additional context menu will open. Selectthe necessary action of the program, if the curing fails.

User Manual

15Anti-virus Scans

For archives, the only action available is Delete. Note, that when Dr.Web Scanner detects a malicious object within an archive(container), it performs the action you select for the whole archive(container). By default, when the Delete action is selected, Dr.WebScanner displays a warning message that data might be lost.

For boot sectors, the only action available is Cure.

Different windows, settings and actions can also be accessed with hotkeys.

Scan Tab

In this window, you can select a scanning mode (in the Scan tab) andsee the results of the operation of the Dr.Web Scanner (in theStatistics tab).

User Manual

16Anti-virus Scans

Figure 5. Scanner main window. Scan pane

Depending on the selected mode, either a list of objects to scan or a filesystem tree is displayed in the center of the window.

At the bottom of the window there is a table where information oninfected and suspicious objects and program's actions is displayed.

Different windows, settings and actions can also be accessed with hotkeys.

Statistics Tab

The statistics pane shows the total information on Dr.Web Scanneroperations, which include the total number of objects scanned, thenumber of objects infected with known viruses or modifications ofknown viruses, the number of suspicious objects, and also the actionscarried out by the program over infected or suspicious objects.

User Manual

17Anti-virus Scans

Figure 6. Scanner main window. Statistics pane

You can also receive statistics for any logical disk of the computer. Todisplay the statistics, select a disk in the drop-down list on top of thepane.

To clear the report list, click Clear.

Different windows, settings and actions can also be accessed with hotkeys.

Detection Methods

The Dr.Web anti-virus solutions use several malicious softwaredetection methods simultaneously, and that allows them to performthorough checks on suspicious files and control software behaviour:

1. The scans begin with signature analysis, which is performedby comparison of file code segments to the known virussignatures. A signature is a finite continuous sequence of bytes

User Manual

18Anti-virus Scans

which is necessary and sufficient to identify a specific virus. Toreduce the size of the signature dictionary, the Dr.Web anti-virus solutions use signature checksums instead of usingcomplete signature sequences. Checksums uniquely identifysignatures which preserves correctness of virus detection andneutralization. The Dr.Web virus databases are composedso that some entries can be used to detect not just specificviruses, but whole classes of threats.

2. On completion of signature analysis, the Dr.Web anti-virussolutions use the unique Origins Tracing™ method todetect new and modified viruses which use the known infectionmechanisms. Thus the Dr.Web users are protected againstsuch viruses as notorious blackmailer Trojan.Encoder.18 (alsoknown as gpcode). In addition to detection of new andmodified viruses, the Origins Tracing mechanism allowed toconsiderably reduce the number of false triggering of the Dr.Web heuristics analyser.

3. The detection method used by the heuristics analyser is basedon certain knowledge about attributes that characterizemalicious code. Each attribute or characteristic has weightcoefficient which determines the level of its severity andreliability. Depending on the sum weight of a file, the heuristicsanalyzer calculates the probability of unknown virus infection.As any system of hypothesis testing under uncertainty, theheuristics analyser may commit type I or type II errors (omitviruses or raise false alarms).

While performing any of the abovementioned checks, the Dr.Webanti-virus solutions use the most recent information about knownmalicious software. As soon as experts of Doctor Web VirusLaboratory discover new threats, the update for virus signatures,behaviour characteristics and attributes is issued. In some casesupdates can be issued several times per hour. Therefore even if a brandnew virus passes through the Dr.Web resident guards andpenetrates the system, then after update the virus is detected in the listof processes and neutralized.

User Manual

19Scanner Settings

Scanner Settings

The program default settings are optimal for most cases. Do not needlesslymodify these settings.

To change the settings of the program

1. In the program main menu, select Options, then selectChange settings. The settings window with several panes willopen.

2. Modify options and, if necessary, click Apply.

3. After editing settings, click OK to save the changes made, orclick Cancel to close the window without saving the changes.

4. To get information on the settings, click Help.

Changes in the settings of Dr.Web Scanner within Dr.Web CureIt!are retained only in the current program session. New session resetsprogram settings to default values.

Scan Tab

In the tab you can select files and folders to be excluded fromscanning.

User Manual

20Scanner Settings

Figure 7. Settings. Scan pane

Location of excluded folders

Here you can create a list of folders (for example, the Quarantinefolder, program files folders) excluded from scanning.

To create a list of excluded folders

· Enter a path to the folder you do not want to be scanned. You

can also click Browse and select the necessary object.

· Click Add. The folder will be added to the list.

· To remove a folder from the list, select it and click Remove.

Excluded files

Here you can create a list of files (file masks) to be excluded fromscanning. If a mask is specified, all files the names of which match themask will be excluded from scanning (this option is appropriate fortemporary files, swap files, etc).

User Manual

21Scanner Settings

To create a list of excluded files

· Enter a file name or a mask to be excluded from scanning. You

can also click Browse and select a file. The * and ? symbolscan be used instead of a part of a file name. The * symbol isused instead of any symbol combination; the ? symbol is usedinstead of only one (any) symbol.

· Click Add. The file mask will be added to the list.

· To remove an object from the list, select it and click Remove.

In case you want to exclude a definite file from scanning, add the path to

this file (you can use Browse ) and its name (specify the file namemanually) to the list of Excluded folders.

In this pane you can also enable or disable the heuristic analyzer,which helps to detect suspicious objects that can be infected withunknown viruses. By default, this option is enabled. It is notrecommended to disable the option.

File Types Tab

In this tab you can configure additional restrictions for the files to bescanned according to the scan mode, and determine if archives andmail are included in the scanning.

User Manual

22Scanner Settings

Figure 8. Settings. File types pane

The files are selected for scanning in the Scan mode radio buttonsarea.

The All files option provides for maximum protection. This option isselected by default.

The Selected types and the User masks options instruct to checkonly those files, the extensions or names of which fall within the listspecified in the right part of the pane. By default, the list includes theextensions of main file types, which can be virus carriers, and of themain types of file archives. The list can be edited.

Scanning of emails is not allowed by Dr.Web CureIt! licenseagreement. Use Dr.Web anti-virus for Windows to check emails.

Actions Tab

In this tab you can set program reactions on detection of infected orsuspicious files, malicious programs and infected archives.

User Manual

23Scanner Settings

For different types of infected objects, actions are assigned separatelyfrom respective drop-down lists:

· Objects infected with known and (supposedly) curable viruses

· Objects infected with incurable viruses

· Supposedly infected (suspicious) objects

Reaction on detection of malicious software and infected packages(archives,email, containers) is also set separately.

Figure 9. Settings. Actions pane

By default, Dr.Web Scanner just informs the user when there is asuspicion an object is infected with a virus. The data for all infected orsuspicious objects are displayed in the report list, in which you canmanually specify the necessary program’s action. If an object infectedwith a known virus is detected, Dr.Web Scanner by default attemptsto cure it. If curing fails, the action specified for incurable objects willbe applied (by default it will be moved).

Apart from reporting, there are other actions available:

· Cure (available for Infected objects only) instructs the Dr.Web Scanner to try to cure objects infected with a knownvirus. If the virus is incurable, or the attempt of curing failed,

User Manual

24Scanner Settings

the action set for incurable viruses will be applied.

· Delete instructs the Dr.Web Scanner to delete infected orsuspicious files (no action will be taken to boot sectors).

· Rename – instructs the Dr.Web Scanner to rename theextension of an infected or suspicious file according to the maskspecified in the Rename extension field (by default, it isrenamed to #??, i.e. the first symbol in the extension is replacedwith #).

· Move to instructs the Dr.Web Scanner to move infected orsuspicious files to the quarantine folder specified in the Movepath field (by default it is the Quarantine subdirectory, which onWindows 9x/Me is located in С:\DoctorWeb\, and for laterversions of the Windows operating system — in %USERPROFILE%\DoctorWeb\).

· Ignore (enabled for malicious programs only) instructs theDr.Web Scanner not to display information in the reportwindow.

Advanced Cure Settings

To cure some infected files, a system reboot is required. In this windowyou can adjust additional reboot settings.

Figure 10. Advanced Settings

If you select the Restart automatically, if necessary option buttonthen the Dr.Web CureIt! will reboot Windows automatically, withoutprompting the user.

User Manual

25Scanner Settings

During a system reboot all unsaved data will be lost. It isrecommended to close all running applications before attempting tocure if the Restart automatically, if necessary option button isselected.

By default, the Do not restart automatically option button and thePrompt restart, when necessary checkbox are selected. In thiscase the Dr.Web Scanner prompts the user for a reboot whenever itis necessary.

If you clear the Prompt restart, when necessary checkbox, thenthe Dr.Web CureIt! will not be able to reboot Windows. In this case itmay become impossible to correctly cure some of the infected files.

Log File Tab

In this tab you can configure logging options.

User Manual

26Scanner Settings

Figure 11. Settings. Log file pane

By default, the Log to file check box is selected.

By default, the CureIt.log log file is located in C:\DoctorWeb\ (Windows9x/Me) or %USERPROFILE%\DoctorWeb\ (for later versions of theWindows operating system).

You can specify the name and the location of the log file, text encoding,the log mode (to add new entries to the end of the log file or tooverwrite the file in the beginning of each session), and the level ofdetail of the log. You can also specify whether the size of the log fileshould be limited or not, and specify the maximum size.

General Tab

In this tab you can configure interaction between Dr.Web CureIt! andthe operating system and set program sound alerts for different events.

User Manual

27Scanner Settings

Figure 12. Settings. General pane

The Autosave settings box is not available in Dr.Web CureIt!.

The Check the battery state checkbox when enabled instructs tocheck before scanning is active whether your computer runs on battery.This option is available on portable computers only.

The Scan priority slider allows to modify the priority of the scanprocess in a system.

Sound alerts on virus events are not allowed by the Dr.Web CureIt!license agreement and are only available when using Dr.Web anti-virus for Windows.

User Manual

28Command Line Parameters

Command Line Parameters

You can run Dr.Web CureIt! with additional parameters. Objects to bescanned and command line switches can be specified as command lineparameters. Command line switches are used to define additionalparameters when launching a program.

Syntax:

[path][CureIt!-filename] -sp"[switches][scan_objects_list]"

If you need to place a blank space within the list of command lineparameters, you have to include the whole list in quotes and double thequotation marks within the list. For example:

636frs47.exe -sp/tm-

45hlke49.exe -sp"/tm- /ts- d:\test\"

10sfr56g.exe -sp"/OK- ""d:\Program Files\"""

Command line switches start with the forward slash mark ("/") and areseparated by blanks.

The list of objects to be scanned can be left empty or contain severalpaths separated by blanks. If no path to the objects is specified, Dr.Web Scanner searches for the objects in the Dr.Web CureIt!directory.

Below are a few most commonly used ways of specifying path toobjects which should be scanned:

· * - scan all files on all disks

· C: - scan all files on disk C

· D:\Games - scan all files in the specified folder

· C:\games\* – scan all files and subfolders in the specified folder

Scanner Command Line Switches

/@<file_name> or /@+<file_name> instructs to scan objects listed

User Manual

29Command Line Parameters

in the specified file. Each object is specified in a separate line of the list-file. It can be either a full path with the file name or the ?boot stringwhich means that scanning of boot sectors should be performed. Thefile names with mask and directory names should be specified there.The list-file can be prepared manually in any text editor; this can alsobe done automatically via applications using the Dr.Web Scanner tocheck certain files. After the scanning is completed, the Dr.WebScanner deletes the list-file, if used without the '+' character.

/AL to scan all files in the given device, or in the given folder,regardless the extensions or the internal format.

/CN – to set action for containers (HTML, RTF, PowerPoint) withinfected or suspicious objects. As specified (/CN) the switch instructsto report such containers to a user. If D, M or R modifiers are added tothe switch, a different action is applied: /CND – delete; /CNM – move(by default, to the Quarantine directory in the C:\DoctorWeb\ directoryfor Windows 9x/Me, or the %USERPROFILE%\DoctorWeb\ directory forlater versions of the Windows operating system); /CNR  rename (bydefault, the first symbol of extension is replaced by the '#' character).The switch may end with the N modifier, and in such case a messagewith the container type will not be printed.

/CU – actions with infected files and boot sectors of drives. The curableobjects are cured and the incurable files are deleted without additionalD, M or R modifiers (if different action is not specified by the /ICswitch). Other actions taken towards infected files: /CUD – delete; /CUM – move (by default, to the infected.!!! folder); /CUR – rename(by default, the first symbol of extension is replaced by the '#'character).

/EX to scan files with the default extensions: EXE, COM, DLL, SYS,VXD, OV?, BAT, BIN, DRV, PRG, BOO, SCR, CMD, 386, FON, DO?, XL?,WIZ, RTF, CL*, HT*, VB*, JS*, INF, PP?, OBJ, LIB, PIF, AR?, ZIP, R??,GZ, Z, TGZ, TAR, TAZ, CAB, HLP, MD?, INI, MBR, IMG, CSC, CPL, MBP,SH, SHB, SHS, SHT*, MSG, CHM, XML, PRC, ASP, LSP, MSO, OBD,THE*, EML, NWS, SWF, MPP, TBB.

User Manual

30Command Line Parameters

If an element of the list of scanned objects contains the explicit fileextension, and it is used with the '*' and '?' special characters, all filesspecified in this element of the list will be scanned and not only thosematching this list of extensions.

/FAST perform an express scan of the system (for more informationon the express scan mode see Anti-Virus Scans).

/FULL perform a full scan of all hard drives and removable datacarriers (including boot sectors).

/GO batch mode of the program. All questions implying answers froma user are skipped; solutions implying a choice are taken automatically.This mode is useful for automatic scanning of files, for example, duringa daily or weekly check of the hard disk.

/HA to perform heuristic scanning of files and search for unknownviruses in them.

/ICR, /ICD or /ICM – actions with infected files which cannot becured: /ICR – rename; /ICD delete; /ICM – move.

/MW – actions with all types of unsolicited programs. As it is specified(/MW) the switch instructs to inform a user. If the switch issupplemented with the D, M, R or I modifier, other actions are taken:/MWD – delete; /MWM – move (by default, to the Quarantinedirectory in the C:\DoctorWeb\ directory for Windows 9x/Me, or the %USERPROFILE%\DoctorWeb\ directory for later versions of theWindows operating system); /MWR – rename (by default, the firstsymbol of extension is replaced by the '#' character); /MWI – ignore.Actions with certain types of unsolicited programs are specified by the /ADW, /DLS, /JOK, /RSK, /HCK switches.

/NR do not create a log file.

/NS disable interrupting of computer scanning. With this switchspecified, a user will not be able to interrupt scanning by pressing ESC.

/OK display full list of scanned objects and mark the uninfected oneswith Ok.

User Manual

31Command Line Parameters

/PF prompt on, if multiple floppies are scanned.

/PR prompt for confirmation before action.

/QU the Dr.Web Scanner checks the objects specified in thecommand line (files, disks, folders) and then automatically terminates.

/RP<file_name> or /RP+<file_name> log to a file the name ofwhich is specified in the switch. If no name is specified, log to a defaultfile. If the '+' character is present, the file is appended. If there is nocharacter, a new one is created.

/SCP:<n> sets the priority of the scanning process, where <n> is anumber ranging from 1 to 50.

/SD scan subfolders.

/SPR, /SPD or /SPM – actions with suspicious files: /SPR – rename; /SPD – delete; /SPM – move.

/TB scan boot sectors and master boot records (MBR) of the harddrive.

/TM search for viruses in main memory (including Windows systemarea). Available for Dr.Web Scanners for Windows only.

/TS search for viruses in autorun files (in Autorun directory, systemINI-files, Windows registry). Used only in Dr.Web Scanners forWindows.

/UPN disable the output of the names of the programs used forpacking, conversion or vaccination of the scanned executable files tothe log file by the Dr.Web Scanner.

"Negative" Forms

Certain switches allow the '-' character to be used at the end. In such"negative" form the switch means cancellation of the mode. Suchoption can be useful if a certain mode is enabled by default. Here is thelist of the command line switches allowing the "negative" form:

User Manual

32Command Line Parameters

/ADW /CU /DLS /HCK /JOK /HA /IC /MW /OK /PF /PR /RSK /SD /SP /TB /TM /TS /UP

For the /CU, /IC and /SP switches the "negative" form cancels anyactions specified in the description of these switches. This means thatinfected and suspicious objects will be reported but no actions will beapplied.

For the /RP switch, the "negative" form is written as /NR.

For the /AL and /EX switches, the "negative" form is not allowed.However, specifying one of them cancels the other.

If several alternative parameters are found in the command line, thelast of them takes effect.

© 2003-2009 Doctor Web