Dr.Web Anti-virus is a malware scanner and real-time file monitor for a Windows computer. Its SpIDer Guard component watches files and process behavior as the system uses them, while the on-demand scanner checks selected files, folders, memory areas, startup objects, or entire disks. Dr.Web Anti-virus can cure certain infected files, isolate an object, or delete it according to the chosen action. It does not repair every change malware has already made or make an unsafe file harmless merely because a scan started.
Guard modes differ
SpIDer Guard stays in memory and reacts when files launch, appear, or change. Optimal mode concentrates on launched, created, and modified files. Paranoid mode also scans files as they open across hard disks, removable media, and network disks.
The broader mode performs more work and can make file-heavy tasks feel slower. Use it for a specific investigation rather than assuming the strictest setting always belongs in ordinary operation. Disabling the guard removes real-time checking until it starts again, so an on-demand scan is not a permanent substitute.
Scans choose scope
The scanner has express, full, and custom paths. Express scan focuses on critical system areas. Full scan examines a wider set of objects, and custom scan lets the user select disks or folders. A file or folder can also start a direct scan through its Windows context menu.
A full disk scan can take substantial time and storage activity. Schedule it for a period when the machine can remain powered, and avoid interrupting it merely because progress pauses on a large archive. The current file name and processed-object count give more context than the percentage alone.
Cure has limits
Cure attempts to remove known viral code while preserving the host file. Dr.Web Anti-virus can use that action only for known, curable file infections. Trojans, suspicious objects, and many compromised containers do not have a clean original body that the engine can reconstruct.
When Cure is unavailable, the remaining choices carry different consequences. Remove permanently deletes the selected object. Move to quarantine preserves it in an isolated form. Ignore leaves it in place and belongs only to a confirmed false detection, not to an unfamiliar warning.
Containers act as one
An archive, installer, or email database can contain an infected member. Dr.Web Anti-virus can inspect content inside these containers, but its action cannot always target one inner file. The documented behavior applies the action to the entire archive, installer, or email object.
Deleting a whole container may remove legitimate files beside the detected member. Quarantine it first when the surrounding material matters, then obtain a clean copy or extract only known-safe content through an isolated process. Do not restore the unchanged container simply to recover one document.
Quarantine changes access
Quarantine moves suspicious or infected files into a protected folder and removes their ordinary extension. This stops the original path from launching the object and keeps a copy available for review. The Quarantine Manager later lists actions for isolated items.
Restoring returns risk as well as data. Confirm a false detection through an updated rescan or publisher verification before restoring anything. If an application stops working after isolation, reinstalling it from a trusted source is safer than returning an executable that the engine still identifies as malicious.
Exclusions create gaps
SpIDer Guard and the on-demand scanner maintain separate exclusion controls. An excluded path or file bypasses the relevant scan. This can resolve a verified compatibility conflict, but it also creates a place where malicious content receives less inspection.
Exclude the narrowest confirmed object rather than an entire downloads folder or user profile. Record why the exclusion exists and remove it after the conflict ends. Dr.Web Anti-virus cannot protect content that its configuration explicitly tells it to skip.
Definitions change results
A file can enter the machine before the database knows its signature and become detectable after a later update. Real-time monitoring checks activity as it happens, while a scheduled scan revisits stored material with newer recognition data. These jobs complement each other.
Let database updates complete before investigating a doubtful result. If an earlier scan found nothing but symptoms continue, run a focused or full scan after the update. A clean result still does not explain hardware failure, corrupted Windows files, or a network problem that has no malware cause.
