Program Structure

Dr.Web for Linux consists of the following components:




Scans file system objects (files, directories, and boot records) for threats. Scanning can be started at user request or as scheduled.

The user can start scanning from both graphics and command-line modes.

SpIDer Guard
file system monitor

Operates in resident mode and controls file system operations (such as creation, opening, and closing a file). Sends Scanner requests to check contents of new or modified files and contents of executables when they are attempted to run.

SpIDer Gate
Internet access monitor

Component operating in resident mode and controlling all attempts to access web resources. Checks whether requested URLs are in the used black lists and, if so, blocks access to the corresponding resources. Sends Scanner requests to scan files downloaded from the Internet (from allowed web servers).

Moreover, when authorized by the user, it transmits URLs entered by the user to the Dr.Web Cloud service to verify them against the list of unwanted and malicious sites.

Anti-virus engine

Central component of anti-virus protection used by Scanner for searching and detecting of threats as well as for analysis of suspicious object behavior.

Virus databases

Automatically updated database used by the anti-virus engine and containing information for detection and neutralization of known threats.


Downloads updates to the virus databases and anti-virus engine from Doctor Web update servers automatically, according to the schedule or at user request.

License manager

Helps users manage their licenses and do the following: activate a license and demo period, view information on the current license, renew the license, as well as install or remove a license key file.

Apart from the components described in the table, Dr.Web for Linux includes service components that operate in background mode and do not require user intervention.

SpIDer Guard, the file system monitor, can operate in one of the following modes:

FANOTIFY - using the fanotify monitoring interface (not all GNU/Linux-based OS support fanotify)

LKM - using the loadable Linux kernel module (compatible with any GNU/Linux-based OS with kernel 2.6.x and newer)

By default, the file system monitor automatically chooses the appropriate operation mode according to the environment. If SpIDer Guard cannot be started, build and install a loadable kernel module by using the supplied source codes.