Threat Search Components

Component

Description

GNU/Linux File System Monitor.

Operates in background mode and controls file operations (such as creation, opening, closing, running) in GNU/Linux file systems. It sends the Dr.Web File Checker component requests to scan new or modified files as well as executables of programs when they are run.

Operates with a file system using the fanotify system mechanism. The monitor can operate in enhanced or “paranoid” mode, blocking access to the files that have not been scanned yet until the scan is complete. By default, a regular monitoring mode is enabled.

The component is supplied only with the distributions designed for GNU/Linux OSes.


Executable file: drweb-spider.

Logged internal name: LinuxSpider

Samba shared directory monitor.

Operates in a background mode and monitors file system operations (such as creating, opening, closing, read and write operations) in directories selected as the Samba SMB server file storage. Sends requests for scanning of new and modified files to the Dr.Web File Checker component.

For integration with the file server uses VFS SMB modules that operate on the Samba server side


Executable file: drweb-smbspider-daemon.

Logged internal name: SMBSpider