A non-signature anti-virus offering preventive protection against the latest active threats, targeted attacks, and infiltration attempts that take advantage of vulnerabilities (including zero-day ones) your anti-virus can’t detect

Protects critical system areas from being modified by malware.
Detects and stops the execution of malicious, suspicious or unreliable scripts and processes.
Detects unwanted file modification, monitors the operation of all processes to detect actions that are typical of malware (e.g., the activities of encryption ransomware), and prevents malicious objects from injecting their code into other processes.
Detects and neutralises threats that have not yet been discovered and entered in the Dr.Web virus database: encryption ransomware, injectors, remote-controlled malware used for espionage and to create botnets, and malware packers.
Protects against exploits—malicious objects that take advantage of software flaws, including those not yet known to anyone except for the intruders who created them (i.e., zero-day vulnerabilities). If it detects that malicious code is attempting to exploit a vulnerability, Dr.Web KATANA will end the attacked process immediately.
Blocks malware’s ability to modify boot disk areas in order to prevent the launch of Trojan horses, for example, on your computer.
Blocks changes from being made to the Windows Registry to ensure that the safe mode won't be disabled.
Prevents malicious programs from altering basic system routines. By blocking certain Windows Registry keys, it prevents malware from changing the appearance of the desktop or hiding a Trojan with a rootkit.
Prevents malware from changing launch permissions.
Prevents new or unknown drivers from being downloaded without user consent.
Prevents malware and certain other applications, such as anti-antiviruses, from adding their entries into the Windows Registry where they could be launched automatically.
Locks registry sections containing information about virtual device drivers, ensuring that no new virtual devices are created.
Blocks connections between spyware components and the server that controls them.
Prevents malware from disrupting system routines such as scheduled backups.

When is it necessary to run two anti-virus applications concurrently—a conventional anti-virus and a non-signature anti-virus?

When your anti-virus fails to detect threats.
When your anti-virus cannot be updated frequently enough.
When your PC has been disconnected from the Internet for quite some time.
When your PC is connected to a network that has no Internet access and is rarely supplied with updates.

All-seeing  

neutralises threats that are completely new and not yet known to your anti-virus. Every day the Doctor Web anti-virus laboratory receives several hundred thousand program samples. Every day tens of thousands of entries are added into the company’s virus databases. These are the threats with which virus analysts are already familiar and for which neutralisation routines have been designed. However, programs that have not yet been analysed by information security experts are the ones that benefit cybercriminals the most.
Dr.Web KATANA offers protection against the latest malicious programs that have been designed to bypass detection by traditional signature-based scanning and heuristic mechanisms. These programs have not yet been analysed by the anti-virus laboratory and, therefore, are unknown to Dr.Web at the moment of intrusion. They include the latest encryption ransomware programs, Trojan injectors, and Trojan blockers, as well as threats that use zero-day vulnerabilities.

Invisible

The functionality of anti-virus software must constantly be enhanced to keep pace with ever-evolving and ever-increasing numbers of malware programs. An antivirus must be able to operate without interruption in anticipation of an imminent attack. Such enhancements often decrease computer performance and irritate users to the point that they sometimes prefer to disable their anti-virus protection in order to allow their computers to work faster. Dr.Web KATANA’s developers have significantly enhanced computer security to create a new product that is practically invisible in terms of system load and system resources.

Lightning-like  

analyses the behaviour of each threat in real time and immediately neutralises harmful scripts and processes that your anti-virus didn’t manage to recognise.
Dr.Web KATANA’s protection is based on non-signature-based search methods, the neutralization of malware, and cloud protection technologies. The product analyses and monitors all system processes and blocks those that exhibit malicious behaviour.

Settings

The Optimal mode is enabled by default. This mode provides protection for only those registry branches that are used by malicious software and can be blocked (modification can be prohibited) — without a significant load on system resources.
If the threat of infection increases, the protection level can be raised to Medium.
For full control over critical Windows areas, the protection level can be increased to Paranoid.

Non-signature-based preventive protection

Traditional antivirus systems rely on signature detection, but Dr.Web KATANA uses behavior analysis, cloud-based threat detection, and predefined rules to move beyond such methods.
This allows it to effectively detect and block new types of threats that are not yet included in known databases—especially ransomware, trojans, and zero-day vulnerabilities.
It becomes active during system boot-up, engaging before signature-based antivirus software loads.
It works in parallel with other antivirus programs without conflict, providing a strong defense without additional system load.

Behavior analysis and cloud advantage

Every running application is monitored in real time for behavioral patterns. Any suspicious or unauthorized activity is immediately stopped.
The analysis process is carried out by comparing local system behavior with the Dr.Web cloud reputation database.
Cloud support ensures the most up-to-date threat information is delivered instantly.
Even when the computer is offline, local mechanisms remain active.
It consumes minimal system resources and runs almost invisibly.

Low system resource usage

Dr.Web KATANA has minimal impact on system performance.
CPU and memory usage are optimized, so it runs in the background without burdening the user.
Even when running alongside other antivirus programs, it does not cause system slowdown.
Despite real-time behavior analysis, it operates with high efficiency.
This ensures uninterrupted performance during resource-intensive tasks like gaming or video editing.

Protection during system boot

KATANA activates immediately when the system starts—before the signature-based antivirus is even loaded.
This early-stage scanning plays a critical role in blocking boot-specific threats like bootkits and rootkits.
Thus, malware is neutralized before it has a chance to infect the system.
While traditional antivirus software typically activates after the OS loads, KATANA responds much faster.
Result: fast-spreading malware chains are halted before they begin.

Customizable protection profiles

Includes predefined modes like “Optimal,” “Medium,” and “Paranoid.”
Allows users to choose a protection level based on system resource availability.
The Paranoid mode offers maximum security by taking full control of critical Windows areas.
This profile-based system adds flexibility to handle potential software incompatibilities.
As the protection level increases, security tightens, though users may see more alerts about potential conflicts.

BASIC FEATURES

Dr.Web KATANA is a lightweight, non-signature antivirus that runs alongside traditional AVs. It offers advanced preventive protection using real-time behavioral analysis, cloud reputation services, and heuristic detection to block zero-day threats, ransomware, exploit-based attacks, malicious scripts, and unauthorized system modifications—even before Windows boots up.

WHAT'S NEW

The latest 2.0 release (April 7, 2025) brings enhanced behavior-analysis algorithms, improved cloud-based threat detection, optimized compatibility with Windows 11, lower CPU and memory usage, and a refreshed user interface for better usability.

SYSTEM REQUIREMENTS

Windows 11, 10, 8.1, 8, 7, Vista SP2, or XP SP2+ (32- or 64-bit); minimum 100 MB RAM (plus OS requirements); approximately 150 MB of free disk space (installation may require additional temporary space); internet connection needed for updates.

USER INTERFACES LANGUAGES

English, Russian, French, German, Japanese, Korean, Chinese (Simplified), Ukrainian.

BRAND

Dr.Web 

TYPE

Non-signature, preventive antivirus tool

FOR OPERATING SYSTEM

Designed for Windows desktops and laptops, KATANA complements traditional signature-based antivirus software—operating boot-up and kernel-level behavioral monitoring to catch active threats 

LICENSE CATEGORY

Subscription-based software

FORMAT

Digital Download

MODEL

Dr.Web KATANA 2025

COUNTRY OF USE

Global

MANUFACTURER COUNTRY

Russia