Copyright: Iparmor V5 Help © www.Luosoft.com   Thursday, October 18, 2001 15:32:42:00                    Help File © 2001 by Kieran O'Donnell


	Cover
	To navigate use any blue links or the header above


Topic 1
	Contents
	General
		System Requirements
		Hints and Tips
		Introduction
		Trojan Virus Worm or Hoax ?
	Using Iparmor
		Select icon or topic below
		Opening screen / Scan memory
		Scan Local Drive(s)
		Options
		Update
		Refresh
		Select icon or topic below
		View System Processes
		View Network Status /  Ports
		View Start-up
		Sniffer
		View Log
		Select icon or topic below
		About / Contacts
		Registration


Topic 2
	System Requirements
	To successfully use Iparmor, you need: Pentium (or better) IBM ® compatible PC    Microsoft ® Windows 95, Windows 98, WindowsMe, Windows NT 4.0 or Windows 2000 Operating Systems Above 2 MB of free disk space   A mouse   A 256 (or more) color SVGA card & monitor


Topic 3
	Introduction
	Why do I need Iparmor? A Trojan program (Just like the ancient wooden horse from Troy) is a means of getting inside your computers defences. Often this program hides in a "gift" program sent by a friend or downloaded by yourself. Once installed the Trojan acts either as a "Stealth Spy Server" sending information back to its base or as a means for others to snoop or drive (possibly damage) your computer. Often the client is just used to harvest your account details, which could include passwords and other private information. The information is sent amongst your IP (internet protocol) packets when you connect to the internet. To shield you, Iparmor will "de-sTROY" any suspect process in memory. In addition to memory scanning, you can file scan for known Trojans, monitor network ports and for the “Power User” kill active processes or remove registry start-up entries. BEWARE you could cause even more damage than a Trojan. In summary: - This is a powerful tool for your efficient Network Armoury.


Topic 4
	Trojan, Virus, Worm or Hoax?
	Which one? Trojan, Virus, Worm or Hoax! Summary from alt.comp.virus FAQ (1999) with added notes (2001) A TROJAN HORSE is a program intended to perform some covert and usually malicious act, which the victim did not expect or want. It differs from a destructive virus in that it doesn't reproduce; (though this distinction is by no means universally accepted). Some types of Trojan horses include Remote Access Trojans (RAT), KeyLoggers, Password-Stealers (PSW), and logic bombs - programs that execute destructive instructions when a certain condition is met. ADware & SPYware are also a form of Trojan (non reproducing executables) that send personal details back to base or a third party agency. A VIRUS is a block of executable code, which attaches to, overwrites or otherwise replaces another program in order to reproduce itself without the knowledge of the PC user.  Many viruses are “comparatively” harmless, and may be present for years with no noticeable effect: some, however, may cause random damage to data files (sometimes insidiously, over a long period) or attempt to destroy files and disks. Others cause unintended damage. Even benign viruses (apparently non-destructive viruses) cause significant damage by occupying disk space and/or main memory, by using up CPU processing time and by the time and expense wasted in detecting and removing them.  A WORM is a program, which spreads (usually), over network connections. Unlike a virus, it does not attach itself to a host program. The latest Worm “Code Red” exists in memory only, the only data file it looks for on the server is used as a disinfectant. It spreads through TCP/IP transmissions on port 80 looking for the existence of C:\notworm. If the file C:\notworm is present the worm stops seeking other machines to infect. VIRAL MAIL (including VIRUS HOAXES)  Not strictly a virus, (more a socially driven Worm) relies on your human action (or reaction) to the content of an E-mail. Commonly an official sounding warning about the latest Mobile/Trojan/Virus/Worm ridden message is sent asking you to send it to all your friends. The term Viral Mail can also be applied to chain mail and those “Get Rich” e-mails that ask you to forward them. DON’T waste your time forwarding your name on junk mail, you’ll just ask for more.


Topic 5
	Hints and Tips
	Trojan Detection / Prevention Trojans & Viruses are easily spread through email, IRC and surfing the web. Whatever mail, chat or browser software you use, ensure it is a recent and secure version. Check vendors for security patches. For Microsoft ® see http://www.microsoft.com/security Trojans, Viruses and Worms are discovered daily, so update your protective software regularly. Updates should ideally be not more than a week old copy of the product’s virus signature files. You may also need to update the product's “Scan Engine.” For Trend ® and McAfee ® the best day is generally Thursday’s. Do not directly click on any file sent as an email, MOST ESPECIALLY if from your trusted friend. ALWAYS save files to disk & scan before opening.  Instantly delete Viral Mail (unsolicited e-mails). Try to set your filters to kill chain and junk mail. MOST ESPECIALLY Don’t forward them (or even confirm you exist with an unsubscribe reply). These e-mails are “Viral Pulp” which clog up your Internet performance and can carry your personal details. Download from the Internet with caution. Ensure every source is bona-fide. If you aren’t sure, either look somewhere else (e.g. mirror sites) or download the file to a safe area and scan it. Back up your data on a regular basis. If your files or drive are infected, you can always replace them from your back-up copy. You should always store backup copies at a separate location (i.e. one that is not on your computer). To reduce the risk from SPYware, Trojans and Worms, consider encrypting data folders so reduced amounts are “exposed as required”. Always use rotating passwords (NOT recorded on any PC) especially for shared folders.


	Topic 6
	Topic 6 Replace this text with your topic. Note: Do NOT delete the footnote mark(s) below. These marks identify your topic, 'Topic 6', and will be processed by the Help Compiler. They will not be visible in the final Help file.


	Topic 7
	Topic 7 Replace this text with your topic. Note: Do NOT delete the footnote mark(s) below. These marks identify your topic, 'Topic 7', and will be processed by the Help Compiler. They will not be visible in the final Help file.


Topic 8
	Sniffer
	Sniffer The Sniffer function allows you to monitor data sent between your computer and the Internet. The screen is blank until you select the “Sniffer Start” button. NOTE: - The screen will remain blank if you are not actively connected to the web. By running the sniffer on an active connection you will see a running commentary of both IN bound and OUT bound data. Whilst browsing this can often be informative, however the potentially vast amounts of detail may be difficult to analyse. It is best to select a single trusted and simple web page, then by selecting refresh you should only see the same information over and over. If you see other transmissions then those are the ones to analyse for suspicious activity. NOT ALL transmissions need be suspect, for example your SMTP e-mail will also show (and can thus be monitored). TIP: - to store a text transcript for later analysis use Ctrl-A to select ALL and Ctrl-C to Copy to Clipboard, then open “Wordpad” or your favourite editor and use “paste” to transfer your selection. Here is a short sniffer transcript, whilst connecting and checking for POP3 E-Mails (note 0 to download). C:\OUTLOOK EXPRESS\MSIMN.EXE In/Out: Out Remote Ip:  123.45.678.90 Remote Port:  28160 USER your.identity C:\OUTLOOK EXPRESS\MSIMN.EXE In/Out: Out Remote Ip:  123.45.678.90 Remote Port:  28160 PASS your password required. C:\OUTLOOK EXPRESS\MSIMN.EXE In/Out: Out Remote Ip:  123.45.678.90 Remote Port:  28160 STAT logged in. C:\OUTLOOK EXPRESS\MSIMN.EXE In/Out: Out Remote Ip:  123.45.678.90 Remote Port:  28160 STAT user 0  has 0 visible messages (0 hidden) in 0 octets. C:\OUTLOOK EXPRESS\MSIMN.EXE In/Out: Out Remote Ip:  123.45.678.90 Remote Port:  28160 QUIT 0 C:\OUTLOOK EXPRESS\MSIMN.EXE In/Out: In Remote Ip:  123.45.678.90 Remote Port:  28160 +OK Bye-bye. or +OK Pop server at linux signing off.


	Options
	Options There are currently two options you can chose. Option 1 is to allow Iparmor to be automatically loaded when windows starts. NOTE: - You will see this Icon [image] in the system tray when Iparmor is active. Option 2 is to allow the in-built firewall in Iparmor v5.15 (or later) to monitor and block suspect connections to your computer. The Firewall will allow you to confirm connection with a dialog such as : - In this case it is a valid request by Internet Explorer to connect to a web site. If you suspect the application or the address it wishes to connect to click on the No button, you can then check the IP Address with a web service such as WhoIs.


	Scan Memory for Trojans
	Scan for active Trojans in Memory The main page is the most important and the simplest.  This page opens automatically when you start Iparmor. Its function is to scan all active system processes for Trojan activity.  If no Trojan is found it will report that the “System is safe”, however, if a Trojan is found it shows the name is xxx and date is xxx and that it has been killed etc. This page will scan and kill Trojans automatically without intervention. You should remember to run Iparmor before logging on to the Internet to ensure you control your system before a Trojan does. The virus database is not updated automatically. So you need to run "Update" regularly. After an " Update" select "Refresh" to rescan your system..


Scan Local Drives
	Scan Local Drive(s)
	Scan local drive(s) for Trojans Here you can either select a drive or directory branch to be scanned. You may type in the drive:\directory name or use the browse folder button on the right. You may optionally delete any Trojans found by checking the “[ ] Clean Trojan” box. At present Iparmor will search through .EXE or .DLL files that have been unpacked by you (or crackers) on your system.  NOTE: - Iparmor does not currently search through archive or cabinet files. Press the [image] button. If an infected file is found the directory location and Trojan name will be shown. If there are no entries, just the message “Scanning is over.” then Iparmor did not find any Trojans in the area selected. NOTE: - you can press the “Stop” button at any time, but Iparmor can only show Trojans found up to that point. We recommend you do a full system scan  of your main drive (C:\) at least once a week (perhaps overnight if you have a lot of files). On a modern system Iparmor can be left to background scan for Trojans in your “Windows” directory, whilst you continue to browse the web.  NOTE: - it is necessary to manually select the scan button on each completed run.


	View System Processes
	View active system processes When you select this Icon you are presented with a list of all currently running processes. By looking at this list on a regular basis you may see a suspicious process loaded that was not there before. If you wish to “Kill” a process you can select it and use the Delete key. NOTE: - BEWARE that by killing a valid key windows process you can make the system unstable to the point it may hang or not shut down cleanly. AVOID killing the following KERNEL32.DLL EXPLORER.EXE Remember that killing a running process does not stop it re-loading. To prevent a process from loading each time windows starts see Startup View


View Network Status
	View Network Status / Ports
	View active network ports On this page you can view all open ports and their associated connection activities. This list will change (as you browse) to show the IP address of sites you connect to. You need to know which ports are normally active and look at the activity on port numbers that are suspect. The following Port List shows some (but not all) of the many Trojans known. PORT   TROJAN NAME 1     Spying King 2     Death  20    Senna Spy 21    VARIOUS (FTP port)       Back Construction,       Blade Runner,       Doly,       Fore,       Invisible FTP,       Juggernaut 42,       Larva,       LittleWitch FTP,       MotIv FTP,       NerTe,       Net Administrator,       Senna Spy,       Traitor 21,       WebEx,       WinCrash 22    Shaft 23    VARIOUS (Telnet Port)       Fire HacKer,       RTB666,       Swarm,       TelnetPro,       TTS (Tiny Telnet Server),       Truva Atl 25    VARIOUS (E-mail Port)       Ajan,       Antigen,       EPS (Email Password Sender),       EPS II,       Gip,       Gris,       Happy99,       Hpteam mail,       I love you,       Kuang2,       Magic Horse,       MBT (Mail Bombing Trojan),       Moscow Email Trojan,       Naebi,       NewApt worm,       ProMail,       Shtirlitz,       Stealth,       Tapiras,       Terminator,       WinPC,       WinSpy 31    Agent 31,       Hackers Paradise,       Masters Paradise 41    Deep Throat,       Foreplay or Reduced Foreplay 48    DRAT 50    DRAT 58    DMSetup 59    DMSetup 79    CDK,       Firehotcker 80    VARIOUS (WWW port)       AckCmd,       Back End,       CGI Backdoor,       Executor,       Hooker,       NerTe,       RingZero,       RTB666 81    RemoConChubo 99    Hidden port 110   ProMail 113   Cyn,       Invisible Id Deamon,       Kazimas 119   Happy99 121   BO JammerkillahV 123   Net Controller 133   Farnaz 142   NetTaxi 146   Infector 334   Backage 420   Breach 421   TCP Wrappers Trojan 455   Hackers Paradise 456   Hackers Paradise 513   Grlogin 514   RPC Backdoor 531   Net.666,       Rasmin,       SemiSoft 555   Net Administrator,       Phase Zero,       Stealth Spy 603   Secret Service 605   Secret Service 666   Attack FTP,       Back Construction,       Cain & Abel,       NokNok,       Peur de Rien FTP,       SBD (Satans Back Door),       ServU,       Shadow Phyre 667   SniperNet 669   DP 692   GayOL 777   UMuerte 808   WinHole 831   NeuroticKat 911   Dark Shadow 999   Deep Throat,       Foreplay or Reduced Foreplay,       WinSatan 1000  Der Spaeher 3 1001  Der Spaeher 3,       Le Guardien,       Silencer,       Theef,       WebEx 1005  Theef 1010  Doly 1011  Doly 1012  Doly 1015  Doly 1016  Doly 1020  Vampire 1021  Vampire 1024  PSS (Psyber Stream Server),       NetSpy,       R.A.T 1031  UltimateRAT 1033  Netspy 1037  MoSucker 1042  Bla,       Rasmin 1045  Rasmin 1050  MiniCommand 1054  AckCmd 1080  WinHole 1081  WinHole 1082  WinHole 1083  WinHole 1090  Xtreme 1095  RAT 1097  RAT 1098  RAT 1099  Blood Fest Evolution,       RAT 1170  PSS (Psyber Stream Server),       Streaming Audio Server,       Voice 1200  NoBackO 1201  NoBackO 1207  SoftWar 1212  Kaos 1234  Ultors 1243  BackDoor-G,       SubSeven,       SubSeven Apocalypse,       Tiles,       Mainline 1245  GabanBus,       NetBus,       VooDoo Doll,       Ultors 1255  Scarab 1256  Project nEXT 1257  Frenzy 2000,       Sub Seven 1269  Mavericks Matrix 1313  NETrojan 1338  Millenium Worm 1349  Back Orifice DLL 1394  Gofriller,       BackDoor 1492  FTP99CMP 1509  PSS (Psyber Stream Server) 1524  Trinoo 1529  SkyRAT 1600  Shivka-Burka 1703  Exploiter 1807  SpySender 1981  ShockRave  1966  Fake FTP 1969  OpC BO 1981  Bowl,       Shockrave,       Ullysse 1999  BackDoor,       Transcout 2000  Der Spaeher 3,       Insane Network,       Transscout 2001  Der Spaeher 3,       TrojanCow,       TransScout,       Senna Spy 2001 2002  TransScout 2003  TransScout 2004  TransScout 2005  TransScout 2023  Hack City Ripper Pro,       Ripper,       Pass Ripper 2040  Inferno Uploader 2080  WinHole 2115  Bugs 2140  Deep Throat,       Foreplay or Reduced Foreplay,       The Invasor 2155  Illusion Mailer,       Nirvana 2255  Nirvana 2283  LNVSTTSHVLRAT5 2300  Xplorer 2339  Voice Spy 2345  Doly 2400  PortD 2565  Striker 2583  WinCrash2 2600  Digital RootBeer 2702  Black Diver 2716  The Prayer 2721  Phase Zero 2773  SubSeven,       SubSeven Gold 2801  Phineas Phucker 2989  RAT 3000  Remote Shut,       Theef 3024  WinCrash 3031  MicroSpy 3128  RingZero 3129  Masters Paradise 3150  Deep Throat,       The Invasor 3344  Matrix 3355  Matrix 3456  Terror 3459  Eclipse 2000,       Sanctuary 3587  ****Head 3700  Portal of Doom 3791  Total Eclypse 3801  Total Solar Eclypse 4000  PSS (Psyber Stream Server),       SkyDance 4092  WinCrash 4201  War 4242  VHM (Virtual Hack Machine) 4321  BoBo,       Schoolbus 4444  Prosiak,       Swift Remote 4523  Celine 4567  FileNail 4590  ICQ Trojan 4836  Buttman 4837  Buttman 4950  ICQ Trojen 5000  Back Door Setup,       Bionet Lite,       Blazer5,       Bubbel,       ICKiller,       Sockets de Troie 5001  Back Door Setup,       Sockets de Troie 5002  cd00r,       Shaft 5010  Solo 5011  OOLT,       OOTLT 5025  WM Remote KeyLogger 5031  Netmetro,       NetMetropolitan 5032  NetMetropolitan 5321  Firehotcker 5343  wCrat (WC Remote Admin Tool) 5400  BackConstruction,       Blade Runner 5401  BackConstruction,       Blade Runner 5402  BackConstruction,       Blade Runner 5512  Illusion Mailer,       Xtcp 5521  Illusion Mailer 5550  Xtcp 5555  ServeMe 5556  BO Facil 5557  BO Facil 5569  Robo-Hack 5637  PC Crasher 5638  PC Crasher 5639  PC Crasher 5666  PC Crasher 5714  WinCrash 5741  WinCrash 5742  WinCrash 5760  Portmap Remote Root       Linux Exploit 5880  Y3KRAT 5882  Y3KRAT 5884  Y3KRAT 5888  Y3KRAT 5889  Y3KRAT 5890  Y3KRAT 6000  The tHing 6001  Trojan Killer 6006  Bad Blood 6272  Secret Service 6317  Latinus 6400  Dark Connection Inside,       NetBus worm,       The Thing 6667  Pretty Park,       ScheduleAgent,       SubSeven,       Trinity,       WinSatan 6669  Host Control,       Vampire 6670  BackWeb,       Deep Throat,       Foreplay or Reduced Foreplay,       WinNuke eXtreame 6671  DeepThroat 6674  DeepThroat 6711  BackDoor-G,       LittleWitch,       SubSeven,       VP Killer 6712  Funny,       SubSeven 6713  SubSeven 6723  Mstream 6767  UandMe 6771  Deep Throat,       Foreplay or Reduced Foreplay 6776  2000 Cracks,       BackDoor-G,       SubSeven,       VP Killer 6838  Mstream 6883  Delta Source 6912  Shit Heep 6939  Indoctrination 6969  Danton,       GateCrasher,       IRC 3,       Net Controller,       Priority 6970  Gatecrasher 7000  Exploit Translation Server,       Kazimas,       Remote Grab,       SubSeven Gold 7028  Unknown Trojan 7215  SubSeven,       SubSeven Gold 7300  NetMonitor 7301  NetMonitor 7302  NetMonitor 7303  NetMonitor 7304  NetMonitor 7305  NetMonitor 7306  NetMonitor 7307  NetMonitor 7308  NetMonitor 7309  NetMonitor 7323  Sygate Backdoor 7424  Host Control 7597  QAZ 7777  Tini 7789  Back Door Setup,       ICKiller,       ICQKiller 7826  Oblivion 7983  Mstream 8012  PtAkkS Generated 8032  PRO-ED 8080  Brown Orifice,       RemoConChubo,       RingZero 8681  Psycho Derek 8682  Psycho Derek 8787  Back Orifice 2000 8812  Fraggle Rock Lite 8813  Fraggle Rock Lite 8879  Hack Office Armageddon 8988  BacHack 8989  Rcon,       Recon,       Xcon 9000  Netministrator 9325  Mstream 9400  InCommand 9408  Shang Quan 9870  R3C 9872  Portal of Doom 9873  Portal of Doom 9874  Portal of Doom 9875  Portal of Doom 9876  Cyber Attacker,       Rux 9878  TransScout 9989  iNi-Killer 9999  The Prayer 10067 Portal of Doom 10085 Syphillis 10086 Syphillis 10100 Gift 10101 BrainSpy 10167 Portal of Doom 10520 Acid Shivers 10528 Host Control 10607 Coma,       Danny 10666 Ambush 11000 Senna Spy 11050 Host Control 11051 Host Control 11223 Progenic,       Secret Agent 11831 Latinus 12076 Gjamer 12223 Hack'99,       KeyLogger 12310 Precursor 12345 cron,       crontab,       Fat Bitch,       GabanBus,       icmp_pipe.c,       Mypic,       NetBus (many),       Pie Bill Gates,       Whack Job,       X-bill 12346 Fat Bitch,       GabanBus,       NetBus,       X-bill 12349 BioNet 12361 Whack-a-mole 12362 Whack-a-mole 12623 ButtMan,       DUN Control 12624 ButtMan 12625 ButtMan 12631 Whack Job 12701 Eclypse 2000 12754 Mstream 13000 Senna Spy 13010 HBR (Hacker Brasil),       Bitch Controller 13700 Kuang2 14500 PC Invader 15092 Host Control 15104 Mstream 15858 CDK 16484 Mosucker 16660 Stacheldraht 16772 ICQ Revenge 16959 SubSeven 16969 Priority,       Priotrity 17166 Mosaic 17300 Kuang2 17449 Kid Terror 17499 CrazzyNet 17777 Nephron 18753 Shaft 19864 ICQ Revenge 20000 Millenium 20001 Millennium 20002 AcidkoR 20005 MoSucker 20023 VP Killer 20034 NetBus Pro,       NetRex,       Whack Job 20203 Chupacabra,       Logged 20331 Bla 20432 Shaft 20433 Shaft 21544 GirlFriend,       Kid Terror 21554 Exploiter,       GirlFriend,       Kid Terror,       Schwindler,       WinSp00fer 21579 Breach 2001 21584 Breach 2001 22222 Donald Dick,       Prosiak 23005 NetTrash,       Oxon,       SkyRAT 23023 Logged 23032 Amanda 23321 Konik 23432 Asylum 23456 Evil FTP,       Ugly FTP,       Whack Job 23476 Donald Dick 23477 Donald Dick 26274 Delta Source 26681 Voice Spy 27184 Alvgus 27374 BadBlood,       Diems Mutter,       SubSeven 27444 WinTrinoo 27573 SubSeven 27665 WinTrinoo 28678 Exploiter 29104 NetTrojan 29891 The Unexplained 29976 Trojan Spirit 2001a 29980 Trojan Spirit 2001a 29984 Trojan Spirit 2001a 30000 Infector 30001 ErrOr32 30003 Lamers Death 30029 AOLTrojan 30100 NetSphere 30101 NetSphere 30102 NetSphere 30129 Masters Paradise 30133 NetSphere,       Trojan Spirit 2001a 30303 Sockets de Troie,       Socket23 30700 Mantis 30947 Intruse 30999 Kuang 31320 LittleWitch 31335 WinTrinoo 31336 Bo Whack,       Butt Funnel 31337 Back Fire,       Back Orifice (many),       Baron Night,       Beeone,       cron,       crontab,       Freak88,       icmp_pipe.c,       Sockdmini 31338 Back Orifice,       Butt Funnel,       DeepBO,       NetSpy DK 31339 NetSpy DK,       LittleWitch 31340 LittleWitch 31666 BOWhack 31785 Hack'a'tack 31787 Hack'a'tack 31788 Hack'a'tack 31789 Hack'a'tack 31790 Hack'a'tack 31791 Hack'a'tack 31792 Hack'a'tack 32001 Donald Dick 32100 Peanut Brittle,       Project nEXT 32418 Acid Battery 32791 Acropolis 33270 Trinity 33333 Blakharaz,       Prosiak,       PSS (Psyber Stream Server) 33577 PsychWard 33777 PsychWard 33911 Trojan Spirit 2000 & 2001 34324 TTS (Tiny Telnet Server),       BigGluck,       TN 34444 Donald Dick 34555 Trinoo 35555 Trinoo 37651 YAT (Yet Another Trojan) 38742 CyberSpy 40000 Infector 40123 MoSucker 40412 The Spy 40421 Agent 40421,       Masters Paradise 40422 Masters Paradise 40423 Masters Paradise 40426 Masters Paradise 41666 RBT (Remote Boot Tool) 43210 Schoolbus 44444 Prosiak 45632 LittleWitch 45673 Acropolis 47262 Delta Source 48512 Arctic 49301 Online Keylogger 50505 Sockets de Troie 50766 Fore,       Schwindler 51234 MoSucker 51966 Cafeini 52317 Acid Battery 2000 53001 Remote Windows Shutdown 54283 SubSeven,       SubSeven Gold 54320 Back Orifice 2000 54321 Back Orifice 2000,       Schoolbus 57341 NetRaider 58339 Butt Funnel 60000 DeepThroat,       Foreplay or Reduced Foreplay,       Sockets de Troie 60068 Xzip 6000068 60411 Connection 61348 Bunker-Hill 61466 Telecommando 61603 Bunker-Hill 63485 Bunker-Hill 63536 Insane Network 5 64101 Taskman (Task Manager) 65000 Devil,       Sockets de Troie,       Stacheldraht 65432 th3tr41t0r (The Traitor) 65535 RC1 Trojan,       Shit Heep


Start-up view
	View Start-up Programs
	View programs loaded at Start-up If you look at the programs to be loaded during Windows start-up, you may find application(s) that you don’t recognise. NOTE: - you can select an entry and delete it by pressing the Del key.  BEWARE that if you select a valid file it will NOT be loaded in future and you may need to uninstall then re-install a program to get it to auto-load as before. TIP: - Keep a note of the full entry so you can add it back in to the registry if needed.


	View Log
	View Log The log shows processes that have been uprooted (renamed and unregistered). NOTE: - You can restore an entry by using a “right click” of the mouse and selecting the restore option. TIP: - If you need to restore the name of an uprooted file use “Find - Files or folders” and in the “Named” box enter _iparmor Select the file with a right click of the mouse chose “Rename” and remove the _IPARMOR from the end of the filename.


	Update
	Update The “Update” function permits you to connect to Luosoft and download the latest Trojan database. NOTE: - a wise precaution is to keep a backup of the Virus.300 data file (located in the Iparmor directory). Should the download be interrupted or fail (evidenced by a smaller data file), then delete the new file and restore the backed up Virus.300 file.


	Refresh
	Refresh screen Refresh is only relative to the main screen and causes Iparmor to rescan memory. TIP: - You may wish to do this during a long connection period on the web. If a Trojan has been activated during your session it will now be deactivated.


Register
	Registration
	Registering Iparmor Unregistered users can use Iparmor 30 times, NOTE: - some functions are limited. Registration is required to restore full functionality especially after the 30 demonstration uses. Secure registration is serviced by “QWERKS” Product ID is 3128. Upon payment you will receive a registration code by e-mail. Go to the “Register” menu option and enter the code you receive, full functionality will be restored, and you are then advised to use the “Update” menu option. To place your order activate your browser and use this link: - https://www.qwerks.com/order/buynow.asp?ProductID=3128


	About
	To navigate use any blue links or the header above Contact us For Help        iparmorhelp@luosoft.com  Purchasing  iparmorsales@luosoft.com  Suspect files to      trojans@luosoft.com  Credits This Help file was created by  Kieran O’Donnell © 2001  Using Microsoft ® Word 97 with  the  freeware  BorHelp