Introducing

Being online is fraught with dangers: Internet worms, spyware agents, Trojan horses, hijackers and other malware can wreak havoc, causing anything from slow performance to system crashes and full-blown identity theft. To provide you with the kind of protection you need against cyber thieves and online extortionists, you need a powerful firewall. Your choice in firewalls is one of the most important security decisions you can make. The firewall you choose must be able to monitor all inbound and outbound traffic and protect you from any unauthorized intrusion by rendering your PC invisible to anything that you haven't specifically authorized.

The award-winning provides a vastly superior arsenal of defense giving you the latest in personal firewall technology which makes it the clear security choice for your system.

With :

  • You know what's happening on your PC at all times

    • watches every connection between your computer and the Internet, alerting you immediately to any communications that may be unauthorized so you can take the appropriate action.

  • You're protected by automatic, intelligent protection against hacker attacks

    • Our Attack Detection plug-in automatically blocks network probes, zombie attacks, and other remote attempts to access your PC.

  • Your online activities are secure

    The Active Content plug-in blocks potentially dangerous scripts that could hijack your browser, as well as other website components that can track your online preferences and surfing history. Our fully integrated Anti-Spyware protection safeguards against spyware infections and stops spyware dead in its tracks before it can get anywhere near you.

  • You control how applications communicate

    • Component Control, Hidden Process Control, and Process Memory Control let you decide what applications and processes on your PC are allowed to do and what - if any - outbound connections they may make. Spyware can't phone home from an -protected PC.

  • You understand the threats

    • The Log Viewer lets you review the history of your Internet connections, including sites blocked, attacks repelled, and more than a dozen other security categories that keep you protected, helping you to optimize your protection.

Note:

  • For more information about , please visit http://www.agnitum.com/products/outpost/.

  • Also see Beginner Guide for basic information concerning Internet dangers.


What's New in Version 4.0?

's 4.0 boasts even greater and more proactive security.

The following features are new:

  • This version delivers proactive security functionality that blocks all currently-known techniques for bypassing security protection (leak tests), so it fully prevents sensitive data leakage from individual PCs. Its new Anti-Leak Control integrates Hidden Process Control and Process Memory Control technologies available in previous versions and provides a set of additional anti-leak features that allow to prevent such actions of malicious processes as control over another application, components injection, application window control, application launch with command line parameters, and others.
  • 's new spyware signature analyzer provides even more accurate spyware detection to increase users' protection against all known and even modified and new versions of malware. The spyware scanner besides calculating checksums using the entire file, can detect malware by the unchanged unique part of a file to more precisely evaluate threats.
  • 4.0 uses a new, ultra powerful Secure Hash Algorithm (SHA) 256 verification routine to identify applications while automatically creating network access rules through ImproveNet. This enables to be much more precise in identifying an application in order to ensure the creation and distribution of optimum rule sets. This algorithm replaces the old MD5 algorithm that could be bypassed by recently discovered hacking techniques, which, of course, significantly reduced the ability of this commonly used algorithm to protect users' machines.
  • 4.0 makes it much easier to create the most secure configurations with its new macro definitions for applications and global rules. These can be used, for example, to designate the local network as LOCAL_NETWORK or all DNS servers simply as DNS_SERVERS. This gives advanced users the ability to quickly define security rules for their Intranet communications as well as some Windows-based services (for example, DNS).
  • 4.0 also provides a specially designed Entertainment mode that avoids distracting the user's attention or interrupting a game yet still protects the system when you are playing or watching movies online. While in this mode, the protection is active without bothering the user with numerous prompts or alerts.
  • For those who want to decrease the number of prompts, yet still want to have full control, 4.0 suggests the Low level of Component Control, which does not warn about every changed or added application component, but warns only about executable files.
  • Finally, 4.0 features a new self-protection mode. With self-protection turned on, protects itself against termination caused by viruses, Trojans or spyware. Even attempts to simulate user keystrokes that would otherwise lead to firewall shutdown are detected and blocked. also constantly monitors its own components on the hard drive, registry entries, memory status, running services, and so on, and disallows any changes by malicious applications.

Version 4.0 improves overall usability and performance, and is available for 64-bit operating systems.


System Requirements

The minimum system requirements for are:

  • 233 MHz Intel Pentium or compatible CPU
  • 32 MB RAM
  • Windows 98/2000/XP or Server 2003 operating system
  • 30 MB of hard disk space.

Note:

  • supports 64-bit platforms Windows XP x64 and Windows Server 2003 x64.

  • No special network adapter or modem and no special network configuration settings are needed for the normal operation of the software.

  • should not be run with any other firewall software. Running with other firewall products can result in system instability (i.e., crashes) and can cause your system to operate in an insecure mode.


How to Order

is available for your free evaluation. You are entitled to evaluate the software during the trial period with no obligation to pay. After the trial period, if you decide to keep the software, you must register your copy with us for a small fee.

For pricing information please visit http://www.agnitum.com/purchase/outpost/.


Interface

When you launch for the first time, its Main Window is displayed. The Main Window is your central control panel of the firewall. Its purpose is to let you monitor network operations of your computer and to modify its firewall settings.

The Main Window is very similar to Windows Explorer, so is familiar to most users making quite easy to use.

Show me the Main Window

To display the Main Window when it is minimized to the system tray:

  1. Right-click the firewall's system tray icon.
  2. Select Show.

The Main Window contains:

Menu Bar

The Menu Bar contains the various commands you can use when working with the firewall.

The Toolbar

See The Toolbar section for details.

Folder Bar

This displays the name of the tree node currently selected in the left panel.

Left Panel

See the Left and Information Panels section for details.

Information Panel

See the Left and Information Panels section for details.

Status Bar

The Status Bar is the bottommost part of the firewall Main Window. It is used to display the current state and description of any Toolbar button that you place your mouse cursor over. Also, the current firewall policy is displayed in the right corner of the Status Bar.

Show me the Status Bar


The Toolbar

The Toolbar is close to the top of the Main Window. To see what each button does, hold your cursor over it for a second. Each button on the Toolbar is a shortcut to one of the menu items. These buttons are simply an easy and direct path to their functions rather than having to go through several different menus or dialog windows to access the same functions.

Show me the Toolbar

Show me all the buttons found on the Toolbar

Button | Function | Corresponding Menu Path
 | Changes a firewall policy. | Options > Policy
 | Starts spyware system scan. | Tools > Run Spyware System Scan
 | Accesses the Options or plug-in properties dialogs. | Options > General
 | Modifies the items a listing is grouped by. | View > Group By
 | Narrows a log listing to events within a specified time. | View > Filter By Time
 | Enables/disables Self-protection mode. | Tools > Enable Self-Protection
 | Checks for an update of the firewall plug-ins and components. | Tools > Agnitum Update
 | Opens Log Viewer that displays the logs. | Tools > Log Viewer
 | Displays the firewall's context help. | Help > Context Help

Note:

  • Only some of these buttons are visible (active) at any one time, depending on what is highlighted in the Left Panel or the Information Panel.


Left and Information Panels

To display the collected information in a user-friendly manner, uses two panels. The Left Panel is similar to the left panel of Windows Explorer. It provides a listing of the categories: connections, ports, and plug-ins. The Information Panel gives specific data about any category highlighted in the Left Panel.

Show me the panels

As with Windows Explorer, any line that starts with a plus sign ( [image]) can be expanded to show each of its subcategories. Any line starting with a minus sign ( [image]) shows that the line has already been expanded. By clicking on the minus sign, all of its subcategories can be hidden to conserve screen space.

The Left Panel lists and the Information Panel displays the contents of the following categories:

My Internet

Selecting this category displays the welcome screen and information about your current license. It also lists the latest security news from and provides easy access to the configuration settings. When expanded, this category lists the following nodes:

Network Activity

Lists all applications and processes that have active connections and the details of those connections.

Open Ports

Lists all applications and processes having currently open ports for a network connection.

Allowed

Displays general statistics for all the connections that has allowed.

Blocked

Displays general statistics for all the connections that has blocked.

Reported

Displays general statistics for all the application attempts to access the Internet or LAN that you specified the firewall to report to you (hidden by default).

Plug-Ins

Selecting this category displays general information about plug-ins, lists the latest plug-in news from , and provides an easy access to the plug-ins configuration settings. When expanded, this category lists the installed plug-ins. By default, the following plug-ins are installed:

Active Content

Displays general statistics for sites that had some of its active content blocked based on the settings for Java, VB Script, ActiveX and other active content elements. For information about the Active Content plug-in, see Blocking Active Elements.

Ads

Displays general statistics for all the ads that were blocked. For information about the Ads plug-in, see Blocking Advertisements.

Anti-Spyware

Displays general statistics for all spyware objects that were detected and removed or quarantined from your computer. For information about the Anti-Spyware plug-in, see Protecting against Spyware.

Attachment Quarantine

Displays general statistics for all the e-mail file attachments that were neutralized and quarantined from your computer. For information about the Attachment Quarantine plug-in, see Blocking Harmful Attachments.

Attack Detection

Displays general statistics for any suspected attacks on your computer from the Internet, the ports involved and where the attacks are from. For information about the Attack Detection plug-in, see the Preventing Network Attacks.

Content

Displays general statistics for the web sites or pages that were blocked by this plug-in and the reason why. For information about the Content plug-in, see Blocking Web Content.

DNS Cache

Displays general statistics for the web addresses saved by to speed up your Internet connection to those sites. For information about the DNS Cache plug-in, see the Managing DNS Cache.

Tip:

  • To view detailed statistics, click the Show Detailed Log button in the Information Panel.


System Tray Icon

Another element for controlling the firewall is the system tray icon. The system tray is the rightmost part of the Windows task bar. The blue circle with the question mark [image] is 's icon by default. It is displayed right after installing the firewall and is always available as one of the primary ways you can access the firewall controls, settings and logs. The icon changes depending on the current firewall policy.

When you right-click on the system tray icon you get its context menu.

Show me the system tray icon menu

The following commands are available on this menu:

Show (or Hide)

Displays or hides Main Window.

Show Log Viewer

Displays the Log Viewer.

Policy

Opens a submenu where you can change the firewall policy selecting one of the available modes: Disable, Allow most, Rules Wizard, Block most, and Stop all.

Options

Displays the Options dialog window.

Always on Top

When selected, keeps current window on top of all other windows.

About

Shows the current version of and lists each module in the package and their version numbers.

Exit

Closes the GUI and stops the firewall so is no longer protecting your system.

Note:

  • The system tray icon is not visible while runs in a background mode.


Startup Mode

allows you to control its behavior during system startup. To select one of the three startup modes, click the Options button on the Toolbar. The following modes are available under the Startup section:

Normal

The default mode. Loads automatically at boot-up and displays its icon in the system tray.

Background

If selected, will run in invisible mode, without displaying its system tray icon or any of its dialog windows. Background mode is provided for two reasons: to save system resources and for a parent or system administrator to block unwanted traffic or content in a way that's completely hidden from the user.

For details on background mode, see Running in Background Mode.

Disable

If selected, will not run automatically at startup. Your system will not be protected by its firewall.


Closing and Stopping the Firewall

By default, when you minimize the Main Window, it is minimized to the system tray icon and no task is displayed for in the taskbar. You can alter this behavior by clicking the Options button on the Toolbar and clearing the Minimize to system tray check box in the dialog window.

allows controlling the Main Window behavior on its closing as well. By default, when you click the close button in the right upper corner, you do not actually shut down the firewall. The Main Window is minimized and the firewall icon remains in the system tray indicating that the firewall is running and protecting your system. Clearing the Minimize main window on close check box in the Options dialog lets you tell to stop the firewall and shutdown the service when you close the Main Window so stops protecting your system.

You can also completely stop the firewall by selecting the Exit command on the File menu of the Main Window or by right-clicking the system tray icon and selecting the same command.


Setting the Firewall Policy

One of the most useful and important features of is the firewall policy. A policy is the basic behavior uses in controlling your computer's access to and by the Internet or any other network it may be connected to. The Block most policy, for example, gives a very strict attitude but the Allow most policy makes very trusting.

policies

can function according to the following policies:

Icon | Policy | Description
 | Stop all | All network connections are blocked.
 | Block most | All network connections are blocked except those that are explicitly allowed by global or application rules.
 | Rules Wizard | Helps you determine how an application will interact with the network the first time each application is run.
 | Allow most | All network connections are allowed except those that are explicitly blocked by global or application rules.
 | Disable | All network connections are allowed.

The icon shown for each mode is displayed in the system tray as the icon. You can tell at a glance what mode the firewall is in by looking at its system tray icon.

Changing the firewall policy

To change the current firewall policy:
  1. Click the Options button on the toolbar.
  2. Select the Policy tab.
  3. Select the appropriate icon and click OK.

Tip:

  • You can also change the firewall policy using the system tray icon's shortcut menu. Right-click the icon, select Policy, and select the desired policy from the menu.


Running in Rules Wizard Mode

When is first installed, the default policy is Rules Wizard. According to this policy, displays a prompt each time a new application or process (for which no rules are specified) requests network access or when an application requests a connection that is not covered by its rules. Thus lets you decide whether an application should be allowed a network connection to a specific address and port.

also lets you specify network parameters for each type of application. Instead of having to create a new and often complex rule each time a new application is run, enables you to simply select a preset rule based on a well-known applications. The firewall even recommends the best selection for you, unless you are certain of a better choice, so you simply have to okay 's recommendation.

Show me the Rules Wizard prompt

The choices you can make for an application in Rules Wizard mode are as follows:

Allow all activities for this application

For applications you trust completely. All network requests by this application will be allowed and the application will be given the Trusted application status.

Block all activities for this application

For applications that should not be allowed network access. All network activities for this application will be disabled. The application will be given the Blocked application status.

Create rules using preset

For applications that can obtain network access under specific protocols, via particular ports, etc. Creates a rule or a set of rules for the application that limits network access to those specific ports and protocols using predefined presets that are optimum for most purposes.

Select the required application from the drop-down list and click OK to make the firewall control the application according to the specific rules. You can also create your own rule for this application by selecting Custom from the drop-down list and specifying the rule settings.

This application will be included in the Partially allowed applications list.

Note:

  • In the case that some application requests a connection to the server that has several IP addresses, automatically detects all server addresses and configures the corresponding rules for all the server IP addresses according to the action you specify.

Allow Once

For applications that you are doubtful of but want to see what they do with network access. The connection will be allowed this one time. No rule is created for the application and the next time this application tries to establish a network connection, this same dialog window will appear.

Block Once

For applications that you do not trust but do not want to block totally. The connection will be blocked this one time. No rule is created and the next attempt by this application to establish a network connection results in this same dialog window.

Note:

  • Rules Wizard is not supported when is run in background mode as background mode does not include interaction with the user.
  • can perform on-the-fly spyware scan of the processes requiring network access for which no rules exist and display the result in the Rules Wizard window header. For details, see the Real-Time Protection section.
  • For details on creating the application rules, see Managing Applications Network Access.


Running in Background Mode

When in background startup mode, runs invisibly, without displaying its system tray icon or any of its dialog windows. This makes the firewall completely invisible to users thus allowing parents and system administrators to block unwanted traffic or content in a way that's completely hidden from the user.

Another reason to use background mode is if you need to save system resources.

To have run in background mode, click the Options button on the Toolbar and select Background under Startup.

Specifying the background/Entertainment mode policy

Because Rules Wizard policy is not supported when runs in background mode (as background mode does not include interaction with the user), you need to specify what firewall policy is applied when starts in background mode. To specify the policy that is applied in background mode:
  1. Click Options on the Toolbar and select the Policy tab.
  2. Select Rules Wizard.
  3. Click Advanced.
  4. Select the desired policy from the drop-down list in the dialog box.
  5. Click OK.


Running in Stealth Mode

Stealth mode allows you to define whether your computer will respond to port scans or to silently block them, making itself invisible to hackers.

Normally, when your computer receives a connection request to a port not used for any incoming or outgoing connections, it lets the other computer know that this port is not used by sending a "port unreachable" notification. In stealth mode, your computer will not respond, making it seem like it is not turned on or not connected to the Internet. In this case, packets sent to the unused port are simply ignored by the firewall without notifying the source via any ICMP or TCP message.

To set the firewall to stealth mode, click Options on the Toolbar, select the System tab and then Stealth under Firewall mode.

Note:

  • It is recommended that you keep in stealth mode unless you have some reason not to.


Running in Entertainment Mode

When playing games or watching movies you probably want to avoid product prompts and alerts from distracting your attention or capturing focus, yet still want to be protected, especially when playing online.

provides a specially designed Entertainment mode where protection is active without bothering users with numerous product prompts and alerts. Once the full screen application (a game, media player, etc.) is started, detects this event and suggests entering Entertainment mode, so the application runs using the background/Entertainment mode policy that is specified in Options > Policy > Advanced dialog, in which case no alerts and messages are displayed with the full screen application and updates are not checked.

Show me the Entertainment mode prompt

If you want a particular application to always or never use Entertainment mode, select the Remember for this application check box before responding to the dialog box. You can also enable or disable Entertainment mode for specific applications in the Options > Application list using the commands on the application's shortcut menu. Select Entertainment Mode > Enable Entertainment Mode or Disable Entertainment Mode for to automatically change its policy when the application enters full screen mode.

To configure specific Entertainment mode settings, click Advanced. The displayed window lets you set the rules that will be used by whenever you enter Entertainment mode, and lets you define whether advanced protection techniques such as Component Control, Anti-Leak Control and real-time spyware protection should be enabled while runs in Entertainment mode.

Note:

  • When operating in background mode, does not enter Entertainment mode.

  • When an application—with no network access rules already set—enters Entertainment mode, it is put in the Trusted applications group.


Running in Self-Protection Mode

As anti-malware tools have grown stronger, hackers now try to switch them off using rootkits and other advanced tools before proceeding with their own unauthorized actions. To withstand this threat, features so called Self-protection mode. With self-protection turned on, protects itself against termination caused by viruses, Trojans or spyware. Even attempts to simulate user keystrokes that would otherwise lead to firewall shutdown are detected and blocked. also constantly monitors its own components on the hard drive, registry entries, memory status, running services, and so on, and disallows any changes by malicious applications.

By default, self-protection is enabled. To disable it, click the Self-Protection button on the toolbar.

Note:

  • Disabling self-protection may severely impact overall system security. Though disabling is required for the installation of plug-ins and other advanced functions, it should be re-enabled as soon as the changes have been made.


Managing Applications Network Access

One of the main principles of 's operation is granting network access to processes and applications according to specified application rules. This allows for flexible network access setup and insures that no process can get unauthorized network access that is not covered by a rule.

generates a list of installed applications and sets the rules for them automatically but provides an opportunity to manage the application list and rules for applications manually as well. See the appropriate sections for details.


Managing List of Applications

During the initial firewall configuration all installed applications are detected and rules for the applications are created according to built-in presets. To view a list of the detected applications, click the Options button on the toolbar and select the Application tab.

All applications as far as is concerned, are arranged in three groups:

Blocked applications

All network activity of applications of this group is blocked. It is recommended that you add any applications that do not need Internet access, such as text editors, calculators, etc. to this group.

Partially allowed applications

allows network access for these applications based on rules that were set by you manually and/or the rules presets. Only closely specified network activity is allowed for these applications. automatically detects installed applications and configures rules presets when you set the firewall configuration during installation and it is recommended that you put most applications that were not initially detected by the firewall in this group.

Allowed applications

All network activity of applications in this group is allowed. It is not recommended that you include an application in this group unless you trust it absolutely.

You can change the status of an application or process by simply dragging and dropping it into into a different group.

You can also manage the application list by manually adding applications and removing them. To add an application, click the Add button. You will be prompted to browse to the application's executable and, after adding the file, the Rules dialog window will be displayed so you can specify the rules for the new application. After specifying the rules and clicking OK you will be able to see the added application in the Partially allowed applications group. For more information on creating and editing application rules, see Managing Rules for Applications. To remove an application from the list, click the Remove button.

Note:

  • You can also add an application to a list directly by dragging its icon from Windows Explorer or from your desktop into the Options > Application dialog.

  • If you are using the default Rules Wizard policy, there is no need to add your applications to the list manually. will suggest rules for each application the first time an app requests network access.


Managing Rules for Applications

To list the existing rules for an application, click Options on the toolbar, select the Application tab, select the application, and click Modify Rules (or Create Rules to create rules for Blocked or Allowed applications) on the Edit menu. The Rules dialog will be displayed allowing you to manage the existing rules for the selected application and add new rules.

Adding a new rule

To create a new rule, click New in the Rules window. In the rule editor, specify the following rule parameters:

Event the rule will handle

The following criteria are available:

  • Where the specified protocol is - lets you specify a protocol to be allowed or blocked.
  • Where the specified direction is - either outbound or inbound.
  • Where the specified remote host is - a specific IP address or DNS name.
  • Where the specified remote port is - a particular port on the other computer that will be used.
  • Where the specified local port is - the port on your computer that will be used.
  • Where the specified time interval is - the active period of time for the request to come.
  • Where local port is equal to remote port - both computers use the same port number.

Select the criteria of the event and define all the settings in the Rule Description field by clicking the underlined links.

Note:

  • Local and remote port settings are available only if the protocol is defined.

  • For information on using macro addresses to specify local or remote host, see Using Macro Addresses.

Actions the rule will respond with

The following actions are available:

  • Allow it - Allows the connection.
  • Block it - Blocks the connection (the source is not notified so it appears that the packet never reached your computer).
  • Report it - Displays a visual alert when a rule is triggered.
  • Run application - Runs the application with the specified command line parameters when the rule is triggered.
  • Do not log this activity - disables activity logging for this rule. If selected, no data will be written to log on this rule triggering.
  • Stateful Inspection - Turns on "stateful inspection" for this application (after an application connects to a remote server, all incoming data from that server to the port opened by the application will be allowed or blocked according to the specified setting).
  • Ignore Component Control - Forces to ignore Component Control during this communication.

Select the actions - the corresponding messages will be displayed in the Rule Description field. If you want a specific application to run or a command to be executed on this event, select the corresponding check box and define the application or command by clicking the underlined link in the Rule Description field.

Make sure there are no undefined parameters in the Rule Description field. will generate the descriptive Rule name automatically basing on the specified parameters.

Click OK to save the rule. The rule will be displayed in the list. The selected rule transcript is shown at the bottom of the window.

Adding rules according to presets

lets you assign a predefined set of rules to an application. For example, if you use some an uncommon browser that was not detected by the firewall during installation, you need not create all the rules manually. Just click the Preset button in that program's Rules dialog and select Browser from the drop-down menu. All the necessary rules for this kind of application will be added automatically.

Modifying an existing rule

To modify an existing rule, highlight it in the list and click Modify. Perform any changes in the rule editor described in the rule creation section above and click OK to save the changes.

The selected rules are active (turned on) and processed by the firewall. Clear the check box next to the rule name to turn it off if you do not want to process the rule but you don't want to delete it. You can turn the rule on any time later by selecting its check box.

Rules are applied in the top-down order (higher on the list first) but note that uses the first rule having several criteria that match the application's type of communication activity and ignores all subsequent ones. To change a rule's priority, highlight the rule in the list and use the Move Up/Down buttons.

You can also copy the highlighted rule within an application and remove rules using the corresponding buttons. However, you cannot copy a rule from one application to another.

Tips:

  • Use the rule transcript at the bottom of the dialog to quickly change one of its parameters.
  • Rules automatically created by are marked blue in the list.
  • It is prudent to save the present configuration before making changes to it.


Using Macro Addresses

allows you to specify macro addresses in rule descriptions to facilitate the creation of rules. Instead of having to type IP addresses manually while creating rules for your Intranet communications or some Windows-based services (for example, DNS), you can use suggested macro definitions, to designate local networks as LOCAL_NETWORK, all DNS servers as DNS_SERVERS, etc.

automatically recognizes current macro values so you do not need to change host and subnet addresses whenever network adapter settings are changed. For example, a mobile user's protection will always be active since the rules on his laptop work regardless of what network he is connected to.

When you specify a local or remote address, you can select one of the following macros:

DNS_SERVERS

Specifies addresses of all DNS servers in your network.

LOCAL_NETWORK

Specifies addresses of all your local networks and addresses from the broadcast ranges available on your computer.

WINS_SERVERS

Specifies addresses of all WINS servers on your network.

GATEWAYS

Specifies addresses of all gateway servers for your network.

MY_COMPUTER

Specifies all IP addresses your computer has in different networks, including loopback addresses.

ALL_COMPUTER_ADDRESSES

Specifies all IP addresses your computer has in different networks, including broadcast and multicast addresses.

BROADCAST_ADDRESSES

Specifies addresses within broadcast ranges available to your computer. A broadcast address is an IP address that allows information to be sent simultaneously to all machines on a given subnet.

MULTICAST_ADDRESSES

Specifies addresses in multicast ranges. A multicast address is a single address that refers to multiple network devices. "Multicast address" is synonymous with "group address".


Protecting from Malicious Process Activity

Some malicious applications can be activated as parts of legitimate programs and perform their activity on behalf of a trusted application. For example, some Trojan horses can be injected into a computer system as a module of a legitimate application (for example, your browser) and thus gain the privileges needed to connect to the person who configured the Trojan. Others can start processes in hidden mode or hijack trusted process memory to pretend to be an application you do not consider as harmful. By employing technologies of Component Control and Anti-Leak does not allow such program activity and thus fully protects you from Trojans, spyware and other dangers. See the corresponding sections for details.


Controlling Application Components

Applications typically have dozens of modules, any of which can easily be substituted by virus or Trojan makers to execute a malicious code on your computer. does not just monitor applications but also each component of each application. If a component of an application has been changed and the application is about to establish a connection, will inform you of the changed component and ask whether this connection should be allowed. The technology responsible for that is called Component Control and its purpose is to make sure no fake and malicious components get network access.

Changing Component Control level

You can set up the desired Component Control level. Click Options on the toolbar, select the Application tab, and click the Components button. The following levels are available in the Component Control Settings window:

  • Maximum - will monitor all components that are being registered as part of a legitimate application. It is recommended that you use this option only when you suspect an unknown malware to exist in your system because this option may seriously impact on your system performance.
  • Normal - will monitor all new components as they are being registered to be a part of an application yet are not located in the application folder and all updated components and remember the legitimate ones in its database. This option is suitable for most cases and provides a balance between security and performance.
  • Low - the same as Normal but in this case will not warn about every changed or added application component, but will warn only about executable files. It is recommended to use this option instead of completely disabling Component Control to keep the minimally necessary security level.
  • Disabled - turns Component Control off. This option is only recommended when you experience significantly reduced performance, crashes, or other errors that lead to system instability. Turning Component Control off severely reduces your system's security level as no longer monitors each application component.

Changing levels affects all applications and their components. It is not possible to change the level for specific applications.

Note:

  • It is not recommended to use the Maximum level unless you are sure your system is being threatened by a virus, Trojan or other malicious program.

Managing shared components

You can specify the components that are to be used by more than one application. will not warn you when a shared component is requested by an application to which it is not registered. By default, all Windows system components are added to this list because they are used by most Windows applications. You can, however, modify the list to match your specific needs.

To modify the shared components list, click Options on the Toolbar, select the Application tab, and click the Components button. Click Edit list under Shared components to display the shared components list. Add or remove specific components using the corresponding buttons.

Note:

  • After you install a service pack or other software upgrade that changes a large number of files in your system it is recommended that you rebuild the shared components database so is aware of the changes and any newly installed system components. To rebuild the database, click Rebuild database in the Shared Components dialog box.

Managing application components

lets you manage the components it monitors for each application. All registered application components are considered legitimate and no warnings are displayed when an application requesting network access uses one of its registered components unless the component was changed.

To manage the components for a specific application, click Options on the toolbar, select the Application tab, select the application on the list, and click Edit > Modify Rules (Create Rules for allowed or blocked applications). Then click the Components button to display the components list. Add or remove specific components using the corresponding buttons.

Tip:

  • In a Rules Wizard prompt for the changed component, shared components are marked red and components of a specific application are marked green.


Controlling Penetration Techniques

There are several advanced penetration schemes that allow malicious software to bypass the security perimeter of a PC. provides proactive security functionality called Anti-Leak Control that blocks all currently-known penetration techniques that are often used by malicious programs to bypass firewall software (for details, see Understanding Penetration Techniques). This prevents sensitive data leakage from individual PCs, gives more control over what’s happening on a PC, and alerts you to spyware programs that use sophisticated techniques to hide themselves. However, some of these techniques can be used by legitimate applications in their regular activity, so it is necessary to be able to flexibly control them as simply blocking the activity can affect system stability and interrupt user work.

To enable Anti-Leak Control, click Options on the toolbar, select the Application tab, click the Anti-Leak button, and select the Enable Anti-Leak Control check box. The available settings allow you to configure which actions all applications in your system are allowed to perform. All actions are divided into dangerous that are critical and most likely will result in system instability and data leaks; and suspicious that sometimes can be used by legitimate applications for their common activity.

Select an action in the list and the right part of the window will show you the element's description and settings. The default setting for each action depends on the security level you chose during installation. To allow or block a particular action globally for the system, select one of these available options:

  • Prompt. will prompt you each time an application tries to perform the selected activity.
  • Allow. The selected activity will always be allowed for all applications on your system.
  • Block. The selected activity will always be blocked for all applications on your system.

Besides these options, you can also have show a visual notification each time an action is allowed or blocked for the application, by selecting the Report check box.

Some applications use the technology of component injection (Windows hooks) for their common activity (Nvidia drivers, for example). If you use such applications and want to allow them to inject components from the shared components list into another process's memory, select the Allow injection of shared components check box. This setting has a higher priority than the Prompt/Block settings for Windows hooks.

If you want to have full control over all system activity of applications installed on your computer, clear the Allow all listed actions for network-enabled applications check box, otherwise it has a higher priority than the Prompt/Block settings for all listed techniques.

To individually set rules for suspicious actions from a particular application (for example, to allow a specific application to modify the memory of other processes), click the Exclusions tab. Click Add and browse to the application's executable file. After clicking Open, you will see the application in the list and will be able to specify its individual anti-leak settings. To change the setting for the selected action, click the link in the Action column next to the action name. The available actions are the same as for the global system settings described above. Besides, you can set to inherit global setting for the action, specifying the Use Global setting.

Click OK to save your settings.

Note:

  • Any actions that are over other instances of the same process are allowed. For example, Internet Explorer can control other Internet Explorer windows.
  • If you completely trust an application and want to allow it to perform all the listed actions, right-click the application in the list on the Application tab and select Ignore Anti-Leak Control.
    • The application will be added to the Anti-Leak exclusions list with all actions set to Allow.


Understanding Penetration Techniques

allows you to control the following actions:

Components injection

Windows operating systems—by design—enable installing system interceptors (hooks) through which foreign code can be injected into processes. Normally, this technique is used to perform common, legitimate actions, such as switching the keyboard layout or launching a PDF file within the web browser window. However, it can also be used by malicious programs to embed harmful code and thus hijack the host application. An example of a leak test that uses such a technique to stage a simulated attack is the PC Audit program (http://www.pcinternetpatrol.com/).

controls the installation of a hook interceptor in a process's address space. This is implemented via the interception of functions that are typically used by malicious processes (Trojans, spyware, viruses, worms etc.) to implant their code into legitimate processes, such as Internet Explorer or Firefox. The behavior of a DLL file invoking such functions is considered suspicious and triggers a legitimacy verification.

Control over another application

DDE technology is used to control applications. Browsers are commonly DDE servers, so can be used by malicious programs to transfer private information onto a network. One example of this technique is the Surfer leak test (http://www.firewallleak tester.com/leak test15.htm). ZABypass is another example of a leak test that uses this method.

With , every attempt to use DDE intercommunication is monitored with no exclusion, whether the process is open or not. The DDE inter-process communication control enables to govern the methods used by applications to gain command over legitimate processes. It prevents malware from hijacking a legitimate program and checks whether such DDE-level interactivity is allowed to be performed on network-enabled applications. In case such an attempt is detected, it triggers a legitimacy verification prompt.

Application window control

Windows allows applications to exchange window messages between processes. Malicious processes can gain control over other network-enabled applications by sending them window messages and imitating user input from the keyboard and/or mouse clicks. An example of using this technique is the Breakout leak test (http://www.firewallleak tester.com/leak test16.htm).

The crucial point here is program interactivity through the SendMessage, PostMessage API, and so on. This technique is used for legitimate inter-process interactivity, but can very easily be used for nefarious purposes by malicious individuals.

controls such attempts.

Active Desktop modification

Creating an HTML page pointing to a certain website and setting it as a Windows Active Desktop, malicious processes can transfer private data on behalf of Windows Explorer. When the Active Desktop is turned on, it is permitted to go to the website address contained in the HTML page, acting on behalf of the system and thus bypassing firewall’s sensors. An example of using this technique is demonstrated by the Breakout leak test (http://www.firewallleak tester.com/leak test16.htm).

controls such attempts to steal data by bamboozling the firewall.

DNS query submission

The DNS Client service contains a vulnerability called DNS tunneling. Malicious code can transfer and receive any information using correct DNS packets to a correctly configured operating DNS server. An example of using this technique is the DNSTester leak test (http://www.klake.org/~jt/dnshell/).

performs double verification of any access to a DNS Client service, thereby providing a more secure system. This controls access to a DNS API even with the DNS Client service on, and thus benefits users who, out of compatibility concerns, cannot disable this service themselves. This functionality allows the assignment of permissions to a specific process to use the DNS Client service.

Application launch with URL

Malicious processes can launch the default web browser with a pre-configured web address in a hidden window, making the firewall believe a legitimate action is taking place. Firewalls that explicitly trust an application without looking beyond—to who actually launched it in the first place and what additional connection parameters are supplied—are unable to challenge the technique, and thereby allow confidential data to be transmitted from the computer. The examples of using this technique are Tooleaky and Ghost leak tests (http://www.firewallleak tester.com/leak test2.htm, http://www.firewallleak tester.com/leak test13.htm).

watches every program started on a computer and controls who has the permission to start each program with the target URL and will prompt the user as to whether such activity should be permitted for a particular program.

Application launch with command line parameters

Several firewalls are exposed to the vulnerability of predatory code launching the default web browser with command-line parameters. These firewalls allow themselves to be circumvented because they are made to believe a legitimate application is performing legitimate actions. However, one or more of those command-line parameters can be private or critical data that gets sent along to the host name. An example of this technique is the Wallbreaker leak test (http://www.firewallleak tester.com/leak test11.htm).

has a the restricted list of processes that are allowed to start the default browser with command line parameters, which protects your browser against tampering. Beyond browsers, command-line launch control applies to all network-enabled applications, which are present in the configuration.

Critical registry entry modification

The registry is a universal repository of system settings and program configurations. Modifying its content can lead to application errors or even system failure. Malicious processes use this technique to make small modifications to the registry elements, enabling an unverified process to unrestrictedly access the network, in spite of the presence of a firewall, by adding its components to the applications, for example, Windows Explorer, and acting on their behalf. An example of using this technique is the Jumper leak test (http://www.firewallleak tester.com/leak test17.htm).

These attempts are controlled by . This proactive capability lets you allow or prevent the embedding of objects into a certain area of the registry.

OLE application control

A relatively new technique has surfaced that controls application activity through OLE (Object Linking and Embedding)—a Windows mechanism, which allows one program to manage the behavior of another program on the computer. It uses the technique of OLE intercommunication to exchange data and commands between applications, for example, to manage the activity of Internet Explorer so it can send user-specific data to a remote location. An example of using this technique is the PCFlank leak test (http://www.pcflank.com/PCFlankleak test.exe).

detects an OLE communication and asks the user if it is normal for that application to control other applications' activity.

Process memory modification

Several Trojan horses and viruses use sophisticated techniques that let them alter the code of trusted applications running in memory and thereby bypass the system security perimeter in order to perform their malicious activities. This is known as code injection or copycat vulnerability. Examples of using this technique are the Thermite and Copycat leak tests (http://www.firewallleak tester.com/leak test8.htm, http://www.firewallleak tester.com/leak test9.htm).

enables you to control the functions that can be used to write malicious code into a trusted application's address space and so prevent a rogue process from injecting their code into those processes. The entire memory space used by any active application on a computer is monitored by (not just that of a network-enabled application). If malware tryes to modify a legitimate application's memory, detects it and displays a pop-up alert. The system works proactively: it allows you to permit or deny the modification of memory of other processes at the application level. For example, Visual Studio 2005 would be able to modify memory, while the "copycat.exe" leak test would be disallowed from doing so. This feature protects against even unknown malware not yet detected by antivirus and anti-spyware vendors that exploits this vulnerability.

Low-level network access

Some network drivers allow direct access to the network adapter, which bypasses the standard TCP stack. These drivers can be used by sniffers and other malicious programs to get low-level network access. They pose an additional risk for the system as traffic passing through them cannot be screened by a firewall. The example of using this technique is MBtest leak test (http://www.firewallleak tester.com/leak test10.htm).

allows the control of applications that request non-standard network access. This feature strengthens overall network security level by preventing outbound data leakage. The user is able to control an application's attempts to open a network-enabled driver; so without the user's authorization, an application is not able to send even the ARP or IPX data.


Managing Global System Network Activity

Besides controlling network access on an application level, enables advanced users to control all system traffic on all levels as well.

With , you have the following opportunities:

  • Define rules for all processes running on the system - called global rules
  • Control the system's ICMP traffic
  • Run the firewall in a stealth mode
  • Control network access through rawsockets

See each corresponding section for details.

Note:

  • These settings are for advanced users only. If changed incorrectly, it could result in your firewall not working as expected. In most cases, you do not need to modify these rules or add yours.


Managing Global Rules

Global firewall rules are applied to all processes and applications on your computer that request network access. You can, for example, block all traffic that uses a specific protocol or all traffic from a particular remote host by creating the appropriate rules. provides several predefined global rules designed for optimal system functioning. To view the global rules list, click Options on the toolbar, select the System tab and click Rules under Global rules and rawsocket access.

Adding a new rule

To add a new rule, click Add in the Global Rules window. In the rule editor you should specify the following rule parameters:

Event the rule will handle

The following criteria are available:

  • Where the specified protocol is - lets you specify a protocol to be allowed or blocked (with the ability to specify the protocol type for IP protocol).
  • Where the specified direction is - either outbound or inbound (with the ability to specify the packet type for outgoing traffic).
  • Where the specified remote host is - a specific IP address or DNS name.
  • Where the specified remote port is - a particular port on the other computer that will be used.
  • Where the specified local host is - your computer IP address or DNS name.
  • Where the specified local port is - the port on your computer that will be used.
  • Where the specified time interval is - the active period of time for the request to come.
  • Where local port is equal to remote port - both computers use the same port number.

Select the criteria of the event and define all the settings in the Rule Description field by clicking the underlined links.

Note:

  • Local and remote port settings are available only if the protocol is TCP or UDP.

  • For information on using macro addresses to specify local or remote host, see Using Macro Addresses.

Actions the rule will respond with

The following actions are available:

  • Allow it - Allows the connection.
  • Block it - Blocks the connection (the source is not notified so it appears the packet never reached you computer).
  • Report it - Displays a visual alert when a rule is triggered.
  • Run application - Runs the application with the specified command line parameters when a rule is triggered.
  • Do not log this activity - disables activity logging for this rule. If selected, no data will be written to log on this rule triggering.
  • Mark rule as High Priority - Sets the rule to prevail over the application rules which take precedence by default.
  • Stateful Inspection - Turns on "stateful inspection" for this application (after an application connects to a remote server, all incoming data from that server to the port opened by the application will be allowed or blocked according to the specified setting).
  • Ignore Component Control - Forces to ignore Component Control during a communication.

Select the actions - the corresponding messages will be displayed in the Rule Description field. If you want an application to run or a command to be executed on this event, select the corresponding check box and define the application or command by clicking the underlined link in the Rule Description field.

Make sure there are no undefined parameters in the Rule Description field. will generate a descriptive Rule name automatically based on the specified parameters.

Click OK to save the rule. The rule will be displayed in the list.

Modifying an existing rule

To modify an existing rule, highlight it in the list and click Edit. Perform any changes using the rule editor described in the rule creation section above and click OK to save the changes.

Selected rules are active (turned on) and processed by the firewall. Clear the check box next to the rule name to turn it off if you do not want to process the rule but you don't want to delete it. You can turn the rule on any time later by selecting its check box.

Rules are applied in top-down order (highest on the list first) but note that uses the first rule that has several criteria that match the type of communication activity and ignores all subsequent ones. To change a rule's priority, highlight the rule in the list and use the Move Up/Down buttons.

You can also copy a highlighted rule or remove a rule by using the corresponding buttons. It is not recommended to remove any built-in global rules.

Tip:

  • It is prudent to save the present configuration before making changes to it.


Controlling ICMP Protocol Activity

Internet Control Message Protocol (ICMP) is used to send error/control messages between computers connected on a network. lets you specify the types and directions of the ICMP messages allowed.

To specify the ICMP settings, click Options on the Toolbar, select the System tab and click Settings under ICMP. In the ICMP Settings dialog, the main ICMP message types are listed; you can allow incoming or outgoing messages by selecting the corresponding check boxes by its side. If a check box is cleared, the connection is blocked.

Use the Default button to reset all the ICMP settings to the default ones.

Note:

  • It is recommended that you do not change the ICMP settings unless you are certain that you are making the right changes.

  • The different types of ICMP messages are described in Appendix B: Types of ICMP Messages of the user's guide.


Controlling Rawsockets Access

Some applications can access a network directly through low-level socket calls, also known as rawsockets. These calls cannot be governed by ordinary protocol and application rules and thus can serve as a backdoor for a rogue application or as a way to access a network without limitation or regulations.

To improve your system's protection, enables you to control rawsocket access. You can define which applications are allowed to make rawsocket calls and which are not. To manage the list of applications that are allowed to use rawsockets, click Options on the toolbar, select the System tab and click Rawsockets under Global rules and rawsocket access. Click Add and select the application you want to grant rawsocket access to.

If you want to ask you each time an application that is not on the allowed list attempts to access rawsockets, select the corresponding check box.

Note:

  • Once an application is added to this list, it is granted unrestricted network access.


Configuring Local Network Settings

A fundamental difference between a local area network (LAN) and the Internet is the level of trust you can have in each. A LAN used in the home or an office is generally comprised of "friendly" computers, computers belonging to or operated by other family members or fellow workers.

allows you to detect the networks your computer belongs to and define the specific access level for each network.


Detecting a Local Area Network

Normally, LAN settings of your computer should be detected and configured during the installation of . But if you chose manual configuration during the installation and/or removed all detected networks, then you will have to detect your LAN newly in order to normally communicate with other computers.

To view the list of networks to which your computer belongs, click Options on the Toolbar, select the System tab and click Settings under LAN settings.

Detecting a LAN automatically

In the LAN Settings dialog, click Detect and will automatically detect the networks your computer belongs to and create a list of their IP addresses, specifying the default level of access for each detected network. You can then fine-tune the appropriate access levels for each network.

For to automatically detect a new network so you will not have to add it manually, select the Auto-detect new network settings check box and click OK to save this setting.

Adding a network address manually

If you prefer to add another network or remote host to the list and to configure a specific access level for it or if for some reason did not detect your networks automatically, you can do this manually. In the LAN Settings dialog, click Add and in the Network Address dialog specify the format you wish to use to enter its address. The following options are available:

  • Domain name. For example, www.agnitum.com. An active Internet connection is required in this case because the IP address needs to be looked up directly over the Internet. The IP address is saved along with the domain name you enter and it is this IP address that is used by .
  • IP address. For example, 216.12.219.12.
  • IP address with subnet mask. For example, 216.12.219.1 - 216.12.219.255.

Type in the desired address in the format you selected (wildcards are allowed) and click Add. You can add several addresses in sequence this way and then click OK to add them to the list in the LAN Settings dialog. Configure the appropriate access levels for each network and click OK to save the settings.

Removing an address from the list

You can remove a selected address or network from the list by clicking the Remove button. Actually removing the address from the list is similar to specifying the Limited Access to LAN level for that address (i.e. clearing both the NetBIOS and Trusted check boxes).

Note:

  • For details on configuring LAN access levels, see Specifying LAN Access Levels.


Specifying LAN Access Levels

All computers on a LAN can be assigned one of three levels of access regarding your computer:

  • NetBIOS access. Only File and Printer Sharing between the LAN and your computer is allowed. To set this level, select the NetBIOS check box for this address.
  • Trusted. All connections to and from the network are allowed. To set this level, select the Trusted check box for this address.
  • Limited Access to LAN. NetBIOS communications are blocked, all other communications are handled by application and global rules. To set this level, clear both the NetBIOS and Trusted check boxes for this address.

It is very important to remember that a host on a Trusted network is given the highest priority possible. Even restricted applications can communicate with a host. It is recommended to set only absolutely trusted computers as Trusted. If you just need File and Printer Sharing, use NetBIOS rather than Trusted.

If you do not want to clutter up logs with information about NetBIOS broadcast packets, you can specify to disable these data logging for each of the detected host or subnet. Select the address from the list and clear the Log NetBIOS broadcasts for selected host or subnet check box in the Information area. This will keep Log Viewer data more clear and may improve computer performance.

Note:

  • NetBIOS broadcast packets are inbound or outbound UDP packets with the sender's address belonging to the selected subnet and sent to 255.255.255.255 address from 137 or 138 port to the same port. Such packets, for example, are used by the client computers to reveal their presence in the network.
  • Please note that 's plug-ins are independent from the address access level. For example, even if you add www.agnitum.com to Trusted network addresses, the plug-ins will still block banners, active content, etc. from this site and perform their common activity regardless of the address access level.


Protecting Firewall Settings

enables you to protect the settings you specify from being altered without your authority. Being secured by a password, firewall settings cannot be changed by another person. You can, for example, block access to objectionable sites for your children and know that your settings cannot be tampered with.

Setting the password

To set the password, click Options on the Toolbar and select Enable under Password protection. Specify the password, click OK and confirm your password in the displayed window. Click OK once again to save the password, and it will start protecting your settings after you close the Options dialog. After that, every time somebody tries to gain access to the firewall settings or create a new configuration, he will be prompted for this password.

Changing the password

To change the password, click Options on the Toolbar, specify the password, and click Set password under Password protection. Specify and confirm the new password, then click OK. Changes will take effect after you close the Options dialog.

Disabling the password

To disable the password, click Options on the Toolbar, specify the password, and click Disable under Password protection. After you click OK, all firewall settings will be available to every person who uses the computer.

By default, your password protects your configuration settings only from being altered, but you can additionally protect the Log Viewer from being launched and 's service from being stopped by selecting the corresponding check boxes. This allows you to keep the system network history from being viewed by unauthorized persons and prevents the service from unloading and disabling its protection and the restrictions you set. This is most useful for parents who want to control their children's Internet access and employers who need to restrict the activities of their employees.

Note:

  • Please remember your password. If you forget the password, you will have to reinstall .


Plug-Ins

Along with 's main activity, its functionality is greatly extended by employing plug-in technology. Plug-ins are special modules that work with the main program to perform independent actions and providing additional functionality. This design strategy is very useful because you can smoothly disable some plug-ins if you do not need their functionality without stopping or disabling your computer security. Furthermore, plug-ins can be created by third party developers to increase 's capabilities even more.

To view a list of the installed plug-ins, expand the Plug-Ins tree node in the Left Panel. By default, the following plug-ins are installed:

  • Active Content. Gives you control of interactive elements (ActiveX, scripts, applets, etc.) web pages.
  • Ads. Blocks graphics banners and other advertisements to speed up your browsing of web pages.
  • Anti-Spyware. Detects, reports, and removes all known types of spyware from your system.
  • Attachment Quarantine. Scans, reports and handles files attached to e-mail messages, preventing malicious files from damaging your system.
  • Attack Detection. Detects, prevents, and reports various types of attacks against your system.
  • Content. Filters out web sites and pages that contain objectionable or abusive content.
  • DNS Cache. Caches the most frequently used DNS addresses to speed up Internet access.

You can manage each plug-in activity by configuring its settings. Right-click the plug-in in the left panel and select Properties to get access to its settings. See the corresponding sections for details on each plug-in functionality.

Adding and removing plug-ins

You can also take advantage of a third-party plug-ins created for . Please see http://www.agnitum.com/products/outpost/plugins3rd.html for information about available plug-ins.

To add extra plug-ins, click Options on the Toolbar and select the Plug-Ins tab. Click Add and browse to the plug-in file. After adding, the new plug-in will be displayed in the plug-in list. Click Start to enable the plug-in to perform its work. The Settings button opens the plug-in properties dialog.

If you need to stop a plug-in so it does not perform its activity or remove a plug-in from the interface, select it in the list and click the corresponding button.

Notes:

  • Plug-ins are absolutely independent from each other and from the main module. Any global rules or rules for an application that you create, or LAN settings you specify (such as Trusted setting, for example), will not affect any plug-in functionality.

  • If you are interested in developing plug-ins, please visit http://www.agnitum.com/products/outpost/developers.html for samples, tutorials and the developer's forum.


Blocking Active Content

Contemporary web site developers embed so called active elements in web pages to extend functionality, increase interactivity and improve usability. These elements include ActiveX, Flash, JavaScript, VBScript, and others. These technologies were developed to improve user experience as people browsed web pages, but hackers are now successfully using them to gain control of your computer. Active elements can pose a security risk to your system. Many sites also use them to display obtrusive, offensive or simply annoying ads, which can significantly decrease browsing speed.

The Active Content plug-in controls the operation of the active elements embedded in the web pages you are browsing or in the e-mail you are receiving so you can independently allow or block any of these elements. The following are controlled by this plug-in: ActiveX, Java applets, programs based on Java and Visual Basic scripts, cookies, pop-up windows, scripting ActiveX, external active content, referrers, hidden frames, animated GIF images, flash animations.

Configuring global filtering settings

The treatment of interactive elements can be independently configured for e-mail, news, and web pages. Select the Active Content plug-in in the Left Panel, right-click it and select Properties. Select either the Mail and News tab or the Web Pages tab and select the element type to manage. The right part of the window will show you the element description and the setting for each selection. By default, the use of all active elements is allowed for all web pages. To allow or block a particular active content element, select one of the available options:

  • Permit. Elements of this type are always allowed.
  • Prompt. prompts you before allowing an element of this type.
  • Block. Elements of this type are always blocked.

Click OK to save your settings.

Note:

  • The Prompt option is not available for hidden frames, animated GIFs, and external active content.

  • Some sites require that all or several of its active content elements be active for their pages to display or function correctly. If you make the settings for all sites very restrictive, you can experience the following problems: images not being displayed, a web page not showing at all, a web page displayed incorrectly or some useful services contained in applets not working. If this happens with only a few sites, just change this plug-in settings for those sites by adding them to the exclusions list as described below; otherwise you may need to loosen the default active content treatment policy.

Personalizing filtering settings for specific web sites

To set the policy for handling active content elements individually for a particular web site, select the Active Content plug-in in the Left Panel, right-click it and select Properties. Select the Exclusions tab, click Add and specify the address of the site you want to personalize the active content settings for. After clicking OK, the Edit Properties window for this site will be displayed allowing you to set how the site's active content should be treated. The site that you add is immediately given all the default active content settings. The settings are pretty much the same as the global site settings described above and the following options are available:

  • Permit. Elements of this type from this site are always allowed.
  • Block. Elements of this type from this site are always blocked.
  • Use global setting. Element behavior is defined by the global setting (displayed in brackets) for this site.

Note, that settings that inherit global values are displayed in gray; settings that are assigned unique values are displayed in blue. Make your choices (use the Restore Original button if you want to start from the global settings again) and click OK to save your changes.

You can later edit the site's active content settings selecting the site from the list and clicking Properties.

If you want to be able to individually configure each of the sites you visit, select the Add web sites to the exclusions list on the first visit to have display the Host Rules Assistant window each time a web page is first visited. Whether you select to Allow/Block all active content from the site, the site will be simply added to the exclusions list with the corresponding settings. Select Edit host settings to display the Edit Properties dialog in which you can customize the specific site's active content treatment settings as described above.

Note:

  • To see the elements that Active Content plug-in has blocked, select the plug-in in the Left Panel and click the Show Detailed Log button on the Information Panel. Log Viewer will start displaying the log for the Active Content plug-in. For more information about the 's log system, see Tracking Network Activity.


Blocking Advertisements

More and more web sites are filled with ads that often are very irritating, clutter up web pages with objectionable images and which can significantly slow down modem browsing.

The Ads plug-in can block the display of banner ads from certain advertisers speeding up web page download. Advertisements can be blocked using two criteria: by keywords found in the content of the downloaded web page or by size of the advertising image.

Blocking by keywords

The Ads plug-in blocks advertisements based on keywords found in Internet advertisement URLs located in the "IMG SRC=" and "A HREF=" HTML tags. If the banner URL contains one of the specified keywords, it is replaced with the text "[AD]" or with a transparent GIF image the same size as the ad image.

To enable blocking by content, open the plug-in properties by right-clicking it in the 's Left Panel and selecting Properties, then select the Block ads containing specific keywords check box on the Content Blocking tab.

You can also manage the list of keywords to be blocked. To add a word to the blocked list, type it in the provided text box and click Add. The word will appear in the list and any advertisement that contains this word, will not be displayed in the web browser. You can also edit and remove keywords from the list. To reset the list to its default state, click the Default button.

Blocking by image size

The Ads plug-in blocks advertisement images based on their size as specified within the "A" HTML tag. If the banner size matches one of the sizes on the list, it will be replaced with the text "[AD]" or with a transparent GIF image of the same size.

To enable blocking by size, open the plug-in properties by right-clicking it in the 's Left Panel and selecting Properties, select the Image Blocking tab, then select the Block images of specific size check box.

By default, standard size ad images are already blocked. To block a banner with a different size, specify its width and height in the fields provided and click Add. The size record will appear in the list and any advertisement of this size, will not be displayed in the web browser. You can also edit and remove sizes from the list. To reset the list to its default state, click the Default button.

Ad replacement options

The Ads plug-in gives you the option to either replace banner ads with text "[AD]" or with a transparent image the same size as the banner. To set the replacement option, select the Miscellaneous tab in the plug-in properties window and make your selection under Replace advertising images.

Note that although replacing banner ads with transparent images greatly increases your comfort level while browsing by removing annoying graphics, you may prefer to replace banners with the "[AD]" text links so you can navigate them.

Specifying trusted sites

If you experience problems viewing specific sites because most of the sites' images are filtered out, you can add those sites to the list of trusted sites to stop the plug-in from blocking their graphics. To add a site to the list, click Edit List under Trusted sites on the Miscellaneous tab and specify the site name. Click Add to add the site to the list and OK to close the window. No ads on trusted sites are blocked.

Blocking ad objects

Modern Internet advertisements are not limited to graphic banners; various ActiveX objects are also used to display ads. An example is the broadly used Macromedia Flash, which consumes much more system resources and network bandwidth than traditional banners and is not blocked by most ad removal software.

can and does block such advertisements that are generated by various web page ActiveX objects thus conserving your system resources and traffic bandwidth. To enable objects blocking, select the Block advertising objects check box on the Miscellaneous tab of the plug-in properties.

Exporting and importing plug-in settings

You can save (export) a plug-in configuration to a file and later load it back (import it) from a previously saved export. This feature is used if you want to quickly switch between various plug-in configurations. For example, you can have one configuration that blocks adult content, another that blocks advertisement content and another that blocks any other sort of undesirable content. This feature also helps you transfer a configuration from one computer to another and can simplify the initial configuration of on new computers added to your network.

To export or import a plug-in configuration, click either Export or Import button on the Export/Import tab of the plug-in properties. Specify the file name you are saving to or loading from and click OK.

You can also download a complete set of ad blocking keywords from the forum (AGNIS list) using the link provided in the plug-in properties window.

Note:

  • Banner ads are blocked according to the settings you specify. Therefore, some legitimate images could be blocked if the setting is too broad, such as adding the word "image" to the list of keywords. At the same time, some ads might not be blocked with the plug-in default settings.

  • To see the elements that the Ads plug-in has blocked, select the plug-in in the Left Panel and click the Show Detailed Log button on the Information Panel. Log Viewer will display the log for the Ads plug-in. For more information about the 's log system, see Tracking Network Activity.


Protecting against Spyware

Spyware is a growing problem that has affected many personal computer users. In increasing frequency users are confronted (unknowingly generally) by malicious programs that collect information about their web surfing stats, their computers' installed applications and other private data that is sent to third persons afterwards, spyware that tracks their actions without their consent. Spyware can change e-mail texts, modify files on your hard disk, display annoying ads, change your browser's homepage. If all those weren't enough reasons to be alarmed, resident spyware requires system resources, which slows down your computer dramatically in some cases.

Anti-Spyware plug-in is designed to prevent you from unwanted and unauthorized actions performed by spyware. It eliminates abusive ads and protects your private data from being seen by spyware and Trojans.

Note:

  • Please see User's Guide for detailed information about spyware threats.


Performing a System Scan

If you did not perform a system scan when you installed , it is recommended to run a full scan just after installation to check the system for whatever spyware it already has on it. To do this, start On-Demand Spyware Scanner by selecting the Anti-Spyware plug-in in the tree and then click the Run System Scan button in the Information Panel. The wizard will help you specify the scanning settings and guide you through the whole process of the system scan.

Selecting Scan Type

The first step lets you to select the type of system scan. The following options are available:

  • Quick system scan. This option performs a fast scan of your system by checking only the most vulnerable points (such as running processes in memory, susceptible registry keys, target files and folders). This option is recommended for every day usage.
  • Full system scan. A full system scan is a deep analysis of the registry and file system as well as some extra checks (processes in memory check, cookies scan, startup entries scan). This check should be performed when you scan your system for the first time. The operation can take a considerable time depending on the speed of your processor, the number of applications you have on your computer and the amount of data you have on your drives.
  • Custom scan. This option enables you to select the locations to be scanned explicitly. You can select either of the options above or you can choose specifically what to scan on your file system.

Select the scan type and click Next. If Custom scan is selected, the Select Objects to Scan step appears allowing you to explicitly select the objects to be scanned. Click Select folders to select specific disks, folders, and files to be scanned. In the Select Folders window, browse to and select the particular locations. If you want to scan specific files, select the Show files check box to display the files as well. Click OK after making your selections.

Once you have specified the locations to scan, click Next to start the process.

Performing a Scan

After you specify what to scan (see above), clicking Next, starts the scanning process. Stats are displayed on the progress step of the total number of objects scanned and the number of detected potentially malicious objects.

The scanning process can run in background mode. If you want to work with while the scan is underway, click the Background button and the wizard will be minimized to the progress bar on the Information Panel. To see the full window again, click Show Wizard.

You can abort a scan and see its results at any time by clicking Cancel.

When the scan is complete, a list of detected objects (if any) is displayed automatically. If your system is clear (i.e. no suspicious objects are found), just the stats of the scan are displayed.

Removing Detected Spyware

The Select Objects to Remove step lets you view whatever spyware was detected so you can remove it from your system. Next to each spyware is displayed its degree of risk, the category it belongs to, and the number of hits—the number of places on your computer the object was found. Double-click the object to see a listing of where it is located on your computer.

Select the objects you want to remove and click Next. They are then removed from the places they are registered in and from memory and are placed in quarantine so you can restore one of them later if you find your favorite software won’t work without it or you can delete them completely if all is well. While in quarantine, spyware has no effect on your system. Details on using spyware quarantine are below.

The software that you did not select for removal will be left intact and will continue their activity in your system.

Tip:

  • In the case you know about some of the found programs that they are not a sort of spyware but a legitimate software and do not want to treat them as spyware (for example, you want to see ads displayed by some adware program), you can add such programs to Ignore list. will ignore the programs on the list displaying no alerts on detecting their activity. Also these programs will not be displayed in the list of detected spyware. To add a program to ignore list, right-click its name and select Add to Ignore List. The record for this program will be removed from the detected spyware list.
    • You can later remove program from the Ignore list using the Edit button on the General tab of plug-in properties.

Important:

  • In fact, cookie is not a spyware but can be used to steal private information from your computer. Spyware programs installed on the computer can write the information into the cookie files, and on visiting the corresponding site, the information can be sent to the third party person.

Viewing the Scan Results

The last step of the wizard displays the scanning report where you can see the number of detected, removed, and quarantined spyware and other scanning details. After viewing the results, click Finish to close the wizard.

Note:

  • To see the objects that the Anti-Spyware plug-in has detected and removed, select the plug-in in the Left Panel and click the Show Detailed Log button on the Information Panel. Log Viewer will display its log for the Anti-Spyware plug-in. For more information about the 's log system, see Tracking Network Activity.


Real-Time Protection

Anti-Spyware plug-in provides the real-time non-stop protection against spyware. When real-time protection is enabled, all system vulnerable objects are permanently monitored to ensure the spyware is detected before performing any malicious activity.

To enable the real-time protection, open the plug-in properties by right-clicking the plug-in in the tree and selecting Properties and select the Enable real-time protection check box. You can customize the plug-in behavior on detecting the spyware using the options in this dialog. The following actions can be performed on detecting the suspicious program:

  • Prompt. On detecting the suspicious program(s), the dialog box will be displayed to the user asking him for an action.

    Show me prompt window

    To remove all the detected spyware from your computer, click Remove All. If you want, you can view the list of detected spyware programs and remove the programs selectively by clicking the More button, highlighting the spyware in the list and clicking Remove by its side. If you consider some of the detected programs as legitimate software which are not a sort of spyware and do not want to treat them as spyware (for example, you want to see ads displayed by some adware program), you can add these programs to Ignore list by clicking Ignore next to them. will ignore the programs on the Ignore list displaying no alerts on detecting their activity. You can later remove program from the Ignore list using the Edit button on the General tab of plug-in properties. To add all the detected spyware to Ignore list, click Ignore All.

  • Remove automatically. On detecting the suspicious program, the corresponding object will be automatically removed. It is not recommended to select this option as you can remove some legitimate programs.

    In this mode, you can set the visual alerts to be displayed and sound alerts to be played on detecting the spyware by clicking the Alerts button and selecting the corresponding check boxes. will display visual alert and play the specified sound file each time the spyware is detected and removed. This allows to get to know which programs you run and sites you visit pose you under the risk.

You can also specify to automatically scan processes requiring network access for which no rules exist. Select the Scan processes asking for network access check box and you will see the result of the spyware scan in the Rules Wizard window header each time some application requires the connection for the first time. This will keep spyware protection levels high even if the real-time spyware protection isn't running due to performance impact.

Note:

  • To see the objects that the Anti-Spyware plug-in has detected and removed, select the plug-in in the Left Panel and click the Show Detailed Log button on the Information Panel. Log Viewer will display its log for the Anti-Spyware plug-in. For more information about the 's log system, see Tracking Network Activity.


Spyware Quarantine

's default procedure is for removed spyware to not be deleted completely but placed into a special isolated storage ("quarantine") so it can be restored later if you find an application you depend on will not function without its associated spyware. This will let you recover the data that application locked so you can then uninstall it and find another app that doesn’t use spyware. Objects in quarantine do not pose any threat to your computer.

To have put all removed items into quarantine, open the plug-in properties and select the Quarantine object before removal check box. When this check box is selected, you can see quarantined objects in the Quarantine in the main window. Every spyware program is represented in the quarantine list only once despite the number of separate signatures detected. The date and time each object was quarantined is displayed. If the check box is cleared, all the items will be completely deleted from the system after removal.

Each item can be restored from quarantine to resume its normal operation on your computer. To restore an item, click the Restore link next to it. Registry keys and INI files will be restored to just before they were quarantined.

You can restore a program and add it to the Ignore list to make ignore it as spyware by selecting the Restore and Add to Ignore List command on the item's shortcut menu. You can also remove the item permanently by clicking its Delete link. To delete all the quarantined objects, use the Clear Quarantine command on the plug-in's shortcut menu.

Note:

  • There are some spyware programs that cannot be placed into quarantine.


Blocking Private Data Transfers

lets you specify the personal data that is never to be transmitted by your computer through Internet browsers, instant messaging software, e-mail clients or any other applications. This provides protection against identity theft through abuse of credit card account details, passwords, or other unique and valuable personal information.

To protect your private data, select the ID Block tab of the plug-in properties window, and select the Block private data transfer check box. Click Add and under Data to protect enter any combination of symbols, letters or digits you do not want to leave your computer. Give a description to identify the string later and the category it belongs to. After clicking OK and applying changes, that string will be blocked from any outgoing communication.

You can have alerts displayed each time an attempt is made to transfer one of the specified strings from your computer by selecting the Show visual alert check box. If you select the Replace transferred ID with asterisks instead of blocking check box, any requesting source will receive only asterisks in place of the data.


Blocking Harmful Attachments

One of the simplest ways for worms, Trojans, and other malware to get to your computer is through e-mail attachments. Hundreds of self-replicating programs use e-mail and address lists of unlucky users to distribute themselves throughout the Internet and/or a local network. A user needs only to launch the file attached to a received e-mail and the worm or virus starts performing its malicious actions resulting in system infection and malfunction.

The Attachment Quarantine plug-in protects you from attachments containing viruses, worms, and Trojans, checking files attached to e-mail arriving to your computer and quarantining those which recognizes as potentially dangerous. With this plug-in, you can specify that attached files are to be renamed so they cannot harm your computer as well as to alert you with appropriate messages. Each attachment type can be treated individually based on its file extension.

Specifying the attachment type to monitorr

comes already configured with the most common file types. If you do not see a file type that you want to set rules for, you can create a new rule for that file type by right-clicking the plug-in in the left panel, selecting Properties and clicking the New button.

Enter the attachment extension in the Specify file type field, give an appropriate description and click OK. Highlight the rule you created and select the action you want performed when these attachments are received. The following actions are available:

  • Rename It. The attachment will be renamed so it cannot harm your computer. When you go to open such a file, you will be asked whether you trust the source the file is from.
  • Report It. An alert will be displayed when receiving such an attachment.

You can edit the list of attachment types and remove some file extensions or reset the list to its default state by clicking the corresponding buttons.

Note:

  • To see a list of attachments that the Attachment Quarantine plug-in has blocked, select the plug-in in the Left Panel and click the Show Detailed Log button on the Information Panel. Log Viewer will display its log for the Attachment Quarantine plug-in. For more information about the log system, see Tracking Network Activity.


Preventing Network Attacks

A major function of firewall protection is inbound filtering, which controls all incoming activity to block hackers and malicious programs when they try to attack your computer.

The Attack Detection plug-in detects, prevents, and reports all possible attacks on your computer from the Internet or the network your computer is connected to. It screens inbound traffic and determines its legitimacy either by comparing it against a set of known attack patterns or by performing behavior evaluation analysis. The Attack Detection plug-in can detect not only every known type of attack (such as port scanning, Denial of Service (DoS) attacks, attacks of 'short fragments' and 'my address' classes, and many others) but future exploits as well.

Setting port scanning alarm level

You can define how sensitive should be in detecting attacks by setting the desired alarm level. The alarm level determines the number of suspicious packets detected before reports an attack is detected. To set the alarm level, right-click the plug-in in the Left Panel and select Properties. Move the slider to one of the following values:

  • High. An attack alert is displayed even if a single scan of one of your ports is detected.
  • Normal. An attack alert is displayed only if several ports are scanned or if a specific port is scanned that recognizes as one commonly used in attacks.
  • Low. An attack alert is displayed only if a multiple attack is definitely detected.

Change the alarm level depending on the risk your computer runs or if you are suspicious, set the level to high.

You can also adjust the 's sensitivity to attacks, by specifying the number of suspicious packets required for an alarm at each level. To do to this, click the link under the slider to set the numbers.

To receive visual and/or sound alerts about detected attacks, select the Show visual alert when attack is detected and/or the Play sound alarm when attack is detected check boxes.

Blocking attackers

After detects an attack, it can change its behavior to automatically protect you from any future attacks from the same address. To do this, select the Block intruder for check box and all traffic from the computer attacking yours will be blocked for the number of minutes you designate. The default value is 5 minutes.

You can also set to block the entire subnet the attacker's address belongs to by selecting the Also block intruder subnet check box.

Protecting from Ethernet attacks

When data is sent from one computer to another over a local network, the sending machine broadcasts an ARP (IP-to-Ethernet address lookup) request to determine the MAC address based on the IP address of the target machine and waits for it to send back its MAC address. During the time between the packet broadcast and the MAC address response, data is vulnerable to tampering, hijacking, and/or redirection to an unauthorized third party.

The Attack Detection plug-in also protects your system from invasions on a local network. It detects and blocks Ethernet attacks such as IP spoofing, ARP scanning, ARP flood and others by inspecting your Ethernet and/or Wi-Fi connections. To specify the Ethernet attack prevention settings, select the Ethernet tab in the plug-in properties window. The following options are available:

  • Enable smart ARP filtering. Prevents ARP spoofing - where a node starts sending a huge number of ARP replies with varying MAC addresses in a short time span, trying to overload the network equipment as it tries to determine which MAC address actually belongs to the node. If enabled, only permits incoming replies from other hosts for which there was a previous outgoing request. Only the first ARP reply is accepted for each request. Smart ARP filtering also protects from ARP cache poisoning, which occurs when someone succeeds in intercepting Ethernet traffic using fake ARP replies in an effort to change the address of a network card to one that an attacker can monitor. Additionally, it prevents ARP floods - where a huge number of bogus ARP replies are sent to the target machine freezing a system.
  • Detect IP address spoofing and block IP flood. Detects when an attacker falsifies or forges his IP address and blocks abnormal volumes of traffic which may otherwise overload a computer. This option cannot stop the network from being flooded but can protect the PC from overload.
  • Prevent gateway network adapter MAC spoofing. Detects any attempt by an attacker to associate a gateway network adapter IP address with their own MAC address to allow them to intercept packets. Hackers can substitute legitimate MAC addresses with ones of their own and reroute legitimate traffic to a hacker-controlled machine, by sending out forged ARP responses which will detect and block. This ARP spoofing enables hackers to be able to 'sniff' (read) packets and view any data in transit, to direct traffic to non-existent hardware causing delays in data transmission or a denial of service on the affected equipment. Specialized hacker sniffing programs can also intercept traffic, including chat sessions and related private data such as password entries, names, addresses, and even encrypted files, by modifying MAC addresses at the Internet gateway.
  • Protect my IP addresses from being falsely reported as used. Detects cases where two or more hosts share the same IP address. This can be due to an attacker attempting to gain access to network traffic or block a computer from accessing the network, but could also happen legitimately where an ISP uses multiple servers for load-sharing. If enabled, blocks ARP replies that have the same IP (but different MAC's) and thus protects computer from the IP address duplication consequences.
  • Block hosts enumerating other computers on LAN. Limits the number of ARP requests enumerating IP addresses from one MAC address during a specified time interval which can imply network scanning. Some massively propagating viruses use mass host enumeration to hop from one computer to another, infecting them as they go. This technique is also used by scanners and vulnerability analyzers.

Specifying attacks to detect

You can designate what attacks is to detect and block. By default, more than fifteen different types of attack or exploit are handled, but you can select not to detect certain types to lower your system resource usage or to stop too-frequent or faulty alert messages that may appear if, for example, a trusted service in your network is falsely perceived as an attack source.

To customize the attack detection list, select the Advanced tab of the plug-in properties window and click Edit list under Attacks list. Click Advanced to set some extra settings such as attack duration time and click OK in both windows to save the settings.

Paying special attention to vulnerable ports

From the security point of view TCP and UDP ports in your system are divided into several groups according to probability of an attacker to use a port to break into your system. Typically, ports assigned to vulnerable services like DCOM or RPC should be monitored with greater care because they are more likely to be an attack target.

However, you may have custom services assigned to custom ports that are also a lure for an attacker. The Attack Detection plug-in lets you set selective preferences for different ports and create a list of ports to which it will pay more attention while monitoring network traffic.

To specify a port that you consider vulnerable, select the Advanced tab of the plug-in properties and click Specify under Vulnerable ports. Vulnerable ports are divided in two groups: system ports and Trojan ports. Add ports that are used by vulnerable system services to the system ports list. Add ports that are exploited by well-known Trojan horses to the Trojan ports list. Select the tab according to the list you want to change.

To add a port, click Add and specify the following parameters: protocol, port number and weight. Weight is a decimal value that indicates that port's importance. A greater number indicates a more vulnerable port. You may also add optional comments in the corresponding field to describe the port's purpose or anything else you'd like noted.

Specifying trusted hosts and ports

There may be computers that you are absolutely sure are not a source of danger to your system as well as ports on your system you are sure cannot serve as an intruder's backdoor. In other words, you consider any monitoring of these hosts and ports unnecessary and prefer to conserve system resources and performance by not monitoring them. The Attack Detection plug-in features exclusion lists to which you can add hosts and ports you don't want to be monitored.

To add a host or port to the trusted list, click the corresponding button under Exclusions on the Advanced tab of the plug-in properties and add the desired host or port.

Note:

  • To see a list of attacks the Attack Detection plug-in has blocked, select the plug-in in the Left Panel and click the Show Detailed Log button on the Information Panel. Log Viewer will display its log for the Attack Detection plug-in. For more information about the 's log system, see Tracking Network Activity.


Blocking Web Content

Many web sites contain undesirable content with a lot of tempting banners and links leading your child to information you do not want your children to view.

The Content plug-in keeps them from objectionable content by blocking the display of particular web sites or pages containing unacceptable material. The Content plug-in blocks web pages and sites based on keywords contained on those pages or in the page’s URL. It displays your specified warning message in the browser window every time a page with objectionable content is visited.

Blocking by keywords

You can specify the list of keywords to be used by the plug-in to block web pages. If a web page contains any of the keywords, it will not be displayed in the web browser. To enable web site blocking by keywords, right-click the plug-in in the left panel and select Properties. On the Block by Keywords tab, select the Block web pages containing specific keywords check box.

You can also manage the list of keywords to be blocked. To add a word to the block list, type it in the provided text box and click Add. The word will appear in the list and any page containing any of the words on this list, will not be displayed in the web browser. You can also edit and remove keywords from the list.

Blocking by URL

The Content plug-in also blocks specific web sites according to their URL. You can specify the strings contained in the URL that you do not want to be displayed (e.g. explosive or porn). If a web page has an address (URL) that contains one of the specified words, it will not be displayed.

To enable, web site blocking by URL, right-click the plug-in in the tree and select Properties. On the Block by URL tab, select the Block sites with specific keywords in address check box.

To list a particular web site or part of an address that you do not want to be displayed on your computer, type in the string in the provided text box and click Add. The string will appear in the list and any page containing any of the words on this list in its address, will not be displayed in the web browser. You can also edit and remove keywords from the list.

Note:

  • It is not necessary to add "*" symbols in the word you enter because the Content plug-in will search the whole URL for the string you enter. For example, if you add "explosive" the following sites will be blocked: www.how-to-make-explosive.com, www.explosive.example.com, www.explosivetutorial.net and all others that have the "explosive" sub-string in their addresses.

Changing content blocking message

The Content plug-in enables you to specify a custom message to be displayed in the browser window every time a page with objectionable content is accessed. To change this message text, select the Miscellaneous tab of the plug-in properties window and click Edit under Message. Specify your message and click OK to save it.

Specifying trusted sites

If you need to browse some web pages regardless off its content, you can add those pages to the list of trusted sites to stop the plug-in from blocking them. To add the site to the list, click Edit List under Trusted sites on the Miscellaneous tab and specify the site name. Click Add to add the site to the list and OK to close the window. No sites on the trusted sites list are blocked.

Exporting and importing plug-in settings

You can save (export) the entire plug-in configuration to a file and load it back (import it) from a previously saved export. This feature can be useful if you want to quickly switch between various plug-in configurations. For example, you can have one configuration that blocks adult content, another that blocks advertisement content and another that blocks any other sort of undesirable content. This feature also helps you transfer a configuration from one computer to another and can simplify the initial configuration of on new computers added to a network.

To export or import a plug-in configuration, click either Export or Import button on the Export/Import tab of the plug-in properties. Specify the file name you are saving to or loading from and click OK.

Note:

  • To see the pages the Content plug-in has blocked, select the plug-in in the Left Panel and click the Show Detailed Log button on the Information Panel. Log Viewer will display its log for the Content plug-in. For more information about the 's log system, see Tracking Network Activity.


Managing the DNS Cache

The Internet works by assigning a series of numbers to each computer connected to it. This is called the IP address. An example of an IP address is: 192.0.2.178. You can simply type in this series of numbers into your browser address bar and press Enter and your browser will go to that computer web pages.

Although these numerical IP addresses are easy for a computer to use, they are difficult for us humans to remember. So an address system was invented that uses words or letters called the DNS (Domain Name System). A DNS name is what you are probably more familiar with than IP numbers. An example of a DNS name is: www.agnitum.com.

DNS names are much easier for us to remember, but our browsers still need to use the IP address to find and transfer files on the Internet. Therefore, there are databases throughout the Internet that keep track of what IP address goes with what DNS name. To find the IP address that corresponds to a DNS name, sometimes your browser has to consult several different databases located at different places on the Internet and this often takes time.

To speed things up, the DNS Cache plug-in provides a personalized look-up table of DNS addresses on your own computer. This is called a domain name cache and you can customize it however you like.

DNS Cache maintains the cache automatically within your specifications to include those addresses that are most recently used by you. The amount of time that a DNS address is saved in the cache depends on the time you specify as one of the settings for this plug-in. It also depends on how many DNS names you want to keep track of. Only the most recently used names are kept, up to the maximum number of entries you specify.

Managing DNS Cache

To enable the DNS cache, right-click the plug-in in the Left Panel and make sure Enable DNS Caching is selected. You can set the limit of the DNS cache database specifying the amount of records the plug-in should store and/or their expiration time. Select the Limit DNS cache to and/or the DNS records expire in check boxes and specify the corresponding number of records to store and number of days after which the address will be deleted from the database. Number of days is counted from the last day your computer used this record.

Note:

  • It is recommended that you do not set an unlimited cache size and expiry period by clearing these check boxes.

Blocking malformed DNS requests

A DNS service can be a source of potential threat to your computer security because a malformed DNS request can hang your system or allow it to execute arbitrary malware code. The DNS Cache plug-in protects your system from malformed DNS requests and prevents their potentially disastrous consequences. To enable this protection, select the Verify and block malformed DNS requests check box in the plug-in properties window. Also, you can specify to block extra long DNS requests, which can be an attempt to send out your private data as the domain name of a fourth or higher level. To do that, select the Block extra long DNS requests check box.

If you wish to stay informed about blocked requests, select the Alert about blocked DNS requests check box to have an alert pop-up each time a malformed DNS request is blocked.

Viewing the DNS cache

To view and edit the DNS cache database, click Edit under DNS records on the Miscellaneous tab of the plug-in properties. All the DNS records stored in cache are listed. You can remove records selectively or clear the entire cache by clicking the corresponding buttons.

Creating an exclusion list

If you do not want to cache DNS records of a site (for example, when a site's IP address changes too frequently or its resolution speed is acceptable and you want to conserve cache space for slower sites) you can add the site to the exclusion list. To add a site to the list, click Edit under Exclusion list on the Miscellaneous tab of the plug-in properties and specify the site URL. Click Add to add the site to the list and OK to close the window. The site address will no longer be cached.

Note:

  • To see the addresses the DNS Cache plug-in has cached, select the plug-in in the Left Panel and click the Show Detailed Log button on the Information Panel. Log Viewer will display its log for the DNS Cache plug-in. For more information about the 's log system, see Tracking Network Activity.


Tracking Network Activity

For your convenience all network-related actions and events occurring on your computer are logged in details and can be viewed using a special application called the Log Viewer, which shows every application and connection that was allowed or blocked by , the specific activities of each plug-in, the start of every program and all changes made to policies, configuration settings and passwords.

Log Viewer allows for flexible customizing of its data display so you can view only the information you need, sort it the way you need. It lets you filter data by any parameter - port, host, application and others.

To start Log Viewer, select Log Viewer on the Tools menu in Main Window.

Note:

  • logs can also be viewed via the Microsoft Management Console (MMC) snap-in.
    • To view the logs through MMC, open the MMC console, select Add/Remove Snap-in on the File menu, click Add and select Logs from the list. Click Add, Close and OK to add the snap-in to the console.


Log Viewer Interface

When you launch Log Viewer, its main window is displayed. From the main window you can select the log, viewing information and modify the Log Viewer settings. In general, the elements of the Log Viewer main window are similar to the elements of main window and are managed similarly.

Show me the Log Viewer main window

To display Log Viewer when is minimized to the system tray:

  1. Right-click the firewall's system tray icon.
  2. Select Show Log Viewer.

The Log Viewer main window contains:

Menu bar

The menu bar contains different commands for working with Log Viewer.

The Toolbar

See The Toolbar section for details.

Folder bar

Displays the name of the tree node currently selected in the Left Panel.

Left Panel

See the Left and Information Panels section for details.

Information Panel

See the Left and Information Panels section for details.

Status bar

The status bar is the bottommost part of the Log Viewer main window used to display the current state, the number of the selected record and the total number of records displayed in the Information Panel.

Show me the status bar


The Toolbar

The Toolbar is close to the top of the main window. You can see what each button does by holding your cursor over it for a second or so.

Show me the Toolbar

Show me all the buttons found on the Toolbar

Button | Function
 | Goes back to the previous selected log.
 | Goes forward to the next selected log.
 | Goes up one level.
 | Shows or hides the Left Panel.
 | Exports the selected log to a text file.
 | Automatically refreshes the log.
 | Activates the Log Viewer context help.

Note:

  • Only some of these buttons are visible (active) at any one time, depending on what is highlighted in the Left Panel or the Information Panel.


Left and Information Panels

To represent the collected information in a user-friendly manner, Log Viewer uses two panels. The Left Panel is similar to the Left Panel of Windows Explorer. It provides a listing of the logs and filters. Information Panel gives specific data stored in any log highlighted in the Left Panel.

Show me the panels

As with Windows Explorer, any line that starts with a plus sign ( [image]) can be expanded to show each of its subcategories. Any line starting with a minus sign ( [image]) shows that the line has already been expanded. By clicking on the minus sign, all of its subcategories can be hidden to conserve screen space.

By default, Left Panel lists and the Information Panel displays the contents of the following logs:

Alerts Tracker

Displays all the visual alerts shown to the user.

Allowed Connections

Displays all the connections that has allowed.

Anti-Leak

Displays all the events of 's Anti-Leak Control.

Blocked Connections

Displays all the connections that has blocked.

Component Control

Displays all the events of 's Component Control.

Plug-Ins

Each plug-in has its own log:

Active Content

Displays the the interactive web page elements that were blocked based on the settings for Java, VB Script, ActiveX and other active content elements. For information about the Active Content plug-in, see Blocking Active Elements.

Ads

Displays all the ads that were blocked. For information about the Ads plug-in, see Blocking Advertisements.

Anti-Spyware

Displays all spyware objects that were detected and removed/quarantined from your computer. For information about the Anti-Spyware plug-in, see Protecting against Spyware.

Attachment Quarantine

Displays all the e-mail file attachments that were neutralized and quarantined from your computer. For information about the Attachment Quarantine plug-in, see Blocking Harmful Attachments.

Attack Detection

Displays every suspicious activity and attacks on your computer from the Internet, the ports involved and where the attacks are from. For information about the Attack Detection plug-in, see Preventing Network Attacks.

Content

Displays the web sites or pages that were blocked by this plug-in and the reason why. For information about the Content plug-in, see Blocking Web Content.

DNS Cache

Displays the web addresses saved by to speed up your Internet connection to those sites. For information about the DNS Cache plug-in, see Managing DNS Cache.

System Log

This is a record of every program started and every change made to the firewall policies, program options and configuration settings.

For each group of logs (except the Alerts Tracker, Component Control, and System Log), several helpful filters are created by default.

Note:

  • You can create your custom filters based on your own needs and add them to the groups in the Left Panel.


Creating Multiple Configurations

The exact state of at any moment of time is represented by all of its settings, which include: application and global rules, LAN settings, plug-in exclusion lists, etc. The totality of these settings is called the configuration. The first configuration is created during installation. You can always modify any of the settings and even create different configurations for different activities. This allows for separate configurations for each computer user; configurations to prevent children from accessing unacceptable sites, from playing online games or chatting if they use their parent's computer. This makes it easy to transfer configuration settings from one computer to another and easy to back up your configurations. Switching between configurations is very quick.

To create a new configuration, select New Configuration in the File menu. The Configuration Wizard will help you create a new configuration.

The Configuration Wizard provides two ways to configure your firewall: automatic configuration or by letting the Configuration Wizard help you. The first step lets you select whether you want to create a configuration automatically or specify each of its settings manually.

Automatic configuration

You can select an automatic configuration that conforms to the security level you'd prefer. Two levels are available: Advanced security provides the best protection against all penetration techniques that are often used by malicious software to bypass firewall software and Normal security ensures protection only against the more dangerous techniques (for details, see Protecting from Malicious Process Activity). Normal security has a reduced number of product prompts that require your response and is recommended for most cases.

Automatic configuration is much faster than custom. After you select either Advanced security or Normal security and click Next, the Rules Autocreation step is displayed, which allows you to enable rules autocreation, so that global rules and rules for well-known applications are created automatically when they first request an action (for example, network access or process memory modification). If you do not want to enable rules autocreation, select Use predefined rules for detected applications for the rule sets to be created according to our engineers' built-in presets in order to provide optimal system performance and application security.

At this step, you can also join ImproveNet program to improve quality, security and control features of products by selecting the Help make program better check box. For details, see ImproveNet.

After clicking Next, automatically scans your system and adjusts all its settings without your supervision. It configures network settings, builds the Component Control database, and, in case you selected to use predefined rules, searches for known applications installed on your computer that might require Internet access and configures an appropriate the network access level for each of them.

Note:

  • If Normal security level is selected, some of the more exotic security test programs (leaktests) will be failed.

Custom configuration

If you select Custom configuration, the Configuration Wizard will guide you through the configuration process, allowing you to fine-tune the firewall for each of your specific needs, as well as select the specific configuration settings for each of the networks to which your system is connected and for each of your installed network-enabled applications. By modifying these configuration settings you can define the precise security levels that provides. The wizard lets you produce a fully customized configuration, but it takes considerable time and assumes you have advanced knowledge of Windows and your system.

After clicking Next, the Rules Autocreation step is displayed allowing you to enable rules autocreation, so that rules for well-known applications and global rules are created automatically when each application first requires an action (for example, network access or process memory mdification). If you do not want to enable rules autocreation, select Use predefined rules for detected applications for the rule sets to be created according to our engineers' built-in presets to provide optimal system performance and application security.

At this step, you can also join ImproveNet program to improve quality, security and control features of products by selecting the Help make program better check box. For details, see ImproveNet.

Click Next and will automatically detect your network environment. On the Network Configuration step you will see a list of the networks to which your system is connected. To view and edit the network settings, click the Change button. You can change these settings at any time when working with . For details see Configuring Local Network Settings.

If you selected to use predefined rules, after clicking Next, starts searching for the known applications installed on your computer, which might require Internet access, and configures a network access level for each of them. On the Searching for Applications step you can view a list of those applications and edit each suggested security rule using the Details button. You can cancel rule configuration for a specific application by simply clearing the check box to the right of its name. Click OK to save and Next to proceed. You can change these settings at any time when working with . For details see Managing Applications Network Access.

After clicking Next, the Component Control database is collected and the wizard automatically proceeds to the last step.

On the final step you can configure other settings, such as firewall policy, global rules, and others by clicking the Advanced button. The Options dialog then lets you alter any settings. By default the created configuration is called configurationN.cfg (where N is an increasing index) and is saved in the installation folder. If you prefer to save it to another location, click Change and specify its path.

Click Finish to apply the changes and save the configuration.

You can create several configurations based on the current settings simply by giving each a different name using the Save Configuration As command on the File menu. To change to a new configuration, select Load Configuration on the File menu and select the configuration file you want or simply select the configuration name on the File menu.

A configuration can be protected from being modified or swapped by specifying a password. For details see Protecting Firewall Settings.

Note:

  • When exiting , the configuration file that is currently in use is saved so it will be automatically loaded the next time is started.


Agnitum ImproveNet

ImproveNet

We invite you to contribute to a safer Internet through the free and cooperative ImproveNet program to improve the quality, security and control features of products. There is no work on your part. You simply agree to have some non-personal data anonymously collected each week to expand ’s database of known applications, so that many more automatic rules are available to you. This will reduce the number of dialog pop-ups that require your attention.

With your consent, will collect information only about applications on your computer. The data is collected completely anonymously, which means that no name, no address, no network identification nor any other personal or identifying information will be collected of any kind whatsoever. simply collects data on network-enabled applications for which no rules presently exist, any new system rules created, and general application usage stats. The information is compressed and sent once a week to as a background process so your computer use is not interrupted or disturbed in any way.

After a new rule has been received and validated by , it is automatically shared with all other users via Update along with other product updates.

To help us better serve the Internet community, please join the ImproveNet program. Simply select the Help > ImproveNet menu command and select the Help make program better check box. You can disable this feature at any time simply by clearing this check box.


Contacting Technical Support

If you need assistance in working with , please visit the support page at http://www.agnitum.com/support/index.php. Among available support options are the knowledge base, documentation, support forum, product-related web resources, and direct contact with support engineers.

Please note, that if you are using Outpost Firewall Free, cannot also supply free personalized support.


.//============== opst_ui ==============
.topic 0x00010153
Click to update the product.

.topic 0x00010152
Click if you do not want to perform update.

.topic 0x00000001
Closes the dialog box and saves any changes you have made.

.topic 0x00000002
Closes the dialog box without saving any changes you have made.

.topic 0x808b0004
Applies and saves any changes you have made without closing this dialog.

.topic 0x000100dc
Allows to add an application to the list.

.topic 0x000100db
A list of possible actions that are possible for the application.

.topic 0x000100f9
A list of events that are possible for the application.

.topic 0x00010118
The name of the rule.

.topic 0x00010137
A description of the rule.

.topic 0x0001011d
An input field for your new password.

.topic 0x0001011e
An input field for your old password.

.topic 0x0001014f
An input field to confirm your new password.

.topic 0x000100f6
Activates password protection.

.topic 0x000100f3
Deactivates password protection.

.topic 0x0001013e
Lets you set a password.

.topic 0x00010113
Specifies that the close button is to minimize the Outpost Firewall Pro window rather than exit the application.

.topic 0x00010114
Specifies that Outpost Firewall Pro is to be started minimized without a button on the taskbar but its icon placed in the system tray.

.topic 0x00010140
Loads Outpost Firewall Pro automatically at system start-up and displays its icon in the System Tray.

.topic 0x00010141
Loads Outpost Firewall Pro in invisible mode, without its system tray icon or any of its dialog windows.

.topic 0x0001013f
Outpost Firewall Pro is not loaded automatically at system start-up.

.topic 0x000100de
Lets you add another application to the list of applications that Outpost Firewall Pro is to manage.

.topic 0x000100f5
Lets you modify the settings for a highlighted application.

.topic 0x00010133
Removes a highlighted application from the list.

.topic 0x0001014d
The list of applications that Outpost Firewall Pro manages.

.topic 0x000100ed
Displays the list of components of each application.

.topic 0x00010101
Lets you configure the ICMP settings.

.topic 0x0001012a
Lets you configure the global application and system rules settings.

.topic 0x0001012e
Switches to Normal mode, when computer IP-address is available on the network.

.topic 0x0001012f
Switches to Stealth mode, when computer IP-address is hidden on the network.

.topic 0x0001010e
The list of plug-ins on your system that can be used by Outpost Firewall Pro.

.topic 0x00010125
Adds a new plug-in to the list.

.topic 0x00010126
Removes a highlighted plug-in from the list.

.topic 0x00010127
Lets you change a highlighted plug-in's settings.

.topic 0x00010128
Starts a highlighted plug-in running.

.topic 0x00010129
Stops a highlighted plug-in.

.topic 0x00010138
Lets you modify a highlighted rule.

.topic 0x00010139
Moves a highlighted rule down on the list of rules for this application. Moving a rule down decreases its priority because rules are followed in the sequence shown in this list.

.topic 0x0001013a
Moves a highlighted rule up on the list of rules for this application. Moving a rule up increases its priority because rules are followed in the sequence shown in this list.

.topic 0x0001013b
Adds a new rule for this application.

.topic 0x0001013c
Creates rules for the application modeled on the successful rules of a similar application.

.topic 0x0001013d
Removes a highlighted rule.

.topic 0
The list of rules for this application. To make a rule active, check its box.

.topic 0x000100db
A list of possible actions that are possible for the application.

.topic 0x000100f9
A list of events that are possible for the application.

.topic 0x00010118
The name of the rule.

.topic 0x000100d9
Specifies that this activity should be allowed once.

.topic 0x000100da
Specifies that this activity should be blocked once.

.topic 0x000100e4
Specifies that all activities for this application should be allowed.

.topic 0x000100e5
Specifies that all activities for this application should be blocked.

.topic 0x000100e6
Specifies that a rule is to be created for this application based on an earlier (preset) rule that was set for a similar application. To create your own rule, select Other: from the drop down list and press OK.

.topic 0x00010112
A list of available predefined rules sets.

.topic 0x000100e0
A checkmark means the Allowed folder is to be displayed.

.topic 0x000100e9
A checkmark means the Blocked folder is to be displayed.

.topic 0x000100f8
A checkmark means the Network Activity folder is to be displayed.

.topic 0x0001010f
A checkmark means the folder bar is to be displayed.

.topic 0x00010110
A checkmark means the status bar is to be displayed.

.topic 0x00010111
A checkmark means the toolbar bar is to be displayed.

.topic 0x0001011f
A checkmark means the Open ports folder is to be displayed.

.topic 0x00010134
A checkmark means the Reported folder is to be displayed.

.topic 0x0001010c
The list of all the times the rule is active.

.topic 0x00010144
Adds a time when the rule is active.

.topic 0x00010145
Specifies the rule is to be active every day.

.topic 0x00010146
A place to select when the rule is to be active.

.topic 0x00010147
Used to specify the start of a time interval.

.topic 0x00010148
Specifies the rule is to be active only for specific time intervals.

.topic 0x00010149
Lets you modify a highlighted rule in the list of times the rule is active.

.topic 0x0001014a
Specifies the rule is to be inactive.

.topic 0x0001014b
Removes the time a rule is active.

.topic 0x0001014c
Used to specify the end of a time interval.

.topic 0x000100fa
A drop down list of items to show in the history.

.topic 0x000100fb
An input field to enter the date that filtering should begin from.

.topic 0x000100fc
If selected, specifies that filtering should start from a particular date and/or time.

.topic 0x000100fd
If selected, specifies that logs should be shown from the beginning.

.topic 0x000100fe
An input field to enter the time that filtering should begin from.

.topic 0x00010107
An input field to enter the date that filtering is to continue until.

.topic 0x00010108
If selected, specifies that filtering is to finish at a specific date and time.

.topic 0x00010109
If selected, specifies that logs are to be shown up to the latest entry.

.topic 0x0001010a
An input field to enter the time that filtering is to continue until.

.topic 0x0001014e
An input field to enter the condition to be shown in the history.

.topic 0x00010136
Copies a highlighted rule.

.topic 0x00010115
Lets you modify a highlighted rule on the list.

.topic 0x00010116
Moves a highlighted rule down in the list. Moving a rule down decreases its priority. The list shows the sequence each rule is used.

.topic 0x00010117
Moves a highlighted rule up in the list. Moving a rule up increases its priority. The list shows the sequence each rule is used.

.topic 0x0001011c
Adds a new rule to the list.

.topic 0x00010131
Removes a highlighted rule from the list.

.topic 0x00010135
The list of global application and system rules. To make a rule active, check its box.

.topic 0x0001012b
Select this to allow all communication via this protocol.

.topic 0x0001012c
Select this to block all communication via this protocol.

.topic 0x0001012d
Select this to create custom rules for this protocol.

.topic 0x0001011b
Lists the networks your computer belongs to and their settings.

.topic 0x000100e8
Automatically detects any new networks so you don't have to add them manually.

.topic 0x00010104
Adds a new network to the list.

.topic 0x00010105
Detects your networks automatically.

.topic 0x00010106
Removes a selected network from the list.

.topic 0x00010119
The application that will be run when the rule is triggered.

.topic 0x00010154
Lets you browse your computer and select the application to be run.

.topic 0x0001010d
List of firewall policies.

.topic 0x00008047
Changes Outpost Firewall Pro policy.

.topic 0x00008009
Accesses the Options dialog window.

.topic 0x0000801E
Changes the listed item grouping.

.topic 0x00008020
Narrows a log listing to events within a specified time.

.topic 0x0000805D
Checks for an update of Outpost Firewall plug-ins or components.

.topic 0x0000E801
Displays description of highlighted items and info about current policy mode.

.topic 0x000100dd
Click to add an application that will be allowed to access rawsockets.

.topic 0x000100df
Allows you to adjust advanced configuration settings.

.topic 0x000100e1
Allows network access for the application.

.topic 0x000100e2
Allows access to rawsockets for this application.

.topic 0x000100e3
The rule will be applied if an event matches all the specified criteria.

.topic 0x000100e7
Select this to configure Outpost Firewall Pro automatically.

.topic 0x000100ea
Blocks network access for the application.

.topic 0x000100eb
Blocks access to rawsockets for this application.

.topic 0x000100ec
Click to change the program installation path.

.topic 0x000100ee
Disables Component Control.

.topic 0x000100ef
Sets the Maximum level of Component Control.

.topic 0x000100f0
Sets the Normal level of Component Control.

.topic 0x000100f1
Resets the system settings to default ones.

.topic 0x000100f7
Enables Component Control.

.topic 0x00010100
Disables automatic updates. You can enable them later by selecting Tools > Automatically Check for Updates from the Outpost Firewall Pro main window.

.topic 0x00010103
Import configuration settings from a file.

.topic 0x0001010b
The list of networks to which your computer is currently connected.

.topic 0x103
Click to change the settings for the networks to which your computer is currently connected.

.topic 0x00010121
The rule will be applied if an event matches any of the specified criteria.

.topic 0x00010123
Specify parameters that will be passed to an application.

.topic 0x00010124
Specify the password in the space provided.

.topic 0x841b03ed
List of applications that are allowed rawsockets access.

.topic 0x00010130
Click to manage the list of applications that are allowed rawsockets access.

.topic 0x00010132
Removes an application from the list of those that are allowed rawsockets access.

.topic 0x00010151
Select to configure Outpost Firewall Pro manually.

.topic 0x000100ff
Click to set up hidden processes control.

.topic 0x00010120
Click to set up processes mamory control.

.topic 0x00008047
Allows to changes Outpost Firewall Pro policy.

.topic 0x00008009
Opens the Options dialog window.

.topic 0x0000801E
Allows to changes the listed item grouping.

.topic 0x00008020
Allows to narrows a log listing to events within a specified time.

.topic 0x0000805D
Checks for an update of Outpost Firewall Pro plug-ins or components.

.topic 0x00009C5F
Opens Outpost Firewall Pro Log Viewer.

.topic 0x0000E145
Displays Outpost Firewall Pro help topics.

.topic 0x00009C75
Starts On-Demand Spyware Scanner.

.topic 0x0000E801
Displays description of highlighted items and info about current policy mode.

.topic 0x808e0456
Select to enable rules autocreation to reduce the number of product prompts.

.topic 0x808e0458
Select if you do not want to create rules automatically.

.topic 0x808e0484
Click to specify the policy for background mode and inactivity timers settings.

.topic 0x806a0483
Clear if you do not want to clutter up logs with information about NetBIOS broadcast packets.

.//=========== 4.0 ===========
.topic 0x8428048c
Allows to set the required Component Control level.

.topic 0x840e03f4
If selected, all network traffic will be blocked after the specified inactivity interval.

.topic 0x840e03f7
If selected, all network traffic will be blocked upon activation of your Windows screensaver.

.topic 0x840e03f8
Select if you want Outpost Firewall Pro to detect full screen applications automatically and suggest to enter Entertainment mode.

.topic 0x840e03f3
Allows to specify the number of minutes after which the traffic will be blocked.

.topic 0x840e03f9
Select if you want Anti-Leak Control to be active while Outpost Firewall Pro runs in Background or Entertainment mode.

.topic 0x840e03fb
Select if you want real-time spyware protection to be active while Outpost Firewall Pro runs in Background or Entertainment mode.

.topic 0x840e03fa
Select if you want Component Control to be active while Outpost Firewall Pro runs in Background or Entertainment mode.

.topic 0x808c03f1
Opens Anti-Leak Control settings.

.topic 0x840e03e8
Allows to select the policy according to which Outpost Firewall Pro will act while running in Background or Entertainment mode.

.topic 0x00009C84
Enables/disables Outpost Firewall Pro self-protection.
.//============== eo opst_ui ==============

.//============== engine ==============
.topic 0x00010035
Specifies that this activity should be allowed once.

.topic 0x00010036
Specifies that this activity should be blocked once.

.topic 0x00010037
Allows network activity for this hidden process.

.topic 0x0001003c
Blocks network activity for this hidden process.

.topic 0x0001003e
Blocks all network activity for this application until it is restarted.

.topic 0x0001003f
Makes the changed application components shared so that other applications can use these components.

.topic 0x00010040
Updates information for this application components.

.topic 0x00010041
The text field provided for entering the registration code.

.topic 0x00010042
The list of Outpost Firewall Pro plug-in modules.

.topic 0x00010044
Expands the list of Outpost Firewall Pro plug-in modules.

.topic 0x00010045
Pastes the registration code in the field provided.

.topic 0x00010049
The address that the application requests access to.

.topic 0x0001004a
The application on the remote server that the application requests access to.

.topic 0x0001004b
The service on the remote server that the application requests access to.

.topic 0x0001004c
Click to enter the new registration code.

.topic 0x0001004d
Click to renew the registration code.

.topic 0x00010051
Click to enter the new registration code.

.topic 0x00010052
Refers you to the web page on the Agnitum web site containing the information about purchasing Outpost with discount.
.//============== eo engine ==============

.//============== op_cmn ==============
.topic 0x00010061
Adds a new address to the list of remote addresses.

.topic 0x00010062
The list of remote addresses with which you want to allow communication.

.topic 0x00010063
Lets you modify a highlighted address in the list of remote addresses.

.topic 0x00010064
Removes a highlighted address from the list of remote addresses.

.topic 0x00010089
Allows to specify a domain name.

.topic 0x0001008a
Allows to specify an IP address.

.topic 0x0001008b
Allows to specify an IP range.

.topic 0x00010060
A place to enter the remote address as a domain name, IP number or IP range.

.topic 0x00010068
The list of ports that displays their names, numbers and descriptions.

.topic 0x0001007d
An input field for you to enter a port number, port name or port range.

.topic 0x0001006d
The list of ICMP messages types. A selected check box in the "In" column allows your system to receive that type of ICMP signal. A selected check box in the "Out" column allows your system to send this type of ICMP signal.

.topic 0x0001006f
Resets to the default settings.

.topic 0
Specifies your computer or network incoming data traffic.

.topic 0
Specifies your computer or network outgoing data traffic.

.topic 0x000100bf
Specifies the protocol to be used is TCP.

.topic 0x000100c6
Specifies the protocol to be used is UDP.

.topic 0
Specifies the protocol to be used is IP.

.topic 0
Does not specify a protocol.

.topic 0x00010065
Adds a highlighted field to the listed fields list.

.topic 0x00010066
Adds a highlighted field to the column header.

.topic 0x00010067
Lets you configure the advanced settings.

.topic 0x00010076
The list of available fields.

.topic 0x00010077
The list of the listed fields. These are the fields that are shown if you press the plus sign (+) that precedes each line in the Information Panel.

.topic 0x00010079
The list of column headers. These are the fields that are always shown.

.topic 0x0001007f
Deletes, moves up or down a highlighted field.

.topic 0x00010080
Deletes, moves up or down a highlighted field.

.topic 0x00010081
Removes a highlighted Listed Field from its list and places it in the list of Available Fields.

.topic 0x00010082
Removes a highlighted Column Header from its list and places it in the list of Available Fields.

.topic 0x00010069
Specifies that Outpost Firewall Pro is to always resolve IP address into the DNS name.

.topic 0x0001006a
Specifies that Outpost Firewall Pro is to display traffic in the most convenient format.

.topic 0x0001006b
Specifies that Outpost Firewall Pro is to display traffic in bytes.

.topic 0x0001006c
Specifies that Outpost Firewall Pro is to resolve an IP address into its DNS name only if the DNS name is in cache.

.topic 0x00010075
Specifies that Outpost Firewall Pro is to display traffic in KB.

.topic 0x0001007a
Specifies that Outpost Firewall Pro is to display traffic in MB.

.topic 0x0001007b
Specifies that Outpost Firewall Pro is never to resolve an IP address into its DNS name.

.topic 0x0001007c
Specifies that Outpost Firewall Pro is to display a port as a number rather than its name.

.topic 0x0001007e
Specifies that Outpost Firewall Pro is to display a port as a name rather than its number.

.topic 0x00010078
List of the available protocols.

.topic 0x0001006e
The list of columns. If selected, the column is to be displayed in Outpost Firewall Pro main window.

.topic 0x00010072
Moves a column down in the list. This means the column is displayed closer to the right in relation to the other columns.

.topic 0x00010088
Moves a column up in the list. This means the column is displayed closer to the left in relation to the other columns.

.topic 0x00010083
Resets the list to the default settings originally programmed by our engineers.

.// ============ 4.0 ============

.topic 0x84360406
Click to add a process to the exclusions list.

.topic 0x84330457
If selected, the action highlighted in the list will be allowed for all applications.

.topic 0x843603ea
The list of processes that have specific anti-leak settings.

.topic 0x84330458
If selected, the action highlighted in the list will be blocked for all applications.

.topic 0x843303f3
Allows to enable or disable Anti-Leak Control technology.

.topic 0x8436049c
The list of dangerous and suspicious actions that you can allow or block for the selected application.

.topic 0x843303f6
The list of dangerous and suspicious actions that you can allow or block globally for all applications in your system.

.topic 0x84330518
If selected, all listed dangerous and suspicious actions will be allowed for network-enabled applications installed on your computer. This setting has the higher priority than the Prompt/Block settings for all the listed techniques.

.topic 0x84330456
If selected, each time some application tries to perform the action highlighted in the list, Outpost Firewall Pro will display a prompt window asking you to allow or block the activity.

.topic 0x843603f5
Click to remove the selected process from the exclusions list.

.topic 0x843303f4
Select if you want to see a visual alert each time the selected action is performed by some application.

.topic 0x84330517
If selected, all applications installed on your computer will be allowed to inject components from the shared components list into other processes memory. This setting has the higher priority than the Prompt/Block settings for Windows hooks.

.topic 0x83f20435
Allows to specify an address macro.

.//============== eo op_cmn ==============

.//============== op_data ==============
.topic 0x0001008c
Enables the Log Cleaner.

.topic 0x0001008d
Disables the Log Cleaner.

.topic 0x0001008f
Specify the maximum number of records to keep in the each of the logs stored in the database.

.topic 0x00010090
Select this option to limit the log size by the number of event records.

.topic 0x00010091
Select to have Outpost Firewall Pro to create the new log database at the next startup.

.topic 0x00010092
Click to set individual size limits for each of the Outpost Firewall Pro logs.

.topic 0x00010093
Specify the maximum number of days to keep the Outpost Firewall Pro event log records.

.topic 0x00010094
Select this option to specify the number of days to keep event records in the database.

.topic 0x00010097
Select to specify individual cleanup settings for each of the Outpost Firewall Pro logs.

.topic 0x00010098
The list of Outpost Firewall Pro logs. Select a log to enable the log cleanup. Specify the number of records to keep and the number of days to keep records in the database.

.topic 0x00008009
Click to set the Log Cleaner options.

.topic 0x0001009d
Select to apply specified limits to all Outpost Firewall Pro logs.

.topic 0x0001009f
Specify the maximum Outpost Firewall Pro log database size in megabytes.

.topic 0x000100a0
Select to limit the Outpost Firewall Pro log database size.

.topic 0x00010095
Select if you do not want to see this message in the future.

.topic 0x00010096

.topic 0x00010099
Loads ODBC Drivers.

.topic 0x0001009a
Click to view the error description.

.topic 0x0001009e
Click if you want the visual alerts to be displayed during log database cleanup.

.topic 0x000100a1

.topic 0x000100a2
Refers you to the FAQ web page on the Agnitum web site.
.//============== eo op_data ==============

.//============== op_log ==============
.topic 0x000100b0
Specifies that Log Viewer wiil display applications names along with pathes.

.topic 0x00007919
Edits an existing filter.

.topic 0x000100af
Specifies that Log Viewer wiil display applications names along with icons.

.topic 0x000100c0
An input field to enter the time that filtering should begin from.

.topic 0x000100c2
Specifies that Log Viewer is to display traffic in the most convenient format.

.topic 0x000100b8
A checkmark specifies the direction of traffic when it is coming from your computer or network.

.topic 0x000100c3
Specifies that Log Viewer is to display traffic in bytes.

.topic 0x000100b4
A checkmark specifies the direction of traffic when it is coming to your computer or network.

.topic 0x00007918
Creates a new filter.

.topic 0x000100b7
Specifies any protocols excluding those displayed above.

.topic 0x000100a8
Resets to the default settings that were specified by our engineers.

.topic 0x000100a3
Lets you select defined time interval.

.topic 0x000100a4
Lets you specify the condition for the filtering rule.

.topic 0x00002725
Refreshes the current log.

.topic 0x000100ab
Displays selected values.

.topic 0x000100ae
Specifies filtering rules for events you want to see.

.topic 0x000100c5
Specifies that Log Viewer is to display traffic in MB.

.topic 0x000100b2
Specifies that Log Viewer will turn table grid ON.

.topic 0x000100be
Displays the descriptions of all filtering rules.

.topic 0x000100aa
Lets you specify the date till which the records are to be deleted.

.topic 0x000100a6
Specifies the date before which all records are to be deleted.

.topic 0x000100bd
Specifies that Log Viewer is to display a host as resolved name.

.topic 0x000100c1
An input field to enter the time that filtering is to continue until.

.topic 0x000100a5
A select field to choose the date that filtering should begin from.

.topic 0x000100b1
Specifies the name of the rule you are creating.

.topic 0x000100b3
Specifies the protocol to be displayed is ICMP.

.topic 0x000100b6
Specifies that Log Viewer is to display a host as its IP number.

.topic 0x000100c4
Specifies that Log Viewer is to display traffic in KB.

.topic 0x000100bb
Lets you select the limitation type.

.topic 0x000100a7
A select field to choose the date that filtering is to continue until.

.topic 0x0000791A
Removes an unnecessary filter.

.topic 0x000100c6
Specifies the protocol to be displayed is UDP.

.topic 0x000100bf
Specifies the protocol to be displayed is TCP.

.topic 0x000100b5
Lists the options available for the filter.

.topic 0x000100ac
Lets you specify the value for selected condition.

.topic 0x000100ad
Lets you specify the value for selected condition.

.topic 0x000100a9
Specifies that all records of the filter are to be deleted.

.topic 0x000100ba
Specifies that Log Viewer is to display a port as a number.

.topic 0x000100bc
Lets you select the limitation type.

.topic 0x000100b9
Specifies that Log Viewer is to display a port as a name rather than its number.

.topic 0x0001008c
Enables the Log Cleaner.

.topic 0x0001008d
Disables the Log Cleaner.

.topic 0x0001008f
Specify the maximum number of records to keep in each of the logs stored in the database.

.topic 0x00010090
Select this option to limit the log size by the number of event records.

.topic 0x00010091
Select to have Outpost Firewall Pro to create the new log database at the next startup.

.topic 0x00010092
Click to set individual size limits for each of the Outpost Firewall Pro logs.

.topic 0x00010093
Specify the maximum number of days to keep the Outpost Firewall Pro event log records.

.topic 0x00010094
Select this option to specify the number of days to keep event records in the database.

.topic 0x00010097
Select to specify individaul cleanup settings for each of the Outpost Firewall Pro logs.

.topic 0x806903ee
The list of Outpost Firewall Pro logs. Select a log to enable the log cleanup. Specify the number of records to keep and the number of days to keep records in the database.

.topic 0x00008009
Click to set the Log Cleaner options.

.topic 0x0001009d
Select to apply specified limits to all Outpost Firewall Pro logs.

.topic 0x0001009f
Specify the maximum Outpost Firewall Pro log database size in megabytes.

.topic 0x000100a0
Select to limit the Outpost Firewall Pro log database size.

.topic 0x0001009c
Select to have Outpost Firewall Pro to repair the log database at the next startup.

.//============== eo op_log ==============

.//============== op_viewer ==============
.IDD_CUSTOMIZE (4) ********************************************************************************

.topic 0x000100d8
A checkmark means the Console Tree is to be displayed.

.topic 0x000100d7
A checkmark means the Toolbar is to be displayed.

.topic 0x000100cb
A checkmark means the Description bar is to be displayed.

.topic 0x000100d6
A checkmark means the Status bar is to be displayed.

.IDD_FAVORITES_ADD_TO (3) *************************************************************************

.topic 0x000100d1
Displays the name of the current filter you are viewing as it will appear in your Favorites folder.

.topic 0x000100cd
Displays a list of folders inside your Favorites folder.

.topic 0x000100d4
Creates a new folder in your Favorites list.

.TOOLBAR (6) **************************************************************************************

.topic 0x0000800A
Goes back to the previous selected item.

.topic 0x0000800B
Goes forward to the next selected item.

.topic 0x0000800C
Goes up one level.

.topic 0x0000800D
Shows or hides the Console Tree.

.topic 0x0000801A
Exports the selected log to a text file.

.IDD_FAVORITES_MOVE (1) ***************************************************************************

.topic 0x000100ce
Click the folder that you want to move the selected filter to.

.IDD_FAVORITES_ORGANIZE (6) ***********************************************************************

.topic 0x000100c9
Creates a new folder in your Favorites list.

.topic 0x000100d3
Moves the selected filter to a new location.

.topic 0x000100d5
Renames the selected filter.

.topic 0x000100ca
Deletes the selected filter.

.topic 0x000100cf
Lists the folders in the Favorites list.

.topic 0x000100cc
Dispays the decription of the selected filter.

HIDC_REFRESH
Enables log automatic refresh.
.//============== eo op_viewer ==============

.//============== ads ==============
.IDD_ADTRASHCAN (3) *******************************************************************************

.topic 0x00010018
Blocks the entire ad string.

.topic 0x0001000d
A portion of the ad string that should be blocked.

.topic 0x0001000e
Blocks a portion of the ad string.

.IDD_PAGE_HTMLSTR (8) *****************************************************************************

.topic 0x00010000
Adds the ad string you specified in the input field to the list.

.topic 0x00010001
Resets the list of ad strings to the default settings from our engineers.

.topic 0x00010003
An input field to enter the ad string you want blocked.

.topic 0x00010004
A checkmark enables advertisement blocking by ad string.

.topic 0x0001000b
The list of ad strings.

.topic 0x0001000c
Lets you modify a highlighted ad string in the list.

.topic 0x00010011
Removes a highlighted ad string from the list.

.topic 0x00010012
A checkmark in this box displays the Ad Trashcan on your desktop.

.IDD_PAGE_IMGSIZE (7) *****************************************************************************

.topic 0x00010006
A checkmark enables advertisement blocking by image size.

.topic 0x00010008
The input field used to specify the height of the image.

.topic 0x00010009
The input field used to specify the width of the image.

.topic 0x00010013
Adds the size (width and height) that you specify in the input field to the list of image sizes.

.topic 0x00010014
The list of image sizes to be blocked.

.topic 0x00010015
Lets you modify a highlighted size in the list of image sizes.

.topic 0x00010016
Removes a highlighted size from the list of image sizes.

.topic 0x00010002
Resets the list of ad images to the default settings from our engineers.

.topic 0x00010005
Enables web page advertising objects blocking (such as Flash animations).

.topic 0x00010007
Click to export plug-in settings to a file.

.topic 0x0001000a
Click to import plug-in settings from a file.

.topic 0x00010017
Click to add/remove the site to/from the Trusted sites list.

.topic 0x0001000f
Replaces advertising images with transparent images of the same size.

.topic 0x00010010
Replaces advertising images with the text [AD].

.topic 0x401
Adds the site name you specified in the input field to the list.

.topic 0x402
Removes a highlighted site from the list.

.topic 0x403
Lets you modify a highlighted site name in the list of trusted sites.

.topic 0x404
The list of trusted sites.

.topic 0x405
An input field to enter the trusted site name.

.//============== eo ads ==============

.//============== content ==============
.topic 0x07
Removes a highlighted word from the list of words to be blocked.

.topic 0x0001001c
A checkmark enables content blocking by words in web pages.

.topic 0x01001
Adds the site address that you specified in the input field to the list of sites to be blocked.

.topic 0x20
Click to modify the message to be displayed on the page which content was blocked.

.topic 0x03
Lets you modify a highlighted site address that is in the list of site to be blocked.

.topic 0x0001001d
Click to export plug-in configuration to a file.

.topic 0x0001001b
A checkmark enables content blocking by domain names.

.topic 0x00010022
Click to specify the trusted servers. Outpost Firewall Pro will not block content from the sites on the list.

.topic 0x06
Adds the word or phrase you specified in the input field to the list of blocked words.

.topic 0x0001001e
Click to import plug-in configuration from a file.

.topic 0x08
Lets you modify a highlighted word in the list of blocked words.

.topic 0x05
An input field to enter a domain name (eg. asite.com). Note: do not use wildcards.

.topic 0x04
The list of site addresses to be blocked.

.topic 0x0a
An input field to enter the words you want blocked.

.topic 0x09
The list of words that are used to block the viewing of any web pages containing them.

.topic 0x01002
Removes a highlighted site from the list.

.topic 0x10
Adds the specified server to the list.

.topic 0x11
Removes the highlighted server from the trusted list.

.topic 0x12
Click to modify the server address.

.topic 0x13
The list of trusted servers.

.topic 0x14
Specify the server address to add to the trusted list.
.//============== eo content ==============

.//============== dns ==============
.topic 0x00010026
An input field to enter the number of days before a DNS record expires.

.topic 0x00010028
A checkmark enables an expiry period for the DNS records.

.topic 0x00010029
A checkmark enables a size limitation for the DNS database.

.topic 0x0001002a
The database of DNS records.

.topic 0x00010030
An input field to enter the size limit of the DNS database.

.topic 0x00010033
Removes a highlighted DNS record from the database.

.topic 0x00010024
Enables malformed DNS requests blocking.

.topic 0x00010034
Displays the visual alert in the case of blocked DNS request.

.topic 0x204
The list of servers excluded from caching.

.topic 0x00010032
Clears the DNS cache database.

.topic 0x201
Adds the specified address to the list.

.topic 0x0001002b
Click to view and edit the DNS cache database.

.topic 0x0001002d
Click to edit the servers exclusion list.

.topic 0x202
Removes the highlighted server from the exclusion list.

.topic 0x205
Specify the address of the server you do want want to be cached.

.topic 0x203
Click to modify the server address.

.topic 0x00010025
Allows to block DNS requests with the fourth level domain names to prevent possible private data leak.

.//============== eo dns ==============

.//============== file_int ==============
.IDD_CONDITION (2) ********************************************************************************

.topic 0x00010053
Event matchs all of the criteria.

.topic 0x0001005e
Event matchs any one of the criteria.

.IDD_FILE_TYPE (2) ********************************************************************************

.topic 0x00010058
An input field used to enter a description (extension) for a new file type.

.topic 0x00010059
An input field used to enter a new file type.

.IDD_PAGE_EMAILGUARD (6) **************************************************************************

.topic 0x00010057
Resets the list of file types and actions to the default settings given by our engineers.

.topic 0x0001005a
A list of possible actions for a highlighted file type. A checkmark means the action is to be performed.

.topic 0x0001005b
Description of the action that is to be performed.

.topic 0x0001005c
A list of file types.

.topic 0x0001005d
Adds the rule you just created regarding the specified attachment types.

.topic 0x0001005f
Removes a highlighted file type from the list.

.//============== eo file_int ==============

.//============== prot_int ==============
.topic 0x00010163
Number of suspicious packets that are considered to be an attack.

.topic 0x00010166
Edit the Trusted Hosts list.

.topic 0x00010168
Edit the list of vulnerable ports. Outpost Firewall Pro will pay more attention monitoring these ports.

.topic 0x00010159
List of attack against which Outpost Firewall Pro protects you.

.topic 0x0001016b
Click to add a port to the list.

.topic 0x0001016d
Specify decimal value that identifies port importance.

.topic 0x00010161
Click to manage the list of detected attacks.

.topic 0x00010171
Click to remove a port from the list.

.topic 0x00010172
Select to have plugin to display an alert message every time an attack is detected.

.topic 0x0001016c
Specify protocol.

.topic 0x0001015e
Click to reset settings to the default values.

.topic 0x0001016f
Parameters that determine how Outpost Firewall Pro detects attacks.

.topic 0x00010167
Edit the Trusted Ports list.

.topic 0x00010165
Number of suspicious packets that are considered to be an attack.

.topic 0x00010174
Select to display visual alerts every time an attack is detected.

.topic 0x0001015c
A checkmark enables the blocking of an intruder's subnet mask.

.topic 0x0001015a
A checkmark enables the blocking of an intruder's IP address for a period if port scanning is detected.

.topic 0x00010155
Click to add a port to the list.

.topic 0x00010162
An input field to enter the period an intruder's IP address is to be blocked.

.topic 0x00010156
Sets the alert level to low, normal or high.

.topic 0x00010173
Select to play an audio file every time an attack is detected.

.topic 0x00010164
Number of suspicious packets that are considered to be an attack.

.topic 0x00010170
List of vulnerable ports.

.topic 0x0001016a
Type any information that helps better understand why this port is considered trusted or vulnerable.

.topic 0x0001016e
Click to modify advanced attack detection features. Note that they will apply to all attacks on the list.

.topic 0x00010157
Click to reset the alarm levels settings to default.

.topic 0x0001015b
A checkmark enables the blocking of a local port if a DoS attack is detected.

.topic 0x00010158
Limits the number of ARP requests enumerating IP addresses from one MAC address during a specified time interval which can imply network scanning.

.topic 0x0001015d
Prevents ARP spoofing - where a node starts sending a huge number of ARP replies with varying MAC addresses in a short time span, trying to overload the network equipment as it tries to determine which MAC address actually belongs to the node. If enabled, only permits incoming replies from other hosts for which there was a previous outgoing request.

.topic 0x0001015f
Detects any attempt by an attacker to associate a gateway network adapter IP address with their own MAC address to allow them to intercept packets.

.topic 0x00010160
Detects cases where two or more hosts share the same IP address blocking ARP replies that have the same IP (but different MAC's) and thus protecting computer from the IP address duplication consequences.

.topic 0x00010169
Detects when an attacker falsifies or forges his IP address and blocks abnormal volumes of traffic which may otherwise overload a computer.

.//============== eo prot_int ==============

.//============== web_int ==============
.topic 0x000101ad
Always allow this type of requested content.

.topic 0x000101ae
Allow this type of requested content this time only.

.topic 0x000101af
Always block this type of requested content.

.topic 0x000101b0
Block this type of requested content this time only.

.topic 0x000101b1
Remember current selection and use it next time this type of content is requested.

.topic 0x000101b2
Select to add each of the newly visitied sites to the exclusion list so that individual active content treatment settings could be specified for them.

.topic 0x000101b3
Hosts exclusion list.

.topic 0x000101b4
Add host to the exclusion list.

.topic 0x000101b5
Edit individual host active content treatment settings.

.topic 0x000101b6
Locate host with specified name in the list.

.topic 0x000101b7
Click to modify host active content treatment settings.

.topic 0x000101b8
Click to remove selected host from the list.

.topic 0x000101b9
Type the host name to locate in the list.

.topic 0x000101ba
Click to add new host to the exclusion list.

.topic 0x000101bb
List of active content elements and their treatment settings.

.topic 0x000101bc
Reset host active content treatment settings to default active content treatment policy settings.

.topic 0x301
Select to apply the global setting for the elements of this type.

.topic 0x302
Select if you want to allow elements of this type on the web pages.

.topic 0x303
Select if you want to be prompted whether the element should be blocked or allowed each time Outpost Firewall Pro encounters the element of this type.

.topic 0x304
Select if you want to block elements of this type on the web pages.

.topic 0x305
Select if you want to display the first frame of the animated GIF image only.
.//============== eo web_int ==============

.//============== sp_ui ==============
.topic 0x00010175
Adds the specified server to the list.

.topic	0x00010176
Click to add new ID to the list.

.topic	0x00010177
Click to specify which alerts should be displayed if spyware is detected.

.//.topic	HIDC_ALWAYS_DO

.topic 0x00010179
Lets you browse your computer and select the file to be played.

.topic	0x0001017a
Specify the category this string of characters belongs to.

.topic	0x0001017b
Click to select all objects in the list.

.//.topic	HIDC_CHECK_ENABLE_REALTIME
.//.topic	HIDC_CHECK_RUN_SCAN

.topic	0x0001017e
Select to scan cookies.

.topic	0x0001017f
Select to display the files in the tree.

.topic	0x00010180
Select to scan file system objects.

.topic	0x00010181
Select to scan processes running in memory.

.topic	0x00010182
Select to scan the registry.

.topic	0x00010183
Select to scan startup entries.

.topic	0x00010184
Click to remove the detected object from your system.

.topic	0x00010185
Shows a list of currently selected folders.

.topic	0x00010186
Specify a descriptive comment for this private data.

.topic	0x00010187
Displays the file system tree.

.topic	0x00010188
Specify the server address to add to the trusted list.

.//.topic	HIDC_EDIT_TRUSTED_HOSTS

.topic	0x0001018a
Specify the wav file name to be played.

.topic	0x0001018b
Select if you want the specified private data to be protected from unauthorized leaks.

.topic	0x0001018c
Select if you want to be continuously protected from spyware.

.topic	0x0001018d
Select if you want the detected objects to be placed in Quarantine quarantine rather than directlyremoved from your system.

.topic	0x0001018e
If selected, each time the spyware object is detected, you will be asked to choose the action to be performed on it.

.topic	0x0001018f
If selected, the detected object will be removed automatically.

.topic	0x00010190
Click to minimize the wizard and continue scanning in background mode.

.topic	0x00010191
Click to add the detected object to the Ignore list.

.topic	0x00010192
The list of objects that are not treated by Outpost Firewall Pro as spyware. These are ignored during scanning.

.topic	0x00010193
Click to view and edit the Ignore list.

.topic	0x00010194
Removes the selected object from the list.

.//.topic	HIDC_IGNORE_SELECTED

.topic	0x00010196
The list of trusted servers.

.topic	0x00010197
The list of vulnerable system objects Outpost Firewall Pro pays special attention to.

.topic	0x00010198
Select if you want a sound notification to be played each time an object is detected and removed.

.topic	0x00010199
The list of IDs to be protected.

.topic	0x0001019a
Shows the current status of system scanning.

.topic	0x0001019b
Select if you want to scan specific file system locations.

.topic	0x0001019c
If selected, only vulnerable system folders will be scanned.

.topic	0x0001019d
If selected, all local hard drives will be scanned.

.topic	0x0000801B
Click to refresh the file system tree.

.topic	0x0001019f
Removes the highlighted server from the trusted list.

.topic	0x000101a0
Removes the selected ID from the list.

.topic	0x000101a1
If selected, the specified IDs will be replaced with asterisks in all outgoing packets they are detected in.

.topic	0x000101a2
Displays brief scanning statistics.

.topic	0x000101a3
Select if you want to manually specify the explicit objects to be scanned.

.topic	0x000101a4
If selected, a thorough system analysis will be performed.

.topic	0x000101a5
If selected, only the weakest system points such as the registry and vulnerable folders will be scanned.

.topic	0x000101a6
Provides a space to enter a private data you do not want to leave your computer without your consent.

.topic	0x000101a7
If selected, visual alert will be displayed each time one of the specified IDs is detected in the outgoing packet.

.topic	0x000101a8
Select if you want a visual pop-up notification to be displayed each time an object is detected and removed.

.topic	0x000101a9
The list of objects detected during system scanning.

.topic	0x000101aa
Click to clear all objects in the list.

.topic	0x806f043b
Select to enable proactive scan of processes on accessing the network.

.//.topic	HID_CONTINUE_BKGND
.//.topic	HID_STOP

.//============== eo sp_ui ==============