About Cyberhawk

Cyberhawk is patent-pending, security software for your computer. This Help system covers both CYBERHAWK BASIC, the free version, and CYBERHAWK PRO. Any features included in CYBERHAWK PRO only are noted as such in red.

Cyberhawk protects you by intelligently blocking behavior consistent with that of malware such as viruses, worms, trojans, spyware, adware, rootkits, keyloggers, and buffer overflows. Cyberhawk vigilantly monitors any activity that might compromise the security of your computer. Technological advances allow Cyberhawk to monitor your computer at very low levels to seek out even deeply hidden threats.

When you install Cyberhawk, it is already fully configured and no additional set up is required. Cyberhawk will automatically block any known malicious threats. For indeterminate threats, or threats that might be a virus, it will immediately suspend the suspicious process and present you with the choice to “Allow” or “Deny” the process. You can always undo any actions you decide to take. Information about the type of threat, a description of what it does, and the risk level associated with that type of threat, are always provided so that the program is intuitive and easy-to-use.

As you choose to respond to a perceived threat, the behavior of the threat and your response are relayed to Novatix for analysis. The Cyberhawk Secure Community, which includes all Cyberhawk users who wish to participate, thus gains knowledge of new behaviors of threats, and Novatix can create and distributes new enhancements as necessary. You also have the option of customizing your own rules if you wish to supplement Cyberhawk’s comprehensive built in protection, but you are very strongly advised not to do this unless you have expert knowledge of Windows and your computer.

Use this Help system to learn how to use Cyberhawk:

  • how to modify its options and settings

  • what to do when a security threat is discerned

  • how to use the additional features included only in CYBERHAWK PRO: Quarantine, Rootkit Scanner and Custom Rules.

Additional help can be found in the Cyberhawk User's Guide (pdf).

Cyberhawk Copyright © 2006-2007 Novatix Corporation. All Rights Reserved.

Cyberhawk is patent-pending technology. Cyberhawk is a trademark of Novatix Corporation. Other brands and their products are trademarks or registered trademarks of their respective holders and should be noted as such.

Information in this document is subject to change without notice. The software described in this document is furnished under a license agreement or nondisclosure agreement. The software may be used or copied only in accordance with the terms of those agreements. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or any means electronic or mechanical, including photocopying and recording for any purpose other than the purchaser’s personal use without the written permission.

Novatix Corporation

5777 Central Ave, Suite 130

Boulder, CO 80301 - USA

www.novatix.com


Offered protection

Additional protection

Protecting You When Traditional Antivirus Can’t

A “Zero-Day” attack occurs when your computer is infected by a Zero-Day threat – a virus, trojan, worm or spyware which is so new that traditional antivirus programs have no “signature” to identify the threat.

Because Zero-Day attacks happen faster than traditional antivirus vendors can react.

Here is what your traditional signature-based antivirus product must do to protect you against any new threat:

1) Catch the threat.

2) Analyze the threat to understand what it does

3) Write a signature that recognizes the threat.

4) Test the signature to ensure it does not damage your computer.

5) Issue you an update with the new signature. And then…

6) You still have to update your software with the new signature!

It can be days before traditional antivirus vendors provide the “signature update” necessary to protect your computer. And traditional signatures cannot protect you if a threat “morphs” to evade the signature.

Cyberhawk does not rely on signatures in order to protect you. Its patent-pending ActiveDefense technology is the most intelligent behavioral analysis technology available today. It continuously monitors all activities on your PC at a very low system level and uses a proprietary combination of analytics, risk algorithms, program histories and tolerance thresholds to identify and shut down threats.

  • When Cyberhawk detects an attack on your computer by a known virus, it will immediately terminate the attack and permanently isolate the virus process. An alert screen will appear to confirm that Cyberhawk has prevented the attack.

  • If Cyberhawk detects a potentially malicious process that might be an attack, it will immediately suspend the suspicious process and alert you that your computer is at risk. You can then choose to “Allow” or “Deny” the process based on the informative information provided in the alert.


About Cyberhawk Versions

Cyberhawk Versions

There are several versions of Cyberhawk included in its one main installation package: Cyberhawk Basic (the free version), Cyberhawk Pro, and a 15-day trial of Cyberhawk Pro. Upon first installing Cyberhawk, you will find yourself starting with a 15-day trial of Cyberhawk Pro. The basic and trial versions will always present a gold box that when clicked will display the Cyberhawk Registration window:

The various versions of Cyberhawk are explained below:

Cyberhawk Pro Trial

All Cyberhawk installations begin as a 15-day trial for Cyberhawk Pro. At any time during (or after) the trial you can purchase a registration code for Cyberhawk Pro which you then enter in the Cyberhawk Registration window to activate all the protective features of Cyberhawk Pro. If a registration code for Cyberhawk Pro is not purchased, Cyberhawk will scale down to Basic after 15 days. If you elect to continue with Cyberhawk Basic, any Cyberhawk Pro features such as Quarantine, Rootkit Scanner or Custom Rules, will no longer be active and accessible.

Cyberhawk Pro

Cyberhawk Pro is the full version of Cyberhawk which has all features activated and accessible. If you have already purchased a registration code for Cyberhawk Pro, simply enter that code in the field provided to convert the trial version to Cyberhawk Pro.

Cyberhawk Basic

Cyberhawk Basic is the limited version of Cyberhawk which does not allow access to any Cyberhawk Pro features. This version of Cyberhawk provides basic protection against malware. If at any time while you’re using Cyberhawk Basic you wish to upgrade to the full protection of Cyberhawk Pro you may do so by purchasing a registration code.


About This Help Facility

The following conventions are used through out this help file:

  • bold text — Used to designate responses you type in, menu names, command names, dialog box options, dialog box titles, icon names, and fields.

  • Underlined blue font text — Used to indicates that more information about that text can be seen by clicking the word or phrase. A second click will remove the information.

  • Underlined gold font text — Indicates a link that will take you to another topic with relevant information.

  • Italic text - Used to designate guides, books, and other reference material.

  • The following words are used interchangeably: click, select, and choose.


How to Purchase Cyberhawk

How to Purchase (Register) Cyberhawk

How do I purchase (register) Cyberhawk Pro?

Purchasing and registering Cyberhawk Pro is easy. You may register Cyberhawk Pro at any time by following these steps:

  1. Click on the Register Now link in the gold box in Cyberhawk. This will display the Registration window.

  2. Select the Buy Now button to be directed to the Novatix secure ecommerce store to purchase your Cyberhawk Pro subscription license. At the completion of your order you will receive your registration code through email. Check your email inbox for this message.

  3. When you have your registration code, click the Register Now link in the gold box in Cyberhawk to again display the Registration window.

  4. Enter your code in the box provided and click Register.

All Cyberhawk Pro features are now activated for the duration of your subscription.

Should you have any questions when purchasing or registering, please feel free to contact us: http://www.novatix.com/support


Cyberhawk Tray Icon

Cyberhawk installs an icon in the system tray area - the area next to the clock in the Windows Taskbar which is usually located at the lower right corner of your computer screen. This Cyberhawk tray icon gives you access to several Cyberhawk features.

Bringing Up the Cyberhawk Main Window

To bring up the Cyberhawk main window (Cyberhawk Control Panel):

  1. Right-click the Cyberhawk icon in the system tray. A menu will be displayed offering four choices:

    • Cyberhawk

    • Orientation

    • Suspend

    • Status

  2. Click Cyberhawk

Note: You can also access the Cyberhawk Control Panel from the Start menu by selecting Start > All Programs > Novatix > Cyberhawk >Cyberhawk

Viewing Cyberhawk Orientation

To replay the Cyberhawk program Orientation:

  1. Right-click the Cyberhawk icon in the system tray.

  2. Click Orientation. The orientation will launch for you to view.

  3. Click Close on the last page of the Orientation when you are finished viewing it.

Suspending Cyberhawk

To suspend Cyberhawk:

  1. Right-click the Cyberhawk icon in the system tray.

  2. Click Suspend. The word ‘Suspend’ is then preceded by a check.

  3. Click Suspend again to activate Cyberhawk.

Viewing Security Status

To view your current Cyberhawk Security Status:

  1. Right-click the Cyberhawk icon in the system tray.

  2. Click Status to view the Security Status report.

  3. Click Close when you are finished viewing the report.


About Cyberhawk's Main Viewing Area

Cyberhawk's Main Control Panel

The Cyberhawk Control Panel shows five available tabs down the left side. When selected, each tab will display further information for the selected option in the area to the right:

The tabs are Security Status, Threat Control, Rootkit Scanner, Custom Rules, and Options.

Rootkit Scanner and Custom Rules are only accessible in CYBERHAWK PRO.

Security Status

This tab:

  • displays both "Your Protection" and "Cyberhawk Secure Community Protection."

"Your Protection" provides you information on what Cyberhawk is doing to protect your particular PC. "Cyberhawk Secure Community Protection" provides you information on what Cyberhawk is doing to protect the entire Secure Community.

When you view your security status statistics you’ll notice five tabs across the top: Today, Last 7 Days, Last 30 Days, Last 90 Days and Total. Clicking on any of these tabs allows you to see your security statistics for the relevant time period.

The following items are included in the reports:

Events Analyzed - number of times Cyberhawk has evaluated an action to determine whether it was potentially harmful.

Programs Examined - number of processes that Cyberhawk has monitored or examined for signs of suspicious behaviors.

Suspicious Activities Detected - number of times Cyberhawk has flagged a potentially risky process.

Malware Blocked - number of times Cyberhawk has discovered and blocked malware.

Zero-Day Malware Blocked - number of zero-day threats found and prevented that could not be stopped by traditional antivirus or anti-spyware.

You can always review what these items mean by clicking the Learn More link at the bottom right of the window. Clicking this link will launch a web page which explains all the terms and gives you the latest statistics.

There are five date tabs across the top: Today, Last 7 Days, Last 30 Days, Last 90 Days and Total. Clicking on any of these tabs allows you to see your statistics for the relevant time period.

You may also access this report at any time through the tray icon. Simply right-click on the Cyberhawk icon and choose Status.

Threat Control

The Threat Control Center is where you can manage your Allow or Deny choices with respect to system activity, where you manage Quarantined items in CYBERHAWK PRO and where you can view the log of all Cyberhawk actions.

Rootkit Scanner

The Rootkit Scanner tab provides access to the Cyberhawk rootkit scanner (CYBERHAWK PRO only)

Custom Rules

The Custom Rules tab provides the means for creating custom rules and blocking files. (CYBERHAWK PRO only)

Only those advanced users who are extremely knowledgeable in all aspects of their system’s behavior should visit this section, and even so Novatix strongly encourages you to exercise caution when making any changes.

Options

The Options tab provides access to the Cyberhawk options.


About Cyberhawk's Rule Actions

Cyberhawk Alert Dialogs

When Cyberhawk detects what it considers to be suspicious behavior on your computer, it alerts you with one of two types of alerts - the "Known Malware" alert or the "Potentially Malicious" alert.

"Known Malware" Alert

When Cyberhawk detects an attack on your computer by a known virus, it will immediately terminate the attack and permanently isolate the virus process. An alert screen will display and notify you that Cyberhawk has prevented the attack.

All you need to do is click "Proceed" to get back to what you were doing at the time of the attack.

CYBERHAWK PRO ONLY — In Cyberhawk Pro, the malware will be automatically quarantined for you. You can manage the threat or permanently delete it from the Quarantine section of the Threat Control tab.

Also, Cyberhawk Pro provides a "Learn more about this threat" link to launch a quick web search on the threat. This provides you with further information and details on the type of threat you have just avoided.

"Potentially Malicious" Alert

When Cyberhawk detects a "potentially malicious process" that might be a virus attack, it will immediately suspend the suspicious process and alert you that your computer may be at risk:

You have three courses of actions open to you. You can:

  1. Click the Allow button to allow the operation to proceed.

  2. Click the Deny button to deny the operation.

  3. Check the Remember this answer the next time this application runs box so that Cyberhawk performs the same action you chose the next time the same situation arises.

Let's say you have a trusted application that you recognize as the application that triggered the alert. In that situation, you could instruct Cyberhawk to always allow the operation to proceed. If you change your mind, you can always use the Undo option to reverse your decision.

CYBERHAWK PRO ONLY —Click the "Learn more about this threat" link to launch a quick web search on the threat. In most cases the result of this search provides a clear indication of how to proceed.

"Adware" Alert

When Cyberhawk detects that adware is attempting to run on your computer, it will immediately halt the process and notify you with the following alert:

You have three courses of actions open to you. You can:

  1. Click the Allow button to allow the operation to proceed.

  2. Click the Deny button to deny the operation.

  3. Check the Remember this answer the next time this application runs box so that Cyberhawk performs the same action you chose the next time the same situation arises.

While all adware is designed to serve you ads in some format, it is sometimes bundled with other software programs that you may actually want. It is completely your choice whether to run the adware or not. Let's say you have a trusted application that you recognize as the application that triggered the alert. In that situation, you could instruct Cyberhawk to always allow the operation to proceed. If you change your mind, you can always use the Undo option to reverse your decision.

CYBERHAWK PRO ONLY —Click the "Learn more about this threat" link to launch a quick web search on the threat. In most cases the result of this search provides a clear indication of how to proceed.


Cyberhawk Security Status Update

Security Status Update

Cyberhawk is always at work protecting your computer: 24 hours a day, 7 days a week, no holidays. Any time you wish you can view the processes Cyberhawk has protected and check your security status simply by opening the control panel. You may also view the Status information by right-clicking on the Cyberhawk tray icon and choosing "Status." And every couple of weeks we'll provide you this same status report with all the information necessary to know Cyberhawk is working for you.

This report displays both "Your Protection" and "Cyberhawk Secure Community Protection."

"Your Protection" provides you information on what Cyberhawk is doing to protect your particular PC. "Cyberhawk Secure Community Protection" provides you information on what Cyberhawk is doing to protect the entire Secure Community.

The following items are included in the reports:

Events Analyzed - number of times Cyberhawk has evaluated an action to determine whether it was potentially harmful.

Programs Examined- number of processes that Cyberhawk has monitored or examined for signs of suspicious behaviors.

Suspicious Activities Detected - number of times Cyberhawk has flagged a potentially risky process.

Malware Blocked - number of times Cyberhawk has blocked malware discovered.

Zero-Day Malware Blocked - number of zero-day threats found and prevented that could not be stopped by traditional antivirus or anti-spyware.

There are five date tabs across the top: Today, Last 7 Days, Last 30 Days, Last 90 Days and Total. Clicking on any of these tabs allows you to see your statistics for the relevant time period.

You may also access this report at any time through the tray icon. Simply right-click on the Cyberhawk icon and choose Status.


Cyberhawk Threat Control

Threat Control is the 2nd tab down the left on the main Cyberhawk control panel. The Threat Control Center is where you can manage your Allow or Deny choices with respect to system activity, where you manage Quarantined items in CYBERHAWK PRO and where you can view the log of all Cyberhawk actions.

The Threat Control tab displays the following four tabs across the top:

Allowed

  • This list displays all items you asked Cyberhawk to always allow. If you no longer wish to always allow a particular item, select the appropriate entry and click Remove to remove it from this list. The next time that process attempts to run you will be presented with a new alert where you can then select Allow or Deny as appropriate.

Denied

  • This list displays all items you asked Cyberhawk to always deny. If you no longer wish to always deny a particular item, select the appropriate entry and click Remove to remove it from this list. The next time that process attempts to run you will be presented with a new alert where you can then select Allow or Deny as appropriate.

Quarantined (CYBERHAWK PRO only)

  • Malware that has been automatically quarantined for your protection can be managed here. You can Restore or Permanently Delete an item by selecting it in the list and clicking the appropriate link at the bottom of the window.

Protection Log

  • This section displays a log of all actions taken by Cyberhawk and all processes monitored or examined for signs of suspicious behaviors.


About Rootkit Scanner

This feature is only available withCYBERHAWK PRO.

Cyberhawk is constantly on the lookout for signs of hidden processes that are running on your system that might indicate the presence of a rootkit. However, hidden processes are not the only indicators of a rootkit. A rootkit may contain several pieces and the Rootkit Scanner dives deeper into your system seeking out any hidden files, registry keys or other objects that may be part of a rootkit.

If the Rootkit Scanner finds any trace of a rootkit, it will give you the option to quarantine the objects so that the rootkit cannot run. From the Quarantine section in Threat Control you can then also choose to permanently delete the objects off your system.

See Running a Rootkit Scan for instruction on how to run a scan.


Running a Rootkit Scan

This feature is only available withCYBERHAWK PRO.

To run a Rootkit Scan:

  1. From the Start menu, select Start > All Programs > Novatix > Cyberhawk > Cyberhawk.

Or

Right-click the Cyberhawk icon in the system tray. The dispalyed menu shows four choices, Cyberhawk, Orientation, Suspend and Status. Click Cyberhawk.

The Cyberhawk window appears.

  2. On the left side pane of the Cyberhawk window select Rootkit Scanner.

  3. The main Rootkit Scanner window appears.

  4. On the Rootkit Scanner tab, select the scan type you wish to run: Quick or Full.

A Quick scan will only search certain key areas of your system where rootkits most typically hide, whereas a Full scan will perform a comprehensive scan of your entire system.

  5. After selecting your scan type, click the Scan Now button to begin the scan. The active Rootkit Scan window appears.

As the scan is running you may click the Pause button to temporarily stop the scan. If you choose to Pause, the Pause button changes to a Resume button which allows you to resume the scan when you choose.

You may also choose to Stop the scan by hitting the Stop button. This action will terminate the scan in progress.

  6. At the completion of the scan you will be shown the results of the scan and any rootkits found. If rootkits are found, select the items in the list and quarantine them by clicking the Quarantine Selected link.

Note: After quarantining, you may wish to permanently remove any rootkits. Simply visit the Quarantine section of the Threat Control tab to manage quarantined items.


About Rule Settings

About Custom Rules Settings

This feature is only available withCYBERHAWK PRO.

Cyberhawk is designed fully configured to provide you with the best possible protection against new and unknown threats. There should be no need for you to create additional rules to supplement your protection, but Cyberhawk allows you to create your own custom rules if desired.

BE AWARE though that improperly configured rules can prevent your system from running properly. Only those advanced users who are extremely knowledgeable in all aspects of their system's behavior should consider creating custom rules, and even so we strongly encourage you to exercise caution when making any changes.

The Custom rule Settings are organized in two tabs:

  • The Rules tab

  • The Process Lists tab

To access these tabs:

  1. Select the Rule Settings Option on Cyberhawk's main viewing area.

  2. Click the Custom Rule Settings button.

  3. Click the Rule Settings button.

  4. The Settings dialog is displayed and the Rules, and Process Lists tabs are available.

You have options available to you by clicking the buttons on the right of each tab.


About the Rule Settings Tabs

About the Custom Rule Settings Tabs

This feature is only available withCYBERHAWK PRO.

There are three Custom Rule Settings tabs:

The Rules tab allows you to:

  • Create a custom rule using the Rule Wizard

  • Copy a rule

  • Modify a rule

  • Delete a rule

  • Check and uncheck all rules

Rather than deleting a rule, you can simply disable it by removing the check in the box in front of the rule.

The Trusted Processes list allow you to:

  • Create (add) new Trusted Processes for use in the Exclusion section of the Rule Wizard

  • Delete Trusted Processes for us in the Exclusion section of the Rule Wizard

  • Check and uncheck all Trusted Processes

  • Create (add) new email programs and browsers for use in the Source section of the Rule Wizard

  • Delete new email programs and browsers for us in the Source section of the Rule Wizard

  • Check and uncheck all email programs and browsers

The Rule Wizard contains the Source of the rule, the Trigger for the rule, any Options that qualify the rule, and any Exclusions to the rule.

Use the Rule Wizard to create and modify rules.


About the Rule Wizard

What is the Rule Wizard?

The Rule Wizard is an advanced feature used to create and modify rules.

Only those advanced users who are extremely knowledgeable in all aspects of their system’s behavior should visit this section, and even so Novatix strongly encourages you to exercise caution when making any changes.

The Rule Wizard takes you through four items that allow you to create arguments that compose a rule Cyberhawk will enforce. Let's say you know of several dangerous Internet sites. You can compose a rule to prevent access to those sites.

The Rule Wizard consists of the following four items:

  • Source

  • Trigger

  • Options

  • Exclusions

Accessing the Rule Wizard

To access the Rule Wizard:

  1. Select Start/All Programs/Novatix/Cyberhawk/Cyberhawk.

Or

Right-click the Cyberhawk icon in the system tray:

The two choices are Suspend and Cyberhawk.

  2. Select Cyberhawk.

The Cyberhawk window appears.

  3. On the left side of the pane, select Rule Settings.

  4. Click the Rule Settings button on the right of the pane.

The Novatix Cyberhawk Settings window appears with its two tabs:

  • The Rules tab

  • The Process Lists tab


Creating a Rule

Using the buttons on the right of the Novatix Cyberhawk Settings Rules tab, you can create a rule.

To create a rule:

  1. Select Start/All Programs/Novatix/Cyberhawk/Cyberhawk.

Or

Right-click the Cyberhawk icon in the system tray:

The two choices are Suspend and Cyberhawk.

Click Cyberhawk .

  2. The Cyberhawk main window appears.

  3. On the left side of the pane select Rule Settings.

  4. Click the Rule Settings button on the right side of the pane.

  5. On the Rules tab, click New.

The Rule Wizard appears:

  6. Click the Next button.

The Rule Wizard – Source dialog box appears.

  7. Click an option from What is the rule source? Your choice appears under the Rule box, which demonstrates the creation of the rule.

  8. Click the Next button.

The Rule Wizard – Trigger dialog box appears.

  9. Select an option from Which event triggers the rule? Your choice appears under the Rule box, which demonstrates the creation of the rule.

Click on an underlined value to edit it.

  10. Click Next.

The Rule Wizard – Options dialog box appears.

  11. Check an option under Select any rule options

Click on an underlined value to edit it. All parts of the argument appear under the Rule box.

If you click named file name, type the name in the File List dialog box and click + to add it to the list of file names. Click OK, and the name appears as part of the rule components.

  12. Click Next.

The Rule Wizard – Exclusions dialog box appears

By default, the source process is in the system process list and the source process is in the trusted process list are selected. Clear these checks, as shown above.

  13. Click Next.

  14. Type in the rule name and description.

  15. Click Finish.

  16. The rule appears in the list of rules.

  17. Click Apply to finalize your rule.


Copying a Rule

Using the buttons on the right of the Novatix Cyberhawk Settings Rules tab, you can copy a rule.

To copy a rule:

  1. To copy a rule, first highlight the rule.

  2. Click the Copy button.

The rule is copied and put on the bottom of the rules.

  3. Click the Apply button at the bottom of the window to finalize any changes.

To copy all rules:

  1. To copy all rules, click the Check All button.

  2. Click the Copy button.

Click the Uncheck All button to uncheck them

  3. Click the Apply button at the bottom of the window to finalize any changes.


Modifying a Rule

Using the buttons on the right of the Novatix Cyberhawk Settings Rules tab, you can modify a rule.

To modify a rule:

  1. Highlight the rule you want to modify.

  2. On the Rules tab, click Modify.

The Rule Wizard appears.

The Rule Wizard shows you the choices you made in making your rule, and you can make any modifications to

• Source

• Trigger

• Options

• Exclusions

  3. Click the Next button.

The Rule Wizard – Source dialog box appears.

If you want to modify the Source, make your selection from the What is the rule source? box.

Click on any underlined value to edit it.

  4. Click the Next button.

The Rule Wizard – Trigger dialog box appears with the choice you made in the Rule box.

If you want to modify the Trigger, make your selection from the Which event triggers the rule? box.

Click on any underlined value to edit it.

  5. Click Next.

The Rule Wizard – Options dialog box appears with the choice you made in the Rule box.

Click on any underlined value to edit it.

  6. Click Next.

The Rule Wizard – Exclusions dialog box appears with the choice you made in the Rule box.

Click on any underlined value to edit it.

  7. Click Next.

  8. Make any changes to Rule Name and Rule Description.

  9. Click Finish.

The edited rule appears in the Rule box on the Rule Settings tab.

  10. Click Apply at the bottom of the tab to finalize any changes.


Deleting a Rule

Using the buttons on the right of the Novatix Cyberhawk Settings Rules tab, you can delete a rule.

To delete a rule:

  1. Highlight the rule.

  2. Click the Delete button.

A warning dialog appears.

A profile is the set of rules configured on a given computer.

  3. Click OK to continue or Cancel to cancel.

  4. Click the Apply button to finalize your changes.


Checking and Unchecking All Rules

Using the buttons on the right of the Novatix Cyberhawk Settings Rules tab, you can check and uncheck all rules.

To check or uncheck all rules:

  1. Click Check All to select all rules and Uncheck All to uncheck all rules.

  2. Click the Apply button to finalize your changes


The Process Lists Tab: Trusted Processes List

The Process Lists tab allows you to add exclusions to rules and email programs and browsers to rule sources.

The tab has two boxes:

  • Trusted Processes

  • Email and Browsers

Rule Wizard — Exclusions

Exclusions is one of the four components the Rule Wizard uses to configure a rule.

Exclusions exempt processes that are listed in the Trusted Processes box. The rule will not execute when one of these processes is the source process when the rule is triggered.

Remember, the final item in the Rule Wizard used to construct rules is Exclusions. Here you would include any trusted processes rule exceptions.

Trusted Processes List

At the top of the Process Lists tab is the Trusted Processes box.

Use this box to list trusted processes that are created as exceptions to custom rules.

Any processes listed in the Trusted Processes box are exempt from the rules. A rule will not fire for those processes.


Adding a Trusted Process

Using the buttons on the right of the Novatix Cyberhawk Settings Process Lists tab, you can create a trusted process.

To create a trusted process:

  1. Click the New button next to the Trusted Processes box.

The New button does not bring up a custom rule; it brings up a dialog box that allows you to add processes that will be excluded a rule fires.

  2. The Process dialog box appears.

  3. Highlight the program from the tree or use the ellipse to browse to the selected program.

  4. Click OK to continue or Cancel to cancel.

The program is added to the Trusted Processes list.

  5. Click Apply at the bottom of the Process Lists tab to finalize any additions.


Deleting a Trusted Process

Using the buttons on the right of the Novatix Cyberhawk Settings Process Lists tab, you can delete a trusted process.

To delete a trusted process:

  1. Highlight the rule.

  2. Click the Delete button.

A warning dialog appears.

A profile is the set of rules configured on a given computer.

  3. Click OK to continue or Cancel to cancel.

  4. Click the Apply button to finalize your changes.


Checking and Unchecking All Trusted Process

Checking and Unchecking All Trusted Processes

Using the buttons on the right of the Novatix Cyberhawk Settings Process Lists tab, you can check or uncheck a trusted process.

To check or uncheck all trusted processes:

  1. Click Check All to select all rules and Uncheck All to uncheck all rules.

  2. Click the Apply button to finalize your changes


The Process Lists Tab: Email Programs and Browsers

The Process Lists tab allows you to add exclusions to rules and email programs and browsers to rule sources.

The tab has two boxes:

  • Trusted Processes

  • Email and Browsers

Rule Wizard — Source

The first item in the Rule Wizard used to construct rules is Source.

Rule Wizard – Source has four selections:

  • Any process

  • Any non-interactive process

  • Any email or browser process

  • Any process list

The third choice is for any email or browser process, and the sources for that choice are listed in the Email and Browsers list on the Process Lists tab.

Email and Browsers List

At the bottom half of the Process Lists tab is the Email and Browsers list.

Here you would include any email and browser rule sources so that when the rule fires it is caused by one of the email programs or browsers in this list taking an action with certain options and exclusions. The action is determined by you, the user, when you respond to the choices in the dialog box that appears when a rule triggers.


Adding a New Email Program or Browser

Using the buttons on the right of the Novatix Cyberhawk Settings Process Lists tab, you can add a email program or browser.

To add an email program or browser:

  1. Click the New button next to the Email and Browser box.

The New button does not bring up a custom rule; it brings up a dialog box that allows you to add processes that will be the sources when one of those rules fire.

  2. The Process dialog box appears.

  3. Highlight the program from the tree or use the ellipse to browse to the selected program.

  4. Click OK to continue or Cancel to cancel.

The program is added to the Email and Browsers list.

  5. Click Apply at the bottom of the Process Lists tab to finalize any additions.


Deleting an Email Program or Browser

Using the buttons on the right of the Novatix Cyberhawk Settings Process Lists tab, you can delete an email program or browser.

To delete an email program or browser:

  1. Highlight the rule.

  2. Click the Delete button.

A warning dialog appears.

A profile is the set of rules configured on a given computer.

  3. Click OK to continue or Cancel to cancel.

  4. Click the Apply button to finalize your changes.


Checking and Unchecking All Email Programs or Browsers

Using the buttons on the right of the Novatix Cyberhawk Settings Process Lists tab, you can check or uncheck all email programs and browsers.

To check or uncheck all email programs and browsers:

  1. Click Check All to select all rules and Uncheck All to uncheck all rules.

  2. Click the Apply button to finalize your changes


Cyberhawk Options

The Options tab is the 5th down the left on the main Cyberhawk control panel. It has 3 tabs across the top: General, Quarantine, and Rootkit Scan.

General Options

The items in the General Options tab are:

Cyberhawk Protection

  • Ensures that Cyberhawk can actively monitor your computer for signs of suspicious behavior and potential attacks.

Check for Updates

  • Automatically checks for program updates available for download on the Novatix servers.

Community Protection

  • Automatically reports to Novatix information about the event when a suspect rule is triggered by Cyberhawk. Participating in the Secure Community is win-win: you help identify new threats and provide better protection to all other Cyberhawk users, and in turn, other members do the same for you. If Community Protection is ever set to Off, the Check for Updates option is automatically set to Off as well and cannot be turned back on until Community Protection is turned back on.

Quarantine Options (CYBERHAWK PRO only)

If you are using Windows XP or later version of Windows, you can tell Cyberhawk to automatically set a System Restore Point before performing any quarantine action. While it is very rare that there would be any problems during quarantine, having a system restore point to revert back to is just an added safety measure to make it easy to recover from any potential problem.

To set this option, simply check the checkbox to Set System Restore Point. Should you decide you wish to stop setting restore points, simply uncheck the same box.

Rootkit Scan Options (CYBERHAWK PRO only)

We recommend that you scan for rootkits at least once a week. Under the Rootkit Scan options tab you can configure Cyberhawk to conduct either a Quick Scan or Full Scan automatically for you at the time and frequency of your choice.

To schedule an automatic scan:

  1. Check the Run a scheduled scan box to indicate that you wish to turn on and run automatic scans.

  2. Use the Time, Repeat, and Type dropdown boxes to choose the scan’s start time, repeat frequency and type.

  3. Click OK to confirm your scan options.

  4. Click Cancel to cancel your dropdown box selections.

You must click OK to confirm that you wish to run an automatic scan with the specified scan choices.

Important: Please note that when you run an automatic scan, any items found will be automatically quarantined. You can manage quarantined items in the Quarantine section of the Threat Control Center.


End User License Agreement

End User License Agreement (EULA)

IMPORTANT NOTICE. This license agreement is a legal agreement between you (either an individual or a legal entity) and Novatix Corporation, or any subsidiaries of Novatix Corporation (if any), and its suppliers ("NOVATIX"). By installing or using this Software (defined below) in any way you acknowledge and unconditionally agree that you have read, understand and agree to the terms of this agreement. If you do not agree to these terms, do not install or use this Software in any way.

LICENSE GRANT. NOVATIX grants you a personal, limited, non-exclusive license to use this software and related documentation (collectively, the "Software") for only your personal use in accordance with the documentation provided with the Software and as provided herein. If you have purchased a Single User License, you may install and use one copy of the Software on a single personal computer or workstation. The Software is in "use" on a single computer when it has been loaded into temporary memory (i.e. RAM) or installed into permanent memory (e.g. hard disk or other storage device) of that computer. If you have purchased a Multiple User License in conjunction with a Single User License, you may install and use the Software on the number of computers authorized at the time of purchase. The basic, or free, version of the Software is intended exclusively for personal, private, and non-commercial use on a home computer only and may not be used within any organization or for commercial or professional purposes without prior written consent from Novatix.

SOFTWARE USE. The Software is designed to block malicious behaviors on your computer. If a potentially malicious behavior is detected, the Software will prompt an action to “Allow” or “Deny” the process in question. If you have the Community Protection option in the Software set to "On" then information regarding this event is collected and transmitted to Novatix. This information may include the reason a program alert triggered, the history of relevant events that led to the event, the decision you made regarding this alert, and a copy of the file that triggered the alert. This data is transmitted solely for research and analysis purposes to aid in determining whether a process is malicious in nature. Sample malware files collected may be shared with other security providers for the sole purpose of creating signatures to protect against further spread of the specific threats. All information and file samples are held completely confidential and are not tracked back to individual users. Each installation of the Software is also associated with a unique anonymous identifier that does not include any personal data and is used solely to help track the total number of active users.

OTHER RESTRICTIONS. You shall not, nor allow any person to: (a) remove any product identification, copyright notices, or other notices or proprietary restrictions from this Software; (b) sell, lease, license, sublicense, rent, timeshare, allow use on a service provider basis or commercialize this Software in any manner; (c) cause or permit reverse engineering, disassembly, decompilation, modification or alteration of this Software except and only to the extent that such activity is expressly permitted by applicable law notwithstanding this limitation; (d) copy the Software other than for back-up purposes..

As a condition of your use of the Software, you represent, warrant and covenant that you will not use the Software: (i) to infringe the intellectual property rights or proprietary rights, or rights of publicity or privacy, of any third party, including the Novatix; (ii) to violate any applicable law, statute, ordinance or regulation; (iii) to disseminate information or materials in any form or format ("Content") that is harmful, threatening, abusive, harassing, tortuous, defamatory, vulgar, obscene, libelous, or otherwise objectionable under applicable laws; or (iv) to disseminate any software viruses or any other computer code, files or programs that may interrupt, destroy or limit the functionality of any computer software or hardware or telecommunications equipment. You, and not Novatix, remain solely responsible for all Content that you upload, post, email, transmit, or otherwise disseminate using, or in connection with, the Software. You acknowledge that all Content that you access using the Software is at your own risk and you will be solely responsible for any damage to any party resulting therefrom.

COPYRIGHT/OWNERSHIP. This Software is licensed and not sold. This Software and its source code are proprietary products of NOVATIX and are protected by copyright and other intellectual property laws. You acquire only the right to use the Software and do not acquire any rights, express or implied, in the Software or media containing the Software other than those specified in this License. NOVATIX shall at all times retain all rights, title, interest, including intellectual property rights, in the Software and media.

TERM. Except as otherwise stated in any written software license agreement with Novatix, or unless terminated earlier in accordance with this Section, the term of this Agreement is for the duration of the Novatix copyright in the applicable Product. You may terminate it at any time by destroying the Software, together with all copies thereof. This license will also terminate if you fail to comply with any term or condition of this Agreement. Upon such termination, you agree to destroy the Software, together with all copies thereof. The paragraphs under the following section titles shall survive the termination of this agreement: Other Restrictions, Disclaimer of Warranties, Export Restrictions, Limitation of Liabilities and Miscellaneous.

SUPPORT. This Agreement does not entitle you to any support, upgrades, patches, enhancements, or fixes for the Software (collectively, "Support") although Novatix may provide such support in the manner it deems commercially reasonable, at its sole discretion. Any such Support for the Software that may be made available by Licensor shall become part of the Software and subject to this Agreement.

TRADEMARKS. NOVATIX, and other names of NOVATIX and NOVATIX products referred to herein or in any documentation that accompanies the Software are trademarks or registered trademarks of NOVATIX Corporation in the United States and/or other countries. All other brands and product names are trademarks of their respective holders.

EXPORT RESTRICTIONS. You agree to comply fully with all laws and regulations of the United States and other countries (Export Laws) to assure that neither the Software, nor any direct products thereof are (1) exported, directly or indirectly, in violation of Export Laws, or (2) are used for any purpose prohibited by Export Laws, including, without limitation, nuclear, chemical, or biological weapons proliferation.

None of the Software or underlying information or technology may be downloaded or otherwise exported or re-exported (i) into (or to a national or resident of) Cuba, Iraq, Libya, Yugoslavia, North Korea, Iran, Sudan, Syria or any other country to which the U.S. has embargoed goods; or (ii) to anyone on the U.S. Treasury Department's List of Specially Designated Nationals or the U.S. Commerce Department's Table of Denial Orders. By downloading or using the Software, you are agreeing to the foregoing and you are representing and warranting that you are not located in, under the control of, or a national or resident of any such country or on any such list.

DISCLAIMER OF WARRANTIES. THIS SOFTWARE IS DISTRIBUTED 'AS IS' AND YOU, ITS USER, ASSUME ALL RISKS WHEN INSTALLING OR USING IT. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NOVATIX DISCLAIMS ALL WARRANTIES EXPRESS OR IMPLIED, BY OPERATION OF LAW OR OTHERWISE. NOVATIX DISCLAIMS THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. NOVATIX DOES NOT WARRANT THAT THE SOFTWARE IS NON-INFRINGING, THAT IT WILL MEET YOUR REQUIREMENTS OR THAT ITS OPERATION WILL BE UNINTERRUPTED, ERROR-FREE OR VIRUS-FREE.

LIMITATION OF LIABILITY. IN NO EVENT SHALL NOVATIX BE LIABLE FOR ANY DAMAGES OF ANY KIND INCLUDING DIRECT, INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES (WHICH SHALL INCLUDE WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS OR PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, OR OTHER PECUNIARY LOSS) WHETHER BASED ON CONTRACT, TORT OR OTHER LEGAL THEORY, ARISING OUT OF THE USE OF OR INABILITY TO USE THE SOFTWARE, EVEN IF NOVATIX HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THE ABOVE LIMITATION OR EXCLUSION MAY NOT APPLY TO YOU. IN ANY CASE, THE ENTIRE LIABILITY OF NOVATIX UNDER ANY PROVISION OF THIS LICENSE AGREEMENT SHALL BE LIMITED TO U.S. $5.00.

INDEMNITY. You agree that Novatix shall have no liability whatsoever for any use you make of the Software. You shall indemnify and hold harmless Novatix from any third party claims, damages, liabilities, costs and fees (including reasonable attorney fees) arising from your use of the Software as well as from Licensee's failure to comply with any term of this Agreement.

MISCELLANEOUS. In the event of invalidity of any provision of this Agreement, the parties agree that such invalidity shall not affect the validity of the remaining portions. The Agreement is governed by the laws of the State of Colorado as applied to agreements between Colorado residents entered into and to be performed entirely within Colorado, and each party hereto submits to the exclusive jurisdiction of the Courts of that State. The United Nations Convention on Contracts for the International Sale of Goods is specifically disclaimed. This is the entire agreement between you and NOVATIX, which supersedes any prior agreement, whether written or oral, relating to this subject matter.

U.S. GOVERNMENT RESTRICTED RIGHTS. In the event the Federal Acquisition Regulations (FAR) or DFARS is applicable to this Agreement, the Software is provided only with Restricted Rights as defined in paragraph 52.227-19 or paragraph 252.227-7013(c)(1)(ii), respectively (or a comparable or successor clause to either), as applicable. If you are part of an agency, department, or other entity of the United States Government ("Government"), the use, duplication, reproduction, release, modification, disclosure or transfer of the Software is restricted in accordance with the Federal Acquisition Regulations as applied to civilian agencies and the Defense Federal Acquisition Regulation Supplement as applied to military agencies. The Software is a "commercial item," "commercial computer Software" and "commercial computer software documentation." In accordance with such provisions, any use of the Software by the Government shall be governed solely by the terms of this Agreement. Contractor/manufacturer is Novatix Corporation, 5777 Central Ave, Ste 130, Boulder, CO 80301, USA.


Technical Support

Online Help:

If you are reading this, then you are already familiar with part of the available Help system. You can browse the index or the topics list and find help on individual topics. Additional help can be found in the Cyberhawk User's Guide (pdf).

Technical Support:

Additional support information and resources can be found at the Novatix web site at http://www.novatix.com/Support.


Secure community

The Cyberhawk Secure Community is a worldwide network of active users who volunteer to aid in identifying new threats. Any time a suspect alert is triggered in Cyberhawk, information related to this event is automatically reported to Novatix for analysis through a secure connection. Any information collected is held completely confidential and is used solely for the purposes of researching new or previously unknown threats, gaining an understanding of their behaviors, and developing new protection against them. Information collected may include the Cyberhawk alert that fired, the history of relevant events leading to that alert, the decision taken, and any relevant IP address information. This immediate confidential feedback on potentially dangerous new threats allows Novatix to advance its ActiveDefense technology to block these threats. So as threat strategies evolve and new security penetration tactics emerge, Cyberhawk technology will remain at the forefront of the solutions that defeat those threats.


The Rule Wizard

The Rule Wizard is an advanced feature found under the Rule Settings that is used to create and modify rules.

Only those advanced users who are extremely knowledgeable in all aspects of their system’s behavior should visit the Rule Settings area and use the Rule Wizard.

The Rule Wizard takes you through five items that allow you to create arguments that compose a rule Cyberhawk will enforce. Let’s say you know of several dangerous Internet sites. You can compose rules that keep you or other users of your computer from entering those sites.

The Rule Wizard contains the following four items:

  • Source,

  • Trigger,

  • Options,

  • Exclusions;

and it consists of a logical argument in this form:

If (condition x acts this way) Then (take this action) Except (when this is involved)

The first clause of the argument is made up of the following items:

  • Source

  • Trigger

  • Options

The end of the argument consists of the following item:

  • Exclusions

You provide the action when you make your selection in the dialog box that comes up when the rule is triggered by choosing:

  • to allow the operation to proceed

  • to deny the operation


Trusted Process

Trusted processes are applications that can see all protected objects; nothing is hidden from trusted processes. Users can set up certain applications as trusted processes, such as anti-virus software that needs to check protected files for computer viruses.


Recovering Cyberhawk

If Cyberhawk does not shut down properly the last time it ran, the Cyberhawk Recovery dialog box comes up when you start up your computer again:

You are provided with four options.

  • To run Cyberhawk normally

  • To run Cyberhawk for test purposes

  • To not run Cyberhawk at this time, but to be prompted again on the next computer boot

  • Not to run Cyberhawk on startup again

Make one of the following selections:

  1. Select the first option: No problem. Go ahead and run normally.

  2. Click the Next button.

Cyberhawk will run.

  3. To run Cyberhawk for text purposes. To not run Cyberhawk until asked during the next computer boot, or to discontinue running Cyberhawk, choose the appropriate button.

  4. Click Next to confirm your selection.

Cyberhawk will take the action selected.


Checking and Unchecking All File Blocking Rules

Using the buttons on the right of the Novatix Cyberhawk Settings File Blocking tab, you can check and uncheck all rules.

To check or uncheck all rules:

  1. Click Check All to select all rules and Uncheck All to uncheck all rules.

  2. Click the Apply button to finalize your changes


Copying a File Blocking Rule

Using the buttons on the right of the Novatix Cyberhawk Settings File Blocking tab, you can copy a rule.

To copy a rule:

  1. To copy a rule, first highlight the rule.

  2. Click the Copy button.

The rule is copied and put on the bottom of the rules.

  3. Click the Apply button at the bottom of the window to finalize any changes.

To copy all rules:

  1. To copy all rules, click the Check All button.

  2. Click the Copy button.

Click the Uncheck All button to uncheck them

  3. Click the Apply button at the bottom of the window to finalize any changes.


Creating a File Blocking Rule

On the right of the Novatix Cyberhawk Settings File Blocking tab are six buttons: New, Copy, Modify, Delete, Check All, and Uncheck All.

You must first highlight a rule for these buttons to be active. If no rule is highlighted, the Copy, Modify, and Delete buttons appear as dimmed.

To create a file blocking rule:

  1. Click the File Blocking tab.

  2. Click New.

The File Blocking Group dialog box appears.

  3. Fill in the Name and Description fields.

  4. Type in the name of the file(s) you want to block.

  5. Click the + to add in the name of the files or file patterns you want to block.

  6. Highlight a file or file pattern you have chosen to block and click Remove to remove it.

  7. If you want to allow any specific files, add them to the Except these specific files field by typing in the name of the file(s) you want to allow.

Click the + to add in the name of the specific files you want to exempt from the rule.

To remove an exception, highlight the file and click Remove.

  8. Click OK.

The rule appears in the File Blocking tab Blocked Files box.

  9. Click Apply at the bottom of the File Blocking tab to finalize any changes.


Deleting a File Blocking Rule

Using the buttons on the right of the Novatix Cyberhawk Settings File Blocking tab, you can delete a rule.

To delete a rule:

  1. Highlight the rule.

  2. Click the Delete button.

A warning dialog appears.

A profile is the set of rules configured on a given computer.

  3. Click OK to continue or Cancel to cancel.

  4. Click the Apply button to finalize your changes.


Modifying a File Blocking Rule

Using the buttons on the right of the Novatix Cyberhawk Settings File Blocking tab, you can modify a rule.

To modify a rule:

  1. Click the File Blocking tab.

  2. Highlight the Rule.

Click the Modify button.

The File Blocking Group dialog box appears with the selections for the rule.

  3. Change the Name and Description fields by filling in these sections.

  4. Change the files or file types you want to block by typing in the name of the file(s) you want to block.

  5. Click the + to add in the name of the files or file patterns you want to block.

  6. Highlight a file or file pattern you have chosen to block and click Remove to remove it.

  7. Modify the files you want to exempt from the rule by adding them to the Except these specific files field by typing in the name of the file(s) you want to allow.

Click the + to add in the name of the specific files you want to exempt from the rule.

  8. To remove an exception, highlight the file and click Remove.

  9. Click OK.

The modified rule appears in the File Blocking tab Blocked Files box.

  10. Click Apply at the bottom of the File Blocking tab to finalize any changes.