About ThreatFire

ThreatFire is patent-pending, security software for your computer. This Help system covers both ThreatFire Free Edition and ThreatFire Pro.

ThreatFire protects you by intelligently blocking behavior consistent with that of malware such as viruses, worms, trojans, spyware, adware, rootkits, keyloggers, and buffer overflows. ThreatFire vigilantly monitors any activity that might compromise the security of your computer. Technological advances allow ThreatFire to monitor your computer at very low levels to seek out even deeply hidden threats.

When you install ThreatFire, it is already fully configured and no additional set up is required. ThreatFire will automatically block any known malicious threats. For indeterminate threats, or threats that might be a virus, it will immediately suspend the suspicious process and present you with the choice to “Allow” or “Quarantine” the process. You can always undo any actions you decide to take. Information about the type of threat, a description of what it does, and the risk level associated with that type of threat, are always provided so that the program is intuitive and easy-to-use.

As you choose to respond to a perceived threat, the behavior of the threat and your response are relayed to Novatix for analysis. The ThreatFire Secure Community, which includes all ThreatFire users who wish to participate, thus gains knowledge of new behaviors of threats, and Novatix can create and distributes new enhancements as necessary. You also have the option of customizing your own rules if you wish to supplement ThreatFire’s comprehensive built in protection, but you are very strongly advised not to do this unless you have expert knowledge of Windows and your computer.

Use this Help system to learn how to use ThreatFire:

  • how to modify its options and settings

  • what to do when a security threat is discerned

  • how to use the additional features included only in ThreatFire Pro: on-demand virus scanning

Additional help can be found in the ThreatFire User's Guide (pdf).

ThreatFire Copyright © 2004-2007 PC Tools. All Rights Reserved.

ThreatFire is patent-pending technology. PC Tools, ThreatFire and other PC Tools brand and product names used herein are trademarks or registered trademarks of PC Tools Technology Pty Ltd. Other brands and their products are trademarks or registered trademarks of their respective holders and should be noted as such.

ThreatFire uses the PPMd compression library authored by Dmitry Shkarin and Dmitry Subbotin.

Information in this document is subject to change without notice. The software described in this document is furnished under a license agreement or nondisclosure agreement. The software may be used or copied only in accordance with the terms of those agreements. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or any means electronic or mechanical, including photocopying and recording for any purpose other than the purchaser’s personal use without the written permission.

PC Tools, Inc.

5777 Central Ave, Suite 130

Boulder, CO 80301 - USA

www.threatfire.com


Additional protection

Protecting You When Traditional Antivirus Can’t

A “Zero-Day” attack occurs when your computer is infected by a Zero-Day threat – a virus, trojan, worm or spyware which is so new that traditional antivirus programs have no “signature” to identify the threat.

Because Zero-Day attacks happen faster than traditional antivirus vendors can react.

Here is what your traditional signature-based antivirus product must do to protect you against any new threat:

1) Catch the threat.

2) Analyze the threat to understand what it does

3) Write a signature that recognizes the threat.

4) Test the signature to ensure it does not damage your computer.

5) Issue you an update with the new signature. And then…

6) You still have to update your software with the new signature!

It can be days before traditional antivirus vendors provide the “signature update” necessary to protect your computer. And traditional signatures cannot protect you if a threat “morphs” to evade the signature.

ThreatFire does not rely on signatures in order to protect you. Its patent-pending ActiveDefense technology is the most intelligent behavioral analysis technology available today. It continuously monitors all activities on your PC at a very low system level and uses a proprietary combination of analytics, risk algorithms, program histories and tolerance thresholds to identify and shut down threats.

  • When ThreatFire detects an attack on your computer by a known virus, it will immediately terminate the attack and permanently isolate the virus process. An alert screen will appear to confirm that ThreatFire has prevented the attack.

  • If ThreatFire detects a potentially malicious process that might be an attack, it will immediately suspend the suspicious process and alert you that your computer is at risk. You can then choose to “Allow” or “Quarantine” the process based on the informative information provided in the alert.


About ThreatFire Versions

ThreatFire Versions

There are two versions of ThreatFire included in its one main installation package: ThreatFire Free Edition and ThreatFire Pro. All installations begin as ThreatFire Free Edition. For more comprehensive protection, please consider purchasing ThreatFire Pro. To purchase or register ThreatFire Pro simply click the Upgrade Now button on the left side of ThreatFire’s main control panel. This will display the ThreatFire Registration Window:

The various versions of ThreatFire are explained below:

ThreatFire Pro

ThreatFire Pro is the paid (registered) version of ThreatFire which has additional features activated and accessible. These features include advanced options and an antivirus engine with on-demand scanning capability to scan your system for known threats. If you have already purchased a registration code for ThreatFire Pro, simply enter that code in the field provided to convert the trial version to ThreatFire Pro.

ThreatFire Free Edition

ThreatFire Free Edition is the limited version of ThreatFire which does not allow access to any ThreatFire Pro features. This version of ThreatFire provides basic protection against malware. If at any time while you’re using ThreatFire Free Edition you wish to upgrade to the full protection of ThreatFire Pro you may do so by purchasing a registration code.


About This Help Facility

The following conventions are used through out this help file:

  • bold text — Used to designate responses you type in, menu names, command names, dialog box options, dialog box titles, icon names, and fields.

  • Underlined blue font text — Used to indicates that more information about that text can be seen by clicking the word or phrase. A second click will remove the information.

  • Underlined gold font text — Indicates a link that will take you to another topic with relevant information.

  • Italic text - Used to designate guides, books, and other reference material.

  • The following words are used interchangeably: click, select, and choose.


How to Purchase ThreatFire Pro

How to Upgrade to ThreatFire Pro

How do I purchase (register) ThreatFire Pro?

Purchasing and registering ThreatFire Pro is easy. You may register ThreatFire Pro at any time by following these steps:

  1. Click on the Upgrade Now button in ThreatFire. This will display the Registration window.

  2. Select the Purchase Online button to be directed to the PC Tools secure ecommerce store to purchase your ThreatFire Pro subscription license. At the completion of your order you will receive your registration code through email. Check your email inbox for this message.

  3. When you have your registration code, click the Upgrade Now button in ThreatFire to again display the Registration window.

  4. Enter your code in the box provided and click Register.

All ThreatFire Pro features are now activated for the duration of your subscription.

Should you have any questions when purchasing or registering, please feel free to contact us: http://www.threatfire.com/support


ThreatFire Tray Icon

ThreatFire installs an icon in the system tray area - the area next to the clock in the Windows Taskbar which is usually located at the lower right corner of your computer screen. This ThreatFire tray icon gives you access to several ThreatFire features.

Bringing Up the ThreatFire Main Window

To bring up the ThreatFire main window (ThreatFire Control Panel):

  1. Right-click the ThreatFire icon in the system tray. A menu will be displayed offering four choices:

    • ThreatFire

    • Quick Start Guide

    • Suspend

    • Status

  2. Click ThreatFire

Note: You can also access the ThreatFire Control Panel from the Start menu by selecting Start > All Programs > ThreatFire >ThreatFire

Viewing ThreatFire Quick Start Guide

To view the ThreatFire Quick Start Guide:

  1. Right-click the ThreatFire icon in the system tray.

  2. Click Quick Start Guide The Quick Start Guide will launch for you to view.

  3. Click the Close box to exit when you are finished viewing it.

Suspending ThreatFire

To suspend ThreatFire:

  1. Right-click the ThreatFire icon in the system tray.

  2. Click Suspend. The word ‘Suspend’ is then preceded by a check.

  3. Click Suspend again to reactivate ThreatFire.

Viewing Security Status

To view your current ThreatFire Security Status:

  1. Right-click the ThreatFire icon in the system tray.

  2. Click Status to view the Security Status report.

  3. Click Close when you are finished viewing the report.


About ThreatFire's Main Viewing Area

ThreatFire's Main Control Panel

The ThreatFire Control Panel shows six available buttons down the left side. When selected, each tab will display further information for the selected option in the area to the right:

The buttons are Security Status, Start Scan, Threat Control, Advanced Rules, Settings and Upgrade Now.

Upgrade Now is only shown in ThreatFire Free Edition. Once ThreatFire Pro is registered, then the Upgrade Now button is no longer displayed.

Security Status

When you launch ThreatFire, it will always open to Security Status which shows whether ThreatFire protection is ON or OFF and shows the ThreatFire Protection statistics. This report shows both “Your Protection” and “Community Protection.”

"Your Protection" provides you information on what ThreatFire is doing to protect your particular PC. "Community Protection" provides you information on what ThreatFire is doing to protect the entire Secure Community.

When you view your security status statistics you’ll notice five tabs across the top: Today, Last 7 Days, Last 30 Days, Last 90 Days and Total. Clicking on any of these tabs allows you to see your security statistics for the relevant time period.

The following items are included in the reports:

Events Analyzed - number of times ThreatFire has evaluated an action to determine whether it was potentially harmful.

Programs Examined - number of processes that ThreatFire has monitored or examined for signs of suspicious behaviors.

Suspicious Activities Detected - number of times ThreatFire has flagged a potentially risky process.

Malware Blocked - number of times ThreatFire has discovered and blocked malware.

You can always review what these items mean by clicking the Learn More link at the bottom right of the window. Clicking this link will launch a web page which explains all the terms and gives you the latest statistics.

There are five date tabs across the top: Today, Last 7 Days, Last 30 Days, Last 90 Days and Total. Clicking on any of these tabs allows you to see your statistics for the relevant time period.

You may also access this report at any time through the tray icon. Simply right-click on the ThreatFire icon and choose Status.

Start Scan

The Start Scan button provides access to the ThreatFire system scanner where you can scan your system for rootkits or viruses. (Virus scanning only available in ThreatFire Pro.)

Threat Control

The Threat Control Center is where is where you can manage your alert actions and choices with respect to system activity. This is also where you manage any Quarantined items and where you can view the log of all ThreatFire actions.

Advanced Rules

The Advanced Rules button provides the means for creating custom rules that you would like ThreatFire to enforce for you.

Only those advanced users who are extremely knowledgeable in all aspects of their system’s behavior should visit this section, and even so PC Tools strongly encourages you to exercise caution when making any changes.

Settings

The Settings tab provides access to the ThreatFire options.


About ThreatFire's Alerts

ThreatFire Alert Dialogs

When ThreatFire detects what it considers to be suspicious behavior on your computer, it alerts you with one of three types of alerts - the "Known Malware" alert, the "Potentially Malicious" alert, or the "Potentially Unwanted Application" alert.

"Known Malware" Alert

When ThreatFire detects an attack on your computer by a known threat, it will immediately terminate the attack and permanently isolate the malware process in quarantine. An alert screen will display and notify you that ThreatFire has prevented the attack.

All you need to do is click "Proceed" to get back to what you were doing at the time of the attack.

"Potentially Malicious" Alert

When ThreatFire detects a "potentially malicious process" that might be a virus attack, it will immediately suspend the suspicious process and alert you that your computer may be at risk:

You have three courses of actions open to you. You can:

  1. Click the Allow button to allow the operation to proceed.

  2. Click the Quarantine button to deny the operation and quarantine it.

  3. Check the Remember this answer box so that ThreatFire performs the same action you chose the next time the same situation arises.

Let's say you have a trusted application that you recognize as the application that triggered the alert. In that situation, you could instruct ThreatFireto always allow the operation to proceed. If you change your mind, you can always Remove the item from the Allowed list in the Threat Control Center to reverse your decision.

Click the "Learn more about this threat" link to launch a quick web search on the threat. In most cases the result of this search provides a clear indication of how to proceed.

"Potentially Unwanted Application" Alert

Some applications are not clearly good or clearly bad, but may fall somewhere in between as “grayware.” ThreatFire refers to these programs as “Potentially Unwanted Applications” or PUAs. PUAs can include adware or system administrator tools or other classes of programs. When ThreatFire detects that a PUA is attempting to run on your computer, it will immediately halt the process and notify you with the following alert:

You have three courses of actions open to you. You can:

  1. Click the Allow button to allow the operation to proceed.

  2. Click the Quarantine button to deny the operation and quarantine it.

  3. Check the Remember this answer box so that ThreatFire performs the same action you chose the next time the same situation arises.

While all adware is designed to serve you ads in some format, it is sometimes bundled with other software programs that you may actually want. It is completely your choice whether to run a PUA or not. Let's say you have a trusted application that you recognize as the application that triggered the alert. In that situation, you could instruct Cyberhawk to always allow the operation to proceed. If you change your mind, you can always Remove the item from the Allowed list in the Threat Control Center to reverse your decision.

Click the "Learn more about this threat" link to launch a quick web search on the threat. In most cases the result of this search provides a clear indication of how to proceed.


ThreatFire Security Status Update

Security Status Update

ThreatFire is always at work protecting your computer: 24 hours a day, 7 days a week, no holidays. Any time you wish you can view the processes ThreatFire has protected and check your security status simply by opening the control panel. You may also view the Status information by right-clicking on the ThreatFire tray icon and choosing "Status." And every couple of weeks we'll provide you this same status report with all the information necessary to know ThreatFire is working for you.

This report displays both "Your Protection" and "Community Protection."

"Your Protection" provides you information on what ThreatFire is doing to protect your particular PC. "Community Protection" provides you information on what ThreatFire is doing to protect the entire Secure Community.

The following items are included in the reports:

Events Analyzed - number of times ThreatFire has evaluated an action to determine whether it was potentially harmful.

Programs Examined- number of processes that ThreatFire has monitored or examined for signs of suspicious behaviors.

Suspicious Activities Detected - number of times ThreatFire has flagged a potentially risky process.

Malware Blocked - number of times ThreatFire has blocked malware discovered.

There are five date tabs across the top: Today, Last 7 Days, Last 30 Days, Last 90 Days and Total. Clicking on any of these tabs allows you to see your statistics for the relevant time period.

You may also access this report at any time through the tray icon. Simply right-click on the ThreatFire icon and choose Status.


About System Scanner

The System Scanner can be accessed by clicking the Start Scan button, which is the 2nd button down the left on the main ThreatFire control panel. The ThreatFire System Scanner can be configured to scan for rootkits, or if you have ThreatFire Pro, it can scan for any other known threats as well with the built-in antivirus.

You don’t have to do anything special for ThreatFire to monitor your system for rootkits. ThreatFire is constantly on the lookout for signs of hidden processes that are running on your system that might indicate the presence of a rootkit. However, hidden processes are not the only indicators of a rootkit. A rootkit may contain several pieces and the System Scanner dives deeper into your system seeking out any hidden files, registry keys or other objects that may be part of a rootkit.

In ThreatFire Pro you can also configure your scan to look for viruses and other known threats.

If it finds anything, it will give you the option to quarantine the objects so that the threat cannot run. From the Quarantine section in Threat Control you can then also choose to permanently delete the objects off your system.

See Running a System Scan for instruction on how to run a scan.


Running a System Scan

To run a Rootkit Scan:

  1. From the Start menu, select Start > All Programs > ThreatFire > ThreatFire.

Or

Right-click the ThreatFire icon in the system tray. The displayed menu shows four choices, ThreatFire, Quick Start Guide, Suspend and Status. Click ThreatFire.

The ThreatFire window appears.

  2. On the left side select the Start Scan button.

  3. The main System Scanner window appears.

  4. On the System Scanner window, select the scan type you wish to run: Basic or Full.

A Basic scan will only search certain key areas of your system where rootkits and other threats most typically hide, whereas a Full scan will perform a comprehensive scan of your entire system.

A Basic Scan will not scan archive files. If you need to scan archives, please select Full Scan.

  5. Then select the type of threat scan you wish to perform: Rootkit Scan or Virus Scan or Both. Note that virus scanning is only available in ThreatFire Pro.

  6. After selecting your scan type, click the Scan Now button to begin the scan. The active System Scan window appears.

As the scan is running you may click the Pause button to temporarily stop the scan. If you choose to Pause, the Pause button changes to a Resume button which allows you to resume the scan when you choose.

You may also choose to Stop the scan by hitting the Stop button. This action will terminate the scan in progress.

  7. At the completion of the scan you will be shown the results of the scan and any threats found. If threats are found, select the items in the list and quarantine them by clicking the Quarantine Selected link.

Note: After quarantining, you may wish to permanently remove any rootkits. Simply visit the Quarantine section of the Threat Control tab to manage quarantined items.


ThreatFire Threat Control

Threat Control is the 3rd button down the left on the main ThreatFire control panel. The Threat Control Center is where you can manage your alert actions and choices with respect to system activity. This is also where you manage any Quarantined items and where you can view the log of all ThreatFire actions.

The Threat Control button displays the following four tabs across the top:

Allowed

  • This list displays all items you asked ThreatFire to always allow. If you no longer wish to always allow a particular item, select the appropriate entry and click Remove to remove it from this list. The next time that process attempts to run you will be presented with a new alert where you can then select Allow or Quarantine as appropriate.

Denied

  • This list displays all items you asked ThreatFire to always deny. If you no longer wish to always deny a particular item, select the appropriate entry and click Remove to remove it from this list. The next time that process attempts to run you will be presented with a new alert where you can then select Allow or Deny as appropriate.

The Deny list is only applicable if you have created any custom rules. Any custom rules will display a special alert with only Allow or Deny as options instead of Allow or Quarantine. Items will show in the Deny list if you choose Deny and check the Always Remember box.

Quarantined

  • Malware that has been automatically quarantined for your protection can be managed here. You can Restore or Permanently Delete an item by selecting it in the list and clicking the appropriate link at the bottom of the window.

Protection Log

  • This section displays a log of all actions taken by ThreatFire and all processes monitored or examined for signs of suspicious behaviors.

To permanently clear the contents of all log files, click the Clear log link in the bottom right. Please note that once these items have been removed you will no longer be able to access the data.


About Rule Settings

About Advanced Rules Settings

ThreatFire is designed fully configured to provide you with the best possible protection against new and unknown threats. There should be no need for you to create additional rules to supplement your protection, but ThreatFire allows you to create your own custom rules if desired.

BE AWARE though that improperly configured rules can prevent your system from running properly. Only those advanced users who are extremely knowledgeable in all aspects of their system's behavior should consider creating custom rules, and even so we strongly encourage you to exercise caution when making any changes.

The Custom rule Settings are organized in two tabs:

  • The Rules tab

  • The Process Lists tab

To access these tabs:

  1. Select the Advanced Rules button on ThreatFire's main window.

  2. Click the Custom Rule Settings button.

  3. Click the Rule Settings button.

  4. The Settings dialog is displayed and the Rules, and Process Lists tabs are available.

You have options available to you by clicking the buttons on the right of each tab.


About the Rule Settings Tabs

About the Custom Rule Settings Tabs

There are three Custom Rule Settings tabs:

The Rules tab allows you to:

  • Create a custom rule using the Rule Wizard

  • Copy a rule

  • Modify a rule

  • Delete a rule

  • Check and uncheck all rules

Rather than deleting a rule, you can simply disable it by removing the check in the box in front of the rule.

The Trusted Processes list allow you to:

  • Create (add) new Trusted Processes for use in the Exclusion section of the Rule Wizard

  • Delete Trusted Processes for us in the Exclusion section of the Rule Wizard

  • Check and uncheck all Trusted Processes

  • Create (add) new email programs and browsers for use in the Source section of the Rule Wizard

  • Delete new email programs and browsers for us in the Source section of the Rule Wizard

  • Check and uncheck all email programs and browsers

The Rule Wizard contains the Source of the rule, the Trigger for the rule, any Options that qualify the rule, and any Exclusions to the rule.

Use the Rule Wizard to create and modify rules.


About the Rule Wizard

What is the Rule Wizard?

The Rule Wizard is an advanced feature used to create and modify rules.

Only those advanced users who are extremely knowledgeable in all aspects of their system’s behavior should visit this section, and even so Novatix strongly encourages you to exercise caution when making any changes.

The Rule Wizard takes you through four items that allow you to create arguments that compose a rule ThreatFire will enforce. Let's say you know of several dangerous Internet sites. You can compose a rule to prevent access to those sites.

The Rule Wizard consists of the following four items:

  • Source

  • Trigger

  • Options

  • Exclusions

Accessing the Rule Wizard

To access the Rule Wizard:

  1. Select Start/All Programs/ThreatFire/ThreatFire.

Or

Right-click the ThreatFire icon in the system tray:

The choices are ThreatFire, Quick Start Guide, Suspend and Status.

  2. Select ThreatFire.

The ThreatFire window appears.

  3. On the left side of the pane, select Advanced Rules.

  4. Click the Custom Rule Settings button on the right of the pane.

The ThreatFire Settings window appears with its two tabs:

  • The Rules tab

  • The Process Lists tab


Creating a Rule

Using the buttons on the right of the ThreatFire Settings Rules tab, you can create a rule.

To create a rule:

  1. Select Start/All Programs/ThreatFire/ThreatFire.

Or

Right-click the ThreatFire icon in the system tray:

The choices are ThreatFire, Quick Start Guide, Suspend and Status.

Click ThreatFire .

  2. The ThreatFire main window appears.

  3. On the left side of the pane select Rule Settings.

  4. Click the Rule Settings button on the right side of the pane.

  5. On the Rules tab, click New.

The Rule Wizard appears:

  6. Click the Next button.

The Rule Wizard – Source dialog box appears.

  7. Click an option from What is the rule source? Your choice appears under the Rule box, which demonstrates the creation of the rule.

  8. Click the Next button.

The Rule Wizard – Trigger dialog box appears.

  9. Select an option from Which event triggers the rule? Your choice appears under the Rule box, which demonstrates the creation of the rule.

Click on an underlined value to edit it.

  10. Click Next.

The Rule Wizard – Options dialog box appears.

  11. Check an option under Select any rule options

Click on an underlined value to edit it. All parts of the argument appear under the Rule box.

If you click named file name, type the name in the File List dialog box and click + to add it to the list of file names. Click OK, and the name appears as part of the rule components.

  12. Click Next.

The Rule Wizard – Exclusions dialog box appears

By default, the source process is in the system process list and the source process is in the trusted process list are selected. Clear these checks, as shown above.

  13. Click Next.

  14. Type in the rule name and description.

  15. Click Finish.

  16. The rule appears in the list of rules.

  17. Click Apply to finalize your rule.


Copying a Rule

Using the buttons on the right of the ThreatFire Settings Rules tab, you can copy a rule.

To copy a rule:

  1. To copy a rule, first highlight the rule.

  2. Click the Copy button.

The rule is copied and put on the bottom of the rules.

  3. Click the Apply button at the bottom of the window to finalize any changes.

To copy all rules:

  1. To copy all rules, click the Check All button.

  2. Click the Copy button.

Click the Uncheck All button to uncheck them

  3. Click the Apply button at the bottom of the window to finalize any changes.


Modifying a Rule

Using the buttons on the right of the ThreatFire Settings Rules tab, you can modify a rule.

To modify a rule:

  1. Highlight the rule you want to modify.

  2. On the Rules tab, click Modify.

The Rule Wizard appears.

The Rule Wizard shows you the choices you made in making your rule, and you can make any modifications to

• Source

• Trigger

• Options

• Exclusions

  3. Click the Next button.

The Rule Wizard – Source dialog box appears.

If you want to modify the Source, make your selection from the What is the rule source? box.

Click on any underlined value to edit it.

  4. Click the Next button.

The Rule Wizard – Trigger dialog box appears with the choice you made in the Rule box.

If you want to modify the Trigger, make your selection from the Which event triggers the rule? box.

Click on any underlined value to edit it.

  5. Click Next.

The Rule Wizard – Options dialog box appears with the choice you made in the Rule box.

Click on any underlined value to edit it.

  6. Click Next.

The Rule Wizard – Exclusions dialog box appears with the choice you made in the Rule box.

Click on any underlined value to edit it.

  7. Click Next.

  8. Make any changes to Rule Name and Rule Description.

  9. Click Finish.

The edited rule appears in the Rule box on the Rule Settings tab.

  10. Click Apply at the bottom of the tab to finalize any changes.


Deleting a Rule

Using the buttons on the right of the ThreatFire Settings Rules tab, you can delete a rule.

To delete a rule:

  1. Highlight the rule.

  2. Click the Delete button.

A warning dialog appears.

A profile is the set of rules configured on a given computer.

  3. Click OK to continue or Cancel to cancel.

  4. Click the Apply button to finalize your changes.


Checking and Unchecking All Rules

Using the buttons on the right of the ThreatFire Settings Rules tab, you can check and uncheck all rules.

To check or uncheck all rules:

  1. Click Check All to select all rules and Uncheck All to uncheck all rules.

  2. Click the Apply button to finalize your changes


The Process Lists Tab: Trusted Processes List

The Process Lists tab allows you to add exclusions to rules and email programs and browsers to rule sources.

The tab has two boxes:

  • Trusted Processes

  • Email and Browsers

Rule Wizard — Exclusions

Exclusions is one of the four components the Rule Wizard uses to configure a rule.

Exclusions exempt processes that are listed in the Trusted Processes box. The rule will not execute when one of these processes is the source process when the rule is triggered.

Remember, the final item in the Rule Wizard used to construct rules is Exclusions. Here you would include any trusted processes rule exceptions.

Trusted Processes List

At the top of the Process Lists tab is the Trusted Processes box.

Use this box to list trusted processes that are created as exceptions to custom rules.

Any processes listed in the Trusted Processes box are exempt from the rules. A rule will not fire for those processes.


Adding a Trusted Process

Using the buttons on the right of the ThreatFire Settings Process Lists tab, you can create a trusted process.

To create a trusted process:

  1. Click the New button next to the Trusted Processes box.

The New button does not bring up a custom rule; it brings up a dialog box that allows you to add processes that will be excluded a rule fires.

  2. The Process dialog box appears.

  3. Highlight the program from the tree or use the ellipse to browse to the selected program.

  4. Click OK to continue or Cancel to cancel.

The program is added to the Trusted Processes list.

  5. Click Apply at the bottom of the Process Lists tab to finalize any additions.


Deleting a Trusted Process

Using the buttons on the right of the ThreatFire Settings Process Lists tab, you can delete a trusted process.

To delete a trusted process:

  1. Highlight the rule.

  2. Click the Delete button.

A warning dialog appears.

A profile is the set of rules configured on a given computer.

  3. Click OK to continue or Cancel to cancel.

  4. Click the Apply button to finalize your changes.


Checking and Unchecking All Trusted Process

Checking and Unchecking All Trusted Processes

Using the buttons on the right of the ThreatFire Settings Process Lists tab, you can check or uncheck a trusted process.

To check or uncheck all trusted processes:

  1. Click Check All to select all rules and Uncheck All to uncheck all rules.

  2. Click the Apply button to finalize your changes


The Process Lists Tab: Email Programs and Browsers

The Process Lists tab allows you to add exclusions to rules and email programs and browsers to rule sources.

The tab has two boxes:

  • Trusted Processes

  • Email and Browsers

Rule Wizard — Source

The first item in the Rule Wizard used to construct rules is Source.

Rule Wizard – Source has four selections:

  • Any process

  • Any non-interactive process

  • Any email or browser process

  • Any process list

The third choice is for any email or browser process, and the sources for that choice are listed in the Email and Browsers list on the Process Lists tab.

Email and Browsers List

At the bottom half of the Process Lists tab is the Email and Browsers list.

Here you would include any email and browser rule sources so that when the rule fires it is caused by one of the email programs or browsers in this list taking an action with certain options and exclusions. The action is determined by you, the user, when you respond to the choices in the dialog box that appears when a rule triggers.


Adding a New Email Program or Browser

Using the buttons on the right of the ThreatFire Settings Process Lists tab, you can add a email program or browser.

To add an email program or browser:

  1. Click the New button next to the Email and Browser box.

The New button does not bring up a custom rule; it brings up a dialog box that allows you to add processes that will be the sources when one of those rules fire.

  2. The Process dialog box appears.

  3. Highlight the program from the tree or use the ellipse to browse to the selected program.

  4. Click OK to continue or Cancel to cancel.

The program is added to the Email and Browsers list.

  5. Click Apply at the bottom of the Process Lists tab to finalize any additions.


Deleting an Email Program or Browser

Using the buttons on the right of the ThreatFire Settings Process Lists tab, you can delete an email program or browser.

To delete an email program or browser:

  1. Highlight the rule.

  2. Click the Delete button.

A warning dialog appears.

A profile is the set of rules configured on a given computer.

  3. Click OK to continue or Cancel to cancel.

  4. Click the Apply button to finalize your changes.


Checking and Unchecking All Email Programs or Browsers

Using the buttons on the right of the ThreatFire Settings Process Lists tab, you can check or uncheck all email programs and browsers.

To check or uncheck all email programs and browsers:

  1. Click Check All to select all rules and Uncheck All to uncheck all rules.

  2. Click the Apply button to finalize your changes


ThreatFire Settings

The Settings button is the 5th down the left on the main ThreatFire control panel. It has 3 tabs across the top: General, Quarantine, and Scheduled Scan.

General Settings

The items in the General Settings tab are:

ThreatFire Protection

  • Ensures that ThreatFire can actively monitor your computer for signs of suspicious behavior and potential attacks.

Check for Updates

  • Automatically checks for program updates available for download on the PC Tools servers.

Community Protection

  • Automatically reports to Novatix information about the event when a suspect rule is triggered by ThreatFire. Participating in the Secure Community is win-win: you help identify new threats and provide better protection to all other ThreatFire users, and in turn, other members do the same for you. If Community Protection is ever set to Off, the Check for Updates option is automatically set to Off as well and cannot be turned back on until Community Protection is turned back on.

In ThreatFire Free Edition, if Community Protection is ever set to Off, the Check for Updates option is automatically set to Off as well and cannot be turned back on until Community Protection is turned back on.

ThreatFire Pro does not have this restriction and allows you to turn off Community Protection without also having to turn off Check for Updates.

Quarantine Settings

If you are using Windows XP or later version of Windows, you can tell ThreatFire to automatically set a System Restore Point before performing any quarantine action. While it is very rare that there would be any problems during quarantine, having a system restore point to revert back to is just an added safety measure to make it easy to recover from any potential problem.

To set this option, simply check the checkbox to Set System Restore Point. Should you decide you wish to stop setting restore points, simply uncheck the same box.

Scheduled Scan Settings

We recommend that you scan for rootkits and other threats at least once a week. Under the Scheduled Scan settings tab you can configure ThreatFire to conduct either a Basic Scan or Full Scan automatically for you at the time and frequency of your choice.

To schedule an automatic scan:

  1. Check the Run a scheduled scan box to indicate that you wish to turn on and run automatic scans.

  2. Use the Time, Repeat, Type and Scan For dropdown boxes to choose the scan’s start time, repeat frequency and type.

  3. Click OK to confirm your scan options.

  4. Click Cancel to cancel your dropdown box selections.

In ThreatFire Free Edition Scan for is automatically set to Rootkits.

In ThreatFire Pro you have the option to scan for Rootkits, Viruses or Both.

You must click OK to confirm that you wish to run an automatic scan with the specified scan choices.

Important: Please note that when you run an automatic scan, any items found will be automatically quarantined. You can manage quarantined items in the Quarantine section of the Threat Control Center.


End User License Agreement

End User License Agreement (EULA)

NOTIFICATION: PERMISSION TO USE THIS SOFTWARE (“SOFTWARE”) IS CONDITIONAL UPON YOU AS THE CUSTOMER AND LICENSEE ("YOU"), AGREEING TO THE TERMS SET OUT BELOW (“THIS AGREEMENT”).

YOU WILL NOT BE ABLE TO INSTALL THE SOFTWARE UNTIL YOU HAVE READ AND ACCEPTED ALL THE TERMS OF THIS AGREEMENT AND WISH TO BECOME THE LICENSEE OF THE SOFTWARE. ACCEPTANCE SHALL BIND YOU AND ALL OF YOUR EMPLOYEES TO THE TERMS OF THIS AGREEMENT.

BY CLICKING THE "I ACCEPT THE AGREEMENT" BUTTON YOU WARRANT AND CONFIRM THAT YOU ARE ELIGIBLE AND HAVE THE AUTHORITY TO AGREE TO THE TERMS OF THIS AGREEMENT.

SELECTING THE "I ACCEPT THE AGREEMENT" BUTTON BEFORE THE "NEXT" BUTTON AT THE BOTTOM OF THIS SCREEN WILL BE DEEMED TO BE YOUR ACCEPTANCE OF THE FOLLOWING TERMS AND YOU WILL BECOME THE LICENSEE OF THE SOFTWARE. PLEASE PRINT A COPY FOR YOUR RECORDS.

IF YOU DO NOT WISH TO ACCEPT THE FOLLOWING TERMS, DO NOT CLICK ON THE "I ACCEPT THE AGREEMENT" BUTTON AND THE SOFTWARE WILL NOT INSTALL ON TO YOUR COMPUTER.

IN CIRCUMSTANCES WHERE YOU PURCHASE THE SOFTWARE WITHOUT ACCEPTING THE TERMS OF THIS AGREEMENT AND WISH TO RETURN THE SOFTWARE, PLEASE CONTACT PC TOOLS TO DETERMINE WHETHER YOU ARE ELIGIBLE FOR A REFUND.

1. Licence

1.1 If you are a resident of Oceania at the time you either first purchased or first installed the Software (whichever occurred first), then the licensor of the Software is an Australian Company, PC Tools Pty Ltd ACN 108 759 208 and the parties to this Agreement will be you and PC Tools Pty Ltd ACN 108 759 208. If you are not a resident of Oceania at the time you either first purchased or first installed the Software (whichever occurred first), then the licensor of the Software is an Irish Company, PC Tools Limited (Irish Company Number 426110) and the parties to this Agreement will be you and PC Tools Limited (Irish Company Number 426110). For the purposes of this Agreement, the licensor (being either PC Tools Limited or PC Tools Pty Ltd) will be referred to as “PC Tools”. For the purposes of this Agreement, “Oceania” means American Samoa, Antarctica, Australia and its outside territories, including Heard Island & McDonald Islands, Cocos (Keeling) Islands, Christmas Island, Ashmore & Carter Islands, and Coral Sea Islands, Cook Islands, Fiji, French Polynesia, Guam, Kiribati, Marshall Islands, Federated States of Micronesia, Nauru, New Caledonia, New Zealand, Niue, Norfolk Island, Northern Mariana Islands, Palau, Papua New Guinea, Pitcairn Islands, Samoa, Solomon Islands, Tokelau, Tonga, Tuvalu, Vanuatu and Wallis and Futuna Islands.

1.2 PC Tools has agreed to license use of the Software to you pursuant to this Agreement and the terms and conditions set out below.

1.3 PC Tools grants to you a non-exclusive, non-transferable, revocable licence to:

(a) install and execute the Software;

(b) make one copy of the Software for backup purposes only; and

(c) use the Software strictly in accordance with the provisions of this Agreement.

1.4 Except where clause 2.2 applies, if you wish to install and execute the Software on more than one computer at the same time, you may do so upon receipt of written consent from PC Tools and upon payment of an additional licence fee as stipulated by PC Tools.

1.5 Your licence to use the Software as granted herein only permits you to use the version of the Software which you have installed or purchased from PC Tools. It does not permit you to use any other version of the Software. The use of any other version of the Software will be governed by a separate agreement between you and PC Tools. However, if you enter into a separate agreement with PC Tools for PC Tools to supply any updates of the Software to you, then, unless specified by PC Tools to the contrary at the time you receive, install or execute those updates (which may, without limitation, include PC Tools requiring you to agree to a new end user licence agreement before making use of those updates), then this Agreement will also govern the use of those updates.

1.6 You acknowledge that PC Tools may offer to maintain and update the Software but it is not obliged to do so unless you have purchased a subscription that entitles you to updates for a specified period, or you purchase a separate maintenance contract. If no subscription period is specified at the time you purchase a subscription, the subscription period will be one (1) year from the date you either first purchased or first installed the Software (whichever occurred first). Should you wish to receive information about maintenance and updates please view PC Tools website on a regular basis at www.pctools.com.

1.7 If you have purchased a subscription that entitles you to updates, or you purchase a separate maintenance contract, you acknowledge that after the specified subscription period or maintenance period has expired, you have no further right to receive any updates without the purchase of a new subscription or maintenance contract. You also acknowledge that PC Tools may limit the functionality of the Software upon the expiry of any subscription period or maintenance period unless you purchase a new subscription or maintenance contract.

2. Licence Fee

2.1 Where a licence fee is payable by you in respect of the Software, you are not entitled to use the Software until the licence fee has been paid. In the case of payment by credit card, payment will not be deemed paid until the credit card payment has been authorised by the billing provider. A separate licence fee is payable in the circumstances described in clause 1.4.

2.2 If you are downloading a free trial version of the Software, you may use it on one or more computers for an unlimited period of time (subject to any time and/or functionality restrictions that may be incorporated into the trial version). However, you are not entitled to receive technical support nor the full functionality that comes with the Software until a licence fee has been paid.

3. Licensee's Obligations

3.1 As the Licensee you hereby undertake the following obligations:

(a) to not print, copy, reproduce, translate, adapt, vary, alter, change, reverse engineer, decompile or modify the Software by any means or in any other form, other than to make one temporary copy of the Software for back-up and security purposes, without the express consent of PC Tools, except as expressly authorised by this Agreement and subject to your rights under applicable law;

(b) to supervise and control the use of the Software in accordance with the terms of this Agreement;

(c) to ensure your employees, sub-contractors and other agents who have authorised access to the Software are made aware of the terms of this Agreement;

(d) to not provide or otherwise make available the Software in any form to any person other than those referred to in paragraph (c) without the written consent of PC Tools;

(e) to not give, lease, assign, license, sub-license, transfer, distribute, disclose, disseminate or publish the software in any form to any other person or attempt to do any of these acts;

(f) to not alter, change, remove or obscure any notices or other indications (including copyright notices) as to ownership of the Software;

(g) not to access or use the Software on more than one personal stand-alone computer, or otherwise allow the Software to be accessed or used by more than one user at any one time except as expressly authorised by this Agreement;

(h) to not use the Software in automatic, semi-automatic or manual tools designed to create virus signatures, virus detection routines, any other data or code for detecting malicious code or data; and

(i) to not engage in any acts which infringe PC Tools’ intellectual property rights in the Software.

3.2 You acknowledge that the Licence granted by Clause 1 does not make you the owner of the Software nor does it cause any transfer or assignment of any copyright or any other intellectual or industrial property rights subsisting in the Software to you.

3.3 You acknowledge that the Software will seek to remove codes such as viruses, spyware, adware and malware. In some circumstances removal of that code may result in you breaching a licence to use the host software which installed that code or certain host programs to cease operating. You agree to consult the terms of any licence agreement for the host program before authorising the removal of any viruses, spyware, adware or malware associated with that program.

4. Warranty

4.1 You hereby acknowledge that the Software may not be uninterrupted and cannot be guaranteed error free and further acknowledge that the existence of any such errors shall not constitute a breach of this Agreement by PC Tools. In particular, PC Tools does not guarantee that the Software will detect and/or remove all known viruses, spyware, adware, malware, Trojans, keyloggers and trackware, or locate all browser infections and tracking cookies on your computer, nor that the Software will not occasionally erroneously report a virus in a file or system not infected by that virus. If the Software is a beta version, you acknowledge and agree that (i) the Software may contain errors and defects and may not function as intended or in accordance with its specifications; and (ii) you assume all risk in using the Software and agree to take due care in the installation, execution and testing of the Software on your computer system.

4.2 The particular operating systems upon which the Software has been designed to execute will be published by PC Tools from time to time (“Compatible OS”). You agree that you will not execute or install the Software on any operating system other than a Compatible OS. You acknowledge and agree that the Software may not execute correctly and may interfere with other software if executed on an operating system which is not a Compatible OS.

4.3 In the event that any terms, conditions, representations or warranties are implied by statute, common law or equity (“Prescribed Terms”) into this Agreement which cannot be lawfully excluded, the Prescribed Terms will apply to this Agreement, save that the liability of PC Tools for breach of any Prescribed Terms will be limited, to the extent permitted by law, at the option of PC Tools, to any one or more of the following:

(a) the replacement of the Software to which the breach relates or the supply of equivalent Software;

(b) the repair of the Software;

(c) the payment of the cost of replacing the Software or of acquiring equivalent Software; or

(d) the payment of the cost of having the Software repaired.

4.4 If the liability of PC Tools for breach of any Prescribed Terms is capable of exclusion, they are hereby excluded to the fullest extent permitted by law.

4.5 Except as provided by the Prescribed Terms (if any), which are not capable of exclusion or limitation, or as expressly set out in these terms:

(a) PC Tools makes no warranties in relation to the Software, including warranties as to the performance or fitness for purpose of the Software (other than that PC Tools is entitled to grant to you the rights set out in this EULA);

(b) you will not under any circumstances have any cause of action against, or right to claim or recover from, PC Tools for or in respect of any loss, damage or injury (including without limitation any loss of profit, indirect or consequential loss, damage or injury) arising from the supply or use of the Software or any breach of these terms; and

(c) subject to paragraph (b) above, the maximum liability of PC Tools to you in respect of any breach of this Agreement or otherwise in respect of your use of the Software will be the amount you have paid PC Tools for the Software and if you have not paid PC Tools any amount for the Software, will be the amount of USD $1 (one dollar).

4.6 You acknowledge that you have exercised your independent judgment in acquiring the Software and have not relied upon any representations made by PC Tools which have not been stated expressly in this Agreement or upon any descriptions or illustrations or specifications contained in any document including catalogues or publicity material produced by PC Tools.

5. Copyright and Trade Marks

5.1 You acknowledge that the Software and all related products (including but not limited to computer manuals and computer literature) ("Products") are the subject of copyright. You therefore shall not, during or any time after the expiry or termination of this Agreement, permit any act which infringes that copyright and, without limiting the generality of the foregoing, you specifically acknowledge that you may not copy the Software or Products except as otherwise expressly authorised by this Agreement.

5.2 You shall not during or at any time after the expiry or termination of this Agreement permit any act which infringes the trade marks used in connection with the Software.

5.3 You shall indemnify PC Tools fully against all liabilities, costs and expenses which PC Tools may incur to a third party as a result of your breach of this Clause 5.

6. Collection of Information

6.1 The Software is designed to block malicious behaviours on your computer. If a potentially malicious behaviour is detected, the Software will prompt an action to “Allow” or “Quarantine” the process in question. If you have the Community Protection option in the Software set to “on” then the information regarding this event is collected and transmitted to PC Tools. This information may include the response to the alert, the IP address of your computer, a copy of the file that triggered the alert and other information in relation to such file. This data is transmitted solely for research and analysis purposes to aid in determining whether a process is malicious in nature and will not include any personal data.

6.2 We will collect information about any browser plug-ins installed on your computer the first time that the Software is run if you have the Community Protection option in the Software set to “on”. This information will not include any personal data and is only collected to aid in decreasing false positives.

6.3 Sample malware files collected by PC Tools may be shared with other security providers for the sole purpose of creating signatures to protect against further spread of the specific threats.

6.4 All information and file samples are held completely confidential and are not tracked back to individual users.

6.5 Each installation of the Software is also associated with a unique anonymous identifier that does not include any personal data and is used solely to help track the total number of active users.

7. Term of Licence

7.1 This Agreement commences upon payment of the licence fee or upon your first installation and use of the Software (whichever is sooner) and may be terminated in the following circumstances:

(a) if you are in breach of any term of this Agreement;

(b) if you, being a corporation, become the subject of insolvency proceedings or have a liquidator, receiver or examiner appointed to you or become unable to pay your debts;

(c) if you, being a person rather than a company, become bankrupt;

(d) if you, being a firm or partnership, are dissolved; or

(e) if you destroy the Software and/or the Products for any reason.

7.2 Upon termination, you or a representative nominated by you shall destroy any remaining copies of the Software and Products or otherwise return or dispose of such material in the manner directed by PC Tools.

7.3 Termination pursuant to this clause shall not affect any rights or remedies which PC Tools may otherwise have under this Agreement or at law.

8. Assignment

The benefit of this Agreement shall not be dealt with in any way by you (whether by assignment, sub-licensing or otherwise) without PC Tools' written consent and this Agreement shall be binding on your successors and assigns.

9. Waiver

Failure or neglect by either party to enforce at any time any of the provisions of this Agreement shall not be construed or deemed to be a waiver of that party's rights under this Agreement.

10. Amending these terms

PC Tools may amend any of the terms of this Agreement by (a) providing written notice to you of such amendments; and/or (b) displaying such amendments or an amended copy of this Agreement to you during your installation and/or execution of the Software. Without limiting the methods by which you may accept such amended terms, you acknowledge and agree that your ongoing use of the Software after you are made aware of any amended terms to this Agreement will constitute your acceptance of such amended terms.

If you do not agree to any amendments made by PC Tools to the terms of this Agreement, then you must uninstall the Software from your computer and cease any further use of the Software. In such circumstances, you may also contact PC Tools to determine if you are eligible for a refund or partial refund of any purchase price paid to PC Tools in respect of the Software (subject to any conditions which PC Tools may place in respect of paying such a refund).

11. Governing Law and Jurisdiction

If the parties to this Agreement (as determined by Clause 1.1 above) are you and PC Tools Pty Ltd ACN 108 759 208, then this Agreement shall be governed by and construed according to the laws in force in Victoria, Australia and you irrevocably submit to the exclusive jurisdiction of the Courts of the State of Victoria and the Commonwealth of Australia. If the parties to this Agreement are you and PC Tools Limited (Irish Company Number 426110) then this Agreement will be governed by and construed according to the laws in force in the Republic of Ireland and you irrevocably submit to the exclusive jurisdiction of the Courts of the Republic of Ireland.

If you have any questions or require clarification relating to the terms and conditions of this Agreement, please contact PC Tools online at www.pctools.com or attention: PC Tools, C:/ PO Box 1974, North Sydney NSW 2059 Australia.


Technical Support

Online Help:

If you are reading this, then you are already familiar with part of the available Help system. You can browse the index or the topics list and find help on individual topics. Additional help can be found in the ThreatFire User's Guide (pdf).

Technical Support:

Additional support information and resources can be found at the ThreatFire web site at http://www.threatfire.com/Support.


Secure community

The Cyberhawk Secure Community is a worldwide network of active users who volunteer to aid in identifying new threats. Any time a suspect alert is triggered in Cyberhawk, information related to this event is automatically reported to Novatix for analysis through a secure connection. Any information collected is held completely confidential and is used solely for the purposes of researching new or previously unknown threats, gaining an understanding of their behaviors, and developing new protection against them. Information collected may include the Cyberhawk alert that fired, the history of relevant events leading to that alert, the decision taken, and any relevant IP address information. This immediate confidential feedback on potentially dangerous new threats allows Novatix to advance its ActiveDefense technology to block these threats. So as threat strategies evolve and new security penetration tactics emerge, Cyberhawk technology will remain at the forefront of the solutions that defeat those threats.


The Rule Wizard

The Rule Wizard is an advanced feature found under the Rule Settings that is used to create and modify rules.

Only those advanced users who are extremely knowledgeable in all aspects of their system’s behavior should visit the Rule Settings area and use the Rule Wizard.

The Rule Wizard takes you through five items that allow you to create arguments that compose a rule Cyberhawk will enforce. Let’s say you know of several dangerous Internet sites. You can compose rules that keep you or other users of your computer from entering those sites.

The Rule Wizard contains the following four items:

  • Source,

  • Trigger,

  • Options,

  • Exclusions;

and it consists of a logical argument in this form:

If (condition x acts this way) Then (take this action) Except (when this is involved)

The first clause of the argument is made up of the following items:

  • Source

  • Trigger

  • Options

The end of the argument consists of the following item:

  • Exclusions

You provide the action when you make your selection in the dialog box that comes up when the rule is triggered by choosing:

  • to allow the operation to proceed

  • to deny the operation


Trusted Process

Trusted processes are applications that can see all protected objects; nothing is hidden from trusted processes. Users can set up certain applications as trusted processes, such as anti-virus software that needs to check protected files for computer viruses.


Recovering Cyberhawk

If Cyberhawk does not shut down properly the last time it ran, the Cyberhawk Recovery dialog box comes up when you start up your computer again:

You are provided with four options.

  • To run Cyberhawk normally

  • To run Cyberhawk for test purposes

  • To not run Cyberhawk at this time, but to be prompted again on the next computer boot

  • Not to run Cyberhawk on startup again

Make one of the following selections:

  1. Select the first option: No problem. Go ahead and run normally.

  2. Click the Next button.

Cyberhawk will run.

  3. To run Cyberhawk for text purposes. To not run Cyberhawk until asked during the next computer boot, or to discontinue running Cyberhawk, choose the appropriate button.

  4. Click Next to confirm your selection.

Cyberhawk will take the action selected.


Checking and Unchecking All File Blocking Rules

Using the buttons on the right of the Novatix Cyberhawk Settings File Blocking tab, you can check and uncheck all rules.

To check or uncheck all rules:

  1. Click Check All to select all rules and Uncheck All to uncheck all rules.

  2. Click the Apply button to finalize your changes


Copying a File Blocking Rule

Using the buttons on the right of the Novatix Cyberhawk Settings File Blocking tab, you can copy a rule.

To copy a rule:

  1. To copy a rule, first highlight the rule.

  2. Click the Copy button.

The rule is copied and put on the bottom of the rules.

  3. Click the Apply button at the bottom of the window to finalize any changes.

To copy all rules:

  1. To copy all rules, click the Check All button.

  2. Click the Copy button.

Click the Uncheck All button to uncheck them

  3. Click the Apply button at the bottom of the window to finalize any changes.


Creating a File Blocking Rule

On the right of the Novatix Cyberhawk Settings File Blocking tab are six buttons: New, Copy, Modify, Delete, Check All, and Uncheck All.

You must first highlight a rule for these buttons to be active. If no rule is highlighted, the Copy, Modify, and Delete buttons appear as dimmed.

To create a file blocking rule:

  1. Click the File Blocking tab.

  2. Click New.

The File Blocking Group dialog box appears.

  3. Fill in the Name and Description fields.

  4. Type in the name of the file(s) you want to block.

  5. Click the + to add in the name of the files or file patterns you want to block.

  6. Highlight a file or file pattern you have chosen to block and click Remove to remove it.

  7. If you want to allow any specific files, add them to the Except these specific files field by typing in the name of the file(s) you want to allow.

Click the + to add in the name of the specific files you want to exempt from the rule.

To remove an exception, highlight the file and click Remove.

  8. Click OK.

The rule appears in the File Blocking tab Blocked Files box.

  9. Click Apply at the bottom of the File Blocking tab to finalize any changes.


Deleting a File Blocking Rule

Using the buttons on the right of the Novatix Cyberhawk Settings File Blocking tab, you can delete a rule.

To delete a rule:

  1. Highlight the rule.

  2. Click the Delete button.

A warning dialog appears.

A profile is the set of rules configured on a given computer.

  3. Click OK to continue or Cancel to cancel.

  4. Click the Apply button to finalize your changes.


Modifying a File Blocking Rule

Using the buttons on the right of the Novatix Cyberhawk Settings File Blocking tab, you can modify a rule.

To modify a rule:

  1. Click the File Blocking tab.

  2. Highlight the Rule.

Click the Modify button.

The File Blocking Group dialog box appears with the selections for the rule.

  3. Change the Name and Description fields by filling in these sections.

  4. Change the files or file types you want to block by typing in the name of the file(s) you want to block.

  5. Click the + to add in the name of the files or file patterns you want to block.

  6. Highlight a file or file pattern you have chosen to block and click Remove to remove it.

  7. Modify the files you want to exempt from the rule by adding them to the Except these specific files field by typing in the name of the file(s) you want to allow.

Click the + to add in the name of the specific files you want to exempt from the rule.

  8. To remove an exception, highlight the file and click Remove.

  9. Click OK.

The modified rule appears in the File Blocking tab Blocked Files box.

  10. Click Apply at the bottom of the File Blocking tab to finalize any changes.