155 Label with this name already exists, type different name.
156 Cannot create label for new application.
157 Unknown
158 Monitor integrity corruption
159 Ask User
160 Integrity corruption protection
161 VBA Macro
162 <New Group>
163 This application has new checksum!
164 It may part of the application update or it may be a trojan!
165 Service
166 Device
167 <Multiple Groups...>
168 You must select at least one group.
169 Apply to parent key
170 NO GROUPS
171 <f 3><s 18><b>Attempt to Control OLE/COM</b>\n\n<c 3>Create In-Proc COM Server<c 0> - It is very common for applications to use COM dlls such as ActiveX. The ActiveX is running in the security context of an application, so this type of COM access cannot be used to gain more privileges than the application already has.\nHowever, special case are "container" application such as Internet Explorer which are designed to dynamically load and host ActiveX controls. For example, in Internet Explorer, the ActiveX to load could be determined by a HTML page. Similar to IE there are other programs which can dynamically load In-Proc COM Servers, such as the Windows scripting Host (wscript.exe) which can be directed to load COM module by a VB (.vbs) or JScript (.js) scripts. For these "container" applications we recommend not having them in the Trusted applications and rather running them under Default Security.\n\n<c 3>Create Out-Process (Local) COM Servers<c 0> - This is a way how one application can use (and also misuse) services of another application. This access is less common (but it still could be regular) and more dangerous, since it is a potential way how an application running under Default security can gain privileges by controling another - Trusted - application.\nWe recommend to adjust Default Security (rules for application = "*") to AskUser or Prevent or at least Monitor this activity.\n\n<c 3>Create Remote Server<c 0> - this is similar to Create Out-Process (Local) COM Servers but in this case the application to be controolled is running on a different computer. There is no reason why an unknown application should do that. Recommended in this case is to Prevent this access and be alerted about it.\n\n<c 3>COM names and CLSID<c 0> - COM modiules are identified by a unique 128 bit number called CLSID (or Class ID). This is the key by which the particular object is stored in our policy database. However, since this number is not very human friendly, TF usually displays to you the optional name, which is for this CLSID registered such as "Microsoft Browser Architecture".\n\nIf you trust the application, you can select <c 3>"Trust It"<c 0> and you should not be bothered again with Alerts.\n\nTo enroll application into application repository (if not yet) or to assign it into an application group, click on the hyperlink with the application label or <c 3>Unknown<c 0> (next to Assign name:).\n\nApply for all users - if not selected and <c 3>Apply Permanently<c 0> is selected, then the created rule will be valid for you only.\nNote: <c 3>"Apply for all users"<c 0> option may not be allways available. It is dependent on the TF product configuration and type and whether you have administrator rights on the computer.\n\nApply Permanently - you can change your choice made here later on in the TF Administration Center.
172 Access was denied
173 Help
174 <f 3><s 18><b>Attempt to Control System</b>\n\n<c 3>Inject Code<c 0> - injecting code could be very dangerous when misused by a trojan. The application is trying to put its own code into some other process (or all processes) memory and then execute it in the other process boundaries (and its own security context). A malicious application can hide communication to an internet or other dangerous activity by injecting code into a trusted process. The activity thus seems to be done by the target trusted application.\n\n<c 3>Acquire System privileges<c 0> - Another way how to hide its activity in a trusted process is to acquire debug system privilege and gaining unlimited control over the target application.\n\n<c 3>Forced Process or Thread Termination<c 0> - By terminating applications such as firewalls, anti-virus etc., a hostile application can thus get rid of some obstacles preventing it to do the malicious actions.\n\nIt is recommended to block all the three previous accesses for unknown applications.\n\nIf you trust the application, you can select <c 3>"Trust It"<c 0> and you should not be bothered again with Alerts.\n\nTo enroll application into application repository (if not yet) or to assign it into an application group, click on the hyperlink with the application label or <c 3>Unknown<c 0> (next to Assign name:).\n\nApply for all users - if not selected and <c 3>Apply Permanently<c 0> is selected, then the created rule will be valid for you only.\nNote: <c 3>"Apply for all users"<c 0> option may not be allways available. It is dependent on the TF product configuration and type and whether you have administrator rights on the computer.\n\nApply Permanently - you can change your choice made here later on in the TF Administration Center.
175 Help
176 <f 3><s 18><b>Incoming Connection Alert</b>\n\nSomeone on the internet or LAN is trying to connect to your computer. Watch the <c 3>"IP"<c 0> address for the remote computer destination. You can recognize that the remote computer is in your Local Area Network if the IP addrress matches the pattern 192.168.X.X or 10.X.X.X or 172.[16-255].X.X.\n\nIf you will not use the <c 3>"Modify This Rule"<c 0> hyperlink, a temporary or a permanent (if Apply Permanently is selected) inbound rule will be created with the current protocol, local port and remote ip address. The remote port will be set to any.\n\nIf you trust the application, you can select <c 3>"Trust It"<c 0> and you should not be bothered again with Alerts.\n\nTo enroll application into application repository (if not yet) or to assign it into an application group, click on the hyperlink with the application label or <c 3>Unknown<c 0> (next to Assign name:).\n\nApply for all users - if not selected and <c 3>Apply Permanently<c 0> is selected, then the created rule will be valid for you only.\nNote: <c 3>"Apply for all users"<c 0> option may not be allways available. It is dependent on the TF product configuration and type and whether you have administrator rights on the computer.\n\nApply Permanently - you can change your choice made here later on in the TF Administration Center.
177 Access was allowed
178 <f 3><s 18><b>Application Being Started by Another Application</b>\n\nWith Process Spawning Guard you could define whether particular process could be started by some other process or by the user only. You could also define whether the new application would run in the security context of the parent application or its own. This can prevent misuse of trusted applications by a hostile code. Typical example of how to misuse known application is to start "cmd.exe del *.*" without any control of the user.\n\n<c 2>Do not allow unknown applications to start cmd.exe!<c 0>\nLook carefully what other application are to be started from the untrusted one.\n\nYou can modify rules in Administration Center to force parent's Default Security (restricted) for the Trusted application when started by an unknown application. Some Trusted application can be misused (cmd.exe, rundll32.exe, net.exe etc.), some not (notepad.exe, winhlp32.exe etc.). You can add Trusted applications into groups Harmless and Misusable and create appropriate spawning rules for these groups.\n\nIf you trust the parent application, you can select <c 3>"Trust Parent"<c 0> and you should not be bothered again with Alerts.\n\nTo enroll application into application repository (if not yet) or to assign it into an application group, click on the hyperlink with the application label or <c 3>Unknown<c 0> (next to Assign name:).\n\nApply for all users - if not selected and <c 3>Apply Permanently<c 0> is selected, then the created rule will be valid for you only.\nNote: <c 3>"Apply for all users"<c 0> option may not be allways available. It is dependent on the TF product configuration and type and whether you have administrator rights on the computer.\n\nApply Permanently - you can change your choice made here later on in the TF Administration Center.
179 <f 3><s 18><b>Application is loading Dll</b>\n\nSome applications are able to dynamically execute foreign code by loading a supplied dll and executing a predefined exported method in it. This is a case of rundll32.exe process as well as of all applications capable of containing plugins or ActiveX (such as Internet Explorer). Of course, knowing that behavior, malicious application can force its own dll to be executed by such trusted application thus hiding the malicious activity. Another use of Dll Loading Guard is to prevent loading of custom dlls by a particular application if they are changed.\n\nYou can for example create a dll group called MyAppDlls and enroll there all dlls that are used by the application regularly. Then create a dll loading rule which will inform you when an unknown dll is to be loaded by that particular application. But be aware, that even the smallest applications usually use more then 30 dlls and if one of them is prevented to load the application is usually unable to start at all. When you update the application, it usually also leads into that some dlls are replaced and thus will be considered as unknown if identified by checksum. So if you want to use Dll Loading guard, use it with care!\n\nIf you trust the application, you can select <c 3>"Trust It"<c 0> and you should not be bothered again with Alerts.\n\nTo enroll application into application repository (if not yet) or to assign it into an application group, click on the hyperlink with the application label or <c 3>Unknown<c 0> (next to Assign name:).\n\nApply for all users - if not selected and <c 3>Apply Permanently<c 0> is selected, then the created rule will be valid for you only.\nNote: <c 3>"Apply for all users"<c 0> option may not be allways available. It is dependent on the TF product configuration and type and whether you have administrator rights on the computer.\n\nApply Permanently - you can change your choice made here later on in the TF Administration Center.
180 <f 3><s 18>If you know and completely trust this application, choose <c 3>"Trust this application"<c 0> or <c 3>"Run with No Security (installations)"<c 0> if it is an installation. Otherwise select <c 3>"Run with Default Security"<c 0>. Later on, in Administration Center in Application Repository, you can change your <b>"ALWAYS"</b> choice made here.\n\nApplication running with Default Security will be blocked against doing some most dangerous things to your computer. It is however recommended, that you add yourself some more file access rules in the Administration Center to prevent these applications to change your sensitive personal documents or other files. For these rules as an application select "All (Non System)" and set at least access to Write and Delete to Prevent/Monitor or AskUser for your sensitive files folder. But do not limit the file access for applications too much than they won't run at all. Do it just for your private sensitive files.\n\nTracking mode monitors what an application(s) is doing on your computer and in addition to that, you can revert back all the file and registry changes made by the application(s) during the period that tracking mode for it was on.\n\n<b>Track'n Reverse:</b>\nFrom the TF taskbar icon menu you can run "TrackLog Analyzer" where you can end Track'n Reverse mode for a particular application, view the log and revert back file and registry changes.\n\n<b>Special notes for using Track'n Reverse mode for installations (that use Windows Installer msiexec.exe):</b>\n- remove msiexec.exe from application repository\n- in Exceptions, set ON all guards for msiexec.exe (or delete the specific settings for msiexec.exe and set on all guards for "$Tracking" group)\n- make sure you have proper rules (allow/monitor especially for files and registry) for both Tracking and $Tracking application groups\n- do not run another installation before you end up Tracking Mode for a previous installation (that also used msiexec.exe)
181 OK
182 <f 3><s 18><b>Track'n Reverse:</b>\nTracking mode monitors what an application(s) is doing on your computer and in addition to that, you can revert back all the file and registry changes made by the application(s) during the period that tracking mode for it was on.\n\nFrom the TF taskbar icon menu you can run "TrackLog Analyzer" where you can end Track'n Reverse mode for a particular application, view the log and revert back file and registry changes.\n\n<b>Special notes for using Track'n Reverse mode for installations (that use Windows Installer msiexec.exe):</b>\n- remove msiexec.exe from application repository\n- in Exceptions, set ON all guards for msiexec.exe (or delete the specific settings for msiexec.exe and set on all guards for "$Tracking" group)\n- make sure you have proper rules (allow/monitor especially for files and registry) for both Tracking and $Tracking application groups\n- do not run another installation before you end up Tracking Mode for a previous installation (that also used msiexec.exe)
183 %s application group does not exist.
184 <f 3><s 18><b>Unauthorized File Access</b>\n\nApplications usually need change (create/write/delete) access to its own directory and to temporary folders.\n\nHowever, modifying files in the Windows folder is quite suspicious, unless it is a text log file.\n\nIf the modification of a particular file is done completely under your control, then you can select <c 3>Apply until Application ends<c 0> and press <c 3>Allow<c 0>. For your convenience, you can do it for the whole parent folder by selecting <c 3>"Apply to parent folder"<c 0>.\n\nIt is recommended, that you add yourself some more file access rules in the Administration Center to prevent applications which are not trusted to change your sensitive personal documents or other files. For these rules as an application select <c 3>"All (Non System)"<c 0> and set at least access to Write and Delete to Prevent/Monitor or AskUser for your sensitive files folder. But do not limit the file access for applications too much than they won't run at all. Do it just for your private sensitive files.\n\nIf you trust the application, you can select <c 3>"Trust It"<c 0> and you should not be bothered again with Alerts.\n\nTo enroll application into application repository (if not yet) or to assign it into an application group, click on the hyperlink with the application label or <c 3>Unknown<c 0> (next to Assign name:).\n\nApply for all users - if not selected and <c 3>Apply Permanently<c 0> is selected, then the created rule will be valid for you only.\nNote: <c 3>"Apply for all users"<c 0> option may not be allways available. It is dependent on the TF product configuration and type and whether you have administrator rights on the computer.\n\nApply Permanently - you can change your choice made here later on in the TF Administration Center.
185 <f 3><s 18><b>Outgoing Connection Alert</b>\n\nThe application is trying to connect to the internet. Watch the <c 3>"Port"<c 0> value to see what type of connection it wants to establish (web access - HTTP, file transfer protocol - FTP, etc.) and the <c 3>"IP"<c 0> address for the server destination, where it wants to connect to. You can recognize that the destination is your Local Area Network if the IP addrress matches the pattern 192.168.X.X or 10.X.X.X or 172.[16-255].X.X.\n\nIf you will not use the <c 3>"Modify This Rule"<c 0> hyperlink, a temporary or a permanent (if Apply Permanently is selected) outbound rule will be created with the current protocol, remote port and remote ip address. The local port will be set to any.\n\nIf you trust the application, you can select <c 3>"Trust It"<c 0> and you should not be bothered again with Alerts.\n\nTo enroll application into application repository (if not yet) or to assign it into an application group, click on the hyperlink with the application label or <c 3>Unknown<c 0> (next to Assign name:).\n\nApply for all users - if not selected and <c 3>Apply Permanently<c 0> is selected, then the created rule will be valid for you only.\nNote: <c 3>"Apply for all users"<c 0> option may not be allways available. It is dependent on the TF product configuration and type and whether you have administrator rights on the computer.\n\nApply Permanently - you can change your choice made here later on in the TF Administration Center.
186 <f 3><s 18><b>Unauthorized Registry Key Access</b>\n\nApplications usually need change (create/write/delete) access to its own registry keys under SOFTWARE subkey.\n\nHowever, allowing to modify other keys and values should be taken with care. In some cases like modifying MRU (Most Recent Url/Documents Viewed) lists it is harmless, but be alert! <c 2>Do not let some trojan to modify some system settings!<c 0>\n\nIf you trust the application, you can select <c 3>"Trust It"<c 0> and you should not be bothered again with Alerts.\n\nTo enroll application into application repository (if not yet) or to assign it into an application group, click on the hyperlink with the application label or <c 3>Unknown<c 0> (next to Assign name:).\n\nApply for all users - if not selected and <c 3>Apply Permanently<c 0> is selected, then the created rule will be valid for you only.\nNote: <c 3>"Apply for all users"<c 0> option may not be allways available. It is dependent on the TF product configuration and type and whether you have administrator rights on the computer.\n\nApply Permanently - you can change your choice made here later on in the TF Administration Center.
187 <f 3><s 18><b>Unauthorized Service Control Attempt</b>\n\nUnless you are absolutely sure that the application should install or remove a service or a driver, do not allow it to do that.\n\nIf you trust the application, you can select <c 3>"Trust It"<c 0> and you should not be bothered again with Alerts.\n\nTo enroll application into application repository (if not yet) or to assign it into an application group, click on the hyperlink with the application label or <c 3>Unknown<c 0> (next to Assign name:).\n\nApply for all users - if not selected and <c 3>Apply Permanently<c 0> is selected, then the created rule will be valid for you only.\n\nNote: <c 3>"Apply for all users"<c 0> option may not be allways available. It is dependent on the TF product configuration and type and whether you have administrator rights on the computer.\n\nApply Permanently - you can change your choice made here later on in the TF Administration Center.
188 Add Dll to group
189 Advanced Enrollment Settings
190 In order to create a rule for All Users (in the Common database),\nthis application has to be moved from User database into Common database.\nContinue ?
