Copyright: © Aladdin Knowledge Technologies


Introduction to eSafe Protect

The eSafe Protect family of products provides individual computers and entire networks, comprehensive protection from computer viruses and Internet vandals. All of the products in this family are proactive to prevent damage before it occurs. In addition, they all provide traditional anti-virus protection for files that have already been infected.

The basic module, whether deployed to network workstations or installed on a single PC consists of independent modules, each using different technologies that share a common user interface. These modules are:

•	Anti-virus scanning

•	Sandbox

•	Personal Firewall

•	Administration


eSafe Protect family of products

The basic standalone product, eSafe Protect Desktop, protects an individual computer from the evolving threat of viruses and Internet vandals threats. It uses a patent pending "sandbox" quarantine technology to enable you to benefit from active technologies such as ActiveX, Java and push content, without exposing system resources to the potential dangers they pose.

The network product, eSafe Protect Enterprise, extends that same protection to entire networks. It enables central configuration of desktop protection and deploys this protection throughout a network.

eSafe Protect Gateway is a firewall enhancement that lets you filter out malicious content at the your network gateway, preventing damage before it occurs.


Sandbox

Sandboxes are at the heart of the eSafe Protect system. They are the building blocks by which you can create a highly advanced system of privileges and anti-vandal protection for your computer.

The Sandbox module enables you to create and modify as many sandboxes as you desire for each Internet browser, email client or other application. Sandboxes provide safe environments for running active content files without letting them vandalize your computer. You can create different sandboxes for the same application and use these as building blocks in the Administration module .

See also:

Applying the sandbox at home


applying the sandbox at home

The Sandbox module enables you to create and modify as many sandboxes as you desire for each Internet browser, email client or other application. You can create different sandboxes for the same application and use the Administration module to assign them to different members of your family.

In this way, you can create limited working environments for children who need to use the computer for educational purposes, without letting them access system resources that might adversely affect your use of the computer for business or other purposes.

As the needs for individual family members to access system resources grow, you can selectively reassign sandboxes.

To simplify decisions, which previously required an expert understanding of programming and file structure, eSafe Protect lets you place new sandboxes in Learn mode. The Learn mode monitors standard use of the applications to which it is applied and automatically creates a sandbox that allows it to access only those resources required by normal operation. Whether you use the Learn mode or create your sandboxes manually, the ideal sandbox should be configured to limit access to directories that the browser or other Internet application need for normal usage.


Reports

The View report button generates an on-screen report.

Once a report is displayed, queries can be used to narrow the scope of the report and target specific types of information.

The report screen is divided into two parts, a toolbar and a display area for report data.

The toolbar area consists of icon buttons and list boxes , each of which contains a tab on its left side. By clicking and dragging the tab, you can expand, shrink, or move the selection box. If you move a list box or toolbar below the toolbar area, the toolbar automatically expands to provide the extra space needed.


Report list boxes

Selection box	Description
Report name	This contains the name of report formats that can be selected for queries or viewing.
Query field	This list box contains the field in the current report that the query acts upon. The fields that can be selected are as follows: • Date • Time • Event • File • Source • Destination • Result
Query action	This list box contains the list of boolean actions that may be used on the query field. The actions that can be selected are as follows: • Equals • equal • Contains • Does not contain • Greater than • Smaller than
Query value	This contains all of the possible values or value ranges that result from the query.


Report icon buttons

Button	Function
	Save current report after the query is performed to a file
	Open an existing report file
	Open a reports accompanying queries
	Print the current report after the query is performed
	Delete the report
	Display of the number of lines in the report
	The run query button performs the query defined, thus leaving only the transactions containing the query value defined. If another query is performed, it is performed on the new report.
	The undo query button undoes the previous query, thereby returning the transactions that did not contain the query value. You can perform the undo operation as many times as you want until you retrieve the original report.


Queries

The report function contains three list boxes for defining queries. These list boxes are defined from left to right, where each list box affects the options displayed in the following boxes. You can narrow the scope of a query by running the query, then performing another query on the results of the first.

Defining a query

1.	Open the first Query list box and select a field in the report to serve as a delimeter.

2.	Select an action to be performed, to the value selected in the third Query list box.

3.	Select a value from the list of possible options in the third Query list box.

4.	Click the Run Query icon to create a report of the data that meets the query definitions

Example of how to view transactions that occurred prior to an event from the 1st of June:

1.	Open the first Query list box and select Date.

2.	Open the second Query list box and select Smaller Than.

3.	Open the third list box, and select the date 1998-06-01.

4.	Click the Run Query icon to cause a report of the selected period or time to appear.

You can run another query based on the data that appears in the currently active report. This process narrows down the response option further.

Running a query and printing the results:

1.	Using all three Query list boxes define a query.

2.	Click the Run Query icon.

3.	All desired information appears.

4.	To undo the query, click on the Undo icon. To further narrow the scope, perform another query on the report that you have just created.

5.	You can format the report by sorting the columns' contents or resizing them.

6.	To print the report, click the Print icon.

7.	Check the print settings and click OK.


Personal Firewall

Personal Firewalls regulate the information flow, ensure protection from hackers and prevent undesired Internet activity.

Each Personal Firewall can determine the following:

•	Force encryption of sensitive data being transmitted

•	Block undesirable web content

•	Block the use of unauthorized protocols

•	Limit the use of the computer for unproductive activities


Administration

The Administration module lets you create a system of privileges for controlling use the system resources that manage your Windows configuration. You can assign different sandboxes, Personal Firewalls and access to system resources to different users.

When a user starts Windows, using a personal logon password, eSafe Protect Desktop uses the uses the settings that you assigned to that individual.

eSafe Protect Desktop reports let you monitor virus and vandal attacks, attempts to violate Personal Firewall policies, and conveniently review your eSafe Protect Desktop settings.

Cache, cookies and (Internet) history can be cleared whenever the computer is booted to increase privacy and enhance data security.


Anti-virus
Anti-virus module

eSafe Protect Desktop's anti-virus module consists of an on-access and on-demand scanner. These scanners combine the traditional virus signature method for detecting known viruses with heuristic methods to detect previously unknown viruses.

eSafe Protect Desktop can automatically clean most infected files that it detects. Furthermore, the scan engine recognizes potentially harmful file elements, such as MSWord or Excel macros and Java applet tags.

The on-demand scanner inflates and scans all of the popular archive files until it reaches the core files. The on-access scanner also inflates and scans popular archive files when you use your browser to download them. You can limit the number of compression levels that you allow eSafe Protect Desktop to scan, and define whether to treat an archive below the defined level as a non-removable virus.

The eSafe Protect Desktop

See also:

Archive files

On-demand scanner

On-access scanner

Smart scan

Scan and analyze


Anti-virus browser module
Anti-virus web module

eSafe Protect Desktop contains an anti-virus browser plug-in for identifying and blocking vandals as they arrive at the browser. When installed, this scanner identifies the vandals and prevents them from running on your computer.

This scanner is loaded by selecting Start | Programs | eSafe Protect | Anti-virus Web Wizard and following the instructions in the wizard.


Anti-virus Web Wizard

This wizard identifies the browsers installed on your system and lets you install the anti-vandal scanner on your browsers.

To open the wizard, click the Windows Start button and select Programs | eSafe Protect | Anti-virus Web Browser.

The first screen introduces you to the wizard and lists the eSafe anti-virus/anti-vandal software installed on your computer. When it finds more than one eSafe anti-virus/anti-vandal program, it recommends which program to install for anti-vandal protection. Click Next to continue.

The wizard checks for browsers installed on your computer and selects those found. You can deselect browsers that you want to leave unprotected. Click Next and Finish to complete installation.


Wizard button

This opens the eSafe Protect Configuration Wizard, which guides you through the process of configuring eSafe Protect for the applications on your computer.


Help button

This opens the online help topic most closely associated with your current location in the eSafe Protect advanced configuration screens.


Exit button

This exits the eSafe Protect advanced configuration.


Sandbox selection

This drop down menu selects a sandbox to be defined. It contains a complete list of all currently defined sandboxes.


Save button

Click this button to save changes.


Save as button

Click this button to save the definitions under another name.


Save button (sandbox)

Click this button to save changes to the currently selected sandbox.


Save button (Personal Firewall)

Click this button to save changes to the currently selected Personal Firewall.


Save as button (Personal Firewall)

Click this button to create a new Personal Firewall using the definitions currently defined.


Save as button (sandbox)

Click this button to create a new sandbox using the definitions currently defined.


Remove button (sandbox)

Click this button to delete the currently selected sandbox.


Remove button (Personal Firewall)

Click this button to delete the currently selected Personal Firewall.


Operation mode tab

The Operation mode tab lets you decide the active status and type of sandbox.

The activation lever has three settings:

•	Activate this sandbox makes the sandbox available for use

•	Learn mode until places the sandbox in Learn mode until the date in the adjacent definition box. During this time, the sandbox monitors operation of the relevant applications and defines the sandbox boundaries accordingly. After this time the sandbox automatically becomes fully active.

•	Do not use this sandbox makes the sandbox unavailable for use.

There are two types of sandboxes, general purpose and application dependent.

A general purpose sandbox restricts all access to defined directories.

An application dependent sandbox operates only when the defined application is active. Application dependent sandboxes are normally used to provide anti-vandal protection to browsers and other Internet applications.


Enforcement tab (sandbox)

The Enforcement tab lets you define how eSafe Protect enforces the sandbox rules. It consists of a list of illegal activities and enforcement settings for each activity.

The Response setting determines whether your computer ignores the activity or denies access to the protected file(s).

The Silent mode setting defines whether bring the activity to your immediate attention and allow you to change it in the future. eSafe Protect Enterprise system administrators should use this for unattended computers. Sandbox violations are logged to the report file if Sandbox is selected in the Reports tab of the Administration module.

Procedure for editing enforcement settings:

1. Select an illegal activity.

2. Select the desired response for that illegal activity.

3. Select or deselect the silent mode.


Media to monitor tab

This tab enables you to exempt specific media from sandbox restrictions. If a media is not selected, the sandbox ignores all operations by applications located on that media and all operations performed to files on that media.

Sample reasons for deselecting a media

If your application uses a software key that accesses protected resources, you need to deselect the drive containing the software key.

If an application is used to run other applications located on a CD, the protection set for the host application may hinder legitimate use of system resources by the application located on the CD. In this case, it is recommended that you deselect the CD drive.


Sandbox boundaries tab

The Sandbox boundaries tab lets you determine which system files and directories contain restrictions, and what these restrictions are. It contains the following four definition areas for restricting directories and files.

•	Map of restricted areas

•	Restricted areas

•	Allowed activities

•	Files with full access

The Map of restricted areas displays available directories in a tree format. You do not need to know the name of the directory to include it in the sandbox. You can also view a list of the directories in the Restricted areas just below the map.

You can change the sandbox boundaries by selecting a directory and editing the Allowed activities checkboxes listed below.

•	Read allows the monitored application to read from the selected directory.

•	Write allows the monitored application to write to a selected directory.

•	Execute allows the monitored application to run programs in the selected directory.

•	Create allows the monitored application to create files and sub-directories in the selected directory.

•	Delete allows the monitored application to erase files and sub-directories from the selected directory.


Map of restricted areas

This displays available directories in a tree format. You do not need to know the name of the directory to include it in the sandbox. You can change the sandbox boundaries by selecting a directory and editing the Allowed activities checkboxes.

Procedure for expanding sandbox boundaries

1.	Open and scroll through the map of restricted area and select the directory or file that you want to add.

2.	Deselect one or more activities in the Allowed activities panel.

3.	Click Save.


Restricted areas

This displays a list of the directories and files located within the sandbox. You can use this as an alternative method of selecting file and directories to be modified or removed from the sandbox.


Allowed activities

This defines which activities eSafe Protect allows the user to perform in the directory or file currently selected in the Map of restricted areas.

Each of the following activities may be selected or deselected by clicking in the corresponding checkbox.

•	Read allows the monitored application to read from the selected directory.

•	Write allows the monitored application to write to a selected directory.

•	Execute allows the monitored application to run programs in the selected directory.

•	Create allows the monitored application to create files and sub-directories in the selected directory.

•	Delete allows the monitored application to erase files and sub-directories from the selected directory.

Procedure for expanding sandbox boundaries

1.	Open and scroll through the map of restricted area and select the directory or file that you want to add.

2.	Deselect one or more activities in the Allowed activities panel.

3.	Click Save.


Adding a file to the sandbox map

Procedure

1.	Expand the Map of restricted areas tree.

2.	Select a directory.

3.	Select the directory. To restrict some files in a directory and not others, you must exclude specific files from the directory definitions. This adds the excluded files to the map of restricted areas.

a.	Right-click the directory in the map of restricted areas.

b.	Select New file to be excluded and enter the path and filename to be excluded. This feature supports wildcards. For example, you can exclude all files with the extension EXE by selecting *.EXE.

c. 	Select Exclude specific files in subdirectories if you want to exclude all files with the same name in subdirectories.

4.	Deselect the activities to be restricted under Allowed activities.


Sandbox activation lever

The activation lever has three settings:

•	Activate this sandbox makes the sandbox available for use

•	Learn mode duration places the sandbox in Learn mode for the number of days in the adjacent definition box. During this time, the sandbox monitors operation of the relevant applications and defines the sandbox boundaries accordingly. After this time the sandbox automatically becomes fully active.

•	Do not use this sandbox makes the sandbox unavailable for use.


Learn mode

While in Learn mode, the sandbox monitors operation of the relevant applications and defines the sandbox boundaries accordingly. Once the period during which a sandbox is in Learn mode comes to an end, the sandbox automatically becomes fully active.


Sandbox operates in the following mode

There are two types of sandboxes, general purpose and application dependent.

A general purpose sandbox restricts all access to defined directories.

An application dependent sandbox operates only when the defined application is active. Application dependent sandboxes are normally used to provide anti-vandal protection to browsers and other Internet applications.


Illegal activity (sandbox)

The Sandbox | Enforcement tab consists of the following illegal activities and enforcement settings for each activity.

Read violation: an illegal attempt to read a file.

Write violation: an illegal attempt to write to a file.

Execution violation: an illegal attempt to run a file.

Create violation: an illegal attempt to create a file.

Delete violation: an illegal attempt to delete a file.

Procedure for editing enforcement settings:

1. Select an illegal activity.

2. Select the desired response for that illegal activity.

3. Select or deselect the silent mode.


Silent mode

The Silent mode, safeguards your data without informing the end user of attempted violations. Illegal activities are logged to the report file if the relevant module is selected in the Reports tab of the Administration module.

The Silent mode is defined separately for each illegal activity. eSafe Protect Enterprise administrators should use this for unattended computers.


Floppy (Media to monitor)

If Floppy is not selected, the sandbox ignores all operations by applications located on floppy diskettes and all operations performed to files on a floppy diskette.

Sample reasons for deselecting a media

If your application uses a software key that accesses protected resources, you need to deselect the drive containing the software key.

If an application is used to run other applications located on a floppy diskette, the protection set for the host application may hinder legitimate use of system resources by the application located on the floppy. In this case, it is recommended that you deselect the floppy drive.


Hard disk (Media to monitor)

If Hard disk is not selected, the sandbox ignores all operations by applications located on a local hard disk and all operations performed to files on a local hard disk.

Sample reason for deselecting a media

If your application uses a software key that accesses protected resources, you need to deselect the drive containing the software key.


Network (Media to monitor)

If Network is not selected, the sandbox ignores all operations by applications located on a local hard disk and all operations performed to files on a network drive.

Sample reason for deselecting a media

If your application uses a software key that accesses protected resources, you need to deselect the drive containing the software key.


CD-ROM (Media to monitor)

If CD-ROM is not selected, the sandbox ignores all operations by applications located on a CD-ROM and all operations performed to files on a CD-ROM.

Sample reasons for deselecting a media

If your application uses a software key that accesses protected resources, you need to deselect the drive containing the software key.

If an application is used to run other applications located on a CD, the protection set for the host application may hinder legitimate use of system resources by the application located on the CD. In this case, it is recommended that you deselect the CD drive.


RAM drive  (Media to monitor)

If RAM drive is not selected, the sandbox ignores all operations by applications located on the RAM drive and all operations performed to files on the RAM drive.


Personal Firewall module

Personal Firewalls enable you to exercise restraint over use of the Internet and to safeguard sensitive information, such as credit card numbers, from unscrupulous hackers and Internet vandals. The Personal Firewall module lets you create and edit Personal Firewalls.

Each Personal Firewall can determine the following:

•	IP addresses that can be accessed or that are blocked. A smart connection feature enables you to filter out a proxy when defining IP addresses.

•	Forbidden words for URLs. Access is blocked to sites containing any of the forbidden words. This reduces the chance of the Internet being misused to access sex and other forbidden sites.

•	Sensitive information that must be encrypted. If any sensitive information appears in an unencrypted transmission, a warning is issued or the communication is stopped.

•	The time of day when this communication set is active.

By creating multiple firewalls, you create the building blocks that you can use in the Administration module to regulate the way your Internet connection is used by different people at different times of the day.


Creating a new Personal Firewall

1.	Select an existing Personal Firewall.

2.	Click the Save As button. This causes the Save as dialog box to appear.

3.	Enter an unused name for the new Personal Firewall and click the Save button.

4.	Select and modify the newly defined Personal Firewall.


Deleting a Personal Firewall

1.	Select the desired firewall.

2.	Click the Remove button.


Modifying a Personal Firewall

1.	Select the desired firewall.

2.	Review the five tabs and make changes as necessary.

3.	Click the Save button.


Firewall map

The Firewall map tab contains two panels for defining with which IP addresses each port can or cannot communicate. Traffic rules define the types of communication that can take place when a Personal Firewall is active. Green Highway and red Do not enter icons indicate whether ports open or closed to traffic.

Incoming and outgoing communication for each port can be defined separately or together, and you can define exceptions for each traffic rule. The general rules are displayed and edited in the Ports column. Exceptions for a selected port are displayed and edited in the IP addresses column.

To create a traffic rule for a port, click the Add or Edit icon in the Ports column. This opens the following dialog box where you can add a port to the list of controlled ports, and edit whether to enable or disable communication for one or both directions. To delete a port, click on the Delete icon.

Exceptions to the traffic rules are created in the IP addresses column. Exceptions are displayed and defined for each traffic rule in the Ports column. To make an exception to a traffic rule, select the rule in the Ports column and click the Add or Edit icon. To delete an exception, click the Delete icon.

Procedure for adding a port

•	Click Add to open the Add/edit port dialog box.

•	Select the desired port from the Port list. If it does not exist, click the Add icon and enter the name, number and prefix.

•	Select the direction of communication for that port.

•	Select whether to normally enable or disable communication.

•	Click OK.


Communication port

A communication port is a logical address for channeling communication using a specific protocol. Each communication port is assigned a number by which it is identified, and is associated with a protocol and a physical port.

In order to understand how a communication port operates, let us compare it to a telephone.

Your telephone unit is the physical port where you speak (transmit voice data) and listen (receive voice data). Your telephone number is your port number, because just as someone trying to contact you at home dials your telephone number in order to channel communication over the telephone lines, your computer request a port number to channel communication.

Just as you can dial different numbers to speak with people in different locations, your computer can use the same physical port for different communication ports.

Now, let us imagine that all telephone lines are party lines where other people are speaking at the same time. In order to make sense of what is being said, a set of communication rules must be used.

In the world of computer communication, a protocol is a set of communication rules similar to our use of language in daily conversation. Just as all parties to a conversation must know what language is being spoken to conduct a meaningful conversation, computers must know what protocol is being used and understand the rules of that protocol.

To understand how protocol affects Internet communication, try to imagine that you are in a room filled with people from different countries, many of whom speak more than one language. To further complicate matters, imagine that all of the people in the room are involved in more than one conversation at the same time and in many cases using different languages. In order to understand what is being said, you must know three things, what language is being used, the language itself, and to which conversation to associate each word.


Add/edit port dialog box

This dialog box lets you add a port to the list of controlled ports and edit its traffic rules. You can define whether to enable or disable communication for one or both directions.

This dialog box consists of the Port list and traffic rule definition boxes for the port selected.

The Port list is a complete list of all ports and port groupings defined in eSafe Protect. The icons at the top of the Ports list allow you add, delete or edit port identification data.

Direction defines whether the communication traffic rules being defined are for incoming communication, outgoing communication or both.

Proxy connection defines whether to use a smart connection feature that filters out proxies when it defines IP addresses

The Normally enable/disable selection determines whether communication through the port(s) being defined is allowed or blocked. Exceptions to the rule are defined in a dialog box opened from the IP addresses column of the Personal Firewall | Firewall map..


Port list

This is a complete list of all ports and port groupings defined in eSafe Protect. The definition boxes in the Add/edit port dialog box all refer to the port selected.

The icons at the top of the list allow you add, delete or edit port identification data.


Direction (firewall port)
Direction

This defines whether the communication traffic rules being defined are for incoming communication, outgoing communication or both.


Normally enable/disable (firewall port)
Normally enable/disable

This defines whether communication through the port(s) being defined is allowed or blocked. Exceptions to the rule are defined in a dialog box opened from the IP addresses column of the Personal Firewall | Firewall map..


Proxy connection (firewall port)
Proxy connection

When this is selected, a smart connection feature filters out proxies when it defines IP addresses.


Ports (Personal Firewall)
Ports

This is a list of controlled communication ports and whether communication is allowed or blocked. An icon indicating whether communication is allowed or blocked, and the controlled direction appear on either side of the port (port group) name. When a port is selected, exceptions are displayed on the IP addresses list.

A green Highway icon next to the name of the port indicates that communication is allowed; a red Do not enter icon indicates that communication is blocked.

To restrict the use of a port, click the Add or Edit icon in the Ports column. This opens the following dialog box where you can add a port to the list of controlled ports, and edit whether to enable or disable communication for one or both directions.


IP addresses (firewall map)
IP addresses

This is a list of exceptions to the traffic rule selected in the Ports column. It contains IP addresses and Internet site names.


IP address by name

This definition box enables you to use the name of an Internet site or domain to define an exception to the traffic rules for the port currently selected in the Ports column of Personal Firewall | Firewall map.


IP address by IP address

This definition box enables you to enter an IP address or range of addresses to define an exception to the traffic rules for the port currently selected in the Ports column of Personal Firewall | Firewall map.


Add/edit IP address dialog box

This dialog box defines an IP address or range of IP addresses that do not follow the traffic rules currently selected in the Ports column of Personal Firewall | Firewall map.

The Resolve IP address button converts an Internet site name into its IP address and vice-versa.


Low IP address

This definition box enables you to enter the start of a range of ID addresses to define an exception to the traffic rules for the port currently selected in the Ports column of Personal Firewall | Firewall map.


High IP address

This definition box enables you to enter the end of a range of ID addresses to define an exception to the traffic rules for the port currently selected in the Ports column of Personal Firewall | Firewall map.


Resolve IP address button

This converts an Internet site name into its IP address and vice-versa.


Content Filter tab

The Content Filter tab creates a glossary of forbidden words. Access to Internet sites, data and newsgroups containing these words are monitored and restricted. eSafe Protect inspects the contents of the monitored ports (defined in the Firewall map) for the words on the list. If a forbidden word is detected, eSafe Protect interrupts communication or ignore the violation, depending on the response defined in the Enforcement tab.

•	Address names causes eSafe Protect to look for forbidden words in the name of the Internet site or email address.

•	Data contents causes eSafe Protect to look for forbidden words in the body of email and contents of files.

•	Newsgroup names causes eSafe Protect to look for forbidden words in the name newsgroups.

•	Exact match causes the filter to be case sensitive.

Procedure for adding a forbidden word

•	Click Add to open the Add word dialog box.

•	Enter the word and click OK.


Filter the following

Each checkbox determines whether the Personal Firewall applies the Content Filter to a different data field.

•	Address names causes eSafe Protect to look for forbidden words in the name of the Internet site or email address.

•	Data contents causes eSafe Protect to look for forbidden words in the body of email and contents of files.

•	Newsgroup name causes eSafe Protect to look for forbidden words in the name newsgroups.


Exact match (firewall Content Filter)
Exact match

•	Exact match causes the filter to be case sensitive.


List of forbidden words

eSafe Protect inspects the contents of the monitored ports (defined in the Firewall map) for the words on the list. If a forbidden word is detected, it takes the actions defined in the Enforcement tab.


Privacy tab

The Privacy tab creates a list of words, numbers and codes that cannot be sent unencrypted without your knowledge and approval. Descriptions used to identify sensitive data are displayed in the Privacy tab. The actual data is hidden from view.

Procedure for adding a sensitive data entry

•	Click the Add icon to open the Sensitive data dialog box.

•	Enter a description of the sensitive data into the Description of sensitive data box.

•	Enter the sensitive data into the Value box and Verify box. An asterisk is displayed for each character. An error message appears if the data is not exactly the same in both definition boxes.

•	Click OK.


Description of sensitive data display

Descriptions used to identify sensitive data are displayed in the Privacy tab. The actual data is hidden from view.


Operation times tab (Personal Firewall)
Operation times tab

The Operation times tab defines whether the Personal Firewall is active and if so, at what times of the day. It contains an activation lever and operation time range for active Personal Firewalls. The use of operation times allows you to create to take advantage of lower telephone and ISP rates during off-hours and create restrictions that only apply during certain times of the day.

To make the Personal Firewall active, place the activation lever in the up position and set the begin and end times. To activate the Personal Firewall 24 hours a day, set both times to 00:00.

To make the Personal Firewall inactive, place the activation lever in the down position.


Description of sensitive data

Enter a description of the sensitive data. This description is displayed in the Privacy tab.


Sensitive data dialog box

The Sensitive data dialog box allows you to add and edit sensitive data entries. The description entered is used to identify the sensitive data. The actual data is hidden from view and an asterisk is used to represent each character.

Procedure for adding a sensitive data entry

•	Click the Add icon to open the Sensitive data dialog box.

•	Enter a description of the sensitive data into the Description of sensitive data box.

•	Enter the sensitive data into the Value box and Verify box. An error message appears if the data is not exactly the same in both definition boxes.

•	Click OK.


Value of sensitive data

Enter the sensitive data. The actual data is hidden from view and an asterisk is displayed for each character.


Verify sensitive data

Enter the same sensitive data entered in the Verify definition box. The actual data is hidden from view and an asterisk is displayed for each character.


Activate Personal Firewall lever

To make the Personal Firewall active, place the activation lever in the up position and set the begin and end times. To activate the Personal Firewall 24 hours a day, set both times to 00:00.

To make the Personal Firewall inactive, place the activation lever in the down position.


Operation time (Personal Firewall)

Begin time defines the time of the day the Personal Firewall becomes active if the activation lever is in the up position. End time defines the time of the day the Personal Firewall becomes inactive if the activation lever is in the up position.

To activate the Personal Firewall 24 hours a day, set both times to 00:00 and place the activation lever in the up position.


Enforcement tab (Personal Firewall)

The Enforcement tab lets you define how eSafe Protect enforces the Personal Firewall. It consists of a list of illegal activities and enforcement settings for each activity.

The Response setting determines whether your computer ignores the activity or denies access to the protected file(s).

The Silent mode setting defines whether bring the activity to your immediate attention and allow you to change it in the future. eSafe Protect Enterprise system administrators should use this for unattended computers. Personal Firewall violations are logged to the report file if Personal Firewall is selected in the Reports tab of the Administration module.

Procedure for editing enforcement settings:

1. Select an illegal activity.

2. Select the desired response for that illegal activity.

3. Select or deselect the silent mode.


Illegal activity (Personal Firewall)

The Personal Firewall | Enforcement tab consists of the following illegal activities and enforcement settings for each activity.

Site violation: an illegal attempt to access a site.

Port violation: an illegal attempt to access a port.

IP address violation: an illegal attempt to access an IP address.

Forbidden word violation: an illegal attempt to access a site, news group or file containing a forbidden word.

Procedure for editing enforcement settings:

1. Select an illegal activity.

2. Select the desired response for that illegal activity.

3. Select or deselect the silent mode.


Personal Firewall selection

This drop down menu selects a Personal Firewall to be defined. It contains a complete list of all currently defined Personal Firewalls.


Report tab (administration)
Report tab

The Reports tab lets you decide what data is gathered for reports, and generate reports that let you monitor virus and vandal attacks, attempts to violate Personal Firewall policies, and conveniently review your eSafe Protect Desktop settings.

The Sources of report file data checkboxes determine which activities are recorded in the data files are used to generate a report.

•	Sandbox determines whether to include sandbox violations.

•	Personal Firewall determines whether to include Personal Firewall violations.

•	Anti-virus determines whether to include data stored in the on-demand scanner report file and the on-access scanner alert file.

The Report type selection determines whether to include data on every incident of a file being monitored or scanned, or to limit the report to violations of sources selected in the Sources of report file data checkboxes.

The Limit report file to field allows you to set a limit the size of the report file and prevent new data from being recorded until the old file is deleted or renamed.

The View report button generates an on-screen report. Once the report is displayed, queries can be used to narrow the scope of the report and target specific types of information.


Sources of report file data

These checkboxes determine which activities are recorded in the data files are used to generate a report.

•	Sandbox determines whether to include sandbox violations.

•	Personal Firewall determines whether to include Personal Firewall violations.

•	Anti-virus determines whether to include data stored in the on-demand scanner report file and the on-access scanner alert file.


Report type (administration)

The Report type selection determines whether to include data on every incident of a file being monitored or scanned, or to limit the report to violations of sources selected in the Sources of report file data checkboxes.


Limit report file size

The Limit report file to field allows you to set a limit the size of the report file and prevent new data from being recorded until the old file is deleted or renamed.


View report button

The View report button generates an on-screen report. Once a report is displayed, queries can be used to narrow the scope of the report and target specific types of information.

The report screen is divided into two parts, a toolbar and a display area for report data.

Procedure for performing a query

1.	Open the first Query list box and select a field in the report to serve as a delimiter.

2.	Select an action to be performed, to the value selected in the third Query list box.

3.	Select a value from the list of possible options in the third Query list box.

4.	Click the Run query button to create a report of the data that meets the query definitions.

You can run another query based on the data that appears in the currently active report. This process narrows down the response option further.

The Undo icon undoes the last query. You can undo queries until you return to the original data.

The Print icon opens the Windows print dialog box.


Files with full access button

The Files with full access button opens a dialog box for viewing and editing the list of files with full access to all system resources for the sandbox being defined.


Privileges tab

The Privileges tab lets you assign different sandboxes, Personal Firewalls and access to system resources to different users. When a user opens Windows with a personal logon password, eSafe Protect Desktop uses the settings that you assigned to that individual.

This is a tree style display containing two levels of privileges, workstation privileges and personal privileges. Workstation privileges affect the PC as a whole, while personal privileges affect specific users only. The personal privileges assigned to Anonymous affect all undefined users.

The Apply button saves all changes made anywhere in the Administration module. The Undo icon undoes unsaved changes made to Administration | Privileges.

Adding a user

1.	Select New user button or right-click menu option in the Map of user privileges, sandboxes and firewalls panel.

2.	Enter the name of the user.

3.	Click OK.

Workstation privileges:

•	Enable access to boot menus (F4, F8) allows users to access DOS boot menus if marked with a green checkmark. A red X disables the F4 and F8 keys in the Windows Explorer.

•	Enforce privileges implements all personal privileges when marked with a green checkmark, and ignores all personal privileges outside the eSafe Protect group when marked with a red "X."

•	Only use applets on the whitelist is only supported in versions of eSafe Protect deployed by an eSafe Protect Enterprise administrator.

Personal privileges:

Personal privileges consist of resource privileges, sandbox assignments and Personal Firewall assignments. Consult your User's Manual for detailed information on specific privileges.

Assigning sandboxes and Personal Firewalls

1.	Select the user from the Map of user privileges, sandboxes and firewalls panel.

2.	Select the sandbox/Personal Firewall from the Sandboxes and firewalls panel.

3.	Click the red arrow at the top of the Sandboxes and firewalls panel.

4.	Click Apply.

Changing sandbox and Personal Firewall settings

1.	Right-click the sandbox or Personal Firewall, and select Silent mode setting or Activate/deactivate/place in Learn mode to open the relevant dialog box.

2.	Select the desired setting.

3.	Click OK.

Note:	This procedure changes the corresponding setting in the sandbox or Personal Firewall module.


Map of user privileges

This is a tree style display containing two levels of privileges, workstation privileges and personal privileges. Workstation privileges affect the PC as a whole, while personal privileges affect specific users only. The personal privileges assigned to Anonymous affect all undefined users.

Workstation privileges:

•	Enable access to boot menus (F4,F8) allows users to access DOS boot menus if marked with a green checkmark. A red X disables the F4 and F8 keys in the Windows Explorer.

•	Enforce privileges implements all personal privileges when marked with a green checkmark, and ignores all personal privileges outside the eSafe Protect group when marked with a red "X."

•	Only use applets on the whitelist is only supported in versions of eSafe Protect deployed by an eSafe Protect Enterprise administrator.

Personal privileges:

Personal privileges consist of resource privileges, sandbox assignments and Personal Firewall assignments. Consult your User's Manual for detailed information on specific privileges.

Adding a user

1.	Select New user button or right-click menu option in the Map of user privileges, sandboxes and firewalls panel.

2.	Enter the name of the user.

3.	Click OK.

Assigning sandboxes and Personal Firewalls

1.	Select the user from the Map of user privileges, sandboxes and firewalls panel.

2.	Select the sandbox/Personal Firewall from the Sandboxes and firewalls panel.

3.	Click the red arrow at the top of the Sandboxes and firewalls panel.

4.	Click Apply.

Changing sandbox and Personal Firewall settings

1.	Right-click the sandbox or Personal Firewall, and select Silent mode setting or Activate/deactivate/place in Learn mode to open the relevant dialog box.

2.	Select the desired setting.

3.	Click OK.

Note:	This procedure changes the corresponding setting in the sandbox or Personal Firewall module.

Note: The Apply button saves all changes made anywhere in the Administration module. The Undo icon undoes unsaved changes made to Administration | Privileges.


Sandboxes and firewalls (administration)

In order for a sandbox or Personal Firewall to affect a user, it must be assigned to that user. Sandboxes and Personal Firewalls assigned to the Anonymous user affect all users not defined here and all users not using a Windows logon password.

By default, all standard sandboxes and the Blank Personal Firewall are assigned to the anonymous user and other users as they are created. The standard sandboxes are those created by the Configuration Wizard for programs it recognizes and the Blank sandbox.

Assignment procedure

1.	Select the user from the Map of user privileges, sandboxes and firewalls panel.

2.	Select the sandbox or Personal Firewall from the Sandboxes and firewalls panel.

3.	Click the red arrow at the top of the Sandboxes and firewalls panel.

4.	Click Apply.


Apply button

Click this button to save and implement the new eSafe Protect configuration settings. The Undo icon in the Privileges tab undoes all unsaved changes made to Administration | Privileges.


Password tab (administration)
Password tab

The Password tab enables you to password protect access to the eSafe Protect configuration screens.

The checkbox determines whether to use password protection. If it is selected, the three fields for changing the password are activated. Asterisks are displayed in place of each password character entered.


Password protection (administration)
Password protection

Password protection requires that a password be used to perform prevent specific operations or view sensitive information.


Change password (administration)
Change password

When the Password protection checkbox is selected, the change password definition boxes become active. To change a password, you must first enter the old password, then enter the new password twice; once to define and the second time to confirm.


Registration and updates tab (administration)

The Registration and updates tab contains three buttons, Registration, Download and News.

Click the Registration button to connect to the eSafe Protect Desktop software registration site, where you can register the software. Registration entitles you to a full year of virus table updates.

Click the Download button to connect to the eSafe Protect Desktop update site. This site automatically checks the eSafe Protect Desktop files stored on your computer and uploads updated files to your computer whenever it finds outdated files.

Click the News button to connect to the eSafe Protect virus news site, where you can read and print the latest news on viruses and Internet vandals.


Registration button

Click the Registration button to connect to the eSafe Protect Desktop software registration site, where you can register the software. Registration entitles you to a full year of virus table updates.


Download button

Click the Download button to connect to the eSafe Protect Desktop update site. This site automatically checks the eSafe Protect Desktop files stored on your computer and uploads updated files to your computer whenever it finds outdated files.


News button

Click the News button to connect to the eSafe Protect virus news site, where you can read and print the latest news on viruses and Internet vandals.


Undo changes button (administration)

This Undo icon undoes all unsaved changes made to Administration | Privileges.


buttons for map of privileges

The map of privileges contains the following six icons:

Button	Function
	Add new user
	Edit user
	Disable or ignore privilege
	Enable privilege
	Enable all privilege in the group
	Undo all unsaved changes to the map of privileges


Assign sandbox/firewall icon

This icon assigns the selected sandbox or firewall to the selected user.


buttons for the Personal Firewall

The Add and Edit icons open the Add/edit port dialog box for defining traffic rules for a specific port.


Files with full access dialog box (sandbox)

The Files with full access dialog box lets you add to or delete files from the list of files with full access to all system resources for the sandbox being defined.


add file with full access

Procedure:

1.	Click the File with full access button.

2.	Enter the full path name of the file into the text box. You can use the Browse button to select a file.

3.	Click the Add icon.

4.	Click OK.


Files with full access

The Files with full access button opens the dialog box shown below. Files with full access may access all system resources.


Edit port identification

The Add and Edit icons in the Add/edit port dialog box open the Edit port identification dialog box. The Delete icon deletes the selected port.

The port name is a descriptive name to help you identify the port.

The port number is a logical number assigned in your PC to identify the port.

The port prefix is used to identify the protocol used by the port.


Add/edit user dialog box

This is where you enter or edit the name of a user defined in Administration | Privileges.


changing sandbox and Personal Firewall settings

Procedure:

1.	Right-click the sandbox or Personal Firewall, and select Silent mode setting or Activate/deactivate/place in Learn mode to open the relevant dialog box.

2.	Select the desired setting.

3.	Click OK.

Note:	This procedure changes the corresponding setting in the sandbox or Personal Firewall module.

Note: The Apply button saves all changes made anywhere in the Administration module. The Undo icon undoes unsaved changes made to Administration | Privileges.


Boot operations tab

This is only available in eSafe Protect Enterprise. It allows administrators to force eSafe Protect to perform the following operations during workstation boot.

•	Delete cache file

•	Delete cookies

•	Delete history file

•	Hide eSafe Protect diagnostic screen


Delete cache

This is only available in eSafe Protect Enterprise.

When selected, eSafe Protect deletes the existing cache file when opening Windows.


Delete cookies

This is only available in eSafe Protect Enterprise.

When selected, eSafe Protect deletes the existing cookie file when opening Windows.


Delete history file

This is only available in eSafe Protect Enterprise.

When selected, eSafe Protect deletes the existing history file when opening Windows.


Hide diagnostic screen

This is only available in eSafe Protect Enterprise.

When selected, eSafe Protect does not display the eSafe Protect diagnostic screen when booting Windows.


Modules tab

The Modules tab contains three levers, which enable you to deactivate and reactivate any of the following modules the next time that you reboot.

•	Sandbox

•	Personal Firewall

•	On-access scanner (The on-demand scanner does not need to be deactivated because you must initiate its operation each time you want to use it.)

Drag a lever down to deactivate the corresponding module the next time you boot your computer.

Drag a lever up to reactivate the corresponding module the next time you boot your computer.


Activate sandbox module

Select inactive to deactivate the Sandbox module the next time you start your computer and active to reactivate it.


Activate Personal Firewall module

Select inactive to deactivate the Personal Firewall module the next time you start your computer and active to reactivate it.


Activate on-access scanner module

Select inactive to deactivate the On-access scanner module the next time you start your computer and active to reactivate it.


Locate sandbox dialog box (ESPE)

This dialog box allows an eSafe Protect Enterprise administrator to use a pointer to an INI file or the Windows Registry to map a restricted area for an application dependent sandbox.

The INI pointer fields allow the administrator to enter the following:

•	INI file name

•	Section name within the INI file

•	Name of the key or flag

The INI pointer fields allow the administrator to enter the following:

•	INI file name

•	Section name within the INI file

•	Name of the key or flag

The Registry pointer fields allow the administrator to enter the following:

•	Registry key

•	Value of the Registry key

The application name in this directory box enables you to enter the file names or partial file names associated with the application affected by the sandbox. You can use wildcards to define a range of files. For example *.DO? refers to all files with an extension beginning with DO, such as *.DOC, *.DOT, etc.

The Enforce protection in subdirectories checkbox extends the restricted area to files located in the subdirectories.


INI location fields (ESPE)

The INI pointer fields allow the administrator to enter the following:

•	INI file name

•	Section name within the INI file

•	Name of the key or flag


Registry location fields (ESPE)

The Registry pointer fields allow the administrator to enter the following:

•	Registry key

•	Value of the Registry key


Application name in the directory (ESPE)

Enter the file names or partial file names associated with the application affected by the sandbox. You can use wildcards to define a range of files. For example *.DO? refers to all files with an extension beginning with DO, such as *.DOC, *.DOT, etc.


Path protection dialog box (ESPE)

This dialog box allows an eSafe Protect Enterprise administrator to map restricted areas when defining a sandbox for deployment.

The Path definition box defines the restricted drive and path.

The File definition box defines the restricted file or file types.

The Enforce protection in subdirectories checkbox extends the restricted area to files located in subdirectories.


Path for path protection (ESPE)

The Path definition box defines

This definition box allows an eSafe Protect Enterprise administrator to define a restricted drive and path.


File name for path protection (ESPE)

This definition box allows an eSafe Protect Enterprise administrator to define restricted file or file types.


Enforce protection in subdirectories (ESPE)

The Enforce protection in subdirectories checkbox extends the restricted area to files located in subdirectories.


Warning ! Sandbox Violation message

A violation message appears when an illegal action takes place that violates sandbox rules. There are two types of violation messages, those with four buttons for eSafe Protect Desktop users and administrators, and those with two buttons for eSafe Protect Enterprise workstations.

Computers with eSafe Protect Desktop

Violation messages with four buttons inform you of the violation and allows you to redefine how eSafe Protect responds to this event in the future. These messages also contain a checkbox that allows you to prevent display of this if the same violation occurs in the future.

Allow next until reboot temporarily redefines the operation until you reboot your computer. If you retry the same operation eSafe Protect will allow it. Once you reboot, eSafe Protect will return to its previous state and prevent the illegal operation.

Allow in future redefines the relevant sandbox to allow this operation in the future.

Do not allow leaves your sandboxes unchanged.

How to decide if this is real vandal attack or normal system behavior:

Read the message carefully to see what exactly happened.

eSafe Protect Enterprise workstations

Violation messages with two buttons inform you of the violation that occurred only. The possible button combinations are:

•	Run wizard and Help
Run wizard opens the on-demand scanner.

•	OK and Help
OK acknowledges that you have read the message and closes the message.


Warning ! Personal Firewall Violation message

A violation message appears when an illegal action takes place that violates Personal Firewall rules. There are two types of violation messages, those with four buttons for eSafe Protect Desktop users and administrators, and those with two buttons for eSafe Protect Enterprise workstations.

Computers with eSafe Protect Desktop

Violation messages with four buttons inform you of the violation and allows you to redefine how eSafe Protect responds to this event in the future. These messages also contain a checkbox that allows you to prevent display of this if the same violation occurs in the future.

Allow this time allows this operation for this time only.

Allow in future redefines the relevant Personal Firewall to allow this operation in the future.

Do not allow leaves your Personal Firewalls unchanged.

How to decide if this is real vandal attack or normal system behavior:

Read the message carefully to see what exactly happened.

eSafe Protect Enterprise workstations

Violation messages with two buttons inform you of the violation that occurred only. The possible button combinations are:

•	Run wizard and Help
Run wizard opens the on-demand scanner.

•	OK and Help
OK acknowledges that you have read the message and closes the message.


eSafe Protect Warning message
eSafe Protect Warning ! message

A violation message appears when an illegal action takes place that violates anti-virus or other rules. It informs you of the violation that occurred and contains two buttons. The possible button combinations are:

•	Run wizard and Help
Run wizard opens the on-demand scanner.

•	OK and Help
OK acknowledges that you have read the message and closes the message.


Allow next until boot

This temporarily redefines the operation until you reboot your computer. If you retry the same operation eSafe Protect will allow it. Once you reboot, eSafe Protect will return to its previous state and prevent the illegal operation.


Allow this time

This allows the operation for this time only.


Allow in future

This redefines the relevant sandbox or Personal Firewall to allow this operation in the future.


Do not allow

This leaves your sandboxes and Personal Firewalls unchanged.


Silent mode checkbox for warning messages

Select this if you do not want this warning message to appear if the same violation occurs again. Future violations will automatically be prevented.


running the Anti-virus Wizard

The Anti-virus Wizard removes viruses and vandals from an infected file that the on-access scanner has detected. It is only available from the eSafe Protect Warning screen.

Step 1. Click Run wizard in the eSafe Protect Warning screen. The Cancel button exits the warning screen without removing the offending virus vandal.

Step 2. Click Scan now.

Step 3. Click Finish.

Note: If you want to perform an on-demand virus check of other files, click Run anti-virus module instead of Finish.


Active Desktop protection

The Active Desktop allows you to place Internet sites directly on your Windows desktop. As a result, eSafe Protect Desktop warns you of when you attempt to place a sites on the Active Desktop containing potentially dangerous Java or other scripts.

The warning screen is a dialog box, which allows you to place the item on a list of trusted items or remove it from the Active Desktop.

A third option allows you to edit the list of trusted and untrusted sites. eSafe Protect allows you to access all pages of the sites listed as trusted, and prevents you from accessing any page in sites containing listed as untrusted.

Procedures

Allowing placement of a new item

Click Allow always in the eSafe Protect Warning dialog box.

Preventing placement of a new item

Click Don't allow in the eSafe Protect Warning dialog box.

Making changes to the lists of trusted and untrusted sites

Step 1. Click Advanced in the eSafe Protect Warning dialog box.

Step 2. Select the item to be moved and click the arrow pointing to the target list.

Step 3. Click OK.


Violation message

A violation message appears when an illegal action takes place that violates sandbox, personal firewall or privilege rules. There are two types of violation messages, those with four buttons for eSafe Protect Desktop users and administrators, and those with two buttons for eSafe Protect Enterprise workstations.

Computers with eSafe Protect Desktop

Violation messages with four buttons inform you of the violation and allows you to redefine how eSafe Protect responds to this event in the future. These messages also contain a checkbox that allows you to prevent display of this if the same violation occurs in the future.

Allow next until reboot temporarily redefines the operation until you reboot your computer. If you retry the same operation eSafe Protect will allow it. Once you reboot, eSafe Protect will return to its previous state and prevent the illegal operation.

Allow in future redefines the relevant sandbox or personal firewall to allow this operation in the future.

Do not all leaves your sandboxes and personal firewalls unchanged.

How to decide if this is real vandal attack or normal system behavior:

Read the message carefully to see what exactly happened. The screen shot below illustrates an example of a warning generated by normal system behavior. Click on the Warning Details box below for a description what the message means.

eSafe Protect Enterprise workstations

Violation messages with two buttons inform you of the violation that occurred only. The possible button combinations are:

•	Run wizard and Help
Run wizard opens the on-demand scanner.

•	OK and Help
OK acknowledges that you have read the message and closes the message.


eSafe Protect Watch

Click here for basic information on your current version of eSafe Protect. This information includes the following:

•	Product version

•	Serial number

•	Date of the last virus table update

•	To whom it is registered.


Active protocol display

An indicator for the protocol used lights when communication takes place.


Protection level indicator and change view

This displays your current level of eSafe Protect protection and the level of the threat posed by files currently in use. Click on CHANGE VIEW to change the way this is displayed.


CONFIG button

Click here to open the configuration wizard.


ANTI-VIRUS button

Click here to open the On-demand scanner module.


Protection level lever

This lever allows you to reset your level of protection.

Extreme	Exits Learn mode, thereby activating those sandboxes.

Normal	Full operation as configured. New sandboxes remain in Learn mode.

Low	Activates the on-access scanner and Personal Firewall. Deactivates all sandboxes.

Off	Deactivates all eSafe modules.


Minimize button

Click here to minimize the eSafe Protect Watch display to show only the threat level and active protocol.


Maximize button

Click here to maximize the eSafe Protect Watch display.