Cover

Prevx Home

This computer program is protected by copyright law and international treaties. Unauthorized reproduction or distribution may result in severe civil and criminal penalties,
and will be prosecuted to the maximum of the law. All registered trademarks are acknowledged.

November 2004

www.prevx.com


Introduction

Prevx Home is a standalone version of Intrusion Prevention software (IPS). It was developed from Prevx Enterprise, uses Enterprise technology, and was specifically produced for the home user. Prevx Home is provided free of charge, subject to terms and conditions.

It is part of a range of products and services designed for home users, small businesses, large corporations, and Internet Service Providers (ISPs). Details of other Prevx products can be found at the Prevx web site.

Prevx Home was designed to be simple to install and use, and does not require you to set up complex rules or configuration settings. Security settings and product updates are downloaded to your computer when required.

It provides you with protection against attacks that can bypass traditional firewall, anti-virus, and others security tools as they are designed to deal with known threats compared against a signature database. Prevx examines activity on your computer and looks for suspicious behavior.

Prevx Home will stop hack attacks, internet worms and the installation of spyware.

Why is Prevx Home Free?

In return for providing Prevx Home for free, all we ask is that you agree to take part in the fight against cyber crime. How? Well, when Prevx Home detects an Event on your computer, some information is sent to Prevx. No personal information about you is collected.

Your Privacy

Details of Prevx's privacy policy can be found at the Prevx web site.

License Agreement

For full details of the Prevx Home license, see 'License Agreement'.

©2004 Prevx. All rights reserved.


Getting Help

Help and Support

Prevx Home is designed to be easy to use and trouble-free. However, in the unlikely event that you have a problem, you can do either or all of the following:

  • Read the troubleshooting section

  • Read the FAQs

  • Visit the Prevx technical support website.


Security Introduction

Any computer connected to the internet is exposed to security risks. These risks can arise as a result of vulnerabilities such as security bugs in the operating system or programs that you run, such as an internet browser.

Prevx Home provides vital protection against attacks that traditional security products may not adequately protect against. These include:

  • Buffer Overflows

  • Trojans and Exploits

  • Internet Worms and Hack Attacks

  • Spyware and Adware.


Why Prevx Home is Different

Traditional security technologies, such as Intrusion Detection Systems (IDS) rely on recognizing a specific attack by comparing inbound network traffic with a list of known attacks contained in a 'signature' database. Therefore, they can only be as good as the signatures contained in the database and are unable to detect the latest attacks for which signatures have not yet been produced.

With the advent of fast propagating attacks (for example, internet worms), that can infect hundreds of thousands of systems worldwide within minutes, this approach is becoming increasingly ineffective. Prevx Home uses special techniques to detect and predict attack behavior before any damage can be done.

For example, a typical hacking cycle will attempt to:

  • Exploit any weakness in your computer's operating system or programs

  • Secretly copy files to your computer

  • Modify the Windows registry

  • Modify your computer's configuration.

At each step Prevx Home can identify and block malicious activity as it occurs and will eliminate threats before any potential damage is done.

Prevx Home uses Security Settings to determine which type of protection to use, but you can control the level of protection you want to have.


Buffer Overflows

A buffer is an area in your computer's memory where code and data is stored until it is required.

Buffer Overflows are weaknesses or vulnerabilities in programs or operating systems that are commonly used by hackers.

In a typical scenario, a hacker would send extra data, including exploit code to a buffer in your computer's memory (for example, a user name dialog box). This would be accepted as valid program code and would be executed. The hacker can then run an illegal program to install a Backdoor or Trojan. If this happens, the hacker has access and control of your computer at any time, without the need for a further attack.

These programs run when you start your computer, even if you shut it down and reboot it. They can remain undetected, gathering personal information, or use your system for malicious purposes.

The original buffer overflow problem can only be resolved by the manufacturer of the operating system or program by issuing a security patch. For example, Microsoft issues patches through their Windows Update program.

Sometimes patches can take days or weeks to be released after the problem has been discovered. The problem itself may have been undiscovered for months prior to the patch being issued. Since new buffer overflow problems are discovered almost daily, it is logical to assume that even a computer with all the latest patches may still suffer from unknown buffer overflows.

Prevx Home blocks the buffer overflow vulnerability by ensuring that illegal programs cannot access memory where they attempt to run. Your computer is therefore protected from being exploited through buffer overflows, even unknown ones.


Viruses and Trojans

A Trojan is unwanted software which runs on a user's machine, as an agent of the attacker and without the user being aware.

An exploit is a program (exploit code) used to exploit a weakness (vulnerability) discovered in an operating system or program.

The weakness is exploited by a hacker to gain access and take control of your computer. The exploit typically occurs via a backdoor or Trojan to allow a hacker future access your computer without the need to attack it again, even after the original vulnerability has been fixed (i.e. patched).

Examples of Trojans

  • Remote Access Trojans (RATs) allow a hacker to control your computer remotely. These are becoming more commonplace through the use of peer-to-peer file sharing programs. For example, sharing music files.

  • Distributed Denial of Service (DDOS) Zombie allow a hacker to use your computer run a DDOS (Distributed Denial of Service) attack on other computers or collection of computer systems. Attackers frequently attack the web sites of major companies by installing thousands of Zombies on unsuspecting user's computers.

  • Key Loggers monitor your keystrokes and allow a hacker to 'steal' data from your computer, such as your passwords, credit card and bank details.

Prevx Home prevents these types of programs being installed on your computer, even if the original vulnerability weakness has not been fixed by blocking the hole in the program.


Internet Worms

An internet worm is a program that exploits vulnerabilities in a computer operating system or program. A common vulnerability is a buffer overflow. Internet worms use techniques similar to those used by hackers to attack your system.

Unlike an e-mail virus or worm that enters your system as an attachment, an internet worm penetrates your system directly via your internet connection. It does this by scanning the internet for vulnerable systems, and once found it inserts malicious code directly into memory. The affected computer is then used a proxy to scan for other vulnerable hosts.

A worm may itself cause damage, or act as a delivery mechanism for other malicious programs such as viruses, backdoors or key loggers.

Traditional anti-virus software rely on scanning e-mail attachments to discover viruses and worms, and therefore may not detect internet worms.

Prevx Home stops your computer from being infected by worms by preventing them from writing to your computer's file system or registry. Unlike many anti-virus products it protects you against known and unknown threats, without the need for signature updates.


Hack Attacks

A hack attack involves a hacker running exploit code on your computer. These sorts of attack consist of a hacker installing a backdoor program that allows the hacker to access your computer at will.

Hack attacks can be used to serve almost any purpose, from allowing the attacker complete remote control of your computer, stealing personal information, or installing a DDOS Zombie. Hackers can also steal all of your e-mail addresses stored on your computer to build, for example, spam mailing lists, or use your system to secretly distribute spam. Hack attacks can cause your computer to malfunction and render your system unusable.

Prevx Home helps stop hack attacks by preventing the attacker from accessing your computer.


Spyware and Adware

Spyware

Spyware is programs and cookies that use your Internet connection to gather and transmit information about you. In other words, it 'spies' on you. For example, a Spyware program might gather the IP address of your computer, the browser you are using or your browsing behavior.

Spyware is often downloaded without your knowledge or consent, and is often hidden within legitimate downloads (this is commonly known as a Trojan).

Spyware is also referred to as a type of Browser Helper Object (BHO).


Adware

Adware displays targeted advertising on your browser, usually as a banner or pop-up.

Sometimes Adware programs hijack adverts of other vendors, and will track your browsing habits. This information is then reported back to interested advertisers to target you for specific advertising.

Prevx Home prevents Spyware and Adware from being installed, therefore helping to protect your privacy and your data.

Adware is also referred to as a type of Browser Helper Object (BHO).


Installation

Installing Prevx Home

System Requirements

Currently, Prevx Home is supported on the following systems:

  • Intel Pentium 3 600MHz, 256MB RAM (or compatible system).

  • Microsoft Windows XP Professional, XP Home, Windows 2000 Professional and Windows 2000 Server

After downloading

  1. Locate the Prevx Home installation file that you downloaded and double-click it.

The installation wizard starts.

  2. Follow the on-screen instructions.

  3. To complete the installation, reboot your computer.

After rebooting

To ensure that you have the latest security settings, click Update from the Management Console when you first start Prevx Home and then at regular intervals.

Note: If you have firewall enabled, you will need to allow internet access for Prevx Home.


Uninstall Prevx Home

Removing Prevx Home

You can remove Prevx Home via the Start menu or Control Panel.

Note: You will need to reboot your system to complete the removal process, so save any work before continuing.

Start menu method

  1. Go to Start > Prevx > Prevx Home > Uninstall.

The removal process starts.

  2. After the removal process completes, reboot your computer when prompted.

Control Panel method

  1. Go to Start > Settings > Control Panel

  2. In the Control Panel, click Add/Remove Programs.

  3. Select Prevx Home from the list, and then click Change/Remove.

Follow the on-screen instructions.

  4. After the removal process completes, reboot your computer when prompted.


System Reboot

Starting Prevx Home

When you start your computer, Prevx Home protection automatically starts and all previous security settings are enabled. (If you are running Prevx Home for the first time, then default settings are applied).

After the security settings have been applied, Prevx Home runs continuously in the background to protect your system.

You will see the Prevx Home icon in the Windows taskbar when it is running.

Note: If you see the icon with a red cross, it means that you do not have any security settings applied. See 'Updating Your Security Settings' and 'Troubleshooting' for more info.


Shutting Down Prevx Home

Note: Shutting down Prevx Home is not the same as closing the Console. If you shut down, you will unload all of your Prevx Home protection. To close the Console, see 'Closing the Console'.

  1. Right-click on the Prevx Home icon in the system tray, or click the Prevx logo at the top left on the main screen, and select Shutdown Prevx Home.

You see a confirmation message.

  2. Click Yes.

The Console closes, and the System Tray icon is removed.


Introduction

Console Introduction

Although Prevx Home is a powerful security tool, the interface has been designed to be simple to understand, and easy to use.

The Console is the main interface for Prevx Home. The console has four main tabs:

  • The Status tab is the default, and shows the protection level and general information.

  • The Security Settings tab shows a list of your current settings.

  • The Event History tab show a history of the Events that have occurred.

  • The Preferences tab is where you set your password, clear rules and Event history.


START Menu

Starting the Console

By default, Prevx Home starts automatically when you start Windows and works in the background. When Prevx Home is running, you will see an icon in the System Tray.

To configure security settings, view event histories or change preferences, you will need to start the Console.

Do one of the following:

  • Double-click the Prevx Home icon in your system tray

  • Right-click the Prevx Home icon in your system tray and choose Show Management Console

  • Go to Start > Programs > Prevx > Prevx Home > Prevx Home.


Closing the Console

Note: Closing the Console is not the same as shutting down Prevx Home. When you close the Console, you are just closing the interface and Prevx Home is still running. To shut down Prevx Home see 'Shutting Down Prevx Home'.

  • Click Close, or click the Close Window button ( close window button).

The Console closes and the Prevx icon is still showing in the System Tray.


Taskbar Menu

These options are available by right-clicking the Prevx Home icon in the system tray:

Show Management Console | Opens the main interface, known as the Console.
Check for Updates | Allows you to download the latest security settings and product enhancements. See 'Updating Prevx Home' for details.
Trusted Installation | Allows you to install programs without generating Events for the duration of the installation. All your other security settings remain the same.
Suspend/Resume Protection | Allows you to suspend or resume all Prevx security settings. Note: You should only use this feature sparingly as it turns off all Prevx protection. If you close down and restart Prevx Home, or of you restart your computer, your security settings will be returned to their previous state.
Shutdown Prevx Home | Shuts down Prevx Home. Note: Shutting down will stop all Prevx Home protection on your computer.


Installing Trusted Programs

When you install new programs or updates, Prevx may generate a lot of Events. This is because installation programs write to areas which are protected by Prevx Home.

You can suppress Events when you are installing programs by using the Trusted Installation feature. Trusted installation only applies to the program you choose, and all other security settings remain the same.

Note: Although you do not see the Event pop up messages during a trusted installation, you can still view the details by looking in the Event History.

When the trusted installation has finished, Prevx will activate Events again as normal.

How to carry out a trusted installation

  1. Right-click on the Prevx Home icon in the Taskbar, and select Trusted Installation.

The browser window opens.

  2. Navigate to the installation program that you want to trust, and click it to start the installation.


Security Settings Introduction

Security settings are rules defined by Prevx to protect your computer from attack.

Each setting contains rules for monitoring critical aspects of system behavior and attacks can be detected and blocked as required.

Although new attacks can appear daily, the underlying mechanisms (known as 'attack vectors') used by these attacks are relatively few. Detecting these attack vectors by analyzing behavior rather than by using signatures, Prevx Home can defeat both known and unknown (known as 'zero-day') attacks.

A signature is a pattern built from a known set of characteristics, and therefore requires the attack vector to have a previous record for it to be recognized.

You can determine how Prevx Home responds choosing to ignore the attack, or specifying the action to take.


Protection

Types of Protection

Prevx Home protects these main areas:

Memory Protection

Memory protection prevents against buffer overflow attacks, and because different programs behave differently, several different security settings are provided.

File System Protection

File system protection is designed to prevent attackers from accessing your computer's file system, but still allowing legitimate programs to continue normally. Attackers are prevented from installing malicious code on to your computer and stop legitimate programs from being hijacked. For example, Prevx Home will stop unauthorized modification of important system files, such as Autoexec.bat.

Registry Protection

The registry is a key component of Windows. Making changes to the registry can allow an attacker to modify system behavior, cause programs to behave in unusual ways, not to load, allow malicious code to be automatically run, and so on. Numerous security settings are provided to protect the Registry from such unauthorized changes, but ensuring normal access by legitimate programs are not affected.

For each of these areas a number of security settings are available, and when combined, provide comprehensive protection.

Most attacks will violate multiple security settings and in more than one area. Prevx Home provides robust protection through applying multiple security settings in a layered security model. This means that if an attack is not caught by one security setting, it is caught by another.

Uncontrolled Program Execution

This protection stops direct running of e-mail attachments, protecting from e-mail worms viruses, and also from the running of downloaded Internet Explorer files. These settings also block key loggers, trojans and other spyware from being installed and run.

Process Hijacking

This protection detects and shuts down attempts to take ownership of running system processes to prevent a hacker taking control of your computer. It also prevents a program from being stopped by malware running on an infected machine. Malware may attempt to terminate anti-virus, firewall, spyware tools or even Prevx software to avoid detection.


Protection level

Changing Your Protection Level

The protection level monitor is situated on the lower left of the Status screen and shows your current protection level:

Protection Level Monitor

The default is Maximum/100%.

  1. Click the Protection Level drop-down menu.

  2. Choose the level you require:

Maximum | Enables all security settings, including settings that were previously set to Query or Off. The indicator will show 100%.
Off | Disables all the security settings, and Prevx Home will not provide any protection. The indicator will show 0%.
User Defined | If you manually modify the security settings, Prevx Home determines that the settings are customized and will display User Defined with a corresponding percentage number.


Security Settings

Changing Security Settings

Security settings have been individually pre-configured with Prevx's recommended values, but you can change them to suit your own environment. Over time you will discover what will be the best values based on the number and types of Event that you get.

As with most security products it is best to take a cautious approach if you decide to make any changes.

Note: You may not be able to change some security settings, depending on the Prevx product you have.

  1. From the Console, select the Security Settings tab.

The main panel displays a list of security settings and their current status.

  2. Select a setting:

Prevent | Prevent icon | Automatically stop any activity which violates this security setting.
Query | Query icon | Prompt me for the action to take, so I can decide.
Off | Off icon | Disable this security setting.
Report | Report icon | Do not prompt me, but create a report.


Updating Your Security Settings

Prevx Home does not rely on signature files to keep your protection up to date. However, to ensure that you have the latest product updates and any enhanced security settings, Prevx provides you with an easy-to-use update facility.

Before updating Prevx Home, confirm the following:

  • You must be logged in as Administrator

  • You must be connected to the Internet. (Note: If you have a firewall enabled, you will need to allow access for Prevx Home).

How to update

  1. Open the Console and click Update.

  2. Click Begin, and follow the on screen instructions.

The Prevx web site will be contacted, and any updates will be downloaded to your computer.


Event Introduction

An Event is a violation of a security setting.

Prevx Home continually monitors system behavior, and if it detects something suspicious, you see an Event message. For details on how to respond to pop-ups, see 'Responding to Event Messages'.

A record of the event is added to the list of Events, and details can be viewed in the Event History screen. Attacks frequently involve a number of attempts at the same violation, and Prevx Home creates an Event for each one.

An event is almost always evidence that Prevx Home has detected bad behavior on your computer.


Understanding an Event Message

If a program has violated a Security Setting, you receive an Event message. For example:

A | Security Setting type
B | Name of the application which has caused the Event
C | Action that the application is trying to perform
D | Security Setting title
E | Security Setting description
F | Event response options
G | View Event details
H | See how other users have responded
I | Suspend protection


Viewing Event Details

An Event message shows a summary, but if you want to see more information, click Details.

You see a summary of the Event in the lower half of the screen.

The details include:

  • The name of the program (i.e. the application or process) which caused the Event

  • The Event type

  • The date and time of the Event.

  • The possible reason for the Event and the level of potential risk associated with it.


Responding to Events

When Prevx detects suspicious behavior it generates an Event message. Basically, you then need to decide whether to allow or deny the action.

Before you decide which action to take, consider these points (this is not intended to be a full list):

  • Are you installing or updating any software, including automatic web updates?

When a program is installed or updated, key files are usually overwritten or replaced. These files are protected by Prevx Home. If you are certain that the Event relates to a genuine installation being carried out by you, then you could allow the action. You should also consider that you may have automatic updating set. For example, Windows update.

  • Are you changing any program configuration, settings or preferences?

The same advice as the previous point applies here. For example, changing the default home page for Internet Explorer (IE) will generate an Event. The IE default home page setting is stored in the registry, so if it you are not making this change, then it is considered suspicious. In this case, you could deny the action.


Allowing or Denying an Event

  1. Examine the Event summary and note the application and the action it is trying to perform. If the action relates to something that you are doing, then it is probably safe to allow the action.

If you are unsure what to do, click Get Advice to see what other users have decided. This option takes you to the Prevx website, so you will need an internet connection open.

  2. Choose an action to take:

Allow this Event

Select this option if you want the application shown to be allowed to continue with the specific action.

In other words, although Prevx Home has detected that this Event may be suspicious, you want the single action to continue

For example, Prevx Home has a Security Setting that prevents files with a .bat extension from being created in the Windows\System directory. However, you may want to allow Notepad to save a file named Test.bat in that directory.

Allow all Events

Select this option if you want the application shown to be allowed to continue with all the actions protected by the Security Setting.

In other words, although Prevx Home has detected that this Event may be suspicious, you want the application to carry out the other actions protected by the Security Setting. This effectively lets the application ignore the Security Setting.

For example, Prevx Home has a Security Setting that prevents files with a .bat extension from being created in the Windows\System directory. However, you may want to allow Notepad to save any file with a .bat extension in that directory.

Deny this Event

Select this option if you want to prevent the application from continuing with the specific action.

In other words, Prevx Home has detected that this Event may be suspicious and you do not want this single action to proceed.

For example, Prevx Home has a Security Setting that prevents files with a .bat extension from being created in the Windows\System directory. However, you may want to prevent Notepad from saving a file named Test.bat in that directory.

Deny all Events

Select this option if you want to prevent the application from continuing with all the actions protected by the Security Setting.

In other words, Prevx Home has detected that this Event may be suspicious, and you do not want the application to carry out any action protected by the Security Setting. This effectively enforces the Security Setting.

For example, Prevx Home has a Security Setting that prevents files with a .bat extension from being created in the Windows\System directory. However, you may want to prevent Notepad from saving any file with a .bat extension in that directory.

Notes:

  • The option you choose applies only to the application shown in the Event message.

  • The option you choose applies only to a specific Security Setting, and it is possible that an application may violate several different Security Settings. For example, Notepad may violate a File System and a registry Security Setting.

  • You can store your answer by selecting Remember my answer.

How to clear the options

  1. From the main Console screen, click Preferences.

  2. In the Rules Management section, locate Advanced Options for QUERY Mode, and click Clear.


Suspending Protection

You may find it useful to switch Prevx Home to Suspend Mode if you anticipate receiving lots of Event messages. For example, you may be installing or removing some software. Typically, this can generate a lot of Events because many system files or registry settings may need changing.

Notes:

  • As a precaution, only consider using Suspend Mode if it is you that is performing the action, or it is something that you are aware of. For more information see 'Responding to Events'.

  • In Suspend Mode, you are turning off all Prevx Home protection, so remember to resume protection afterwards.

  • Suspend Mode remains in force until you restart your computer. After a restart, your protection is returned to its previous protection level.

To suspend protection

  1. Either:

  1. Click Suspend from the Event message

  2. Right-click on the Prevx icon in the taskbar, and select Suspend Protection.

You see a confirmation message.

  2. Click Yes.

You see the small Suspend Mode dialog box, and the Prevx taskbar icon shows a red cross.


Resuming Protection

You can resume protection if you have previously set Prevx Home to Suspend Mode.

Either:

  • From the Suspend Mode dialog box, click Resume

  • Right-click on the Prevx icon in the taskbar and select Resume Protection.

The red cross on the Prevx icon in the taskbar is removed, and your protection is returned to its previous level.

Note:

  • Restarting your computer also returns Prevx Home to its previous protection level, even if you have not resumed it yourself.


Viewing the Event History

A list of Events is stored in the Event history.

  1. From the main Console, click Event History.

  2. In the list, double-click on an Event, or click Alert Details to see the details.

To sort the list

  • Click the column heading.

  • To re-sort the list, click the column heading again.


Clearing the Event History

You can specify how many Events you want to maintain by setting a level at which earlier Events are cleared.

  1. Click the Preferences tab

  2. In the Clear History if more than field, use the arrows to select the number of Alerts or type in your own number.

  3. Click Save Changes.


Protecting your Security Settings

Setting a Password

To prevent unauthorized changes to your security settings, you can set up a password:

  1. From the Console main screen, select the Preferences tab.

  2. Select Enable password protection to set up the new password.

Note: It is important not to forget your password, it is one-way encryption and cannot be revealed if forgotten.

  3. Type in a new password, retype it in the Confirm Password box, and type in a password hint.

  4. Click Apply.

You see a confirmation informing you that the password has been set.

Any future changes to security settings, or preferences will require the password.


Changing a Password

Note: It is recommended that you change your password periodically.

  1. From the Console main screen, select the Preferences tab.

  2. Click Change Password.

  3. Type in your existing password.

  4. Type in your new password, and retype it to confirm it.

  5. Click Apply.


About

Viewing Product Information

You can get product information by clicking About from the main Console screen.

Details shown include:

  • Product name

  • Version number

  • Installation date

  • Last update date.

This information will assist support queries and in providing updates.


Troubleshooting

Symptom

The icon in System Tray shows a red cross ( System Tray Icon), even though Prevx Home has been downloaded and installed successfully.

Resolution

  1. Click the Security Settings tab, and see if you have any settings listed. If there are no entries, then your firewall has probably prevented Prevx from downloading them.

  2. Allow Prevx access through your firewall, and then run Prevx update.

  3. After the update process has finished, click the Security Settings tab and check that you now have security settings loaded, and that the red cross has been removed from the Prevx icon in the System Tray.

Symptom

I am still getting Event pop-up dialog boxes, even though the Prevx icon is not showing in the system tray.

Resolution

Prevx is still loaded, but the icon is inactive:

  • Expand the System Tray so that it shows all the items. You can tell if there are hidden items, by looking for the arrow to the left.

Check your System Tray properties to see if you have the Hide inactive icons option selected. If it is, then any icons that are unused for a while will be hidden. This is a feature of Windows XP:

Symptom

I've shut down Prevx Home, but the icon is still showing in the System Tray.

Resolution

  • You may have closed the Console rather than shut down. See "Shutting down Prevx Home" for details.


FAQs

Do I still need anti-virus software?

Yes. For maximum security, additionally running anti-virus software reduces the number of routes which can be used to attack your computer.

Do I still need a personal firewall?

Yes. For maximum security, additionally running a personal firewall reduces the number of routes which can be used to attack your computer.

Will Prevx Home detect Spyware on my computer?

When you install Prevx Home, it does not detect existing Spyware, but it does prevent new Spyware from accessing your computer.

How do I update my security settings?

Prevx Home automatically updates your security settings every 30 days by connecting to the Prevx web site. If you want to update your security settings more frequently, click Update on the Prevx Home console screen.

Do I still need to apply patches?

Yes. For maximum security, every computer connected to a network should be at the highest security level.

How do I see the details of a potential intrusion?

You can see details of a potential intrusion by looking at the Event History.

How do I modify my protection level?

You can modify your protection level in three ways:

  • Setting overall maximum security

  • Setting individual protection levels

  • Ensuring that your security settings are up-to-date.

How do I set Prevx Home to notify me of a possible attack before shutting it down?

Prevx Home has three security states; Prevent, Off or Query.

If you choose Query, an Event message is generated every time a potential attack is detected.

How do I protect my security settings?

You can password protect your security settings and Event history from being modified or cleared. For details see 'Preferences'.

How does Prevx protect against exploitation of Buffer Overflow?

Prevx Home protects against known and unknown buffer overflow vulnerabilities by looking at your computer's memory and preventing unauthorized access to locations outside legitimate boundaries. The 'offending' code will be terminated (the result of a buffer overflow attack) to prevent further execution, and an alarm/report is sent.


Glossary

adware. Software installed with some shareware or freeware, that displays web-based advertisement usually via a pop-up window, on a user' computer.

API (application programming interface). A standardized interface whereby an application program can use services provided by the operating system or subsystems.

applet. Specifically, Java programs. An HTML-based program that uses a web browser to provide a user interface.

attack vector. The route or means used by a hacker to carry out an attack.

authorization. Approval or permission to do something.

backdoor. A backdoor is a secret or undocumented method of accessing a computer. It can also be the software that uses such a means to penetrate a system. Some software has a backdoor placed by the programmer to allow them to gain access to troubleshoot or change the program. Software that is classified as a "backdoor" is designed to exploit a vulnerability in a system, and open it to future access by an attacker.

bit. In computing, the smallest unit of storage. Bit is a contraction of the term "binary digit".

browser. A program that can retrieve and display information from servers on the World Wide Web (WWW).

buffer. A temporary storage area in a computer's memory.

buffer overflow. A buffer overflow occurs when a program or process tries to store more data in a buffer than it was intended to hold. Since buffers are created to contain a finite amount of data, any extra information has to go somewhere. This usually results in an overflow into adjacent buffers, corrupting or overwriting the valid data held there.

byte. In computing, a fundamental unit of storage. A byte usually holds one character of information, and usually means eight bits. The word 'byte' is derived from the term 'Bit x Eight'.

cache. A special high-speed storage area. A cache can either be part of main memory or on an independent storage device.

client. A computer on a network that uses services provided by a server.

chroot. A technique under UNIX whereby a process is permanently restricted to an isolated subset of the file system.

cookie. A small file containing data about a visitor to a website. It's main purpose is to identify users when they return to that website.

CRC (cyclic redundancy check). A type of checksum used implement data integrity as a check against accidental changes or corruption to data.

checksum. A one-way function applied to a file to produce a unique 'fingerprint' of that file for later reference. Checksum systems are a primary means of detecting file system tampering on UNIX.

cybercrime. Any criminal activity which uses network access to commit a criminal act.

DOS (denial of service). A type of attack strategy used by hackers with the aim of closing down a website by bombarding it with fake page requests from a number of different locations.

DDOS (distributed denial of service). An attack that pits many computers against a single victim. This type of attack causes a computer to crash or to become so busy processing data that it becomes unusable. It is possible for a home computer to be used as a participant in a denial-of-service attack on another system without the owners knowledge..

domain hijacking. A type of attack where an attacker takes over a domain by first blocking access to the DNS server and then putting another server up in its place.

DNS (domain name system). DNS is how Internet domain names are located and translated into Internet Protocol (IP) addresses. A domain name is a way of using meaningful words to remember an Internet address, rather that IP address numbers.

DLL (dynamic link library). A DLL is a relatively small program which can be called by another program only when needed, and therefore can be shared between many programs.

event. In Prevx terms, essentially a violation of a security setting (or policy).

exploits. An exploit is a way of breaking into a system. An exploit takes advantage of a weakness in a system in order to hack it. Exploits are the root of the hacker culture. Hackers gain fame by discovering an exploit. Others gain fame by writing scripts for it. Most exploits can be classified into categories including buffer overflow, directory climbing and Denial of Service.

firewall. Security devices used to restrict access in communication networks. They prevent computer access between networks (for example, from the Internet to a corporate network), and only allow access to services which are expressly registered. They also keep logs of all activity, which may be used in investigations.

granularity. The relative fineness or coarseness by which a mechanism can be adjusted.

hack. Any software in which a significant portion of the code was originally in another program.

hacker. An individual whose primary aim is to penetrate the security defenses of computer systems. A skilled hacker can penetrate a system and withdraw again, without leaving any trace of activity. Proto-hackers are those who aspire to be 'true' hackers but have not yet acquired the necessary skills to get past serious security measures without setting off alarm systems. The term is also applied to individuals who do not attack or attempt to penetrate computer systems, but use their skill to hack commercially available packages. Hackers, of whatever variety, are a threat to all computer systems.

heap. In computing, an area of memory where the operating system can dynamically allocate blocks of arbitrary size or order. The name signifies a lack of order, as opposed to ordered (such as a stack).

host-based intrusion prevention [software]. Generally used to describe software installed on a system that is designed to detect and block external attacks on that system.

host-based security. The technique of securing an individual system from attack. Host-based security is operating system and version dependent.

hijacker. In software terms, some code that resets your browsers settings to point to other sites. Hijackers may reroute your information and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but slower.

intrusion detection. Detection of unauthorized access to a network by using some form of analysis and behavior patterns.

intrusion prevention. Prevention of actual or attempted attacks to a computer or a network by monitoring key system components and looking for suspicious behavior.

IP (internet protocol). The method or protocol by which data is sent from one computer to another computer on the Internet.

intranet. A computer network, usually based on Internet technology, that an organization uses for its own internal use.

key logger (Keystroke Logger). A program that runs in the background, recording all the keystrokes. Once keystrokes are logged, they are hidden in the machine for later retrieval, or shipped raw to the attacker. The attacker then peruses them carefully in the hopes of either finding passwords, or possibly other useful information that could be used to compromise the system or be used in a social engineering attack.

macro virus. A virus containing a malevolent macro. Depending upon the way the virus is delivered it may sometimes be known as a Trojan, or a Worm.

malicious code. A program that appears to perform a useful or desirable function, but actually gains unauthorized access to system resources or tricks a user into running another program.

malware. A generic term for a number of different types of malicious code.

network worm. A program or command file that uses a computer network as a means for adversely affecting a system's integrity, reliability or availability. A network worm may attack from one system to another by establishing a network connection. It is usually a self-contained program that does not need to attach itself to a host file to infiltrate network after network.

operating system. Computer programs that are primarily or entirely concerned with controlling the computer and its associated hardware. Computers can operate without application software, but cannot run without an operating system.

one-way encryption. Irreversible transformation of plain text to cipher (i.e. encrypted) text.

patch. A small program update released by a software manufacturer, usually to fix bugs.

patching. The process of applying a patch.

personal firewall. A firewall which is intended to run on an individual computer.

port. A communications channel on a computer identified by a number known as a Port Number. Hackers often use an open port to gain unauthorized access to a computer.

program infector. Malware that attaches itself to existing program files.

registry. Central part of the Microsoft Windows operating system where essential hardware and settings are stored.

RAT (remote administration tool). A Trojan that when run, provides an attacker with the capability of remotely controlling a machine via a "client" in the attacker's machine, and a "server" in the victim's machine. What happens when a server is installed in a victim's machine depends on the capabilities of the Trojan, the interests of the attacker, and whether or not another attacker ever gains control of the server - who might have entirely different interests.

rootKit. A collection of programs that a hacker uses to mask intrusion and obtain administrator-level access to a computer or network.

scalability. The ability to expand a computing solution to support large numbers of users without impacting performance.

SSH (secure shell). A program used to log on to another computer over a network, to run commands on a remote computer, and to move files from one computer to another.

SSL (secure sockets layer). A protocol used for secure Internet communications.

shell. In UNIX, a Shell is the interface with which the user interacts with the operating system. In some systems, the Shell is called a command-line interpreter.

SNMP (simple network management protocol). A protocol governing network management and the monitoring of network devices and their functions.

security policy. Security Policies are how Security Settings are known in Prevx Enterprise terms. They are sets of rules which define good or bad system behavior. Prevx constantly monitors your system and checks for behavior that contravenes the security policies.

security setting. Security settings are how Security Policies are know in Prevx Home terms, but they work in the same way. See 'Security Policy'.

server. The control computer on a that controls software access to workstations, printers and other parts of the network.

stack. In computing, a data structure where the first element that can be removed was the last one added. Sometimes know as Last In, First Out (LIFO).

spyware. Software installed with some shareware or freeware that collects and transmits information about users browsing habits to a third party and usually without their knowledge or consent.

TCP/IP (transmission control protocol/internet protocol). The basic communication language or protocol of the Internet.

threat. A potential for a security violation

threat vector. The route or method that a threat uses to get to it's target.

trojan [horse]. Either, (a) any program designed to do things that the user of the program did not intend to do or that disguises its harmful intent or (b) a program that installs itself while the user is making an authorized entry; which is used to break-in and exploit a system. Unlike viruses and worms, Trojans do not replicate.

URL (uniform resource locator). The addressing system used on the World Wide Web. The first part of the address indicates what protocol to use, and the second part specifies the IP address or the domain name where the resource is located.

Unix. An operating system, initially designed to be a small, flexible system used exclusively by programmers.

update. In Prevx terms, update means getting the latest security settings and product enhancements. Update does not refer to getting signature file updates as Prevx does not use signature files.

virus. A self-replicating program that infects other computer programs. A virus inserts its code into a file, so that when that file is executed the virus is executed as well. A virus can be malicious or harmless depending on it's payload.

vulnerability. A flaw or weakness. Vulnerabilities are sought out and exploited by hackers.

worm. Classified as a type of virus. A self-replicating program that propagates by attacking other machines and copying itself to them. It can be destructive or harmless, depending on it's payload. A worm may replace files but does not insert itself (as happens with a virus).

zero-day. Literally less than 24 hours old. Often used to describe attacks that have just appeared on the internet and sometimes used to describe a vulnerability (a security hole that could be exploited by an attacker) that has just been discovered.

zero-day attacks. Literally, "An attack that has been launched for the first time within the last 24 hours". More commonly, this refers to attacks that are so new that security products vendors (for example, anti-virus vendors) have not yet had time to produce a signature to recognize the attack. Can also refer to an attack that exploits a previously unknown vulnerability in a program for which there is no patch available.


Prevx License Agreement

Prevx Software License Agreement

IMPORTANT: ALL INTELLECTUAL PROPERTY RIGHTS IN THE PREVX HOME SOFTWARE PRODUCT TOGETHER WITH ANY ACCOMPANYING DOCUMENTATION AND MATERIAL (COLLECTIVELY, "SOFTWARE") BELONG TO PREVX LIMITED ("PREVX") AND/OR IT’S LICENSORS. PLEASE READ THE FOLLOWING DOCUMENT CAREFULLY AS IT IS A LEGAL AGREEMENT BETWEEN YOU AND PREVX.

YOUR ATTENTION IS DRAWN IN PARTICULAR TO PARAGRAPH 11 BELOW WHICH SEEKS TO DETAIL PRIVACY AND THE FIGHT AGAINST INTERNET CRIME.

IN ADDITION YOUR ATTENTION IS DRAWN TO PARAGRAPH 7 BELOW WHICH SEEKS TO LIMIT PREVX’S LIABILITY TO YOU. PREVX MAKES THIS VERSION AVAILABLE TO YOU FREE OF CHARGE ON THE UNDERSTANDING THAT THESE LIMITS ARE ACCEPTABLE TO YOU.

YOU ACCEPT THAT THIS FREE VERSION IS MADE AVAILABLE FOR PERSONAL AND NOT BUSINESS USE.

CLICKING THE “I ACCEPT” BUTTON BELOW OR INSTALLING OR USING THE SOFTWARE CONSTITUTES YOUR ACCEPTANCE OF THE TERMS AND CONDITIONS OF THIS AGREEMENT. THE SYSTEM RECEIVING YOUR RESPONSE IS NOT CAPABLE OF INTERPRETING OR REACTING TO ANY TERMS OR INPUT SUBMITTED OR TRANSMITTED BY YOU OTHER THAN YOUR ACCEPTANCE OR REJECTION. IF YOU DO NOT AGREE WITH ALL OF THE TERMS AND CONDITIONS OF THIS AGREEMENT, YOU MUST CLICK THE “I DO NOT ACCEPT” BUTTON, IN WHICH CASE YOU WILL NOT BE AUTHORISED TO INSTALL OR USE THE SOFTWARE.

1. LICENCE GRANT

1.1 Subject to all of the terms and conditions of this Agreement, Prevx grants you a non-exclusive, non-transferable license to install copies of the Software on personal or business PCs. This Agreement applies to all authorized users of the Software.

1.2 By accepting this Agreement, you undertake:

1.2.1 that the Software will be used only on personal or business PCs and not on a server or as part of a network, (for the avoidance of doubt you acknowledge that the Software has not been designed to work on a server and may cause problems to your system should it be so used);

1.2.2 once downloaded, not to copy the Software other than to make a backup copy to be used only to replace your original copy of the Software in the event that it becomes unusable;

1.2.3 except as permitted in this Agreement, not to disassemble, decompile or reverse engineer the Software or otherwise attempt to derive the source code (or the underlying ideas, structure, sequence, organization or algorithms) from the Software, except to the limited extent expressly permitted by applicable law;

1.2.4 not to translate, modify, lease, rent, loan, redistribute, sub-lease, sub-license or create derivative works of the Software or use of any the Software in connection with any timesharing arrangement or service bureau for the benefit of a third party;

1.2.5 within 14 days after the date of termination or discontinuance of this Agreement for whatever reason, to destroy the Software and all upgrades or copies in your possession or control; and

1.2.6 to reproduce and not remove, modify or obscure any copyright notice, trademark or any other proprietary notice of Prevx as it appears in or on the Software on all copies.

1.3 Whilst Prevx uses its reasonable endeavours to ensure that the Software is virus-free, it is your responsibility to virus check the Software before installing it.

1.4 You acknowledge that you are responsible for downloading and installing the Software.

1.5 This Software is provided by Prevx free of charge.

2. TITLE AND COPYRIGHT

2.1 The Software is proprietary to Prevx and/or its licensors. All right, title and interest in and to the Software and all copyright, trade secret rights, patents, trademarks and any other intellectual property or proprietary rights in and to the Software, and all copies of the Software regardless of the form or media on which it exists, shall at all times remain the exclusive property of Prevx and/or its licensors.

2.2 All rights not expressly granted under this Agreement are reserved by Prevx.

3. UPDATED VERSIONS

3.1 The Software may be updated or upgraded from time to time by Prevx at its sole discretion. Prevx is under no obligation to notify you of such updates or upgrades but you may obtain such updated or upgraded versions of the Software from www.prevx.com, on the terms stated by Prevx as prevailing at the time.

3.2 All updated versions of the Software shall remain subject to the terms of this Agreement unless varied pursuant to paragraph 3.1. You acknowledge that you are responsible for downloading and installing such updated versions of the Software.

4. RESTRICTIONS ON TRANSFER

The license granted under this Agreement is personal to you, and neither your rights nor any copy of the Software may be sold, assigned, distributed, transferred or sublicensed to any other person, in any form (including electronic media), without the prior written consent of Prevx. Any transfer without consent from Prevx will be null and void and will automatically terminate your right to use or possess the Software.

5. MAINTENANCE AND SUPPORT

The Software is provided with limited technical support, which can be obtained by emailing Prevx on home-support@prevx.com. Prevx has no obligation to provide maintenance services or additional technical support for the Software.

6. DISCLAIMER

6.1 TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SOFTWARE IS PROVIDED “AS IS” WITHOUT WARRANTY OR ASSURANCES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES AND CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. YOU ACKNOWLEDGE AND AGREE THAT PREVX DOES NOT WARRANT, GUARANTEE, OR MAKE ANY REPRESENTATIONS REGARDING THE PERFORMANCE, USE OR RESULTS OF THE USE OF THE SOFTWARE OR ITS CORRECTNESS, ACCURACY, RELIABILITY, CURRENTNESS, OR OTHERWISE. YOU ASSUME THE ENTIRE RISK ASSOCIATED WITH YOUR USE OF THE SOFTWARE. This disclaimer of warranty is an essential part of this Agreement.

6.2 Some jurisdictions do not allow limitations on implied warranties or conditions, so the above limitations may not apply to you. You may have other rights which vary from jurisdiction to jurisdiction.

6.3 If you are acquiring the software as a consumer and not by or on behalf of a business or a corporate entity, nothing in this agreement affects your statutory rights.

7. LIMITATION OF LIABILITY

7.1 NOTWITHSTANDING ANYTHING ELSE, TO THE MAXIMUM EXTENT PERMITTED BY LAW, PREVX SHALL NOT BE LIABLE, UNDER ANY CONTRACT, NEGLIGENCE, STRICT LIABILITY OR OTHER LEGAL OR EQUITABLE THEORY FOR:

7.1.1 ANY LOSS OF BUSINESS;

7.1.2 LOSS OF REPUTATION;

7.1.3 LOSS OF PROFITS OR GOODWILL;

7.1.4 LOSS OF USE;

7.1.5 LOSS OR DAMAGE TO OR CORRUPTION OF DATA;

7.1.6 THE UNAUTHORIZED DISCLOSURE OF SENSITIVE, VALUABLE, OR CONFIDENTIAL INFORMATION;

7.1.7 LOSS ATTRIBUTABLE TO YOUR FAILURE TO MAKE AND RETAIN REASONABLE BACK UPS OF YOUR DATA;

7.1.8 INTERRUPTION OF BUSINESS;

7.1.9 ANY INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES; OR

ANY COSTS OF PROCURING SUBSTITUTE GOODS, SERVICES, TECHNOLOGY OR RIGHTS.

7.2 Prevx’s liability to you for death or bodily injury resulting from the negligence of Prevx or for fraudulent misrepresentation shall not be limited by any provision in this Agreement. OTHERWISE IF, NOTWITHSTANDING PARAGRAPH 7.1, PREVX IS HELD TO HAVE LIABILITY TO YOU IN RELATION TO THE SOFTWARE WHETHER UNDER CONTRACT, NEGLIGENCE, STRICT LIABILITY OR ANY OTHER LEGAL OR EQUITABLE THEORY, PREVX’S TOTAL LIABILITY TO YOU SHALL NOT EXCEED THE MONIES PAID BY YOU TO PREVX FOR THE SOFTWARE and/or its upgrades.

8. TERM AND TERMINATION

This Agreement is effective until terminated. In the event you fail to comply with any provision of this Agreement, Prevx may terminate this Agreement immediately with or without any prior notice. Upon termination you shall destroy all copies of the Software in your possession or control. Termination is not an exclusive remedy and all other remedies will be available to Prevx whether or not this Agreement is terminated.

9. U.S. GOVERNMENT RESTRICTED RIGHTS.

As defined in FAR section 2.101, DFAR section 252.227-7014(a)(1) and DFAR section 252.227-7014(a)(1) or otherwise, the Software is a “commercial item,” “commercial computer software” and/or “commercial computer software documentation.” Consistent with DFAR section 227.7202 and FAR section 12.212, any use, modification, reproduction, release, performance, display, disclosure or distribution of the Software by the U.S. government shall be governed solely by the terms of this Agreement and shall be prohibited except to the extent expressly permitted herein.

10. MEDIATION

In the event of any dispute, difference of interpretation or controversy or claim arising out of or relating to this Agreement, or the breach thereof, (“Dispute”) either party shall before initiating any legal action submit such dispute to mediation in accordance with the WIPO Mediation Rules.

11. PRIVACY AND COMBATING INTERNET CRIME

Prevx

Prevx is committed to combating internet crime, the abuse of the internet and unauthorized intrusions into personal privacy. We believe Prevx Home is a powerful tool in this fight, providing you with protection while accessing the internet and information to help fight internet crime.

The Software is provided to you free of charge. In return your copy of the Software will report attempted intrusion events (the Attack Data) to our central database anonymously. The Attack Data is anonymous and cannot be traced to you or your PC. We do not receive or record any personal data that can or will be used to identify you or your computer. We do not require or request your email address or any other personal details to identify you or your PC. The anonymity of the Attack Data has been audited. You can read the audit report in full at www.prevx.com. It explains the details of the Attack Data and the purpose to which it is put.

On receipt the Attack Data is aggregated into our central database and used to produce general statistics on attacks, threats, their propagation and overall measures of the level of internet abuse and crime. We do not use it for any other purpose other than analyzing and publishing overall threat activity on the internet, researching threats, compiling statistics and to further refine and improve the performance of the Software. Prevx compiles and supplies summary, near real time, threat statistics to commercial organizations from time to time in return for a subscription fee. If you do not wish to be part of a campaign to fight internet crime then simply uninstall the Prevx Home protection software.

Your Help

Prevx appreciates your help in contributing to the fight against Internet crime. This fight cannot be won without the help and collaboration of the end user community. Prevx believes this is essential if the Internet is to be saved from destruction by misuse and crime, your Attack Data will play a part in helping with the effort to combat this.

12. GOVERNING LAW AND GENERAL PROVISIONS

12.1 This Agreement constitutes the entire understanding between us in connection with the licensing of the Software and supersedes and extinguishes all prior agreements, negotiations and discussions in relation to it. You acknowledge that in entering into this Agreement you do not do so on the basis of, and you do not rely on any representation (unless made fraudulently) warranty or other provision not expressly contained in this Agreement.

12.2 If any of the provisions of this Agreement are invalid or become illegal or unenforceable then you and Prevx agree that to that extent the offending provisions shall be deemed omitted and shall not affect the enforceability of the remaining provisions hereof which shall remain in full force and effect.

12.3 This Agreement shall automatically terminate upon failure by you to comply with its terms. Upon such termination you agree to uninstall and destroy all copies of the Software.

12.4 This Agreement may only be modified in writing signed by an authorized officer of Prevx.

12.5 The rights of neither party shall be prejudiced or restricted by any indulgence or forbearance extended by such party or by any delay in exercising or failure to exercise any right and no waiver by either party of any breach shall operate as a waiver of any other or further breach.

12.6 Prevx may assign this Agreement or any part of it to any other person, firm or organization on written notice to you.

12.7 No rights are conferred on any third party by virtue of this Agreement and the Contracts (Rights of Third Parties) Act 1999 shall not apply.

12.8 If you are resident in any jurisdiction outside the United States of America, this Agreement will be governed by the laws of England and the parties hereby submit to the non-exclusive jurisdiction of the English courts. If you are resident in the United States of America, then this Agreement will be governed by the laws of the State of California without regard to its conflicts of laws provisions and the parties hereby submit to the exclusive jurisdiction of the State and Federal Courts of California.