RISING ANTIVIRUS 2008

 

 

 

 

 

User Manual

 

CONTENTS

1.

Key Features

5

2.

Rising Corporation

6

3.

End User License Agreement

7

4.

Tab [Home]

Ø       Information

Ø       Latest security services

Ø       Buttons

Ø       Scan

Ø       Scan Targets

Ø       Settings

10

11

11

12

12

13

13

5.

 Tab [Auto Protect]

16

6.

Tab [Active Defense]

17

7.

 Tab [Tools]

18

8.

Tab [Security Audit]

20

9.

Menus

Ø        Action Menu

Ø       View Menu

Ø       Settings Menu

Ø       Help Menu

 

21

23

24

25

26

10.

Virus Scanning

Ø  Virus scan from[home] tab

Ø  Shortcut Scan

29

29

30

11.

System Requirements and Language

32

12.

Install Rising Antivirus

33

13.

Add, Remove, Repair and Un-install Rising Antivirus 

35

14.

Starting Rising Antivirus

37

15.

Manual Scan

39

16.

Scheduled Scan

42

17.

Virus Types

43

18.

File Shredder

46


 

19.

Detailed Settings

Ø       Manual Scan Settings

Ø       Shortcut Scan Settings

Ø       Customized Tasks Settings

Ø       Embedded Scan Settings    

48

49

52

55

56

20.

Auto Protect

Ø       Auto Protect

Ø       File Monitor

Ø       Email Monitor

Ø       Script Blocking

61

62

64

65

66

21.

Auto Protect Settings

Ø       Auto Protect Settings

Ø       File Monitor Settings

Ø       Email Monitor Settings

Ø       Script Blocking Settings

67

68

70

74

78

22.

Active Defense

Ø       System Reinforcement

Ø       Application Access Control

Ø       Application Protection

Ø       Program Startup control

Ø       Malicious Behavior Detection

Ø       Hidden Process Detection

Ø       Self-Protection

80

82

82

82

82

82

83

85

23.

Active Defense Settings

Ø       System Reinforcement

Ø       Application Access Control

Ø       Application Protection

Ø       Program Startup control

Ø       Malicious Behavior Detection

Ø       Hidden Process Detection   

 

87

88

92

99

105

111

113


 

24.

Tools

Ø       Virus Quarantine

Ø       Other Embedded Scan

Ø       Latest Installer Creation Tool

Ø       Application Protection Wizard

116

117

118

120

121

25.

Other Settings

Ø       Enable Sound Alerts

Ø       Save Log For

Ø       Send Scan Result to Rising

Ø       Back up Virus Infected Files to Quarantine

Ø       Exclude these Directories

Ø       Display Recent Security News

Ø       Warning of Multiple extensions

Ø       Removable Disk Monitor

Ø       Show Pre- Login Status

124

124

124

124

124

124

125

125

125

125

26.

Security Audit

126

27.

Update

Ø       Scheduled Smart Update

Ø       Update

Ø       Connection Settings

Ø       User ID Settings

 

130

131

132

133

135

28.

Contact

 

RISING ANTIVIRUS 2008

 

Key Features:

 

Certified by German TUEV & Checkmark.com

 

High Speed 8th Generation Antivirus Scan Engine

After each virus scan, Rising Antivirus “remembers“ clean files on an internal whitelist. This memory function has strong built-in safety features. The key characteristics of previously scanned clean files are constantly monitored. As soon as these characteristics change, files are again submitted to a full scan. With every update of virus definitions all of the files on the Smart Speedup Whitelist are also scanned for viruses.

 

Smart Virtual Machine with Behaviour&Packing Pattern Recognition

Rising Antivirus 2008 comes with an integrated smart virtual machine, which is used for virus scanning and malware recognition. Rising's proprietary smart virtual machine technology provides the additional safety of a virtual machine without slowing down your system:

 

A potentially malicious file is “test-driven“ in Rising's virtual machine. The unique characteristics of a particular file determine in which way and how long it is being tested. More and more viruses are protected by multiple packing with common or proprietary compression methods.  The testing  of files protected in this way can put a severe strain on any conventional virtual machine, leaving no computing power for you to continue surfing the Internet or enjoying your online game. Rising's Behaviour & Packing Pattern Recognition allows to test such potential malware thoroughly without influencing the performance of your PC.

 

Startup Scan Provides Additional Security Before Windows Login

Protect your personal computer before the Windows login. Rising Antivirus can conduct a full virus scan before the startup of your operational system is completed and provide an additional  layer of protection against certain malware which is hard to eradicate from within Windows.

 

Proactive Defense against Unknown Malware

Risings’ proactive defense  technology protects your personal computer before new virus definitions are available.

 

Small Ressource Consumption

 

Automatic Real-Time Protection

 

Integrated Multiple AutoProtection Features

 

 

Rising – Lion-Strong Security

 

Beijing Rising International Software Co., Ltd. was established in April 1998 and is therefore one of the earliest enterprises engaged in computer virus research in China. Rising is dedicated to developing computer antivirus, network security products and intrusion detection systems. Risings’ intellectual property is recognized and protected by various national and international patents.

Since 2006, Rising Antivirus has been tested by West Coast Labs of the UK and is constantly awarded certifications based on the effectiveness of its products. Rising Corporation maintains China's largest antivirus research and customer service team. This gives the company a leading-edge in technical research allowing it to provide complete antivirus and security solutions for its loyal users. Rising is participating in national and international information security research projects.

Please read on to find out more about the protection you will be enjoying from now on with us. Thank you for choosing Rising Antivirus!

 

 

End User License Agreement

This End User License Agreement (hereinafter referred to as “Agreement”) is a legally binding agreement between you (either a natural person, a legal entity or an organization) and Beijing Rising Technology Corporation Limited (hereinafter referred to as “Rising”), the proprietary right owner of Rising software, including but not limited to Rising Antivirus Software and Rising Personal Firewall, hereinafter referred to as “Software” or “Software Product”. You must read this Agreement before using the Software. Any software, electronic file, etc. related to this Agreement and used by you shall be subject to the terms and conditions of this Agreement. Meanwhile, the Agreement applies to all subsequent releases and updates of this Software. Your installation, copy, download, access or use in any other way of this Software means that you agree to be bound by the terms and conditions of this Agreement. This Agreement is as effective as any written agreement signed by you and entered into through negotiations. If you do not agree, please do not use this.

1. Definitions


1.1 “Software” or “Software Product” refers to:


(1) All contents accompanied by a disk, CD or other medium with this Agreement, including but not limited to the computer information or software owned by Rising or a third party.

(2) Related printed materials, product packages and electronic files, as well as


(3) Updates, modified versions, altered or added contents of this Software and any related tools (if any) released and licensed by Rising to you.


1.2 “Use” means access, installation, copy or functional use in any other way of the Software based on related documents.

1.3 “Purpose” means the limit and scope for you to use this Software. Your purpose to use this Software shall be determined by the Rising Software you have purchased. For example, Rising Personal Firewall can only be used for personal purpose and you shall not use this product for non-personal or commercial purpose unless written authorization from Rising has been obtained.


2. Intellectual Property Rights


This Software and any copy reproduced by you under the authorization from Rising are Rising products. The intellectual property rights are owned by Rising. The structure, organization and codes are all valuable commercial secrets and confidential information belonging to Rising. This Software is protected by Copyright Law of the People’s Republic of China, related international treaties and applicable laws of the countries where the Software is used. This Software must not be copied beyond the scope of this Agreement, otherwise an infringement to Rising’s intellectual property rights will be constituted.

You also shall not reverse engineer, decompile, disassemble the Software, or try in any way to access its source codes, except when you are explicitly and legally permitted by Rising to do so.

All information about the Software provided by Rising, and obtained by you, can only be used for the purposes licensed by this Agreement. This Software shall not be disclosed to any third party or used to fabricate any software with similar style. This Software shall not be used for any other commercial purpose without Rising’s authorization.

The use of trademark(s) including the logo(s) owned by their owners shall be in compliance with the Trademark Law of the People’s Republic of China. The registered trademarks or trademarks owned by Rising include, but are not limited to “Rising”, “Rising Software”, ”Rising” in Chinese characters, ”Rising Antivirus Software” in Chinese characters, ”Rising Antivirus” in Chinese characters and Rising Personal Firewall in Chinese characters.

Your use of this Software under the authorization of this Agreement does not imply that Rising transfers its intellectual property right to you.

 

 

3. License

This Software Product is protected by Copyright Law of the People’s Republic of China and international copyright treaties, as well as other Chinese laws and international treaties. Rising grants you a non-exclusive license to use the Software based on this Agreement as long as you follow the terms and conditions of the Agreement.


3.1 Authorized Range of Usage

For each copy of Rising’s Software Product, Rising authorizes you to use it on one PC only. Under the following conditions, however, you can use it in a multi-user environment or on a networked system:

(a) Rising has explicitly authorized you to use it in a multi-user environment or on a networked system; or

(b) You have already purchased a software license for each node or terminal you are using.

3.2 Duplication, Distribution and Spread

You shall use and duplicate the Software according to this Agreement. You must make sure that each copy you have duplicated, distributed and spread under the authorization from Rising is integral and veritable, including all information about software, electronic file, copyright and trademarks relative to this Software as well as the Agreement.

You can duplicate one copy of the Software for the purpose of backup or archive management. However, you shall not install and use it on any other PC. You shall not transfer this copy to any other person unless you are explicitly authorized by Rising.

3.3 Transfer

All or part of the Software must not be rented, leased, re-licensed or duplicated to other PC users unless an explicit authorization is obtained. However, you can transfer your right to use this Software to others under the following conditions:


(a) You simultaneously transfer the Agreement, the Software, and all other software and hardware bundled to this product altogether to others (including all copies, updates and previous versions);

(b) You no longer keep any copy, including any backup and update saved on your PCs; and

(c)The receiver accepts the terms and conditions of this Agreement, and any other terms and conditions you have accepted when you legally purchased the Software.

4. Warranty

4.1 Rising grants the warranty to entities/persons that have purchased the Software and are willing to follow the terms and conditions of this Agreement. Within thirty days since the purchase of this Software, Rising will replace the software if the Software malfunctions due to error(s) of the storage medium of the Software, and after the error is examined and verified by Rising. Errors caused by misuse, man-made damage, unauthorized use, accident and the loss of the storage medium are not covered by the warranty. To request a replacement based on above reason(s), you must return the Software and proof of purchase (voucher/invoice) to the location of purchase within the time period stated above.

4.2 Rising guarantees that the Software meets the performance requirements described in its instructions.

4.3 Rising makes no warranty on the merchantability and fitness of the Software for some special use in business purpose.

4.4 Rising does not guarantee that the Software is error-free or can function uninterruptedly. Rising makes no warranty that the Software can be effective on any PCs under any conditions.

4.5 You shall know and understand that due to the particularity of antivirus software, this Software may not be effective against every existing or future virus. You agree that Rising is not liable for any loss caused by the use of or failure to use this Software, including but not limited to operating profit/loss, service interruption, loss of business information, document and data, or for other financial losses, even if Rising is notified of the possibility of such losses, unless these losses are caused due to Rising’s deliberation or fraud.


5. License Termination

If you fail to follow any term and condition of the Agreement, Rising has the right to terminate at any time the license granted to you. After the termination, you shall immediately destroy the original and any copies of the Software, or return them to Rising.

This Agreement is governed by the laws of the People’s Republic of China. If there is any dispute on the Software with Rising, a lawsuit can be brought against Rising at the People’s Court of the City of Beijing/Haidian District.

For any question on this Agreement, or any information about Rising, please contact Rising at the following address:

Address: Room 1305, 13th Floor, Zhongke Building, No.22, Zhongguancun Street, Beijing, China


ZIP: 100080


Website: www.rising.com.cn

Tel: +86-10-82616666 (Hotline)

 

 

u      Tab [Home]

 

On the Home page of the Software, four pieces of information are displayed.

 

u      Information

Version: The current version number of the software release.

Last online update: The date and time the last online update.

Virus definitions issued: the latest virus definitions download date and time.

Last complete scan: The date and time of the last virus scan of the system.

 

Appearing at the bottom of the page are four shortcut icons:

 

u      Buttons

Audit: This function is linked to a page that provides a security assessment of the current system configuration.

Scan: Initiates a scan based on the current settings.

Update: Initiates a manual update. All updates including software and virus definition files are downloaded when and if they become available.

Service: Provide the user with an online communications platform with Rising Antivirus experts. (Chinese language only)

 

 

u      Scan

 

Provides the user with an interface page where they can set all of the defaults used in defining the current and customized scans for viruses on the system.

On the left side of the screen is a box entitled Targets. Within that box, there are two tabs: Select Targets and Shortcuts.

u      Main Page

Targets

Select Targets

Under the 'Select Targets' tab, the user has the option of selecting: devices, directories and files; system memory; the boot record; and email boxes. To do this, the user puts a checkmark into the box beside the device or file level needed. The higher in the hierarchy the checkmark is set means that all the sub parts below it are also checked.

Shortcuts

Under the 'Shortcuts' tab, it becomes possible for the user to add, modify and delete custom scans. The user is also given the ability to select a customized security level, icon and to place a shortcut onto the user desktop.

Settings

On the Right of the screen, there is a box entitled 'Settings'.

The Settings box Contains four settings and information fields: Type of scan, default virus action dropdown list, quarantine space settings and the scan completion action drop down box.

The 'Type of scan:' indicates the type of the last or currently executing scan.

The default virus action dropdown box allows the user to select the default action taken when a virus is found. These actions include: 'Ask me what to do', 'Clean virus', 'Delete the infected file' or 'Ignore'.

'Ask me what to do' will result in the Rising program notifying the user that a virus or malware has been found and then prompt them for a course of action.

'Clean virus' will attempt to automatically remove the virus from the infected file or area.

'Delete the infected file' will result in the automatic deletion of the file from the system.

'Ignore' will record the presence of the virus on the scan results screen and/or log but will take no action against the virus.

When a virus is encountered, the normal action is to first quarantine the object so that no damage can occur. The Quarantine Settings button allows the user to define the quarantine environment and to monitor the space usage of the area.

The 'When scan is completed' dropdown box is used to define what action should be taken by the program upon the completion of a scan. These options are: 'Return to Rising Antivirus', 'Exit Rising Antivirus', 'Restart the Computer' or 'Shut Down the Computer'.

The 'Return to Rising Antivirus' causes the user to be returned to the Rising Antivirus program regardless of what program they are currently using.

The 'Exit Rising Antivirus' selection causes the Rising Antivirus Program to self-terminate upon completion of its tasks.

The 'Restart the Computer' option will cause the computer to first do a controlled shut-down and then to go through the re-boot process.

The 'Shut Down the Computer' selection causes the computer to do a controlled shutdown and turn off completely.

Buttons

Under the Settings box, there are three Icons entitled: 'Start', 'Stop' and 'Setup'.

Start initiates the currently configured scan.

Stop halts any scan currently executing.

Setup causes the 'Detailed Setting Page' to be displayed so that the user can further refine the procedures of the scan and the actions taken when a virus or malware is encountered.

During scan execution (The Start button was pressed) the Start button changes to 'Pause' which allows the user to suspend the execution of the scan without terminating it. When paused, the button again changes to 'Continue' to allow the user to resume the scan process.

Information

At the bottom of the screen, there is a box entitled 'Information'. This box contains three pieces of information about the currently executing scan or the last executed scan. These pieces of information are: Files scanned, Viruses detected and Progress.

'Files scanned' indicates the number of files scanned in real-time.

'Viruses detected' indicates the number of viruses encountered in real time during the currently executing scan.

'Progress' indicates how far the scan has progressed as a percentage of the total scan.

Beside the progress indicator, a spinning icon will appear to indicate that there is a scan in progress.

The final item in the 'Information' box is a link to 'More Information'. This page gives a highly detailed account of the currently running scan.

 

More Information Page

The More Information Page contains two boxes. The first box is the 'Scan Summary' and the second, 'Results'.

 

Scan Summary

'Scan Summary' is the summary of the number of 'Objects' to be scanned from the first page (Devices/Files/Memory) and the 'Scan Level' which will be Low, Medium or High.

There is also a link back to the previous page.

Results

In the 'Results Box', there are six items of information:

Scanning: this indicates the current or last object being scanned by the scan engine.

Scan Info: is the itemized progress of the scan so far. It states 'Files scanned:' as an integer, 'Viruses found:' as an integer and the time elapsed since the start of the scan in hours, minutes and seconds.

Progress Bar

A progress bar is also located in the center of the screen to indicate the scan progress visually. (When the bar fills the box from right to left progress is 100%)

Results Table

At the bottom of this box is another text box which displays the information about any viruses that have been found during the current execution of the program.

This Information will include:

·         The 'Filename' of the infected file on the system.

·         The 'Pathname' which is the location of the file within the directory structure.

·         The 'Virus Name' which is the technical name of the virus so that the user can identify the virus during support calls, if needed.

·         The 'Result' indicates the results of performing the default action defined in the scan.

Two additional buttons are located in the top right hand of this box: Pause and Stop. These perform the same actions as defined on the first scan page.

 

Auto-Protect

 

This page contains an Icon box on the left hand side which includes the icons for Auto-Protect, File Monitor, Email Monitor and Script Blocking.

 

Active Defense

 

Rising Antivirus' Active Defense Technology provides real-time system monitoring for malicious programs that try to gain access to enter the computer.

 

 

Tools

 This window includes a default tools package shipped with Rising Antivirus as follow:

Each of the tools is displayed on a table containing the Name of the tool, version number and size. It also supplies the ability to run the tool and to review the help file for detailed instructions on how to use each tool.

By clicking on the '+' sign to the left of each tool, a brief description is given of the function of each tool.

Click Run to start the corresponding tools from the table.

 

Security Audit

 

The Security Check provides a utility that scans the computer's current security setting and provides and evaluation of the strength of the security based on predefined criteria.

Immediately upon entry to the screen, a security scan takes place as indicated by the spinning icon in the centre of the upper box. When the icon stops spinning, the evaluation has taken place and the current security level Icon is displayed at the center: Low, Medium or High.

At the bottom of the page are a group of links to various parts of the Rising Antivirus system where security levels can be changed that will affect the security level however these links have nothing to do with the results of the current scan.

In the event that the security levels seem lower than the user would like, the user can click on the 'Detailed Report' link that will change the lower box to display the security settings in general terms.

A table will then be displayed that includes: Check Items, Status Information and Condition.

Check Items: names the security area that was evaluated.

Status Information: states the current condition of the named security area.

Condition: flag areas where actions should be taken by placing 'Needs Attention' into the right hand column of the table.

WARNING: Because the user is allowed to select the security level of various areas as Low, Medium and High, an indication that something is 'Completely Enabled' and that the Condition is 'Satisfactory' does not mean that security has been set to the highest levels for that area. It merely means that the security level that has been set by the user has been met. These areas will only be flagged as 'partial' and 'needs attention' if a function has been set to 'disabled'.

Double clicking on an item in the security table itself will result in either the user being taken to a page that will give a report on the item or will automatically begin the action to rectify the problem.

For example: If the Virus definitions are out of date, double clicking that item in the table will immediately start the process to download the latest virus definition files from the Rising Web Server. If there are problems with windows settings however, the user is presented with a detailed report of what the problems are and, where an auto-repair can be affected, the user may instruct the program to repair these options. If the area needs the intervention of the user, only detailed information is presented with instructions on how to repair the problem.

 

Menus

 

The menu bar that appears at the top of all page in Rising Antivirus include:

Actions Menu

View Menu

Settings Menu

Help Menu

 

 

 

Actions Menu

 

Actions menu includes: Scan, Stop, Log History and Exit.

Scan: Initiates a Scan of the system based upon the current settings on the scan page.

Stop: Halts any execution of virus scanning currently in progress.

Log History: brings up the page 'Rising Antivirus Log'.

Exit: selecting this option stops the GUI interface but it does not shut down the resident antivirus programs currently executing in the background. To bring up this page again, the user only has to double-click the rising umbrella in the System Tray at the bottom right on the task bar. (Default Location).

 

View Menu

 

The user can switch among six tabs including Home, Scan, Auto-Protect, Active Defense, Tools and Security Audit.

 

 

 

Settings Menu

 

The Settings menu provides links to set up the various features of Rising Antivirus. These links include:

Help Menu

From this menu, the user is able to access four types of information: Help Files, Rising Website, Rising Bulleting Board and About Rising.

Help Files

'Help Files' is the content of this file.

Rising Website

Rising Website is a direct link to the Rising Website on the internet.

Rising Bulletin Board

Rising Bulletin Board is the Rising Forum where users can go to voice concerns, share their experiences, help each other and become a member of a rapidly expanding network of international users.

About Rising Antivirus

This selection will display the information about the current installed product including the Product ID number.

Buttons

 Appearing at the bottom of the page are four shortcut icons:

Buttons

Icon

Description

This function is linked to a page that provides a security assessment of the current system configuration.

Initiates a scan based on the current settings.

 

Initiates a manual update. All updates including software and virus definition files are downloaded when and if they become available.

 

Link to Rising’s Online Support Center

 

 

 

 

 

 

Virus Scanning from the Home Tab

Immediately after Rising Antivirus is installed it is not only possible but advisable to do a complete scan of the system using the default settings.

Starting this scan is as simple as three clicks

1. Launch Rising Antivirus by either selecting it from the Start>All Programs>Rising Antivirus>Rising Antivirus, Selecting it from the desktop or double clicking the Rising umbrella in the system tray.

2. Click the 'Scan' icon at the bottom of the Home Tab.

3. THAT'S IT!!!

Your scan is now running as indicated by the screen changing to the scan page. The scan is running when you see a cycling icon at the bottom of the page on the status area.

When the scan is complete, the cycling icon disappears and the Progress field will indicate 100%.

Should you feel the need to suspend the scan for a moment, you may press the 'Pause' button on this page. You can simply restart by pressing the 'Continue' button.

Should you wish to cancel the scan completely, press the 'Stop' icon.

It's that simple.

The targets to be scanned are displayed under Scan Object. Local hard disks, memory, boot records and mailbox are selected by default. You can change these according to your needs.

When a virus is detected, the file name, path, virus name and action are shown in the Virus List under More information.

Depending upon the nature of any virus found, most should be cleaned without the need for any user intervention.

Shortcut Scan

There are two ways of initiating a 'Shortcut Scan' of any file or program in the system directories: 'Right Click Menu Selection' and 'Drag and Drop'.

Right Click Menu Selection: Simply right click on a file in the directory and point your Mouse at Scan with Rising Antivirus.

Drag and Drop: Drag the target onto the Rising Antivirus icon on your desktop or drag the target into the Rising Antivirus main window.

You can customize the 'Shortcut Scan' by selecting Settings > Detailed Settings > Shortcut Scan. The default settings are the same as for the standard comprehensive scan.

Installing, Repairing and Uninstalling Rising Antivirus

 

System Requirements and Languages

Install Rising Antivirus

Installing, Repairing and Uninstalling Rising Antivirus

 

 

System Requirements and Languages

 

Software

Windows Operating System: Windows 98/Me or Windows NT4.0/2000/XP/2003

Hardware

Non-Vista Standard

  1. CPU: Pentium 500 MHz or higher
  2. RAM: 64 MB or above, up to 4GB
  3. Display: Standard VGA, 24-bit true color
  4. Other: CD-ROM drive, mouse

Vista Standard

Note: This software doesn't guarantee the full support of future hardware and software.

Languages

Rising Antivirus is available in Simplified Chinese, Traditional Chinese, English and Japanese are available (as shown). The English version can be applied in Windows of any language.

Install Rising Antivirus

 

1. Prior to the installation, close all applications and empty the system tray of all non-essential items.

2. CD installation: Insert the Rising Antivirus CD into the CD-ROM drive and select Install Rising Antivirus in the automatic pop-up window. If the opening screen does not appear, double-click Autorun.exe in the root directory of the CD. Select "Install Rising Antivirus".

3. Four languages, i.e. Simplified Chinese, Traditional Chinese, English and Japanese are available (as shown). Click OK to install.

4. If the user has installed other security software and encounters any problem during the Rising Antivirus installation, the Rising Antivirus will pause and suggest the user uninstalls the other security software so that conflicts will not arise in the future. The user can continue with forced installation of Rising Antivirus. Click Next to continue.

5. Click "Next" to continue.

6. The user is encouraged to read the "End User License Agreement" and to select either "I Agree" to signify acceptance of the conditions within the agreement or to select "I Disagree" to reject the conditions. When the user clicks "Next" to continue, if the user has agreed to the "End User License Agreement" the installation will continue. If not, the installation will immediately halt.

7. Enter the Product Key and 12-digit User ID (these can be found on the User Identification Card or inside the Manual supplied in the plastic packaging.) and click "Next" to continue. If the user inputs the wrong ID, the Product Key will be cleared in the input box. The user will have to make another attempt to enter the information correctly. The next step will only start when the user inputs the correct ID.

8. At this point, the user has three options for installation:

Click Next to resume installation or click "Finish" to install all components in the default mode.

9. Choose Destination, select the destination folder or accept the default and click "Next" to continue.

10. Select Program Folder, input the software name or accept the default and click "Next" to continue.

11. In Installation Information, this will confirm the installation path and component list. At the bottom, the user can select Scan memory for viruses before installation to ensure a virus-free environment for installation. Confirm the information and click "Next" to continue.

12. If the user selects Scan memory for viruses before installation in the previous step, then a memory scan will be performed. This process may take 3-5 minutes. Any viruses discovered during this process will be cleaned. The user may elect to "Skip" to abort the scan and continue the installation. (Unadvisable)

13. After installation is complete, please reboot your computer.

14.The user is prompted to Run Settings Wizard, Run Rising Antivirus Main Application, Run Rising Auto-Protect or Run Registration Wizard. Click "Finish" to complete the installation.

 

Add, Remove, Repair and Uninstall Rising Antivirus

 

Users can manage Rising Antivirus according to their needs by adding or removing components, or reinstalling components to repair the system. The user can also uninstall Rising Antivirus when not needed. In the Windows Start menu, select Programs > Rising Antivirus > Add or Remove Components. The Rising Software Maintenance window will appear.

Add or Remove Features

Add or Remove Features: Select this to add or remove Rising Antivirus components based upon the user's need for more flexible and effective use of resources

 

Repair/Reinstall

Repair/Reinstall: Select this to reinstall Rising Antivirus by checking the integrity of installed Rising Antivirus and repairing the problems for more stability.

Uninstall

Uninstall: Select this to uninstall and delete all Rising Antivirus files from your computer.

 

 

Scan

 

Starting Rising Antivirus

Manual Scan

Scheduled Scan

Virus Types

File Shredder

 

 

Starting Rising Antivirus

 

1. After installation, the Rising Antivirus program can be executed from the final installation window by selecting "Run Rising Antivirus Main Applications". It will automatically run upon completion.

2. Normally, Rising Antivirus Main Applications are started by any of the following methods:

 

Double-click the Rising Antivirus icon on the desktop;

 

Double-click the Umbrella icon in the system tray.

 

Single click the Rising Antivirus icon in the Quick Launch bar.

 

Left click the icon of Rising Antivirus Software and select "Open Rising Antivirus

 

In the Windows Start menu, select Programs > Rising Antivirus > Rising Antivirus.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Manual Scan

 

Steps

The scan is running when you see a cycling icon at the bottom of the page on the status area.

When the scan is complete, the cycling icon disappears and the Progress field will indicate 100%.

Should you feel the need to suspend the scan for a moment, you may press the 'Pause' button on this page. You can simply restart by pressing the 'Continue' button.

Should you wish to cancel the scan completely, press the 'Stop' icon.

To get more information on the scan, it is possible to go to the "More Information Page".

The More Information Page contains two boxes. The first box is the 'Scan Summary' and the second, 'Results'.

'Scan Summary' is the summary of the number of 'Objects' to be scanned from the first page (Devices/Files/Memory) and the 'Scan Level' which will be Low, Medium or High.

There is also a link back to the previous page.

 

In the 'Results Box', there are six items of information:

Scanning: this indicates the current or last object being scanned by the scan engine.

Scan Info: is the itemized progress of the scan so far. It states 'Files scanned:' as an integer, 'Viruses found:' as an integer and the time elapsed since the start of the scan in hours, minutes and seconds.

A progress bar is also located in the center of the screen to indicate the scan progress visually. (When the bar fills the box from right to left progress is 100%)

At the bottom of this box is another text box which displays the information about any viruses that have been found during the current execution of the program.

This Information will include:

The 'Filename' of the infected file on the system.

The 'Pathname' which is the location of the file within the directory structure.

The 'Virus Name' which is the technical name of the virus so that the user can identify the virus during support calls, if needed.

The 'Result' indicates the results of performing the default action defined in the scan.

Two additional buttons are located in the top right hand of this box: Pause and Stop. These perform the same actions as defined on the first scan page.

An icon will be displayed before each file name to indicate the virus type. Refer to Virus Type for details. Click Back to previous to return to the previous page. The user can also right click the infected file to take further actions.

All scan results are saved in the log. You can view previous scan results in View Log.

Repeat Steps 2 through 4 to scan other files or disks.  (Note: Please refer to Manual Scan Settings

 

Scheduled Scan

 

Scheduled Scan automatically runs a virus scan following the schedule set by the user. This protects the computer from virus infections even when the user is not present.

Steps:

In the main window, select Settings > Detailed Settings > Customized Tasks.

To configure Scheduled Scan:

Note: when the user does not change certain settings on the tabs, the program executes with the default settings.

The user can perform automatic virus scan during lunch time for example. In the Rising Antivirus main window, select Settings > Detailed Settings > Customized Tasks > Scheduled Scan, set Frequency as Daily and Time as 12:00, then click OK to save. Then at 12:00 every day, Rising Antivirus will perform automatic virus scan. For added efficiency, the user may also choose to enable Screen Saver Scan, which scans for viruses while the screen saver is running.

Virus Types

Rising Antivirus has different icons for specific virus types to make it easier for the user to identify them. The corresponding virus type of each icon is as follows:


 

 


Unknown Virus

 


Boot Sector Virus

 


Unknown Macro Virus

 


com Dos Virus

 


LE Virus (Windows)

 


Unknown Script Virus

 


exe DOS Virus

 


Common Virus

 


Unknown Email Virus

 


PE Virus (Windows)

 


elf File Virus (Unix)

 


Unknown Windows-Virus

 


NE Virus (Windows)

 


Email Virus

 


Unknown DOS Virus

 


Memory Virus

 

 


Floppy Boot Sector   Virus

 

 


Unknown Boot Sector Virus

 


 

 


MacroVirus


HDD Main Boot  Sector Virus

 

 


Script Virus

 


HDD Boot  Sector Virus

 

 


 

 

 

 

 

Rising File Shredder

 

File Shredder is a secure file deletion system that substitutes 0s and 1s for the file information on disk.

Normal file deletion simply removes the file name from the Directory files but leaves the file contents on disk for later recovery via the Waste Basket.

This information can be easily found by an advanced user and the contents can be stolen.

To ensure the files are removed in their entirety, file shredder is used to overwrite the contents.

Damaged areas of the disk are also flagged by Checkdisk as used by files. In certain cases shredding these files may restore the space as usable again provided it is not a hardware fault.

Right click the file or folder to be shredded, select Rising File Shredder. The Rising File Shredder GUI will appear showing the file or folder selected by the user to be shredded. The user may then add other files for shredding into the list. The user may also select files to be removed from the list. Click "Remove all" to clear the entire list of files to be shredded. Click Start to shred all files in the list.

Note: File shred will render the files unreadable and they can not be recovered at a later time by any utility. Pleas be sure that the file will not be needed later before using this utility.

 

Detailed Settings

 

Manual Scan Settings

Shortcut Scan Settings

Customized Tasks Settings

Embedded Scan Settings

 

Manual Scan Settings

 

Manual Scan provides the user with Manual Scan Settings to set the default actions to be taken in the eventuality of a virus being discovered and file types to scan according to user's need. It is also possible for the user to use the slide bar to adjust scan level in more general terms.

In Custom Level, an experienced user can tailor the security level to his needs. Click Default level to restore the original Rising settings. Click Apply to save all settings and then the virus scan will be based on the selected level.

Action Tab

There are several conditions that have been identified that require specific actions to be taken when dealing with a virus:

The options below indicate what each of the Action settings mean:

'Ask me what to do' will result in the Rising program notifying the user that a virus or malware has been found and then prompt them for a course of action.

'Clean virus' will attempt to automatically remove the virus from the infected file or area.

'Delete the infected file' will result in the automatic deletion of the file from the system.

'Ignore' will record the presence of the virus on the scan results screen and/or log but will take no action against the virus.

When a virus is encountered, the normal action is to first quarantine the object so that no damage can occur. The Quarantine Settings button allows the user to define the quarantine environment and to monitor the space usage of the area.

The 'When scan is completed' pull down menu is used to define what action should be taken by the program upon the completion of a scan. These options are: 'Return to Rising Antivirus', 'Exit Rising Antivirus', 'Restart the Computer' or 'Shut Down the Computer'.

At the bottom of the Action Tab is the check box "Hide scan result". When this check box is set, no scan result will be shown by the Rising Antivirus scan.

 

 

 

Types of files to scan Tab

The user is able to set the specific files to scan with three selections:

 

 

Shortcut Scan Settings

 

There are two ways of initiating a 'Shortcut Scan' of any file or program in the system directories: 'Right Click Menu Selection' and 'Drag and Drop'.

Right Click Menu Selection: Simply right click on a file in the directory and point your Mouse at Scan with Rising Antivirus.

Drag and Drop: Drag the target onto the Rising Antivirus icon on your desktop or drag the target into the Rising Antivirus main window.

You can customize the 'Shortcut Scan' by selecting Settings > Detailed Settings > Shortcut Scan. The default settings are the same as for the standard comprehensive scan.

The use will see Shortcut Scan page and scan result. It is also possible for the user to use the slide bar to adjust scan level in more general terms.

In Custom Level, an experienced user can tailor the security level to his needs. Click Default level to restore the original Rising settings. Click Apply to save all settings and then the virus scan will be based on the selected level.

Action Tab

There are several conditions that have been identified that require specific actions to be taken when dealing with a virus:

The options below indicate what each of the Action settings mean:

'Ask me what to do' will result in the Rising program notifying the user that a virus or malware has been found and then prompt them for a course of action.

'Clean virus' will attempt to automatically remove the virus from the infected file or area.

'Delete the infected file' will result in the automatic deletion of the file from the system.

'Ignore' will record the presence of the virus on the scan results screen and/or log but will take no action against the virus.

When a virus is encountered, the normal action is to first quarantine the object so that no damage can occur. The Quarantine Settings button allows the user to define the quarantine environment and to monitor the space usage of the area.

The 'When scan is completed' pull down menu is used to define what action should be taken by the program upon the completion of a scan. These options are: 'Return to Rising Antivirus', 'Exit Rising Antivirus', 'Restart the Computer' or 'Shut Down the Computer'.

At the bottom of the Action Tab is the check box “Hide scan result”. When this check box is set, no scan result will be shown by the Rising Antivirus scan.

Types of files to scan Tab

The user is able to set the specific files to scan with three selections:

 

Customized Tasks Settings

 

Scheduled Scan

Scheduled Scan allows the user to choose when and how often to automatically scan for viruses. This is useful for ensuring your computer's security especially when the user is not present.

Screen Saver Scan

Screen Saver Scan scans for viruses in the background while the screen saver is running. This allows you to utilize your computer's idle time.

Startup Scan

Enabling Startup Scan causes the Rising Antivirus Software to be loaded first. This means it is present to scan all disks, boot tracks, the Windows system directory, all services and drives prior to Windows launch. This occurs as soon as the computer is turned on. Because it is the first thing loaded it is very effective at cleaning rootkits, malicious programs and malware that have self-protection after the system has fully loaded. Press any key to start and press ESC key to exit.

Note: Startup Scan is only available above Windows 2000.

 

Embedded Scan

 

Embedded Scan for Lotus Notes

If Lotus Notes is installed on your computer, you can use Rising Antivirus to monitor Lotus Notes for viruses.

Enable/Disable Embedded Scan for Lotus Notes

Enable Lotus Notes scan: In the main window, select Settings > Detailed Settings > Embedded Scan and check Enable Embedded Scan for Lotus Notes to enable or remove check to disable.

Once checked and saved by clicking OK, this feature will be enabled whenever Lotus Notes starts up and will scan email attachments in Lotus Notes for viruses.

 

 

 

 

 

 

 

 

Embedded Scan settings for Lotus Notes

In Lotus Notes settings, the user can choose high, medium or low level, or customize the level. The user can also set different Actions, Types of files to scan and Scan Mode.  In scan mode select "Outgoing email scan" and "Incoming email scan" to automatically scan for viruses when sending or receiving emails in Lotus Notes. In "Types of files to scan", you can specify the types of files in the attachment to scan. It is recommended that you select "All files" to minimize the possibility of virus infection.

Prompts and alerts

When a virus is detected, a message will appear displaying the virus name, email subject, attachment name and action. Choose how to deal with this virus by selecting "Clean the virus", "Delete the attachment" or "Ignore this time".

 

Embedded Scan for Microsoft Office/IE

When you open an Office document or use Internet Explorer (IE) to browse the web, Embedded Scan can automatically protect your system.

Note that this feature only works with Office 2000 (or above) and IE 5 (or above).

 

Enable/Disable Embedded Scan for Office/IE

Method to enable/disable Embedded Scan for Office/IE: In the main window, select Settings > Detailed Settings > Embedded Scan and check Enable Embedded Scan for Office/IE to enable, or uncheck to disable.

This function is enabled by default.

Embedded Scan Settings for Microsoft Office/IE

In Office/IE, the user can choose high, medium or low level security, or customize the level. The user can also set different Actions, or Types of files to scan. In Embedded Scan for Office/IE, the user can choose whether to "Prompt me when a virus is detected". Choose how to deal with detected viruses by selecting "Clean the virus", "Delete" or "Ignore".

Prompts and alerts

If any viruses are found in the Office document, a message will appear. You can choose to "Clean the virus", "Delete infected file" or "Ignore". If virus cleaning fails, the program will ask you what action to take.

Note: This feature only works with Office 2000 (or above) and IE 5 (or above).

 Embedded Scan for Microsoft Outlook

If Outlook is installed on your computer, you can use Rising Antivirus to monitor Lotus Notes for viruses.

Enable/Disable Embedded Scan for Microsoft Outlook

Enable Outlook scan: In the main window, select Settings > Detailed Settings > Embedded Scan and check Enable Embedded Scan for Outlook to enable or remove check to disable.

In Outlook, the user can choose high, medium or low level security, or customize the level. The user can also set different Actions, or Types of files to scan. In Embedded Scan for Outlook, the user can choose whether to "Prompt me when a virus is detected". Choose how to deal with detected viruses by selecting "Clean the virus", "Delete" or "Ignore".

Prompts and alerts

When a virus is detected, a message will appear displaying the virus name, email subject, attachment name and action. Choose how to deal with this virus by selecting "Clean the virus", "Delete the attachment" or "Ignore this time".

 

Auto-Protect

 

Auto-protect

File Monitor

Email Monitor

Script Blocking

 

 

Auto-Protect

 This page contains an Icon box on the left hand side which includes the icons for Auto-Protect, File Monitor, Email Monitor and Script Blocking.

Auto Protect Icon

When the Auto protect icon is selected, the box on the right displays as ‘Settings’ and allows the user to toggle parts of the Auto-Protect feature on and off. These parts include: File Monitor, Email Monitor and Script blocking. The user can click Enable or Disable buttons to turn them off and on.

 

Rising File Monitor

 

Rising File Monitor is used to monitor all operations in the file system and to scan and clean viruses during file access.

 

Rising Email Monitor

 

Rising Email Monitor is used to scan incoming (POP3) and outgoing (SMTP) email for viruses.

 

Rising Script Blocking

 

Rising Script Blocking is used to monitor script executions within the browser and block web viruses and malicious web scripts.


 

 

Auto-Protect Settings

 

Auto-Protect Settings

File Monitor Settings

Email Monitor Settings

Script Blocking Settings

 

Auto-Protect Settings

The left side of the page is devoted to a quick navigation box of all the areas covered in 'Auto Protection'.

A user can quickly move back and forth between each of the advanced settings for Computer Protection, File Monitor, Email Monitor and Script Blocking.

On the right is a box which changes to reflect the selection in the left hand side navigation box.

 

Security Level Bar

When File monitor is selected, the box on the right changes to 'File monitor Scan Level Settings'

At the top of this box is a slider bar that allows the user to set their security to three predefined levels of protection: Low, Medium (the default) and High.

If the Slider bar is missing and the word 'Custom' appears instead, the user has previously entered this area and altered the security levels for individual file types by pressing the 'Custom' button.

There is also a button entitled, 'Whitelist'.

A Whitelist is a listing of preapproved files that are allowed that are exceptions to the blocking settings or scan settings.

Whitelist Page

When the button is pressed, the user may enter a file name or directory directly or browse for a file on the system to add to the Whitelist.

Alternately, the user can Import and Export Whitelists. This would allow a user to share Whitelists on other computers and with other users of the Rising Antivirus system. This also helps users to transport their settings when upgrading to a new computer system.

Below the security level bar, there is a box with two tabs: Default Settings and Advanced Settings.

Default Settings
This is a series of three drop down boxes that allow the user to define specific actions in response to events that will be tried when dealing with a detected virus.

All of the default settings are pre-set to 'Ask me what to do' which means that the user will be first queried as to what to do about the situation.

So that a scan is not halted by waiting for the user to respond to a query, a default action is set and a specific amount of time is entered in seconds in which the user has a chance to over-ride the default action.

If there is no response from the user within the time as it counts down, the default action is taken and the scan continues.

When a virus is detected: In addition to selecting 'Ask me what to do', the user may specify: 'Clean the virus', 'Delete the file' or 'Ignore'.

The action of 'cleaning' a virus means that only the virus code will be removed from its location.

The action of 'deleting' the file will result in the file itself being removed from the system.

The action of 'ignoring' the file will allow the file onto the system but create an entry into the log files (if selected) and increment the 'number of viruses detected' in the scan results screen.

If virus cleaning fails: In addition to selecting 'Ask me what to do', the user may specify: 'Delete the file' or 'Ignore'. (The definitions for these actions are as above).

If backup to Virus Quarantine Fails: As a part of the process for deleting or cleaning a virus, files are first placed into a predefined quarantine area only available to the Rising Antivirus program.

Again, the user has the option of 'Clean the virus', 'Delete the file' or 'Ignore' however the action of sending a copy of the file to quarantine will be omitted.

At the bottom of this tab box, the user may set the number of seconds delay that the user has to respond to the 'Ask me what to do' query before the default action will be taken.

It is also possible for the user to set a check box on that will cause all activity within the file monitor function to be included in a log file to document the process.

The user may also decide to set another check box to force a display of the activity to the screen or suppress messages and work in a quasi-silent mode.

 

Advanced Settings

Under the Advanced Settings tab, there are three main check boxes: 'Show Timeout Message', 'Enable Smart Monitor' and 'Use Forced File Deletion'.

When the 'Show Timeout Message' box is checked any very large compressed files that are being scanned may cause a time out message to be displayed and prompt the user if they wish to continue. If the box is not set to on, the scan will continue to run until the scan completes.

When the 'Enable Smart Monitor' feature is checked, the user may specify additional monitoring functions for files including: 'Monitor File Creation' and 'Monitor File Modification'. These will produce additional messages when either of these actions is taken on monitored files.

Sometimes, files that are set to read only or those which are open and are being used will resist deletion. Setting the 'Use Forced Deletion' check box will cause the file to be deleted by Rising Antivirus regardless of normal operating system restrictions. This prevents the user having to reboot during virus cleaning or deletion which used to be used to 'free' a file for deletion.

 

Email Monitor Settings

 When the Email Monitor is selected, the box on the right changes to 'Email Monitor Level Settings'.

Security Level Bar

At the top of this box is a slider bar that allows the user to set their security to three predefined levels of protection: Low, Medium (the default) and High.

If the Slider bar is missing and the word 'Custom appears instead, the user has previously entered this area and altered the security levels by pressing the 'Custom' button.

There is a button entitled, 'Set Port'.

Port Settings Box

The 'Port Settings' box is used to define email 'ports' which allow the passage of messages into and out of the user's computer system.

An incoming port is normally referred to as a POP3 protocol port and an outgoing email port is normally referred to as an SMTP port.

POP3 and SMTP both refer to the protocol or specific way in which messages are encoded, transmitted, received and decoded during transmission.

Normally, the default ports will be enough for the average user however some services such as Yahoo for example, when being used as a server to deliver email to the Outlook application use unorthodox port numbers which will have to be defined in this location.

The user may also enable and disable specific ports from this location by setting the check boxes off and on. This does not interfere with the delivery or sending of mail. What the check boxes do is enable or disable the monitoring of the data passing through the ports.

Below the security level bar, there is a box with two tabs: Default Settings and Advanced Settings.

Default Settings

This is a series of three drop down boxes that allow the user to define specific actions in response to events that will be tried when dealing with a detected virus.

All of the default settings are preset to 'Ask me what to do' which means that the user will be first queried as to what to do about the situation.

So that a scan is not halted by waiting for the user to respond to a query, a default action is set and a specific amount of time is entered in seconds in which the user has a chance to over-ride the default action.

If there is no response from the user within the time as it counts down, the default action is taken and the scan continues.

When a virus is detected: In addition to selecting 'Ask me what to do', the user may specify: 'Clean the virus', 'Delete the file' or 'Ignore'.

The action of 'cleaning' a virus means that only the virus code will be removed from its location.

The action of 'deleting' the file will result in the file itself being removed from the system.

The action of 'ignoring' the file will allow the file onto the system but create an entry into the log files (if selected) and increment the 'number of viruses detected' in the scan results screen.

If virus cleaning fails: In addition to selecting 'Ask me what to do', the user may specify: 'Delete the file' or 'Ignore'. (The definitions for these actions are as above).

If backup to Virus Quarantine Fails: As a part of the process for deleting or cleaning a virus, files are first placed into a predefined quarantine area only available to the Rising Antivirus program.

Again, the user has the option of 'Clean the virus', 'Delete the file' or 'Ignore' however the action of sending a copy of the file to quarantine will be omitted.

At the bottom of this tab box, the user may set the number of seconds delay that the user has to respond to the 'Ask me what to do' query before the default action will be taken.

It is also possible for the user to set a check box on that will cause all activity within the file monitor function to be included in a log file to document the process.

The user may also decide to set another check box to force a display of the activity to the screen or suppress messages and work in a quasi-silent mode.

Advanced Settings

On this tab, there is a single box that is used to hide or display the Rising Antivirus Mail Monitor Progress Box.

This indicates the progress of the Rising Antivirus Monitor as it scans the incoming mail for viruses. It is a separate box from the mail application progress box.

 

Script Blocking Settings

 

The box on the right changes to 'Settings for Script Blocking'.

In this area is a drop down box that allows the user to set specific actions in response to events that will be tried when dealing with scripts.

The default setting is pre-set to 'Ask me what to do' which means that the user will be first queried as to what to do about the situation.

So that a scan is not halted by waiting for the user to respond to a query, a default action is set and a specific amount of time is entered in seconds in which the user has a chance to over-ride the default action.

If there is no response from the user within the time as it counts down, the default action is taken and the scan continues.

When a malicious script is detected: In addition to selecting 'Ask me what to do', the user may specify: 'Run the Script' or 'Skip the Script'.

At the bottom of this area, the user may set the number of seconds delay that the user has to respond to the 'Ask me what to do' query before the default action will be taken.

It is also possible for the user to set a check box on that will cause all activity within the file monitor function to be included in a log file to document the process.


Active Defense

 

System Reinforcement

Application Access Control

Application Protection

Program Startup Control

Malicious Behavior Detection

Hidden Process Detection

Self-Protection

 

Active Defense

Rising Antivirus' Active Defense Technology provides real-time system monitoring for malicious programs that try to gain access to enter the computer.

It is common for virus writers to exploit system faults in operating system software to gain access to personal information or do damage to systems by capitalizing on these flaws.

Rising Antivirus engineers constantly study the operating system and the latest patch releases to identify these points of attack and anticipate the type of code required to create what is called an 'exploit'.

As a feature, Active Defense is highly customizable giving the user the greatest scope for achieving the desired security level.

For the non-technical user however, there are wizards and slide bars to provide default protection at the three levels of security: low, medium and high.

The main screen under the Active Defense Tab lists all of the functions covered under active defense, an 'Enable/Disable' toggle button to set each feature off and on and a button to set the defaults for each function.

The six functions of Active Defense are:

Note: Windows 9X, NT and all 64-bit operating systems don't support Rising Active Defense technology.

 

System Reinforcement

System Reinforcement: monitors the security holes in the operating system that make it vulnerable to attack by malicious code.

Application Access Control

Application Access Control: monitors suspicious programs to limit their access to computer resources.

Application Protection

 Application Protection: Protects specified applications from attack by malicious programs. A user can customize protection for online games, instant messengers, etc.

Since these types of applications are by default allowed access directly to the internet, specific viruses, Trojans and other forms of attack attempt to gain access to systems or the gaming information itself. In the case of online games, some of the virtual weaponry that has been won is quite valuable and can be sold in the real world for a lot of money.

Program Startup Control

Program Startup Control: Allows the user to monitor the startup process of specified programs thus detecting when any modifications to the program, an attempt to execute malicious code or malicious code attempts to execute a valid application to complete its task. For example, the last step of a key logger may be to take a file containing passwords and account names and email it using the Outlook process to the virus' owner.

Malicious Behavior Control

Malicious Behavior Control: monitors programs running in memory for activity that appears to be malicious or performing actions similar to known viruses, Trojans and worms.This type of behavioral detection is known as heuristic detection.

The user is then given the opportunity to either accept or reject the execution of the action.

 

Hidden Process Detection

 Hidden Process Detection is used to identify processes that may have been loaded prior to the execution of security software and other parts of the OS. This allows the process to escape detection by things like Task Manager.

This type of executing code can consume vast amounts of system resources while Task Manager is still displaying 100% system usage to 'System Idle'.

Most often, this is due to processes loaded during the boot process and includes things like 'Root Kits'.

In the case of Root Kits, simply inserting a CD into the CD ROM drive of a computer will initiate the installation of a root kit The Sony Corporation used to initiate a Root Kit on all of their CDs but stopped the practice however, at the time of this writing it seems to have been replaced with another two Root Kits.

While Sony thinks it is their right to load this software onto a computer system without the knowledge of the user to monitor and control their IP Rights, they have not taken into consideration the implications of what happens when their programs are infected with viruses.

Alert me when hidden processes are detected: causes an information balloon to be sent to the screen whenever a hidden process is detected.

 

Self-Protection

Previous versions have not offered complete protection to Rising products themselves, resulting in damage to Rising products by specific viruses such as Orange August. The spread of such viruses has prevented users from running Rising products or to browse the Rising website.

We now employ Active Defense Technology to address this omission.

 

 

Active Defense Settings

 

System Reinforcement

Application Access Control

Application Protection

Program Startup Control

Malicious Behavior Detection

Hidden Process Detection

 

 

Active Defense Settings

 The main screen under the Active Defense lists all of the functions covered under active defense, There is a check box beside each function to enable or disable each feature but only after a system reboot.

The six functions of Active Defense are:

 

 

System Reinforcement

 System Reinforcement: monitors the security holes in the operating system that make it vulnerable to attack by malicious code.

When the System Reinforcement selection is pressed on the navigation tree on the left, the Active Defense Settings screen is displayed.

On this screen are two areas. The left side of the page remains as a quick navigation box of all the areas covered in ‘Active Defense'.

On the right is an area entitled 'System Reinforcement'.

At the top of this page is the System Reinforcement Icon and a brief introduction to the function.

Below this area is a slider bar that allows the user to set their security to three predefined levels of protection: Low, Medium (the default) and High which enable or disable specific rules.

Custom Button

If the Slider bar is missing and the word 'Custom appears instead, the user has previously entered this area and altered the security rules for individual areas by pressing the 'Custom' button.

Default Button

To reset to display the slider bar, simply press the 'Default' button.

At the bottom of the page, a check box appears entitled 'Create Log' that allows the user to send all activity monitored by this setting to a log file for later viewing.

Since the user will also be notified of rule violation activity by a pop up screen, there is a drop down list in the lower right hand corner where a selection can be made to provide a 'Detailed Alert' or a 'Brief Alert' when the rules are violated.

Custom Page

System Reinforcement rules can be set to:

Ø       Monitor and alert the user regarding Rules violations against the system

Ø       Protect the Registry

Ø       Protect Critical Processes

Ø       Protect the System Files

On this screen are two areas. The left side of the page is devoted to a quick navigation box of all the areas covered in 'System Reinforcement'.

A user can quickly move back and forth between each of the settings for: System Action Monitor, Protect Registry, Protect Critical Processes and Protect System Files.

The default in this box is to have the System Action Monitor selection highlighted.

On the right is an area which allows the setting and the unsetting of rules relative to the System Action Monitor by use of a check box on each item.

By clicking each item in this list, an explanation of what each item does is displayed in the last section of the page directly underneath this box.

Additionally, when a rule is selected three 'Radio Buttons' become visible to allow the setting of a default action when the rule is violated: Refuse, Accept and Ask.

Refuse: the violation is automatically refused and stopped.

Accept: the violation is executed.

Ask: the user is notified of the violation and is asked to approve or deny the action on a case by case basis.

 

Application Access Control

 Application Access Control: monitors suspicious programs to limit their access to computer resources.

The right side of the page changes to a box with the Application Access Control Icon and description with a box under it to allow the user to add or modify the access control to specific applications currently operating in the system.

The text box contains three columns entitled: Enable, Application and Enabled Rules.

This box is a display of currently defined rules.

Below the displayed rules are five buttons, Add, Edit, Delete, Import and Export.

Add Button (Application)

When the Add button is pressed, a pop-up box appears entitled 'Select Application'. At this point, the user may select a running application from the box or the user may elect to browse the disk for a non-running application.

Add Button (Rules)

When an item is selected, another box appears entitled 'Add Rules' where the user may select a running application and define the rules to apply when the application runs in memory.

The user may also elect to browse the directories to locate an application on the hard drive.

The upper box on the pop-up contains the system restrictions that the user may enable when dealing with this running application. These include: Execution of sub-applications, Global Hooks, Driver loading, and Modification of Kernel Memory data.

Execution of sub-applications: Malicious code can cause the unauthorized execution of sub-applications. This can be used, for example in an attempt to cause stack overflow errors which would leave a computer open to accept further direct commands.

Global Hooks: Global hooks are small programs that operate in the system to monitor and log processes. For example keyboard processes are often monitored so that passwords and account numbers can be captured as they are typed into secure software and websites and are later sent to unauthorized people via the Internet. This type of activity is commonly known as a 'keylogger'.

Driver loading: One of the more popular types of malicious code to emerge is commonly known as a 'Root Kit'. These programs are loaded into memory prior to anything else at the time of a system boot. Since they exist in memory before the anti-virus software is loaded, they often escape detection.

Modification of Kernel Memory data: In this case, malicious code attempts to substitute its own code and overlay the windows kernel (core functions) while they are loaded into memory. This will cause the unauthorized code to be executed in place of normal Windows functions.

Each of the four system restrictions can be either enabled or disabled by using the check box on the left. A default action can be preset by selecting an option in the right drop down box on each item. The selections available are: Accept, Refuse and Ask.

The lower box on the pop-up allows the user to specify custom rules to be created when action is taken against specific directories and files or registry entries and values.

When the 'Add' button is pressed, a small box appears to ask if the user wishes to create a 'file/director' rule or a 'registry rule'.

File/Folder Rule

This screen includes the fields:

Rule Name – How you will refer to this rule in the future.

The Target – This is the actual file or directory to be monitored by this rule. The File/Folder can be directly entered into the field or by using the Browse function to locate the file or folder in the disk directory.

Description – This is a box used to define the intention of the rule. It is advisable to be as descriptive as possible so that in the future, the user remembers why the rule was created.

Additionally, the user has a series of check boxes that can be used to refine the rules:

If the user has selected a folder they are given the opportunity to select the 'Include Sub-Folders' check box.

The user then can check a selection activities related to file and folder that are to be monitored. The options are: Modify, Delete, Create and Open.

The final task on this page is to set the default action for when this rule is broken. These are the standard responses of: Ask, Refuse or Accept.

 

 

Registry Rule

This screen includes the fields:

Rule Name – How you will refer to this rule in the future.

The Target – This is the actual registry entry to be monitored by this rule. The Registry item can be directly entered into the field or by using the Browse function to locate the item in the Registry itself.

Description – This is a box used to define the intention of the rule. It is advisable to be as descriptive as possible so that in the future, the user remembers why the rule was created.

Additionally, the user has a series of check boxes that can be used to refine the rules:

When the user has selected the Registry Item they are given the opportunity to select the 'Monitor Key' check box and when checked, the user may also elect to monitor sub keys that are created below the currently selected level.

The user then can check a selection activities related to keys and sub-keys that are to be monitored. The options are: Modify, Delete and Create.

When Create is selected, the user also has the option of entering a specific key name.

The final task on this page is to set the default action for when this rule is broken. These are the standard responses of: Ask, Refuse or Accept.

Edit Button

When the Edit button is pressed, the page allows the currently selected application rules to be modified and overwrites the current settings.

Delete Button

When the Delete button is pressed, the currently selected application rules are deleted.

Import Button

When the Import button is pressed, a browse directory screen pops up and allows the user to import a set of rules into the current set of rules that were previously exported from another instance of the Rising Antivirus software. This is useful when a user purchases an new computer and wishes to carry their current settings over to the new machine.

Export Button

When the Export button is pressed, the user can save all of the current application rules into an external file to act as a backup or to transport to a newly purchased computer or installation.

 

Application Protection

 

Application Protection: Protects specified applications from attack by malicious programs. A user can customize protection for online games, instant messengers, etc.

Since these types of applications are by default allowed access directly to the Internet, specific viruses, Trojans and other forms of attack attempt to gain access to systems or the gaming information itself. In the case of games, some of the weaponry that has been won is quite valuable and can be sold in the real world for a lot of money.

The right side of the page changes to a box with the Application Protection Icon and description with a box under it to allow the user to add or modify the protection of specific on-line applications.

The text box contains three columns entitled: Enable, Application and Enabled Rules.

This box is a display of currently defined rules.

Below the displayed rules are five buttons, Add, Edit, Delete, Import and Export.

Add Button

When the Add button is pressed, a pop-up box appears entitled 'Select Application'. At this point, the user may select a running application from the box or the user may elect to browse the disk for a non-running application.

When an item is selected, another box appears entitled 'Enable Rules' where the user may enable the rules to apply when the application runs in memory.

The next pop-up contains the rules that the user may enable when dealing with this running application. These include:

DLL injection: When an application triggers the rules of DLL Injection, it means that malicious code has attempted to make a false entry from the Dynamic Link Library and substitute its function for a valid one.

Code injection: When an application triggers the rules of Code injection, it means that malicious code has attempted to overwrite a section of code in the process and substitute its function for a valid one.

Memory modification: When an application triggers the rules of Memory modification, it means that malicious code has attempted to place its own values into the variable storage space of a currently protected process.

Memory read: When an application triggers the rules of Memory read, it means that malicious code has attempted to gain access to the contents of the variables or memory locations of currently protected process.

Suspension: When an application triggers the rules of Suspension, it means that malicious code has attempted to suspend the execution of a piece of called code or a thread during the execution of a protected process. Since a process can have many simultaneous threads executing at the same time this can have unpredictable results and can cause the execution of further malicious code.

Termination: When an application triggers the rules of Termination, it means that malicious code has attempted to terminate the execution of a piece of called code or a thread during the execution of a protected process. It can also terminate the entire process itself. Since a process can have many simultaneous threads executing at the same time this can have unpredictable results and can cause the execution of further malicious code. Termination of an entire process may take down security measures like Firewalls and Antivirus applications.

Simulated sending: sending message to protected processes. Since these processes are actually online applications, they are constantly receiving and sending messages to and from remote locations. Sending a simulated message to the process may cause it to send secure information to a spoof application on the Internet so that information can be captured.

Simulated key: sending message input by simulated keyboard to protected processes. Using this method, malicious code can simulate input from a user to either send unintended messages or to trigger file transfers. If the file transfer is of a virus itself the sender is unaware that the virus has left his machine and the receiver thinks he received a file from a trusted user and executes it. This is a common technique for spreading viruses via Internet Messaging services.

Keylogger: keyboard processes are monitored so that passwords and account names can be captured as they are typed into games and messaging services. They are later sent to unauthorized people via the Internet. This type of activity is commonly known as a 'keylogger'.

Each of the nine rules can be either enabled or disabled by using the check box on the left. A default action can be preset by selecting an option in the right drop down box on each item. The selections available are: Accept, Refuse and Ask.

Edit Button

When the Edit button is pressed, the page allows the currently selected application rules to be modified and overwrites the current settings.

Delete Button

When the Delete button is pressed, the currently selected application rules are deleted.

Import Button

When the Import button is pressed, a browse directory screen pops up and allows the user to import a set of rules into the current set of rules that were previously exported from another instance of the Rising Antivirus software. This is useful when a user purchases an new computer and wishes to carry their current settings over to the new machine.

Export Button

When the Export button is pressed, the user can save all of the current application rules into an external file to act as a backup or to transport to a newly purchased computer or installation.