• Using Immunet 3.0
• Main Pane
  • Status Orbs
    • Connected
    • Secure
    • Up To Date
  • Performance Gauges
  • Right-click Context Scanning
• Community
  • My Community
    • User Registration, Password Recovery and Change, and Login
    • User Invite
  • My Community
    • Country
    • User's Community
    • Protection Factor
    • Full Community
      • Understanding Full Community Data
  • Notices
• Computer Pane
  • Scan Now
  • Flash Scan (Cloud Scan)
  • Custom Scan
  • Full Scan
  • Rootkit Scan
  • Common Scan Dialogue Elements
    • Pause, Stop Scan, and Close
      • Pause
      • Stop Scan
      • Close
    • Completed Scans
      • Files Scanned
      • Threats Detected
      • Threats Removed
      • Elapsed Time
      • Scan History
  • Summary Link
  • History
    • View Types
      • Default View
      • Clean File History
      • Malicious File History
      • Scan History
    • Quarantine - Restoring and Deleting
• Product Pane
  • Updating with Immunet 3.0
  • Update Now Button
  • Settings
    • Protection
      • Monitor Program Install
      • Monitor Program Start
      • Blocking Mode
    • Detection Engines
      • ETHOS
      • SPERO
      • ClamAV
      • TETRA (Plus Only)
      • Allow Definition Updates
    • Quarantine Behavior
      • On Detection of Malicious Files
      • On Detection of Suspicious Files
    • Scan Settings
      • Scan Archive Files
      • Scan Packed Files
      • Scan Email
      • DeepScan
    • Exclusions
    • Scheduled Scan
    • Notifications
      • Cloud Notifications
      • Verbose Tray Notifications
      • Gaming Mode
    • Community Settings
      • Community Sharing
• Custom Signature Creation

Using Immunet 3.0

The Immunet 3.0 3.0 User Guide is formatted to reflect the layout of the Immunet 3.0 user interface. Immunet 3.0 can be broken down into four separate components. They are:

1. Main Pane

2. Community

3. Computer, and

4. Product

Each of these components has a distinct set of features. The following sections of the Immunet 3.0 3.0 User Guide will discuss each component in detail, along with key features of each.

Main Pane

The Main Pane of the user interface (shown below) includes several fixed items that are designed to inform the user of the product's status. These are as follows:

1. Status Orbs (Only in Immunet 3.0 Plus)

2. Performance gauges

3. Right-click context scanning

These features will be discussed at length in the sections that follow.

Main Pane

Status Orbs

In the event that a status orb is yellow or red, the user interface will present the user with an option to fix the issue and re-establish the status as green (if possible). This option will appear beneath the status orb as Fix it.

Status Orbs

The Main Pane features three different status orbs, each of which refers to a different functionality. Each of these status orbs will be discussed at length in the sections that follow. They are as follows:

1. Connected

2. Secure

3. Up to Date

Connected

Immunet Plus can operate without an Internet connection; however, in order to be updated, it must connect to the Internet. The longer it is offline, the more likely it is that its definition files will become outdated. As a result, Immunet Plus users should connect to the Internet periodically to ensure that the anti-virus definitions stay current.

A green Connected orb indicates that the computer is successfully connected with no problems. Yellow status will only appear for users of Immunet Plus. It indicates that the computer is in offline mode and is not receiving any protection from Immunet's cloud engines.

Red status indicates that the computer is not connected to the Internet or that the Immunet 3.0 cannot access the Internet for some reason. Users who encounter a red Connected orb should refer to the Knowledge Base article or email the Immunet Support Team on offline mode.

Secure

Up To Date

Performance Gauges

Right-click Context Scanning

Any file visible in Windows may be scanned by Immunet 3.0 by right-clicking on the file itself (as shown to the right). This will present a dialogue box that will give the user the option to review the file in question.

The current implementation of this feature does not pull up a scan window; instead, the results of the scan will appear in the message tray, as seen below.

Tray Message

Community

The Community component of Immunet 3.0 is presented in the left-hand tab of the of the Immunet 3.0 user interface. It contains the features that enable users to build and manage their Protection Network as well as helping them to keep abreast of the latest security and product news from Immunet. These features will be discussed in depth in the sections that follow.

My Community

The My Community feature allows users to build their own protection network. The goal of this feature is to allow people to draw in those close to them and allow them help create a small network which they use to help protect each other. This is done under the premise that people with similar languages, preferences and surfing habits will encounter similar threats and can therefore band together to form their own early warning network of sorts. Because each person in the network can submit threats to Immunet which they encounter you can quickly build up a powerful protection network. It's like having your own anti-virus company and focusing it just on your friends. Here is an example to illustrate how this work:

A Norwegian Network Example

If you live in Norway and have (for example) 50 people in Norway connected to you, with the Community Feature, then your community will likely encounter and send up threats predominant in Norway. People in your network will see threats that are hosted on Norwegian web sites, sent out in Norwegian language spam and phishing attacks etc. So the more people you surround yourself with who have similar language preferences, geographic locations, hobbies etc. the better. However even without people in your network you get the full protection of the Immunet Cloud.

The My Community feature can be launched by clicking on the My Community icon, which is the first button in the left-hand column of the main pane (shown below). The My Community feature is designed to allow users to build and manage their Protection Network, which is a group of individuals that the user has invited to join Immunet.

Once individuals who have been invited join the Protection Network have accepted, their computers will start to submit suspicious data to Immunet. Immunet will then use this information to secure the computers of the user community against detected threats. This protection will be enacted almost as soon as the suspect files are submitted to Immunet. It will also extend to the communities of other Immunet users.

The more people in a user's network, the more the user will be protected against threats that are detected circulating on the Internet. Further, the bigger a user's network, the more it will contribute to the enhanced security of the entire Immunet community.

User Registration, Password Recovery and Change, and Login

Current users who have existing accounts can log in by clicking on the Sign in with an existing account button in the lower right-hand corner of the Welcome to the Immunet Community pane.

Existing users who have previously registered but who have forgotten their user name and/or password may reset either by clicking on the Recover your password or the Change your password button, as is appropriate.

New users who are logging in for the first time and who have not yet registered will be prompted for the following:

1. Your Name - This constitutes the user's Immunet user name. It does not have to be a real name but rather the name that the user wishes present to other members of the Immunet community.

2. Your email - This email address will serve as the user's credential for signing back into the Community feature. It is also the email address to which Immunet 3.0 will send a confirmation email, enabling the user to validate the account. As a result, the email address must be valid.

3. New Password - This will be the password that the user will use to log on to Immunet 3.0. Users will only be prompted for their username and password if they have used the Sign Out functionality in the Community pane (which is available after registration).

Once the user has registered, the above window will open. As it states, the user will need to validate the account by responding to a confirmation email that Immunet will send to the email address entered for registration. This email will contain a link that the user can click on to validate the account. Users can return to this window at anytime by clicking back on My Community from the main pane.

User Invite

By clicking on the Next button, the user will bring up the Add People screen shown below, which allows the user to invite others into his or her Protection Network.

Users can invite individual users to join the community by entering the invitee's e-mail address in the box labeled Email. On the other hand, users can invite groups of users by importing contacts from Gmail, Yahoo or Hotmail. It is important to note that when contacts are to be imported from Gmail, Hotmail or Yahoo, the user's password for those services is required. Immunet does not store or retain this password in any way.

Regardless of which method is used to add or invite users to join the Protection Network, each added user will receive an email from Immunet, as shown below. This email will invite the prospective user to download the Immunet 3.0 product and join the registered user's network. The email will provide basic information about the product and also invite the new user to contact the registered user directly in order to avoid any confusion with spam or phishing related emails. Once the invited user has accepted the invitation and installed Immunet 3.0, the registered user will see the invitee's name in the Protection Network pane.

My Community

The threat landscape data (shown below) of the node that is currently centered will be displayed the right-hand side of the My Community pane. Beta users will start with two default people in their network, Immunet staff members Oliver Friedrichs and Alfred Huger, which will give users a head start in building their Protection Network.

Once the beta user has added ten friends, Oliver and Al will disappear from this pane. Once a user's Protected Network comprises 10 people or more, only the most active people, or those people with the largest networks of their own, will show up on the main pane. Users who are not listed in the main pane may be viewed by clicking on the Full Community link. Users may be removed or added by using the add people button.

The data sets presented in the right-hand pane of the My Community page describe the threat landscape of the center node user's Protection Network. These data sets will be discussed in greater length in the sections that follow, they are:

1. Country

2. Community of Beta User

3. Protection Factor

Country

1. Total Members: How many members of the Immunet Community at large are situated in this country.

2. Threats Stopped: How many threats have been discovered and stopped by the Immunet Community in this country.

3. Top Threat: The threat that is seen most commonly in this country.

The country-specific data is important because it allows users to view activity that is taking place in their own country, as well as the countries of other members of their Protection Network, and to make comparisons. Greater participation from users in a particular country will help to bolster protection for other people in that country, as they are likely to be subject to the same threats. Users situated in a country with low participation can enhance their own protection by encouraging other people in that country to join their Protection Network.

User's Community

1. People Protected, which indicates how many people the user has added to his or her Protection Network. It should be noted that the invited users must have installed the Immunet 3.0 software for this to work and the number of people protected will not count Alfred and Oliver.

2. Threats Stopped, which details total number of threats the user's Protection Network has stopped and, therefore, contributed to the overall Immunet Community. The user's specific data is not reflected in this number.

3. Top Threat, which details the threat that is seen most commonly in the user's Protection Network.

The larger the user's Protection Network, the greater will be the user's level of protection and the more the user will be contributing to the protection of others, both in his or her own Protection Network and in the global Immunet Community.

Protection Factor

Full Community

Understanding Full Community Data

Whenever a user's name is selected in Full Community mode, the pane will expand to show data about that particular user. Any user who has been selected in this mode may also be removed from the network by clicking the Remove User link on the right-hand side of the My Community page, as shown below.

The data displayed in the expanded box for each user is slightly different than that shown in the main pane. The data displayed is as follows:

1. Community: users: indicates how many users are in this user's community.

2. Community: threats: indicates how many threats this user's community has seen compared to the total number of files. The example for Duck Dodgers (above) shows that his community has stopped 6,488 threats and has seen 907,467 files over all.

3. Country: Users: displays this user's country and indicates how many users are in it.

4. Country: threats: indicates how many threats this user's country has seen compared to the total number of files. The example for Canada shows that Canadian users have stopped 49,579 threats and have been exposed to 4,202,128 files overall.

Notices

Notices Panel

All Notices will be shown with a bolded title along with several sentences of text to provide a summary of the notice. These notices will often contain important information about Immunet products or about topics that Immunet feels are of interest to users, such as current security threats in the wild. As new notices become available, users will be alerted by a pop-up message from the tray icon in the lower right-hand corner of their screen.

Computer Pane

The Computer is the central component of Immunet 3.0. It is also the central tab of the Immunet 3.0 main page.

The Computer contains all of the core anti-virus functionality of the Immunet 3.0. This includes the functionality of scanning, scan configuration, quarantine and system history as it pertains for file installation and and scanning events.

The features included in Computer include:

1. Scan Now

2. Summary

3. History

These features will be discussed in the sections that follow.

Scan Now

Each of these scan options will be discussed at greater length in the following sections.

Flash Scan (Cloud Scan)

The Flash Scan is strictly a cloud-based scan and, as such, will require network connectivity. The Flash Scan is available in both Immunet 3.0 Free and Immunet Plus.

Custom Scan

Custom Scan allows the user to designate specific directories or files for scanning. Selecting this scan type will open a file selection dialogue with which the user can indicate the files or directories to be scanned. Custom Scan is available in both Immunet 3.0 Free and Immunet Plus.

Full Scan

Rootkit Scan

Rootkit Scanning shows up as a grayed out option in all 32 and 64 bit versions of Immunet 3.0. However, it is only possible to be used on 32 bit platforms. This is because currently rootkits are not known to function on 64 bit platforms so the scanner is not needed as their is no threat to 64 bit platforms from this vector. Therefore on 64 bit versions of Immunet Plus this option disappears.

Common Scan Dialogue Elements

Pause, Stop Scan, and Close

Pause

Stop Scan

Close

Completed Scans

Files Scanned

Threats Detected

Threats Removed

Elapsed Time

Scan History

Summary Link

All files that have been dowloaded onto the computer, whether through user activity or by programs on the computer, will be displayed here. Files that are considered to be clean or non-malicious will be represented by blue vertical bars on the graph, whereas malicious or suspicious files will be displayed in red. Users can view any of the data by hovering their mouse over each data type column (as shown in the screenshot above) to show the relevant summary data (which is presented for the whole day).

Users can also click anywhere on the vertical bar to drill down on specific data for the time period that the bar represents. Clicking on the blue portion of a bar will show more detailed data for non-malicious files, whereas clicking on a red portion of the bar will drill down into data on malicious files.

To view the all of the data at a more granular level, users can click on the Detailed History box, in the lower right-hand corner of the pane, which will be open up a new pane to reveal all files according to category or type.

History

Users can navigate the File History pane with the navigation bar at the top of the pane (shown below). This bar allows users to view their data according to predetermined categories (which will be discussed in the next section) or to search the user's history by keyword, as is shown in the screenshot below.

In all cases, the File History pane will feature two panes. In the left-hand pane, the files will be presented by name in chronological order according to the time the file was first seen by Immunet 3.0. On the left side of the left-hand pane, an icon will indicate whether the file is clean (represented by a green check mark) or malicious (as indicated by a red X icon).

When a file is selected (or highlighted), the right-hand pane will display details about about the selected file, such as what event type it is associated with (if any), which program introduced it to the system and where it resides on the computer.

View Types

1. Default View

2. Clean File History

3. Malicious File History

4. Scan History

Each of these will be discussed at greater length in the following sections.

Default View

Clean File History

Details about each file will be listed on the right-hand side of the pane in the Details box, which includes three items. The first is the Path, which indicates where on the user's system the file is situated. The second is the Installed By heading, which details on the program that transmitted or installed the file to the computer are displayed. The third detail is the Date, which indicates when the file was first seen by Immunet 3.0.

Malicious File History

Details about each file will be listed on the right-hand side of the pane in the Details box. Clicking on a particular file name will display three details describing the threat. The first is the Detection Name, which indicates what detection or virus name the threat is associated with. The second is the Installed By heading, which provides details on the program that installed the file on the computer. And the third, the Date, indicates when the file was first detected and assessed by Immunet 3.0.

If Immunet 3.0 is able to quarantine the threat, this will be indicated by the presence of a red lock icon, which indicates a quarantine event. This particular view will always list detection and/or quarantine events for the same file together. This means that if a threat is discovered and quarantined, both events will show in the list on top of each other.

Scan History

1. Event type, which details the type of scan that was performed.

2. Results, which details the results of the scan.

3. Date, which gives the time and date of the scan performed.

Quarantine - Restoring and Deleting

Any file that has been quarantined by Immunet 3.0 may be restored or deleted. The right-hand panel of any Quarantine Event includes both Delete and Restore buttons, which allow the user to delete and restore items from the Quarantine folder as required. Quarantined items that are being restored will be placed back in the exact file from which they were originally quarantined.

Product Pane

Updating with Immunet 3.0

Updates for Immunet Plus consist of software updates that are applied to the Immunet 3.0 product itself. Usually, these updates consist of upgraded features, full new releases, and bug fixes. Each release will be accompanied by a tray pop-up (shown below) indicating there is new release, at which time the update orb at the bottom of the Product pane will turn yellow and will announce New Version Available.

Clicking on the Fix it (as shown below) will download the new package and allow the user to install it.

Update Now Button

The update installation process is very similar to the initial installation, although it may not always require a reboot. In cases where the user is prompted for a reboot, Immunet suggests that this be done immediately. Because of this, users should close all running applications and save their work before running a product update.

Settings

Some features are labeled with a Plus graphic, (as shown on the right). This graphic indicates that this feature is only available or configurable in Immunet Plus, the commercial version of Immunet 3.0.

The features that Settings presents to the reader for configuration (where applicable) include: Protection, Detection Engines and Quarantine Behaviour. Each of these shall be discussed in-depth in the sections that follow.

Protection

Monitor Program Install

Monitor Program Start

Blocking Mode

Detection Engines

ETHOS

SPERO

ClamAV

TETRA (Plus Only)

Allow Definition Updates

Quarantine Behavior

On Detection of Malicious Files

On Detection of Suspicious Files

Scan Settings

1. Scan Archive Files

2. Scan Packed Files

3. Scan Email

4. Deep Scan

Each of these four settings will be discussed in the sections that follow.

Scan Archive Files

Scan Packed Files

Scan Email

DeepScan

Exclusions

Scheduled Scan

Notifications

Cloud Notifications

Verbose Tray Notifications

Gaming Mode

Community Settings

Community Sharing

Custom Signature Creation

Something which has been missing in modern Windows Anti-Virus products is a feature which allows advanced users to craft and deploy their own signatures or detection capabilities. With 3.0 we now offer the first Windows Anti-Virus product which allows our users to write their own detections with our engines just as we would.

Users can now hunt threats (or Advanced Persistent Threats if you like) by creating signatures which range from simplistic (straight MD5 matches) to complex (logically chained expressive signatures w/ offset support and wild carding). Signature management is done with the new SigUI tool which is available in Start -> All Programs -> Immunet 3.0 and looks like this:

Documentation for the SigUI may be found here and our manual for creation of signatures can be found here.

We encourage you to write your signatures and post them to our online Forum.