Programs
When a program starts to run, Online Armor will first try to make a decision automatically by using OASIS to check if it recognizes the program as Trusted or Untrusted, and scan it with the antivirus engine if you are using Online Armor AV+. The Program Guard will also monitor programs for potentially malicious behavior and allow you to set advanced protection options for programs.
To make Online Armor easier to use, Programs that are set to Trusted in the Programs List will also be automatically Allowed by the Firewall.
Video
- Show me how to TRUST a program (Video)
- Show me an example of blocking a dangerous file with Online Armor (Video)
- Show me what happens when a trusted program is changed (Video)
- Show me how to turn off learning mode (Video)
- Show me how to turn on learning mode (Video)
- Show me how to make a program "Run Safer" (Video)
  | Online Armor uses OASIS to automatically allow known Trusted programs, and block Untrusted programs, as much as possible to minimize the amount of pop-ups that you see. Online Armor will also automatically recognize many installers and run them in Install Mode without alerting you. To help make configuration easier these pop-ups will also offer some or all of the following options when a changed, Unknown, or Untrusted program tries to run.
|
Online Armor will also ask you to Allow or Block certain high-risk actions that an Allowed Unknown program can take. Most users will never encounter these pop-ups from legitimate software. If you do encounter a pop-up regarding a program’s behavior, you should carefully consider the program that is taking the action.
Note: You can change how Online Armor handles these events for specific applications by changing the Advanced Options in the Programs list. Online Armor will not monitor these actions from Trusted programs.
Once a program has been Allowed or Blocked, it will be added to the Programs List. To access the Programs list simply open the Online Armor Control Panel and select Programs from the main menu on the left. The Programs list shows you basic information about the programs it has seen and allows you to change how Online Armor handles each program individually.
Above the table, on the right-hand side opposite of the tabs, is a drop down menu. This menu will allow you to filter the list to show only Programs, Components, Drivers, programs set to RunSafer, Installers, and Other. Selecting one of these options will hide all entries in the Programs list that do not match the specified criteria.
The Programs list is organized using a table with the following columns:
- Status – Shows whether the program is Allowed or Blocked.
- Program Name – Shows the file name of the program on your hard drive.
- Name – Shows the name of the program.
- First Detected – Shows the first time Online Armor saw the program.
- Trust Level – Shows whether the program is Trusted, Untrusted, or Unknown.
- Security Level – Shows whether the program runs normally or has been set to “Run Safer.” This column will show “Safer” if it is the latter.
Each row is color coded to indicate whether the program is set to Run Safer (blue), Trusted (green), Untrusted (red), Unknown (salmon), or is no longer present (gray).
A legend showing the colors and their corresponding status can be found in the Options tab of the Programs list.
Underneath the list are the following buttons:
- Run Safer – Sets the selected program to “Run Safer.”
- Trust – Sets the selected program to Trusted.
- Delete – Removes the program from the Programs list and deletes any history information that Online Armor has associated with this program. Deleting the item from the list will cause Online Armor to pop up if the program tries to run again in the future.
- Allow – If a program has been set to Blocked then this button will be enabled and will set the program to Allowed.
- Ask – Sets Online Armor to pop-up the next time this program tries to run, allowing you to Allow or Block it at that time.
- Block – Sets Online Armor to automatically Block the program from running.
Online Armor does not show Trusted programs by default to keep the Programs list more manageable. Remove the check next to the “Hide Trusted” box to the left of the buttons at the bottom to see the Trusted programs in the list.
You can also place a check in the “Only Deleted” box to view only programs that are no longer present.
You can right-click any program in the Programs list to access additional options including:
- Show file information – Shows any information about the file that Online Armor can see, including the full path to the file on your hard drive, the name of the program, the program version, the company that made it, the date it was created, the description, and any copyright information. Most programmers include all of this information with their files, but some may omit some of this information. You can also click More to be taken to the Online Armor website for any information Online Armor has collected about this particular program. Clicking the arrow buttons will show the file information for the previous or next file in the programs list.
- Open – Launches the program.
- Open Safer/Open normal – This menu entry will change according to whether this program is set to Run Safer or not. If the program is not set to Run Safer then this entry will say “Open Safer”, and clicking it will launch the program with the Run Safer restrictions. If this item shows “Open normal” then the program is set to Run Safer and selecting this menu entry will launch the program without the Run Safer restrictions this time only.
- Advanced Options – Takes you to the Advanced Options for this program.
- Trust – Sets this program to Trusted so that it will not be monitored for malicious behavior.
- Untrust – Changes a Trusted program to Unknown so that it will be monitored for malicious behavior.
- Find – Allows you to perform a search in the Programs list to find a particular program.
- Copy to Clipboard - Copies all the text you see in the tooltip (when hovering the mouse over an entry) to the clipboard so that the information can be pasted.
- Delete – Removes the program from the programs list and deletes any history information that Online Armor has associated with this program.
- Add to list – Helps you to add a program to the programs list without having to wait for it to run.
- Autosize columns – Sets the programs list to automatically resize all columns in the table to accommodate the longest string of text in each column. This makes it so that you can see all the text in the table without any information being truncated by the width of the columns and without having to resize the columns manually.
You can access the advanced options for any program by double clicking it in the Programs list or right-clicking and selecting “Advanced options.” Any changes to these settings will only affect the individual program that you have selected.
Security
Place a check in the box to enable the following features, or remove the check to disable them:
- Run Safer – Sets Online Armor to use Run Safer on this program. See the Run Safer help page for more information.
- Installer – Selecting this option will indicate that this is an install/setup file that you downloaded from the internet. Installers run many programs and perform many actions that may raise pop-ups from Online Armor. Using this option will automatically allow Unknown programs that the installer runs, reducing or eliminating those pop-ups.
Permissions
These settings change the way that Online Armor will allow the selected program to behave. These settings restrict potentially high-risk behaviors used by some sophisticated malware. Some malware may take these actions directly, but malware can also hide its actions by manipulating legitimate programs in a way that forces them to perform malicious actions on the malware’s behalf.
Click the icon to the left of the setting to change each setting. A white page labeled “(More)” indicates that clicking this item will open a new dialog with more options to configure this setting. Once the setting is configured this will change to an icon of a page with writing and a green arrow. Otherwise the setting will show the current status icon and label. These settings are best used on applications that should not take these actions in the course of normal use but may be targeted by malware and forced to take malicious actions. Advanced users may also use these settings to restrict Unknown programs.
Note: Some of these options may be automatically configured while in Learning mode.
Warning: While these actions are often taken by malware, they are also used by legitimate programs as well. You should not alter restrictions unless you know what these features protect against and you are sure that the application does not need to perform them. Enabling these options could prevent a program, or your system, from behaving as expected, hang, or crash. If you wish to explore the technical details of these functions, you are encouraged to start or join a discussion in our Support Forum.
All features are set to Ask by default, but may be pre-configured during Learning mode. These settings will not be enforced on Trusted programs.
- Start applications – Changes whether Online Armor will allow this program to start other programs. Clicking this option will allow you to configure Online Armor to allow or restrict the program from starting specific programs, any program, or to pop-up (ask) when it happens.
- Set global hooks – Changes whether Online Armor will allow this program to create hooks. A global hook is a piece of code injected into every program that runs on your computer for the purposes of obtaining specific data from that program. This could be to monitor for Hotkeys, to obtain information that you have typed, and so on.
- Physical memory access – Changes whether Online Armor will allow the program to directly access other programs in memory. This is typically done to gain additional information about a program, but could allow malware to affect other software in ways it normally couldn't. Clicking this option will allow you to configure Online Armor to allow or restrict the program from accessing specific programs, any program, or to pop-up (ask) when it happens.
- Remote code – Changes whether Online Armor will allow the program to control other programs that are running on your computer. Clicking this option will allow you to configure Online Armor to allow or restrict the program from controlling specific programs, any program, or to pop-up (ask) when it happens.
- Remote data modification – Changes whether Online Armor will allow the program to modify the data being held in virtual memory by another program. Clicking this option will allow you to configure Online Armor to allow or restrict the program from modifying data of specific programs, any program, or to pop-up (ask) when it happens.
- Suspend process/thread – Changes whether Online Armor will allow the program to suspend another program in memory or one of the program’s threads, preventing the target program or one of its functions from operating without actually terminating it. Clicking this option will allow you to configure Online Armor to allow or restrict the program from suspending specific programs or its threads, any programs, or to pop-up (ask) when it happens.
- Create executable – Changes whether Online Armor will allow the program to create executable program files on the hard drive. Clicking this option will allow you to configure Online Armor to allow or restrict the program from creating specific executables, any executables, or to pop-up (ask) when it happens.
- Use DNS API – Changes whether Online Armor will allow the program to make DNS queries using the DNS Client service.
- Direct Disk Access – Changes whether Online Armor will allow the program to access the hard drive directly, bypassing the normal methods of creating, modifying, or deleting files. Software such as disk defragmenters or data recovery tools are examples of legitimate software that may require direct disk access.
- System Shutdown – Changes whether Online Armor will allow the program to shutdown Windows.
Protection
These settings protect the selected application against potentially high-risk behavior that sophisticated malware may take against target programs. Placing a check in the box to the left of the setting enables the setting for the selected program, and removing a check disables the setting for the selected program. These settings are best used to protect programs that contribute to your system’s security and do not contain self-protection.
Note: Using these features on certain programs may result in the protected application not behaving as expected, which could lead to unpredictable problems. You should avoid using protection settings on programs that already contain similar protection.
- Restart if terminated – Automatically restarts the program if it suddenly exits, such as if it crashes or is forcibly closed. This setting is best used to protect applications that must remain running at all times.
- Protect from termination – Prevents other programs (such as malware) from forcibly closing the selected program.
- Protect from suspend – Prevents other programs (such as malware) from suspending the protected program, which would leave the program non-functional without actually terminating it.
- Protect from remote code control – Prevents other programs (such as malware) from manipulating the functions of the protected application.
- Protect from remote data modification – Prevents other programs (such as malware) from modifying data in memory belonging to the protected program.
Performance
These settings change the way that the selected application utilizes your computer’s processor. These settings are intended for advanced users that require this type of control of selected programs.
CPU Limit – Malfunctioning programs can sometimes use 100% of your computer’s processing power, causing the system to freeze until it finishes (if it ever does).
This feature changes the maximum amount of processor power that Online Armor will allow the selected application to use. At 100%, the selected application may use as much of the processor as it needs, but programs can be restricted to as little as 10% of the processor. Move the arrow shaped slider left to lower the setting, and move it right to increase. This feature is set to 100% by default (the right-most end of the slider).
- Affinity mask – When your computer has more than one processor, a multiple core processor, or a processor with "Hyperthreading," a program may not be able to use the processor(s) correctly or you may wish to choose which processor/core the program uses. This feature changes which processor/core the selected application should use the most, or “favor.”
The Options tab provides options that allow you to change how Online Armor handles programs in general, rather than individual programs.
These options include the following:
- Legend – Provides a visual reference for the color coding of the Programs list, including what each color indicates.
- Prompt when running unknown programs – Changes whether Online Armor will pop-up when an Unknown program runs, asking if you want to Allow or Block it. Remove the check from the box to the left if you do not want to answer pop-ups to allow Unknown programs to run. This setting is enabled by default.
- RunSafer unknown programs by default – Configures Online Armor to automatically set all new Unknown programs that run to “Run Safer.” (See the Run Safer help page for more information.) This setting is disabled by default.
- Show colored border on programs set to run “safer” – Configures Online Armor to create a green border around any program that is running using “Run Safer.” (See the Run Safer help page for more information.) This setting is enabled by default.
- Hidden proccess detection - Changes whether Online Armor will pop up when a program runs but tries to conceal itself from view (e.g., from the process list in Task Manager). This option is still experimental and may alert you of processes that are not actually hidden.
- Use Online Armor Whitelist – Changes whether Online Armor will use the Trusted list to automatically allow known safe programs to run. Disabling this setting will cause Online Armor to prompt you for any program that tries to run that you have not already Allowed. This setting is enabled by default. Disabling this option is not recommended.
- Contact OASIS in realtime - Changes whether Online Armor contacts the online database to try to identify known legitimate and malicious programs. It is strongly recommended that you keep this option enabled. No personally identifiable information is sent.
- Clear unknown programs on exit – Configures Online Armor to clear the Programs list of all Unknown programs every time Online Armor is shut down, such as when you restart your computer. This option is disabled by default. Please note that enabling this option may cause repeated pop-ups for any Unknown programs that are installed on your computer.
- Notify when Online Armor auto trusts a program – Configures Online Armor to display a notification when Online Armor recognizes a program from the Trusted list and automatically allows it to run.
- Notify when Online Armor blocks a program – Configures Online Armor to display a notification when Online Armor blocks a program from running.
- Notify when Online Armor contacts OASIS in realtime - Changes whether Online Armor displays a balloon tip to let you know when it contacts the OASIS database online to verify known programs. Disabling this feature will disable the balloon tips, but the OASIS check will still occur.