Immunet Blog

All,

Our last release, 1.0.18, has been in deployment now for over a month. That's quite a while for a beta drop to be in play and I would like to thank all of you who provided us with valuable feedback on it. Based off that feedback and our internal roadmap we are pleased to be offer up version 1.0.20. This release has some great new features and whole series of 'plumbing' additions which make us more effective at finding and removing malware. 

What's actually new in 1.0.20 then? First off, we've closed out a bunch of support issues. We've also made some changes which will be more visible to your average user, let me quickly run through them with you.

Better Platform and Side by Side Install Support

We now support Windows 7, Windows XP XP2/XP3, Windows Vista in 32/64 bit and test each of our builds on those platforms. We also have expanded our Officially Supported 'side by side' product install base. In our lingo a 'side by side install' is where you run Immunet Protect Beta with another security product.  An 'Officially Supported' side by side install is where we test each Immunet Protect Beta build with these products prior to release to ensure it operates smoothly. Of course YMMV (your mileage may vary) but we make every effort to test these installs and to date it's working out really well. Our list now looks like this:

Officially Supported Side by Side Installs

• AVG 8.5 (Free) (Windows XP SP2 / Vista)
• AVG 9 Free (Windows XP SP3 / Vista SP1 / Windows 7)
• Avast! Premium 4.8 (Windows XP SP3 / Vista SP1 / Windows 7)
• Avira 2009 Personal Free (Windows XP SP3)
• Norton Anti-Virus 2008 (Windows XP SP2)
• Norton Anti-Virus 2009 (Windows XP SP2 / Vista)
• Norton Internet Security 2008 (Windows XP SP2)
• Norton Internet Security 2009 (Windows XP SP2 / Vista)
• Norton Internet Security 2010 (Windows XP SP3 / Vista SP1 / Windows 7)
• Norton 360 2009 (Windows XP SP2 / Vista)
• Norton 360 2010 (Windows XP SP2 / Vista SP1 / Windows 7)
• Mcafee Security Center 9.3 (Windows XP SP3 / Vista)
• Mcafee Security Center 2009 (Windows XP SP2)
• Microsoft Security Essentials (Windows XP SP3 / Vista SP1 / Windows 7)
• Trend AntiVirus 2010 (Windows XP SP3 / Vista SP1 / Windows 7)
• Trend AntiVirus + AntiSpyware 2010 (Windows XP SP3 / Vista SP1 / Windows 7)
• Trend Virus Buster 2010 Vista (Japanese Marketplace) (Windows XP SP3 / Vista SP1 / Windows 7)
• K7 Total Security 2010 (Windows XP SP3 / Vista SP1 / Windows 7)
• SourceNext Total Security 0  (Windows XP SP3 / Vista SP1 / Windows 7)

Unofficially Supported Side by Side Installs

Of course. there are always packages that we see in our user base but do not actively test with. The list below shows the current list. These are packages we think, based off of user feedback, that work well. However, we do not test with them so cannot be certain of that.

• Webroot Internet Security Essentials 2010 (Windows XP SP3)
• Comodo Internet Security (Windows XP SP2/SP3)
• PrevX 3.5 (Vista SP1)
• Spyware Doctor 6.1.0.447 (Vista SP1)
• Bit Defender AntiVirus 2010 (Vista SP1)
• Threatfire 4.5.24 (Vista SP1)
• Sunbelt VIPRE 3.2.2 (Vista SP1)
• Kaspersky Internet Security 2010 (Vista SP1)
• QuickHeal AntiVirus Plus 10.0 (Vista SP1)
• A-Squared Free (Vista SP1)
• BluePoint Security 1.0.0.68 (Vista XP1)
• AhnLab V3 Intern Security 8.0 (Vista XP1)
• BullGuard 8.7 (Windows XP SP3 / Vista SP1)
• Online Armor (Windows XP SP3 / Vista SP1)
• Symantec Endpoint Protection 11.0 (Vista SP1)

 

White Listing

Real time data management is something you will hear us talk about a great deal at Immunet. The general idea is that your data, Internet data in general, is highly fluid. We feel you must be able to look at data as something that is understood in real time. This is to say that you need to change your opinion and understanding of data as the data itself changes.

We have applied this thinking to 'white listing' files. White listed files are those files that we have decided are not a threat. This determination is drawn from our community and from our own processing systems which constantly review clean software for inclusion to our white list. This dynamic approach allows us to roll out very aggressive Cloud Detection Engines in the future while minimizing the risk of accidentally labeling good files as viruses.

All of our agents in the field from 1.0.10 to 1.0.20 have this ability but we've only turned it on en-masse with this release. So for all users, you will now see entries like this in your 'File History' pane. 

 

 

 

 

 

 

Support Diagnostic Tool

If you have contacted us for support then you know our first few emails generally involve us trying to learn as much as we can about your environment. We often end up with 3 or 4 emails exchanged before we even get to helping you solve your issue. With the release of Immunet Protect (Beta) 1.0.20 we have introduced a new support tool called the ‘System Diagnostic Tool’  that is designed to help us jump start the support process. This tool will allow you to generate a ‘support package’ for Immunet Support to help you diagnose issues which may encounter with Immunet Protect (Beta). This tool will generate a file to your desktop (when you click the menu item) which you can mail to us as an attachment along with any bug report.

Using the SDT is straight forward. First you will need to launch the Immunet folder from your Start menu. You can do this by opening ‘‘Start -> All Programs -> Immunet Protect’’  When you click on Immunet Protect you should see these items appear.

In order to launch SDT you simply need to click on the "Systems Diagnostic Tool" menu item. Once you click on the item nothing visual will take place. However you will now see a new file on appear on your desktop. It will look something like the screenshot shows you here:



The file is actually a zip archive of a number of log files which Immunet Protect generates in it’s regular operation. It also contains debug data that Immunet mines when you click on the menu item.
This archive will actually look empty if you inspect it with Windows Explorer. It is not. It appears empty because we use different compression libraries than those used by Explorer. Popular unzip programs like 7Zip or Winzip will open these files if you wish to look inside.

We put quite a bit of data in this archive and it’s important you understand what is there if you choose to send it to us. Please rest assured we do not make any of your personal information available to any third party and we use this data exclusively for trouble shooting our products. You can view our privacy policy here.  The following is a list of all the files we place in the SDT archive and a description of the data within each file:

• agent.exe.log

This is a synopsis of all the Immunet Protect ‘agent’ activity including issues related to communication issues and access issues (history.db, cache.db and kernel driver).

• ipsupporttool.log

This includes a detailed description of the users system including: language, time zone, OS and patch level. It also includes a detailed list of all kernel drivers loaded and their respective altitudes as well as all Windows services registered.

•  iptray.exe.log

This records all issues specific to the Immunet Protect user interface (iptray.exe).

•  cache.db

This is a SQLlite database showing all of a users cached file lookups. This includes the lookup to the Immunet Cloud and the response from the Immunet Cloud.

•  history.db

This is a SQLlite database showing all of a users file copies, downloads, convictions, quarantine items and quarantine roll backs.

•  local.xml

Contains all of the local environment variables a user may set in the product.

•  global.xml

Contains all of the global environment variables an Immunet Protect agent may reference in the product.

•  install.log

Show a detailed history of our installation process. This includes installation paths, driver load successes and failures and general product file creation at install time.

Exclusion Lists

Now when configured in the 'Settings' tab Immunet Protect will filter out files, directories, file extensions and/or detection names that meet the criteria specified. To enable this feature you simply select the type of exclusion you wish to add, enter the value or select the path and hit the 'Add' button. Note that you will have to hit the Apply button for the exclusion settings to be saved.

 

What's next?

Our expectation is that we will have one release in December 2009 and one in January of 2010 both of which will contain new detection technologies to greatly enhance our ability to detect malware. It is likely that both the December and January releases will be 'forced updates' so you will see your version numbers increment however these releases will likely have little in the way of user facing feature changes. Expect new features in the first calendar quarter of 2010 though, we hope the wait will be well worth it. 

Immunet Protect BETA 1.0.20