Untitled Document

COVERT

This program is designed to protect the user's actions on the computer from viruses and spyware - Trojans. It prevents the following actions: intercepting keystrokes, creating screenshots of your actions, any covert videotaping of your screen using a special program, prevents the recording of data displayed on the screen (including timeout), hides the contents of the clipboard. The program prevents all attempts to similar actions by using a remote connection.

Short description. The program masks the user's actions, creating a secure platform, which allows you to run applications for work, but makes the process invisible to software - Spyware or surveillance using a remote connection. The program has features that allow detecting Driver spies working at the kernel level. Camoufleur monitors system services, network connection to the computer, the system processes and the clipboard. The program has built-in identification (authorization) feature. Its purpose to protect and fix applications and their data for recover them after the sudden closure. Covert provides quick launch buttons for favorite applications.

System requirements:

• OS Windows

• Minimum screen resolution 800x600

• Pentium processor or better

• 128 MB RAM

• 90 MB free disk space

For full functionality of the program you need admin rights.


2

You can protect yourself from most of the existing methods of computer espionage by pressing just one big button «COVERT» in the main window of the program interface (image № 0). But to get the full range of protection, it is necessary to make some additional actions.

Additionally, it is recommended to check:

1) Driver monitor. (Image № 1)

2) Network monitor. (Image № 2)

3) System services. (Image № 3)

4) System processes. (Image № 4)

5) Monitor DLL. (Image № 5)


0

Click the large button COVERT in the main window to access the secure platform.

Instead of your desktop, you will see the following background image:

This means that you are in the secure platform.


50

You can open Help in the program in two ways:

1) Press "F1" on the keyboard

2) Right-click on the upper frame of the window and in the context menu select "Help".


3

Run Covert-Inst.exe for installing COVERT

In the opened window, select the language and click "Install" button. Default path for installation - C: \ Program Files. If you want to install it to a different location, choose another path by clicking “Browse…”

With a default installation, the desktop shortcut will be created. If you don’t want to create this shortcut, uncheck the corresponding option.

If the installation of the program is successfully completed, you will see this message:


4

Run the setup file of the program COVERT - USB

In the opened window, select the language of interface, letter of your removable media, and click "Install".

If the installation of the program is successfully completed, you will see this message:


5

When you launch the program first time, you will see language selection window and license agreement. Select a language, read the license. If you accept, confirm your selection by pressing the button "Yes, I agree."

After that, the window of the program will be opened.


6

If you see the numbers 1-12 on the buttons in the main window of the program interface, these buttons are not linked to quickly launch applications. To bind the program to the button, click on the button or on the "Settings".

In the settings window, click "Program Path" button under the number for which you want to make the setting.

Select the path to the program that you want to link to the quick launch button. For example, we chose the program WINWORD.EXE

When the choice is made, the icon and the program name appears in the Settings window and the main window.

In order to start the selected program simply click on the name of the program


69

To customize the quick access buttons, open a special window by clicking on the "Settings" button in the main window. Then press and hold the left mouse button on a file or a shortcut of the desired application and drag it into the text field (under the button to which you want assign it). Using this method you can configure all quick start buttons.

If you have a version for PC and you have enabled User Account Control (UAC), you should disable it at this time by using the context menu of the upper window frame. Through this same menu, (UAC) can be turned on again.

(UAC - User Account Control - function which prevents unauthorized changes in system files of the computer. UAC requests permission or an administrator password before making a potentially dangerous action for the computer or when you change the parameters that may affect the work of other users).

(COVERT Pro has administrator rights. If UAC is enabled the user may not have such rights. If you try to drag and drop files between objects with different rights, it will not work.).

If you are using USB version of Covert, then disabling of UAC is not required. You can just run the program without administrator rights and configure quick access buttons without further action.


72

To unassign program from a button, you should click the program shortcut that is assigned for this button in the "Settings" window. In the prompt message you should confirm your action by pressing button "Yes".

To unassign all Quick Launch buttons simultaneously, press the "Clear" button, below the "Settings" window. In the prompt message you should confirm your action by pressing button "Yes".


7

The program has a context menu that you can use for convenience or necessity. To get to the context menu, press the right mouse button on the top frame of the interface of the program or in any list in the program.


8

Right-click on the upper frame of the main window of the program. In the context menu, select "Settings", then "Language".

In the opened window select the language you want to install.

Then press "Select".


54

The "Secure messenger" allows users of COVERT Pro to exchange instant messages within the secure platform. Messages transmitted through COVERT server (as a test), or user’s server, which is specified in the settings. Program is stores your messages in encrypted form on the server and deletes them after reading by recipient. COVERT Pro server deletes unread messages automatically when they stores more than one day. After closing Covert Pro, history of your correspondence will be cleaned in order to prevent its theft by spyware.


63

To create your first contact, left-click on the blank field of contact list and choose “Add”, or right-click on top frame “Settings”. Select avatar, enter the number, name, and encryption key. Confirm your action by pressing "Save" button.

If everything is successful, you will see confirmation message and new contact in the address book. To add another contact, delete, or modify the old one, you can use the context menu in the address book (right click on the contact).

After adding contacts to the address book, you can select any person (by left click) and all his/her data will appear automatically in the appropriate field for sending message.


60

To enter the secure messenger, press the appropriate button of the main menu. The messenger window consists of three main blocks. The left block contains a list of contacts. In the center, the text of the received and sent messages is displayed. To the right is a list of sent and received but not read messages.

To send or receive messages, you do not need to register. You do not need to enter your login and password.

The address for communication is a unique serial number of the program that creates COVERT Pro for each computer or flash drive. For messaging, you need to know the serial numbers of the installed programs on the recipients' PCs. There is a field for entering the destination number in the upper right corner of the central part of the menu. It must be filled in before sending the message. At the time of receiving the message, the sender's number will appear in it. You can send a reply to this number.

The message text must be entered in the appropriate field of the central part of the menu. Before sending, make sure that you have filled in the encryption key and the recipient's number.


53

Secure messenger is free in the unregistered version of COVERT Pro with some limitations:

1. There is no possibility in the settings to specify the parameters of your server to organize your own secret channel of correspondence. All messages are sent through COVERT Pro server, which is provided for testing purposes, and its settings can be changed automatically. After changing the server settings, it is necessary to reinstall the program.

2. The server may not store more than 5 messages simultaneously. According to the algorithm of the messenger, the message will be automatically deleted from the server immediately after reading it. For the unregistered version, the server can have no more than 5 unread messages. If at least one of them will not be read and deleted, the sixth message cannot be sent.

3. The duration of one session of the messenger is limited to 5 minutes. Once this time expires, a message appears about the end of the session. After that, for the same term, you can reopen the messenger. By the number of sessions, there are no restrictions. The chat history will be lost after the session ends.

4. User of the unregistered version can create up to 5 contacts in the address book of the messenger.


55

“Information field” in the lower right corner of the interface shows messages about performed actions and their status. Its inform user about possible problems with Internet access or access to the server, the status of the messages (sent, delete from the server) and provide other useful information.


56

The key is used to encrypt a message that will be sent to the user. The recipient needs to know the key to read the message. The encryption key can be used in two ways:

The first is the introduction of the key in the "Encryption key". You need to specify the recipient number (it is the serial number of his COVERT Pro copy) in the upper right corner and enter the encryption key. To read a received message, you need to enter the encryption key manually. If the recipient is in your contacts, then there is a more convenient way to use encryption key.

The second option will automatically fill the field with the encryption key when sending or receiving messages. It is necessary to specify the encryption key when you create a contact, or if the contact has been created, then select it from the context menu of the contact list. To do this, select "Edit contact", enter in the field "Encryption key" right number and click save. This way you can change the key in the contact list for each contact unlimited number of times.

If the recipient is in your contacts list and he/she has the encryption key, the encryption and decryption of messages in correspondence with the user will occur automatically. Recipient number and encryption key will be automatically entered in the appropriate fields. In order to read the received message from the user who is in your contacts list, double-click on the message with the left mouse button or via the context menu select "Open". The program determines the decryption key, taking it from the contacts list.


65

When you send a message to a contact, the information line of your letter appears on the right side of the messenger interface. It will remain in the right window until the recipient opens the message.

If the information about the sent message disappears, it would mean that the letter was read by the recipient.


66

After sending the message, in the right part of the window appears information line. It will be there until the recipient reads this message. If you change your mind to send it or you want to edit this message, then using the context menu you can delete or open it.

If you select "Open", the text of the message appears in the box for writing a message, where you can edit it and re-send.


57

It is possible situation when encryption key is forgotten or unknown at the time of receiving message. The text, which was opened with the wrong key will be unreadable. To avoid losing this message, until it is decrypted, it is not recommended to open or send other messages, because ability to decipher correct key will be lost. You need to know the correct key, enter it into the "Encryption key" field and press "Update" button. If the encryption key is valid, correct text will appear in the message field. If the key is not suitable again, your message will be unreadable. You have got three attempts to decode the message. If wrong key is entered three times, the message will be deleted permanently.


58

Our secure messenger has ability to send message to itself, putting sender number as recipient. This can be useful for COVERT Pro USB users to save important data. For example, user specifies the encryption key that only he knows and sends a message with important information on his/her own number. Then retrieves from computer USB flash drive with COVERT Pro USB and goes to another place, city or country, where connects this USB flash drive to the computer, specifies the encryption key and receives his/her own message. When user moving from one location to another, his/her message is stored in encrypted form on the server that was specified in the program settings. After message opening, it will be deleted from the server.


59

Instant messaging in a secure correspondence goes through a transit server. It is possible to specify parameters of your server. Considering the fact that after reading messages are deleted, opportunity to change server can significantly increase level of protection of messages. Only user of Covert Pro knows which server is currently in use for correspondence.

To enter the settings of your server, you should click with right mouse button on top frame of the window and select item “Settings” in context menu, then “Server”. There are two options in the opened window.

1. The COVERT server is a test server, which is free for all users. Its parameters can be automatically changed without prior notice. The Company is not responsible for its smooth operation.

2. “My server” - is a server that indicated by user for the organization of confidential correspondence. Server settings can be the same for a large group of people. For example, employees of one company.

The ability to use your server for correspondence is in registered version only. Using your server does not mean disability of access to the free server. All registered version can send and receive messages through a user-configured server, and through COVERT Pro server. In the context menu, you can select a server for instant messaging..

For the organization of correspondence you can use any server that has the opportunity to work with FTP. If you have your own website then you can simply create a folder on it for FTP access using username and password.

Go to site administration panel, in the "Files" section, select "FTP Accounts".

In the opened window enter your login, password and click “Create FTP account”.

After you create your account, copy IP of the site in the administration panel.

You can enter and save Login, password and IP in the settings of messenger.

You can share settings of your server with any number of your contacts for correspondence. You can change your server settings as often as you want.


61

The designation of message icons.

Sent message.

The received message.

Message sent to your number.

Warning, the message is sent to the server for more than six hours.

The sent message is on the server more than 24 hours. Remove it or it will be deleted automatically.


62

In order to identify sender of the message in unread list, clicks on it once with the left or right mouse button. The message will be highlighted in blue, and in the same color will be highlighted sender of this message in the contacts list.

Similarly, you can identify to whom in list this message was sent. Click on it once with the mouse and in the contacts list you will see highlighted contact.


64

Color blinking in the lower right corner shows the process of secure messenger work.

Green – data processing server.

Rifle-green – data processing on the computer.

Yellow – error.

Red – delay with processing. That may occur due to poor Internet access, CPU utilization, or other causes.


20

When you put the mouse cursor over some of the objects in the interface, you will see pop-up hints. Some actions may be accompanied by sounds.

To disable this feature, click on the "Settings" button in the main window.

In the settings window check "Off".


9

How to use the clipboard inside COVERT.

You can copy the desired piece of text using a standard context menu - select it, right-click and choose "Copy"

to insert text from the clipboard, you can use the keys Ctrl+9 ,

The usual way "Paste" from the context menu does not work inside the secure platform.

This is because conventional buffer now contains no information. Information is in an internal buffer that exists in the program.

The indicator in the interface is marked in black. This suggests that internal buffer contents information and this information utilize 60% of buffer.

You can you insert this text in your documents from the internal buffer. The substitution of the buffer needed to protect information that spyware could get from the system clipboard.

If the clipboard is locked or does not work, its status will be displayed in red.

To clarify the reasons for blocking the system clipboard, use the “Clipboard monitor".


10

For exit from the secure platform, click "Exit" button in the main window. You can click "Exit" from the context menu or the red X in the upper right corner of the window.


11

If you exit the program without closing applications that worked in the platform, the secure platform is not deleted from memory, and continues to exist with all your unclosed applications. If you use the old ID, you can return to the platform with opened applications and continue to work. In some cases, it is very convenient. However, there are situations when you need to exit quickly, and you have many opened applications with private information in platform. Closing all applications can take a long time.

For such cases, the program has an emergency exit function, which allows you to close the secure platform and all running applications inside it automatically.

Emergency exit can be activated in two ways:

First, through the context menu in the "Opened programs in platform", right-click on any program in the list, and select "Emergency Exit".

The second way - through a combination of keys on the keyboard. Simultaneously press the left arrow, down arrow and right arrow. These buttons are close to each other and you can quickly press them with one hand.


12

ID - digital combination that accompanies each entry in the platform-camoufleur, protecting it from external influences possible malware activity. With each new entry, the user can enter any combination of numbers, or add/remove numbers from the current ID, which was created earlier.

If you quit from the platform, which continued to work running your application that you want to come back later, do not change the ID, or you create a new secure platform from which you will not have access to applications running on the platform with the previous ID.

Remembering previous IDs, you can work in two or more platforms simultaneously with different applications, moving between platforms, indicating IDs from different platforms that you create.

If you create a lot of platforms with different applications running in them, and you need to urgently close all platforms, it will be enough to open Covert, without going into a secure platform, and in the "running programs in the platform," then click "Close all processes" or "Emergency Exit".


13

You may find running programs, which were launched not by the user. When you open the main application, it can run an additional process. The same behavior is typical for malware, including spyware. They launch themselves by clinging to conventional applications, and the user has no idea that he launched a malware program.

Internal protection mode is designed to control running applications inside of the platform. There are three modes in camoufleur.

Mode "0". Protection against unauthorized launch is disabled

Mode "1". Tracking of self-launching applications.

In this mode, all applications that start their own additional processes are highlighted in yellow in the list "Programs open in the platform" and the launch will be accompanied by a warning sound. For example, the program UVScreenCamera triggers additional process SoundRecorder.exe, which is involved in its work. It is impossible to know about this process under normal use of the application.

Mode "2". Block self-launching applications.

The second mode disables the applications that the user did not commit. Blocking unauthorized launch will be accompanied by a short beep. In the "Programs open in the platform" will only display program launched by the user.

If the item in list of "Programs open in the platform" is highlighted in red, it means that the running application is in the database of threats.

Thus, the user will always be able to know and control all processes running in the platform camoufleur.


47

Internal protection mode is designed to control running applications inside the platform. Camoufleur has three modes .

Inside the platform, in any protection mode - 0,1,2 , camoufleur will automatically monitor and block hidden processes. During the blocking of hidden process you will hear a click, the same as in protection mode 2 when blocking the launch not authorized by user. And only in a situation when camoufleur wouldn’t be able to stop the process you will hear an alarm sounds and the electric discharge sound every 10 seconds until the user changes the login ID and create another platform with another ID. Some spyware can be neutralized only by rebooting the system. In this case, it may help to move to another platform with different ID.


14

Camoufleur can protect you from many of the methods of surveillance implemented by spyware. However, there are many legitimate programs collect and store the information in the system for their needs, and sophisticated spy can get access to this information and send it to their owners. For example, all Internet browsers store data about the pages you have visited - for history, autocomplete and quickly display pages. Any program-messenger keeps your correspondence in the archives and databases.

That is why for the full protection of your actions inside the secure platform to prevent information leakage, you need to disable in programs the ability to collect and store information about your actions.

To disable saving information in your Internet browser Mozilla Firefox, go to Options -> Privacy -> Set "Never remember history."


15

Camoufleur can protect you from many of the methods of surveillance implemented by spyware. However, there are many legitimate programs collect and store the information in the system for their needs, and sophisticated spy can get access to this information and send it to their owners. For example, all Internet browsers store data about the pages you have visited - for history, autocomplete and quickly display pages. Any program-messenger keeps your correspondence in the archives and databases.

That is why for the full protection of your actions inside the secure platform to prevent information leakage, you need to disable in programs the ability to collect and store information about your actions.


18

Camoufleur can protect you from many of the methods of surveillance implemented by spyware. However, there are many legitimate programs collect and store the information in the system for their needs, and sophisticated spy can get access to this information and send it to their owners. For example, all Internet browsers store data about the pages you have visited - for history, autocomplete and quickly display pages. Any program-messenger keeps your correspondence in the archives and databases.

That is why for the full protection of your actions inside the secure platform to prevent information leakage, you need to disable in programs the ability to collect and store information about your actions.

To disable storing information in Skype, go to Tools -> Privacy settings -> Security -> Keep history for -> set "no history" -> click "Clear history" and "Save."


19

Camoufleur can protect you from many of the methods of surveillance implemented by spyware. However, there are many legitimate programs collect and store the information in the system for their needs, and sophisticated spy can get access to this information and send it to their owners. For example, all Internet browsers store data about the pages you have visited - for history, autocomplete and quickly display pages. Any program-messenger keeps your correspondence in the archives and databases.

That is why for the full protection of your actions inside the secure platform to prevent information leakage, you need to disable in programs the ability to collect and store information about your actions.

To disable storing information in ICQ, go to Menu -> Settings -> Privacy -> Messages -> All messages -> Delete all.


71

You can change the speaker volume and microphone settings in the window named "Sound".

You can open "Sound" options using context menu in the main window. Press right mouse button on the top frame of the window and select appropriate item from the list.

You can make changes by dragging the slider left or right. You can turn off the device completely by pressing microphone or speaker icons. You can turn it on by pressing this icon again.


21

To switch between programs in a secure platform, use the key combination Alt+Tab.

Navigate through the window of your running programs to the desired application.

You can switch between applications in the "Open programs inside the platform." Click the left mouse button twice on the desired program, or in the context menu, and then select "Open."


22

Software license - it is a legal instrument that defines the use and distribution of the software copyrighted. Software license allows the user to run one or more copies of the program. Using without a license is a violation of copyright.

You will see a window with a license to use the program you first start, or by clicking on "About the program" in the main application window.

Next, click on the word "license"..

You can read the full license using scrolling down.


25

Click in the main window "Register" button.

In the opened window, in the box "Serial number" you will see the unique number, which was generated by the program. Number is unique to each computer. To use the program in full mode, you need to send this number to the email address of the developer. After payment, you will receive a registration key.

You can send the serial number of the program in different ways. You can click on the "Send serial number to generate the key" in the registration window. This will open the e-mail program to send a message, which by default is installed in your system. All data for key generation, including e-mail, will be collected automatically. You only need to click the "Send" button.

If in your operating system e-mail program is not configured, you can copy the serial number to the clipboard by pressing the button in the registration window: "Copy the serial number in clipboard" and send it to the developer using any web-mail.

Generated key to the program will be sent to your email address (from which you have sent the serial number) as soon as your payment will be identified.

You need to enter the key in the special field for registration and press "Register". You can paste the key from the clipboard using the button in the registration window: "Insert data from the clipboard."

If the key is correct, you will receive a confirmation that the program is registered.

After registration of the program, you will be able to use all functions without restrictions.


26

Demo or trial version of the product. Demo version gives possibility to explore and verify the claimed functionality of the program.

To test the functionality provided in the demo, launch a program for capturing data from the keyboard and screen, then go inside the secure platform by pressing the large button with the name of the program. In this demo, you can run only Notepad inside the secure platform, in which you can type text for checking security of the keyboard input.

After the end of the text entry, exit the secure platform and check - whether programs for capturing data received information about your actions performed in camoufleur.

In this demo, you can also check the operation of the monitor system status, but with a time limit.


27

№1. Clipboard – use of internal clipboard in percentage. Internal buffer can contain no more than 10,000 characters.

№2. CPU load - shows how a CPU is loaded. This index indicates how much CPU resources is used at any given time to process the information.

№3. Platform load – how much CPU resources is used by platform.

Most of the load on the CPU create applications that are running. CPU load increases when you run any application, and we can see how it has grown in "CPU load". At 100% load the computer starts to hang, applications run slowly.


28

"Network Monitor" is intended for monitoring a computer network. You can see list of programs having an active network connections presently in the Network monitor.

In the list you can see the name of the application that has access to the network, PID (process ID in the system), the connection protocol, local IP address and local port, remote IP address and remote port, connection status, and the path to the executable file.

In this monitor you can see the other types of connections. If you click on the word "App" in the top of the list, or select from the context menu "Connections", there will be lines highlighted in yellow, green and red.

Yellow means that the application waits for a connection, but doesn't have it yet

Green - are applications that have an active connection at the moment.

Red color indicates that the application requesting the connection is in the the base of threats and will be permanently blocked.

If the Network Monitor you see a program that you did not run, or suspicious, you can add it to the "Base threats" by double-clicking the left mouse button on an item in the list with the name of the application. You can click on the item, right-click on the shortcut menu, select "Add to database threats." You can also disconnect the connection or terminate suspicious process.

If in Network Monitor you see a program that you did not run, or suspicious, you can add it to the "Database threats" by double-clicking with left mouse button on an item in the list with the name of the application. You can right-click on the item, and in the shortcut menu select "Add into database threats." You can also disconnect the connection or terminate suspicious process.


29

"Database threats" - is an internal database, which contains the names of the application files that were placed there based on study of different types of spyware threats.

A user can add or delete information from the database threats, using the right button. "Refresh" button updates the information that is stored in the database of threats after adding or removal of data.

Database of threats used by many functions of the program, such as: "Network Monitor", "P rograms open in the platform", "System services" and "S ystem processes." If the name of the running application will be the same with the existing name in the database, it will be highlighted in red. It is necessary to pay attention as a possible threat.

On the screenshot of the monitor "System processes" threat highlighted in red:

In the "System services" in red highlighted a service that is in the database of threats. Using it attacker can gain access to the user's desktop


30

"Database allowed" - it is an internal database, which consists of the names of the drivers and services that are marked by the developer or by the user, as useful or system. «Driver Monitor» and «System Services» use this database. When name of a file the same as in this database, it will be highlighted in green in the list.

Yellow indicates that the user and the developer have not approved the file. It is necessary to study and make a decision. If you know of its origin or confident that it will not bring harm to your system, you can add it to the allowed database via the context menu.

After the file is added to the database allowed in the driver list it will be marked in green, as an approved.


31

"Database prohibited" - it is an internal database of drivers that have been placed in it by the developer in result of research of different types of spyware threats or by the user. This database is available only in the "Driver Monitor" When the name of a file the same as in the database, it will be highlighted in red. This database has priority over the database allowed. If at the same time we add the same data in both databases, the item in the list will still be highlighted in red. Yellow color in the list indicates that the user and the developer have not approved the file. It is necessary to study and make a decision. If you know that a file or spyware can damage your computer, add it to the database prohibited via the context menu, or add it to the database using the buttons below. The driver will be identified as a threat.

After adding a file to the database prohibited, in the driver list it will be highlighted in red.


32

"Process termination" - it is an internal database, which contains the names of the applications that were placed there based on study of different types of spyware threats by the developer or by the user. This database is available only in the "System processes." When the file name coincides with the one in the database, the process is automatically terminated.

There are such spyware or malicious processes that automatically start the services of the system or other processes. Once you have terminated this process, it immediately start again. If you add it to the database "Process termination" then Covert will automatically terminate any of its launch and will not allow it to work.

You can add the file name to the database "Process termination" from the context menu, or use the buttons that are below.

Warning! Constant processes termination from the database "Process termination" occurs only if the “System processes” window is opened.


33

Inside camoufleur in the windows "S ystem processes," "Driver Monitor" and "System Services" you can use the search function to obtain the necessary information.

For example, you need to find a service "WdiServiceHost", but you do not remember its name. You remember only that the title letters were "wdi". Enter them in the search box and click "Search". Any item in the list, which will be attended by words with these letters will be highlighted in purple.


34

The "System processes" provides information about the processes that are running on your computer.

You can open the "System Processes" by pressing the "System Processes" button in the main window, or via the context menu of the application by right clicking on the top bar of the window.

The process - means running program (system or application).

In Windows, there are dozens of processes. Each process is responsible for performing a particular function: one monitor connected devices, others take care of the maintenance of your Internet connection, and others perform their tasks. However, periodically, some processes are clearly superfluous, and their presence only slow down your computer. It is necessary to pay close attention. Some processes are simply dangerous and you need to get rid of them as quickly as possible.

One of several methods for detecting viruses and spyware on your PC - check running processes. Any program or service has its own process, and some have several. For example, the process of the program and the process of checking for updates of the program. Each of these processes consumes a certain amount of system resources and is displayed in the list of processes.

In the list of system processes, you can see the columns: "App" (application name), "ID" (a unique identifier of the process), "Start-up time", "Address" and "Company".

Green color are highlighted system processes. (Processes created by the system).

Yellow are highlighted processes that are pretend to be systemic. (That is, it has the name of a system process, but it is in the wrong directory).

Highlighted in red are applications that are listed in the "Database threats."

For the termination unwanted processes, you can select the appropriate item in the context menu, or click on "End Process".

After the warning, make a decision, but be very careful to avoid harm the system.


37

"Hidden processes monitor" - is a special function that is used to detect and display the list of hidden processes (rootkits).

The list of hidden processes has columns: "№", "Handle (unique identifier of the window)", "Process", "ID", "Class", "Parent" and "Address".

Hidden processes (rootkits), and other malware software can not be seen in a standard way in the processes of the system.

For viewing hidden processes in your system click the "hidden processes" in the "system processes."

For the experiment, we run the program (rootkit) with the name of the process WinHide.SB.exe, which hides itself and another program ZapuskSystem.exe from standard lists of processes.

In the standard list of processes, we do not see these programs.

In "Hidden processes monitor" program (rootkit) and hides the application were immediately detected and highlighted in red.

For interrupting hidden processes, you can use the context menu.

When a message appears with a warning, make your choice, but be very careful not to harm the system.


36

The "Driver Monitor" is used to display the list of active file system drivers.

You can open the "Driver Monitor" by pressing the button "Driver Monitor" in the main window, or select an item from the context menu of the application by right-clicking on the top bar of the window.

File system driver is a software component that interprets the file system structure and provides a logical hierarchical view using its applications. It can be part of the operating system or third-party vendor provided as a separate module.

In the list of drivers, you can see the columns: "№", "Name", "Driver", "Driver path", "Description", "Driver Type", "Type of loading" and "Status".

Green color displayed drivers that are added in the "Database allowed."

Yellow - indicates that the file has not been approved by the developer and the user.

Red color highlighted drivers that are listed in the "Database of threats".

Gray color highlighted drivers that hide its presence in the system, or do not exist at the specified path.

The list of drivers opens by default in the "Active Drivers" mode.

To view all the available drivers in the system, click the "All drivers"

The driver - a program that provides interaction with the computer hardware and devices. Equipment installed in a PC or connected to it, such as a video adapter or a printer, can not operate without the drivers.

If you want to remove spyware or malicious driver, you can choose from the context menu "Remove driver"

You will see a warning message about the dangers of this kind of action.

If you are confident in your intentions, click "Yes".

After removing the driver you need to restart your computer.

Warning! When working with Windows drivers you should stick to the principle: if you do not know, do not touch. If you know, then think twice, and then taking action.


35

The "System Services" is used to display the list of running services.

You can open the "System Services", clicking on "Service System" in the main window, or by selecting the appropriate item in the context menu of the application that is called by pressing the right mouse button on the top bar of the window.

Services - are applications running in the background during system boot or when specific events occur, and provides the basic functionality of the OS. Typically, the service does not have a GUI, so their work is usually not noticeable to the user.

In the system services list you can see the columns: "№", "Service Name", "Display Name", "File Name", "Status", "Startup type" and "Address".

Green color are highlighted services that are added in the "Database allowed".

Yellow color indicates that the file has not been approved by the developer and the user.

Red color highlighted apps that are listed in the "Database of threats".

The gray color highlighted applications that hide its presence in the system, or do not exist at the specified path.

By default, the list of services opens in "Active services."

To see all the services available in the system, click the "All Services".

In the list of all services yellow point indicates that the file name is recorded in the service "Base threats" but does not currently pose a threat, as the service is disabled.

In the list of all services yellow color indicates that the service name entered in the "Database threats" but does not currently pose a threat, because the service is disabled.

Highlighted in red are the services that are listed in the "Database threats" and are currently active.

If you want to stop the service, run or delete it, use the context menu or the buttons on the right. Similarly, you can change the service startup type.

Before performing any action alert appears:

To complete the actions confirm your intentions.

Warning! When working with Windows, you should stick to the principle: if you do not know, do not touch. If you know, then first carefully evaluate consequences, and then performs actions.


35

The function of "Monitor DLL" displays the list of loaded DLL when COVERT Pro is running.

To open the loaded DLL, you need to click "DLL Monitor" in the main menu or select appropriate item in the context menu by right-clicking on the top frame of the application window.

DLL (Dynamic Link Library) is a library that contains code and data that can be used by more than one program at a time. Thus, each program can use a function that is contained in the DLL library.

UAC can be disabled in the context menu that appears by right-clicking on the frame of the window.

(UAC is a security feature of Windows which helps prevent unauthorized changes to your computer).

The services that are added to the "Allowed database" are highlighted in green.

The yellow color informs you that this file is not approved by the developer or user.

Applications that listed in the "Database threats" are highlighted in red

By default, the list of loaded libraries is in "Connected DLL."

The "File analysis" shows in red the files listed in the "Database threats"; yellow color for files which are recommended to check first of all; white color shows that with very high probability these files are belonging to the operating system.

To neutralize the spyware library, click right mouse button on the related row in the list and in the context menu select “Disable”.

After this action this warning appears:

To complete this step confirm your intentions.

If the operation is successful the string with removable library will be grayed out and a confirmation message will appear.

To complete disabling of the DLL you have to restart your computer.

Attention! When working with DLLs you should stick to the principle: if you do not know, do not touch. If you know, you should think first, and then make an action.


70

The purpose of function "Clipboard monitor" is to display the list of programs which uses the clipboard of the operating system at the moment.

You can open "Clipboard monitor" in the context menu of the main window. Right-click on the upper frame of the window, and select the appropriate option.

You can see the columns in the list: "N" – the number in the list, "Name" – the name of the program, "ID" – unique number of the process in the operating system, “Time” – indicates time at which the request was sent, "Address" – location of the program.

An application that keeps the clipboard open is highlighted in red in the right field.

An application that copied data from the clipboard last is highlighted in yellow.

Using the context menu, you can start or stop viewing the clipboard, terminate detected process, open its folder and get information about this file in the Internet.

There are two dynamic lists in the Clipboard monitor that process and update the information requested from the operating system every second. After 300 seconds monitor lists are reset and start processing from the beginning.

The left field displays an application that is first in the queue to view the clipboard in case of changing its data. In the right-field there are applications which working with the clipboard at the moment or holding it open.

To see the next process, standing in line for view the clipboard, you have to complete the previous one using the context menu. This way you can see every application that wishes to retrieve data from the clipboard in case it changes.

Another way of identifying applications that intercept data from the clipboard is provocative copy. Open text editor and copy large amount of text at once (so big that it will take more than 2 seconds) while the clipboard monitor is open. Look at the right field, which shows the apps that are running and holding the clipboard open in the time of the copy.

On the image below, in right field, we can see that after provocative copy, two more programs have got the data together with the text editor. In the left field, we see that after the completion of the previous process, there is one more process which standing in line for get data from the clipboard.

Attention! The described methods for detecting applications that use the clipboard are workable only for programs with windows in the system. In other cases it is necessary to use another program monitors.


51

Window "Hidden Services" is responsible for a function that is used to detect and display a list of hidden services (rootkits).

Hidden Services (rootkits) hide themselves and other malware from the standard display of the system services.

To view hidden services in your system click the "Hidden Services" in the "System Services."

For example, we run the spyware (rootkit) that uses a hidden service called "wsjxbqbywjypmp" with the executable file "hcbuooq.exe".

In the standard list of services we do not see this service.

In the monitor of hidden services, you can see highlighted in red service, which hides itself.

To delete hidden services, you can use the context menu.

After the appearance of a warning message, make your choice, but be very careful not to harm the system.


38

Window "Settings" is for setting shortcut keys, sound effects and tips.

You can open the Settings window by clicking on the "Settings" button in the main window.

Alternatively, you can select an item in the context menu of the application.

To enter into it, right-click on the upper frame of the interface.


39

Window "Registration" is intended to display the serial number of the program, for sending it for key generation and registration of the program.

You can open the registration window by clicking on the "Register" button in the main window.

Alternatively, you can select the appropriate item in the context menu of the application.

To enter into it, right-click on the upper frame of the interface.


40

Window "About the program" displays the name of the developer, the program version, the contacts and link to the license of the program.

You can open an information window by clicking on "About the program" button in the main window.

Alternatively, you can select the appropriate item in the context menu of the application.

To enter into it, right-click on the upper frame of the interface.


41

The window "Program choice" is to select applications that run through the camoufleur.

You can open the "Program choice", clicking on "Starting programs" button in the main window.

Alternatively, you can select the appropriate item in the context menu of the application.

To enter into it, right-click on the upper frame of the interface.


42

"Language" window - is designed to change the language of the application.

To access the language selection screen, press the right mouse button on the top of the window frame and in the context menu click on the submenu "Language" in the "Settings".


23

To remove (uninstall) program from Windows, run the installer, which was used to install the program, and in the main window, click "Uninstall the program".

After successfully removing the program, you will see the message.


24

To remove (uninstall) the program from removable USB storage (flash memory), open your device in Windows Explorer and delete the folder with the name of the program. (Right-click on the folder and in the pop-up menu select "Delete.")

In the dialog box that appears, click "Yes".


43

By default, the list of drivers is opened in the "Active Driver" windows.

When you first run Driver monitor, you can see the list with items highlighted in green, yellow and red. It is necessary that the items were only green. This will mean that drivers are known and do not pose a threat. Right-click on the driver highlighted in yellow, and in the context menu, select "Search for information in Internet." For example we take driver with the file name HTTP.sys

You can find information about the requested file on a dedicated server, which contains information about all the Windows system files and files of third-party developers.

.

Search result contains 297 links with information about the requested file. Click on the first one and get the data that we are interested in.

Product: NVIDIA nForce (TM) IDE Driver. Company: NVIDIA Corporation. Directory: C:\WINDOWS\system32\DRIVERS\

As a result, we know that this driver is associated with the graphic card from NVIDIA and is located in the declared directory. You can identify it as a positive and add to the database allowed by clicking on it twice with the left mouse or via the context menu. After adding the driver to the database allowed, click "Save" to update the list and the "Active Drivers".

Yellow, undefined point of our list will be allowed, green. In the same way, study all drivers, which are not highlighted in green, and take action on them.

Many other sources in the Internet provide information about the origin of the files. You can use them by copying filename to the clipboard via the context menu.

After the action, items in the driver monitor should be highlighted in green. This means that all drivers are system or approved, and this computer does not have spies masquerading as a driver.


44

By default, the list of drivers is opened in the "Active Driver" windows.

When you first run Driver monitor, you can see the list with items highlighted in green, yellow and red. It is necessary that the items were only green. This will mean that drivers are known and do not pose a threat. Right-click on the driver highlighted in yellow, and in the context menu select "Search for information in Internet." For example, we take driver with the file name Kutani.sys

You can find information about the requested file on a dedicated server, which contains information about all the Windows system files and files of third-party developers.

The search returns No Result. There is no system drivers with this name and in such path. Among the third party developers information about this file also is not found. So, we have installed driver which does not belong to any of the legal developer.

Add it into database prohibited for further identification. If it ever gets to your computer, it will be highlighted in red. These drivers can be safely removed. Right-click on it, in the shortcut menu select "Remove driver".

In this situation, we are confident in our actions and confirm the removal.

If you remove the driver and restart your computer, the drivers in the list it will be highlighted in red, even if it is not included in the database prohibited. Internal function Driver monitor sees information about the driver in the system, but there is no driver in the specified path. This can be when the driver intentionally hidden by location

Driver is highlighted in red in three cases.

1) When the driver hides itself.

2) There is information in the system about the driver, but the driver is absent

3) The driver name is in the database prohibited.

If you have a situation one or two, after the restart when the driver is highlighted in red, you can make additional checks of its presence in the system. Right-click on the driver and then click "Check the driver path."

If the driver that you check exists in the system, you will see this message. In this case, make a removal again with reboot of the system.

In the case when there is information about the driver and the driver itself is missing or hides itself, the message will look like this.

We are confident in our actions, so click "Yes".

When the driver is not present in the system, we do not need any information about it. If the driver hides itself, removing information about it from the system and restart the computer leads to the fact that the driver will not work.

After the action, items in the driver monitor should be highlighted in green. This means that all drivers are system or approved, and this computer does not have spies masquerading as a driver.

Warning! After these actions, in the Driver Monitor do not forget to update the list of drivers pressing the "Active Driver" and "All the drivers", depending on with which list you are working at the moment.


45

By default the list with the system services is opened in "Active services" mode.

When you open system services, you can see the list with items highlighted in green, yellow and red. It is necessary that the items were only green. Right-click on the service highlighted in yellow, and in the context menu, select "Search for information in Internet." For example we take service with the file name nvvsvc.exe

You can find information about the requested file on a dedicated server, which contains information about all the Windows system files and files of third-party developers.

Product NVIDIA Driver Helper Serviceis powered by NVIDIA Corporation, system path C:\WINDOWS\system32\

From this information we understand that this service is related to the graphic card from NVIDIA and is located in the declared directory. You can identify it as a positive and add to the database allowed by clicking on it twice with the left mouse or via the context menu. After adding the service to the database allowed, click "Save" to update the list and the "Active Services".

Yellow, undefined point of our list will be allowed, green. In the same way, study all services, which are not highlighted in green, and take action on them.

Many other sources in the Internet provide information about the origin of the files. You can use them by copying filename to the clipboard via the context menu.

After the action, items in the system services should be highlighted in green. This means that all active services are system or approved, and this computer does not have spyware.


46

By default the list with the system services is opened in "Active services" mode.

"Database threats" - is an internal database, which contains the names of the application files that were placed there based on study of different types of spyware threats.

If in the system services window, we see a service that is highlighted in red, it indicates that it is in the database threats.

If you have found a threat in the list of services, you can read about it in the Internet. You can stop spyware service or delete it using the context menu in the system services list.

All items in the system services list should be highlighted in green. This means that all active services are system or approved.


47

To run the program inside the platform, you can use quick launch buttons or the "Starting Programs" button in the main window.

Click "Starting programs", select the path to the program, find the executable file, and then click "Open."

You can see running program in the list of "Programs open in the platform"


49

If you attempt to enter the secure platform, a message may appear with information about the insufficient amount of virtual memory to open the program.

Camoufleur must create a special platform for the protection of the user, but the system does not have enough virtual memory. In this case, close all unnecessary windows and applications in the system and retry the entrance to the platform. If these steps do not help, restart your computer. You can click "Yes" in a special pop-up message program.

Virtual memory - a combination of RAM and a temporary storage on the hard disk. If the RAM is not enough, the contents of memory are placed in the repository, which is called the swap file. Moving data in swap file frees enough memory to perform the operation. Generally, the greater the amount of RAM installed in the computer, the faster all programs will work.


50

To use this function, you need to click on the top window frame with right mouse button, and then select “Analysis services” in the context menu. Or choose the special button in the program menu.

The feature "Analysis Services" allows you to identify not working services which prevent normal operation of the system. They are highlighted in gray. Yellow identifies services recommended to check (primarily), white color shows a high probability that these files are belongs to operating system, green - the services which user has saved in internal memory of the program. Red color is for the services which are listed in the "Base threats".

To remove non-working service, right-click on the appropriate line, and select "Modify service tasks." Then click on "Delete."

Attention! When working with Windows services you should stick to the principle: if you do not know, do not touch. If you know, you should think first, and then make an action.


52

svchost.exe — the name of the main process for services that run from dynamic link libraries (DLL). File svchost.exe is located in %SystemRoot%\System32 folder. During the boot process on the basis of entries in the registry svchost.exe makes a list of services that need to be run. Several instances of svchost.exe process can run simultaneously. Each session svchost.exe contains a group of services. Therefore, some services can run depending on how and when svchost.exe has been started.

Sometimes spyware create services that masquerade as legitimate processes svchost.exe or use the system process svchost.exe for their own purposes and launch itself at system startup. Function "Analysis svchost.exe" is designed for the detection and the following deactivation of such services.

Select “Analysis svchost.exe” in the context menu of the window “Hidden services”.

Standard services are marked with a green color. They start from dynamic-link libraries (DLL-files) using the main system process svchost.exe.

For example, let’s run the spyware that creates a service called «svcboot_yvnhea» and uses the system process «svchost.exe», launching library (DLL) svcboot_yvnhea.dll for its own purposes.

Using the “Analysis svchost.exe” we will find this service in the monitor of hidden services - it is marked in yellow. Thus, we will be able to see any service that attempts to exploit the main system process. Using the context menu, we can research the service, stop, delete, disable connected DLL or clear its data in the system. We can save it in the internal memory of Covert, for better identification in the future.

If after researching the newly emerging services, it turned out that it belongs to the applications which you need. Add it to the internal memory via the context menu by choosing "Save to memory". The item in the list is highlighted with a dark green color if you researched and approved this service in your system. During next checks, the program does not react to it as to unknown service.

After adding the service to the internal program memory, this service will also be highlighted in dark green color in the list of “System services” when using “Analysis of services” and in the list of “Hidden services”.

To remove the service from the internal memory, use “Delete from memory” in context menu of the list “Service name”. The string in the list will become yellow or red again, depending on which color was in the beginning.

After using "Analysis svchost.exe", the gray blocks in the service string means that the service has no library (DLL) on the declared path, or it is hidden from the system.

It is possible to check the path to the library (DLL) via the context menu by selecting "Check path" -> "Check the path to the DLL".


36

To use this function, you should click on the top frame of window using right mouse button. In the context menu select "File Analysis".

In the "Analysis of files" you can see highlighted in red files which are in the "Database prohibited", highlighted in yellow - files which are recommended to check (primarily), white color shows a high probability that these files are belongs to operating system, gray - drivers which are hiding their presence in the system or do not exist at the specified path.

Attention! When working with Windows drivers you should stick to the principle: if you do not know, do not touch. If you know, you should think first, and then make an action.


48

FAQ

  • 1) After downloading COVERT, my browser said: "The installation file is downloaded rare and may cause harm to your computer." What should I do in this situation?
  • 2) Do I need to send the serial number for the demo version?
  • 3) What is the login ID?
  • 4) What is the meaning of the highlighted row in the Driver monitor?
  • 5) What is the purpose of the button "recheck" in the Driver Monitor?
  • 6) Why, after adding the driver to the database allowed, when you press on "All the drivers," it once again highlighted in red?
  • 7) What is the sound when you start an application platform in the first and second mode?
  • 8) When you start Internet Explorer in the mode №2, the program loops
  • 9) What is the difference between a "system processes" and the "system services"?
  • 10) Information from the clipboard is not copied immediately after pressing "Ctrl + 9".

Q: After downloading COVERT, my browser said: "The installation file is downloaded rare and may cause harm to your computer." What should I do in this situation?

A: This message appears when you use Internet Explorer. You should click on the "Actions" select "Advanced" and click on "Run anyway".

Q: Do I need to send the serial number for the demo version?

A: Is not necessary. The demo version is designed to review the functionality of the program. In the unregistered version you can see which drivers are installed in the operating system, as well as service and system processes. It allows you to run in secure platform only one application (Notepad), and in this example, check protection against spyware. To enter the platform and launch Notepad please click on the square with the name of the program. Term of work the demo version is not limited. To move to a fully functional version of the program you have to pay for a registration key and send the serial number to generate a unique key.

Q: What is the login ID?

A: Input identifier - a digital combination that accompany each session in the secure platform, protecting it from external influences of possible active malware. With each new session user can enter any combination of digits, or add or subtract a number from the current ID, which was used earlier.

Q: What is the meaning of the highlighted row in the Driver monitor?

A: In the Driver monitor in green highlighted drivers that are systemic or approved by the developer or by the user. Yellow highlighted driver are in the database allowed and not systemic. Red highlighted drivers do not exist in the system, but they have an address, or they hide themselves in the system, or they are in the database prohibited.

Q: What is the purpose of the button "recheck" in the Driver Monitor?

A: Function of Driver monitor - reconciliation of the system drivers with a database prohibited and allowed drivers. If someone has access to your computer, he can install spyware and add it to the database allowed, then the driver will be displayed in green (if it is not in the database prohibited). Based on the probability of possible contamination of spyware from the outside, the user has the ability to double-check database. To do this, click he "recheck". After this, system driver will be displayed in green. Those drivers that have been added in the database allowed will be displayed in white when they have the correct path, and yellow - if the driver has wrong path. The user can do recheck and update the list, after that all drivers must be highlighted in green.

Q: Why, after adding the driver to the database allowed, when you press on "All the drivers," it once again highlighted in red?

A: This means that the driver is in database prohibited. The database prohibited has priority, that mean - if you add the driver to the database allowed and database prohibited at the same time, it will be displayed in red. In red can be highlighted driver, which information is present in the system, but driver is absent. You can check it by clicking the right mouse button on the driver and select in the context menu "Check the driver path". There is another possible reason for which the driver may have a red light. If the driver exists, but hides itself from the system. Hidden driver will also be displayed in red as potentially dangerous.

Q: What is the sound when you login to the secure platform in the first and second mode?

Answer: In the first mode, the sound of electric discharge means that some programs were launched not through the platform and most likely not by the user. In the second mode, COVERT is blocking programs that running not in secure platform or not by the user. You can hear click sounds, which means blocking these programs.

Q: When you start Internet Explorer in the mode №2, the program loops.

A: There are programs that start its extra copy in normal mode. Internet Explorer browser is one of them. After launch, it starts another copy IE. In the second mode of defense COVERT blocks all programs that run itself. The first version of Internet Explorer launched by the user - it is not blocked, and the second copy of the program, launched by Internet Explorer, is blocked. In the Windows XP you can’t launch Internet Explorer in the second mode of protection. In Windows 7 and 8.x, COVERT blocks it. The first program is trying again to run a new copy, which will be blocked again, and so on. To avoid this, you need to use first or zero mode before start Internet Explorer. After Internet Explorer is running (also its additional copy), you can go to the second mode of protection.

Q: What is the difference between a "system processes" and the "system services"?

A: Service - it is an internal mechanism of operating system Windows. You can think about service as a special applications running regardless of the current user context. Services can be considered as running tasks in the background without interfering with the operation of the user. Services in Windows are responsible for all kinds of background activity.

Q: Information from the clipboard is not copied immediately after pressing "Ctrl + 9".

A: Such situation can occur if that program into which you want to paste, or any other program at that moment tried to get access to the clipboard. You need to use again the key combination Ctrl+9, and if the clipboard is not busy, then COVERT will paste as expected. Typically, such a situation is very rare, but it is possible.