Advanced Endpoint Protection

• Introduction To Comodo Client Security
  • Special Features
  • System Requirements
  • Install Comodo Client Security
  • Start Comodo Client Security
  • The Main Interface
    • The Home Screen
    • The Tasks Interface
    • The Widget
    • The System Tray Icon
  • Understand Security Alerts
  • Password Protection
• General Tasks - Introduction
  • Scan And Clean Your Computer
    • Run A Quick Scan
    • Run A Full Computer Scan
    • Run A Rating Scan
    • Run A Custom Scan
      • Scan A Folder
      • Scan A File
      • Create, Schedule And Run A Custom Scan
    • Automatically Scan Unrecognized And Quarantined Files
  • Instantly Scan Files And Folders
  • Process Infected Files
  • Manage Virus Database Updates
  • Manage Blocked Autoruns
  • Manage Quarantined Items
• Firewall Tasks - Introduction
  • Configure Internet Access Rights For Applications
  • Stealth Your Computer Ports
  • Manage Network Connections
  • Stop All Network Activities
  • View Active Internet Connections
• Containment Tasks - Introduction
  • Run An Application In The Container
  • Reset The Container
  • Identify And Kill Unsafe Running Processes
  • Open Shared Space
  • The Virtual Desktop
    • Start The Virtual Desktop
    • The Main Interface
    • Run Browsers Inside The Virtual Desktop
    • Open Files And Run Applications Inside The Virtual Desktop
    • Pause And Resume The Virtual Desktop
    • Close The Virtual Desktop
  • Containment Statistics Analyzer
• DLP Tasks - Introduction
  • Run Data Loss Prevention Scans
  • Manage DLP Quarantined Files
• Advanced Tasks - Introduction
  • Create A Rescue Disk
    • Download And Burn Comodo Rescue Disk
  • Remove Deeply Hidden Malware
  • Manage CCS Tasks
  • View CCS Logs
    • Antivirus Logs
    • VirusScope Logs
    • Firewall Logs
    • HIPS Logs
    • Containment Logs
    • Containment Logs
    • Website Filtering Logs
    • Device Control Logs
    • Autorun Event Logs
    • Alerts Logs
    • CCS Tasks Logs
    • File List Changes Logs
    • Vendor List Changes Logs
    • Configuration Changes Logs
    • Virtual Desktop Event Logs
    • Data Loss Prevention Event Logs
    • Search And Filter Logs
  • Submit Files For Analysis To Comodo
  • View Active Process List
• CCS Advanced Settings
  • General Settings
    • Customize User Interface
    • Configure Virus Database Updates
    • Log Settings
    • Manage CCS Configurations
      • Comodo Preset Configurations
      • Personal Configurations
    • Manage Performance
  • Antivirus Configurations
    • Real-time Scanner Settings
    • Scan Profiles
  • Firewall Configuration
    • General Firewall Settings
    • Application Rules
    • Global Rules
    • Firewall Rule Sets
    • Network Zones
      • Network Zones
      • Blocked Zones
    • Port Sets
  • HIPS Configuration
    • HIPS Settings
    • Active HIPS Rules
    • HIPS Rule Sets
    • HIPS Groups
      • Registry Groups
      • COM Groups
  • Protected Objects
    • Protected Objects - HIPS
      • Protected Files
      • Blocked Files
      • Protected Registry Keys
      • Protected COM Interfaces
    • Protected Objects - Containment
      • Protected Files And Folders
      • Protected Keys
  • Data Loss Prevention
    • DLP Monitoring Rules
    • DLP Discovery Rules
    • DLP Keyword Groups
  • Containment Settings
    • Containment Settings
    • Auto-Containment Rules
    • Virtual Desktop Settings
    • Containment - An Overview
    • Unknown Files - The Scanning Processes
  • File Rating Configuration
    • File Rating Settings
    • File Groups
    • Submitted Files
  • Advanced Protection
    • VirusScope Settings
    • Scan Exclusions
    • Device Control Settings
    • Script Analysis Settings
    • Miscellaneous Settings
  • Web Filter Settings
    • Website Filtering Rules
    • Website Categories
• Appendix 1 - CCS How To... Tutorials
  • Enable / Disable AV, Firewall, Auto-Containment And VirusScope Easily
  • Set Up The Firewall For Maximum Security And Usability
  • Block Internet Access While Allowing Local Area Network (LAN) Access
  • Set Up HIPS For Maximum Security And Usability
  • Create Rules To Auto-Contain Applications
  • Run An Instant Antivirus Scan On Selected Items
  • Create An Antivirus Scan Schedule
  • Run Untrusted Programs Inside The Container
  • Run Browsers Inside The Container
  • Restore Incorrectly Quarantined Items
  • Submit Quarantined Items To Comodo Valkyrie For Analysis
  • Enable File Sharing Applications Like BitTorrent And Emule
  • Block Any Downloads Of A Specific File Type
  • Disable Auto-Containment On A Per-application Basis
  • Switch Off Automatic Antivirus Updates
  • Suppress CCS Alerts Temporarily
  • Control External Device Accessibility
• Appendix 2 - Comodo Secure DNS Service
  • Router - Manually Enable Or Disable Comodo Secure DNS
  • Windows - Enable Comodo Secure DNS
• About Comodo Security Solutions

File Rating Settings

 

Click 'Settings' > 'File Rating' > 'File Rating Settings'

• A file rating determines how CCS interacts with a file:

• 'Trusted' files are safe to run.

• 'Untrusted' files are malware so they get quarantined or deleted.

• 'Unknown' files are run in the container until they get rated as trusted or untrusted.

• The rating of a file can change over time, especially in the case of 'unknown' files. For example, an unknown file might be re-classified as 'trusted' or 'untrusted' after it has been tested.

• You can also configure whether CCS should auto-upload unknown files to Comodo for analysis.

Open the 'File Rating Settings' interface

• Click 'Settings' on the CCS home screen

• Click 'File Rating' > 'File Rating Settings'
  

• Enable Cloud Lookup - CCS checks a file's trust rating on our cloud severs as part of the real-time scan process. (Default and recommended = Enabled)

• Analyze unknown files in the cloud by uploading them for instant analysis - CCS uploads files with an 'unknown' trust rating to Comodo for further analysis. Our experts will analyze the file, award it a trust rating, and add it to the global whitelist or blacklist as appropriate. (Default = Disabled)

• Upload metadata of unknown files to the cloud - Metadata is basic file information such as file source, author, date of creation and so on. If enabled, CCS will also send the file metadata when uploading unknown files to Comodo. (Default = Enabled)

• Do not show popup alerts - Whether or not CCS should show an alert when malware is detected by the cloud scanner (FLS). (Default = Enabled)

• Enabled - No alerts are shown. This minimizes disturbances but at some loss of user awareness.

CCS will automatically block and quarantine the threat.

• Disabled - A rating scanner alert is shown for malicious files.

You can choose from these actions:

• Clean - The program is blocked and quarantined

• Ignore - Allows the file to run. Does not attempt to clean the file or move it to quarantine. Only click 'Ignore' if you are absolutely sure the file is safe. Clicking 'Ignore' will open three further options:

• Ignore Once - The file is allowed to run this time, but it will still be flagged as a threat by future scans.

• Ignore and Add to Exclusions - The file is allowed to run this time, and will not be flagged as a threat in future scans. The file is placed on the Exclusions list, meaning it is ignored permanently by the scanner.

• Ignore and Report as a False Alert - The file is allowed to run this time, and submitted to Comodo for analysis. Select this option if you think the file is safe, and that CCS was wrong to flag it as a threat. Comodo will re-examine the file.
  
  
• Terminate the entire process chain of malware detected by rating scan - When a malicious process is detected, the entire process tree can be terminated instead of the only termination of the Malicious process. 

• Rate applications according to their vendor rating - CCS will give files the same rating as the trust rating of the publisher (software creator). For example - if the vendor is trusted, then all files created by the vendor will be trusted. (Default =Enabled)

• The vendor is the software company who created and digitally signed the file.

• You can view vendor trust ratings in 'Advanced Settings' > 'File Rating' > 'Vendor List'.

• CCS ships with a list of vendors with 'Trusted' status. You can add new vendors to the list and set your own vendor ratings as required.

• The vendor rating priority is shown below:

• Admin

• User

• Comodo

• Click the 'Vendor Rating' link to open the 'Vendor List' screen. See Vendor List for more details.

• Trust files installed by trusted installers - CCS awards trusted status to files whose parent applications are listed in the 'Installer or Updater' rule in HIPS Rules. (Default = Enabled)

• Detect potentially unwanted applications (PUA) - CCS scans will flag applications that:

(i) a user may or may not be aware is installed on their computer

(ii) may contain functionality and objectives that are not clear to the user. 

Example PUA's include adware and browser toolbars. 

PUA's are often installed as an additional extra when the user is installing an unrelated piece of software. Unlike malware, many PUA's are legitimate pieces of software with their own EULA agreements. However, the true functionality of the software might not have been made clear to the end-user at the time of installation. For example, a browser toolbar that tells you the weather may also contain code that tracks your online activity(Default = Enabled).

• Automatically purge unrecognized files every NN hour(s) - CCS periodically checks that all unrecognized files in the list are still installed at the path specified. If not, the file is removed from the list. Select the interval in hours from the drop-down box. (Default = Enabled, 4 Hours)

• Use proxy when performing Cloud Lookup - CCS submits files to FLS for analysis through a proxy. The proxy server is same one that is defined for program and database updates.

• See 'Configure Program and Virus Database Updates' for more details. (Default = Disabled)
  

• Automatically scan unrecognized files at equal intervals - CCS can periodically re-scan unknown files to check whether a new trust rating is available for them. (Default = Enabled and set for every 4 hours).

• Click 'Edit Scan Options' to configure the scan settings and schedule.

 

• Scan Name - The label of the scan. This is pre-configured and cannot be edited.

• Items - The files that are scanned by the profile. 'Unrecognized Files’ is the default. You cannot edit or add files to this profile.

• Scan Options - Configure scan technologies, how to handle threats, and more. See Configure scan options for the profile in Scan Profiles for help with this.

• Schedule - Specify the frequency of the automated scans. See Configure a scan schedule in Scan Profiles for help with this. (Default = Every 4 hours)

• Automatically re-evaluate quarantined files at equal intervals - CCS checks our master online database for the latest trust rating on currently quarantined files. (Default = Enabled and set for once every day)

• Click 'Edit Scan Options' to configure the scan schedule.

• Scan Name - The label of the scan. This cannot be edited

• Items - The files that are scanned by the profile. 'Quarantined Files’ is the default. You cannot edit or add files to this profile

• Schedule - Specify the frequency of the automated scans. See Configure a scan schedule in Scan Profiles for help with this. (Default = Once every day)

• Click 'OK' to save your changes

• Click 'OK' in the 'Advanced Settings' screen for your settings to take effect.