Xcitium Unknown File Hunter

• Introduction To Comodo Unknown File Hunter
• Run Unknown File Hunter
  • The Main Interface
  • Login To UFH
• Scan Computers
  • Scan Computers Using Active Directory
  • Scan Computers By Workgroup
  • Scan Computers By Network Addresses
  • Scan Local Computer
• Scan Results
  • Comodo Unknown File Hunter Scan Results
  • Valkyrie Analysis Results
• Reports
  • Executive Report
  • Device Report
  • Program Report
• About Comodo Unknown File Hunter
• Agent Requirements
• About Comodo Security Solutions

Scan Computers Using Active Directory

To scan all or selected endpoints in an Active Directory domain:

• Open Unknown File Hunter

• Click the 'Custom Scan' 'New Custom Scan' button

• Select 'Active Directory' to open the AD configuration screen:

 

• Enter the name of your Active Directory domain and provide admin username and password:

 

• After logging in, he 'Select Computers' screen will open:

• Choose the endpoints that you want to scan and a scan type:

• Quick Scan: Scans critical and commonly infected areas of target endpoints

• Full Scan: Scans all files and folders on target endpoints.

• Click 'Scan Now' to begin the scan.

• Scan progress is shown for each computer, including the number of unknown files and malicious files found so far. Overall scan progress is shown on the menu bar.

• 'Stop Scan' - Discontinue the scan.

• 'Edit Email' - Specify the email address to which the scan report should be sent

The tiles above the scan area show how many files of each type have been found so far:

	Safe files. These files are on the Comodo whitelist are OK to run.
	Unknown, potentially malicious files. These files are automatically uploaded to Valkyrie for analysis during the scan. You can view the analysis results by signing in to your Valkyrie account at https://valkyrie.comodo.com/login You also can sign into Valkyrie with your Comodo Dragon / Comodo One username and password. See 'Valkyrie Analysis Results' for more information.
	Malicious files. These files are on the Comodo blacklist of known malware and should not be allowed to run on your network.

• Click the funnel icon to filter scans by status:

Results are shown when the scan finishes:

Scan Interface - Table of Column Descriptions
Column Header	Description
Name	The name of the computer on which the scan was run. Click '+' to view files discovered on the computer.
Size	The size of the analyzed file.
Verdict	Status of the file. The possible values are: In Progress – Unknown file which is queued for upload to Valkyrie, Comodo's file analysis system Uploading – Unknown file which is currently being submitted to Valkyrie In Analysis – Unknown file which is currently being tested by Valkyrie Clean – Valkyrie tests found the file is safe to run Malicious – Valkyrie tests found the file is harmful and should not be allowed to run No Threat Found – Unknown file which has been passed onto human experts for further testing. Valkyrie's automated tests did not find any malicious behavior, but the file exhibited certain traits which warrant further investigation. We advise you to run this file in the container/sandbox until a full verdict is available, or avoid running it altogether.

• Each scan result is shown on a different row and contains information such as the number and type of files found.

• 'Clean' - Unknown files that have been analyzed by Valkyrie and found safe.

• Click the 'Group By' icons on the right to change how results are displayed:

• Group by Computer: Lists all computers scanned. Expand any computer to view the unknown / malicious files on those computers.

• Group by File: Lists all unknown / malicious files discovered by the scan. Expand any file to view the computers on which it was discovered.

Group by Computer

• Click the computer icon to view results by computer:

• Click '+' beside an endpoint to view the location of the unknown / malicious files

Group by File

• Click the computer with file icon on the right

• Click the '+' beside a file to view the number of instances and the path of the file on the endpoint(s)

Valkyrie is an online file verdict service which analyzes the behavior of unknown files with a range of static and dynamic tests. Unknown files are automatically submitted to Valkyrie.

• Click 'Detailed Scan Results' to view verdicts on unknown files.

• Existing users can login by entering their Comodo username/password, or you can create an account.

• Valkyrie results will be shown in the UFH interface and, in more detail, in the Valkyrie portal:

See 'Valkyrie Analysis Results' in 'Scan Results' for more details.