IT Endpoint Manager

Unknown Files: The Scanning Processes

• When an executable is first run it passes through the following CCS security inspections: 

• Antivirus scan

• HIPS Heuristic check

• Buffer Overflow check

• If the processes above determine that the file is malware then the user is alerted and the file is quarantined or deleted

• An application can become recognized as 'safe' by CCS (and therefore not scanned in the cloud) in the following ways:

• Because it is on the local Comodo White List of known safe applications

• Because the user has rated the file as 'Trusted' in the File List

• Because the software publisher is rated as 'Trusted' in the Vendor List.

• By the user granting the installer elevated privileges (CCS detects if an executable requires administrative privileges. If it does, it asks the user. If they choose to trust, CCS regards the installer and all files generated by the installer as safe)

• Additionally, a file is not sent for analysis in the cloud if it is defined as an Installer or Updater in HIPS Ruleset (See Active HIPS Rules for more details)

• Cloud Scanning

Step 1 - Comodo File Look-up Server (FLS) 

In order to try to establish whether a file is safe or not, CCS will first consult Comodo's File Look-Up Server (FLS) to check the latest signature databases:

• A digital hash of the unrecognized process or file is created. 

• These hashes are uploaded to the FLS to check whether the signature of the file is present on the latest databases. This database contains the latest, global black list of the signatures of all known malware and a white list of the signatures of the 'safe' files.

• First, our servers check these hashes against the latest available black-list

• If the hash is discovered on this blacklist then it is malware

• The result is sent back to the local installation of CCS

• If the hash is not on the latest black-list, it's signature is checked against the latest white-list

• If the hash is discovered on this white-list then it is trusted

• The result is sent back to local installation of CCS

• The local white-list is updated 

• The FLS checks detailed above are near instantaneous.

• If the hash is not on the latest black-list or white-list then it remains as 'unrecognized'. 

• Step 2 - Vendor Rating 

• If a file is still 'unrecognized' after FLS check up, CCS checks the rating of the software publisher.

• 'Trusted' vendor rating – CCS will award trusted status to the file.

• 'Malicious' vendor rating - CCS will award malicious status to the software file and place it in quarantine.

• 'Unrecognized' vendor rating - The file will keep its unknown status and is run in the container. The file is also sent to Valkyrie for analysis.

• Step 3 - Valkyrie Analysis

• Applications that have neither file rating nor vendor rating are first contained then submitted to Valkyrie for analysis.

• Unrecognized files uploaded to Valkyrie undergo a battery of static and dynamic analysis. At the end of the automated tests, files are analyzed by human experts for confirmation.

• Valkyrie returns its verdicts to CCS which will quarantine, allow or contain the file as appropriate.

• Click here to view Valkyrie online help guide.