IT Endpoint Manager

File Ratings Explained

Comodo Client Security (CCS) rates files on Windows devices as follows:

Unrecognized Files

Files that could not be identified as 'Trusted' or 'Malicious' by Comodo Client Security (CCS). You can review these files and can manually rate them as 'Trusted' or 'Malicious' as required.

Trusted Files

Files that are safe to run. Files can be classed as safe by the following:

• File lookup service (FLS) - Whenever a file is accessed, Comodo Client Security (CCS) checks the file’s reputation on Comodo's online file database.

• Vendor rating - The app was created by a vendor who has a 'Trusted' status in the local vendor list. Open CCS > Click ‘Settings’ > ‘File Rating’ > ‘Vendor List’.

• Admin rating - You can assign a trusted rating to files in Endpoint Manager at 'Security Sub-Systems > 'Application Control'.

• User rating - Users can assign a trusted rating to a file in the CCS interface. There are two ways to do this:

• Security alert - If an executable is unknown then it may generate a HIPS alert on the local endpoint. Users could choose 'Treat this as a Trusted Application' at the alert

• File List - From the CCS home screen, click 'Settings' > 'File Rating' > 'File List'

CCS creates a hash of all files that a user classifies as 'Trusted'. So, even if the file name is changed it will keep its trust status because the hash remains same. This is particularly useful for developers creating new applications which, by their nature, are unknown to the Comodo.

Malicious Files

Files on the Comodo blacklist will be quarantined or deleted by CCS. These files are reported to Endpoint Manager as malware.