Comodo Cleaning Essentials

[just.odd.dude]

Comodo Cleaning Essentials (CCE) is a set of computer security tools designed to help users identify and remove malware and unsafe processes from infected computers.

http://www.comodo.com/business-security ... ntials.php

I doubt that it is completely portable, but still not a bad product as a whole.

[guinness]

I doubt it either. Did you test?

[just.odd.dude]

I use this program for over a year. Really helped a couple of times.
I'm not sure that I can properly verify portability. That's why I created the topic.

[just.odd.dude]

I tried to check with ThinApp. I would call this application portable, but not stealth.
In the registry keeps a record of accepting the license agreement.

[guinness]

Just tested it in and Sandboxie and found it didn't leave settings there, but didn't have chance to look at the registry.

I had 3 threats on my machine but none of them were malicious, I mean my HOSTS file is modified for a reason.

[I am Baas]

Just tested it in and Sandboxie and found it didn't leave settings there, but didn't have chance to look at the registry.

I had 3 threats on my machine but none of them were malicious, I mean my HOSTS file is modified for a reason.

I can't test it under Sandboxie, it needs to load a system driver.

[tproli]

If it installs a driver then it is no way portable.

[guinness]

I can't test it under Sandboxie, it need to load 'blqmhi' driver.

I didn't get that message.

[carbonize]

Well I downloaded this and have so far tried the Autorun Analyzer and Killswitch. Both of these seem remarkably similar in look and functionality to Autoruns and Process Explorer from Sysinternals which makes me suspect they are actually using said software.

[guinness]

No, they are just using the Win32 API to access this info. Pretty easy to do.

[I am Baas]

Finally managed to test CCE...

Version tested: cce_2.5.242177.201_x64

Tested: Not Stealth


[HKEY_CURRENT_USER\Software\ComodoGroup]

[HKEY_CURRENT_USER\Software\ComodoGroup\CCE] ("EulaAccepted")

[HKEY_CURRENT_USER\Software\ComodoGroup\KillSwitch] ("KsAppData" empty key)


[HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo]

[HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo\CCE] ("vendorts")

[HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo\CCE\Options]

[HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo\CCE\PendingOperations]

[HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo\Firewall Pro]

[HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo\Firewall Pro\Data] ("LastAvDetection")