COMODO Endpoint Security
Overview
COMODO Endpoint Security is a program developed by COMODO. The most used version is 6.4.33477.2943, with over 98% of all installations currently using this version. Upon installation and setup, it defines an auto-start registry entry which makes this program run on each Windows boot for all user logins. It adds a background controller service that is set to automatically run. Delaying the start of this service is possible through the service manager. A scheduled task is added to Windows Task Scheduler in order to launch the program at various scheduled times (the schedule varies depending on the version). When installed, it will add a context menu handler to the Windows shell in order to provide quick access to the program. The main program executable is cistray.exe. The software installer includes 51 files. In comparison to the total number of users, most PCs are running the OS Windows 10 as well as Windows 7 (SP1). While about 81% of users of COMODO Endpoint Security come from the United States, it is also popular in South Africa and Thailand.
Program details
URL: www.comodo.com
Installation folder: C:\Program Files\COMODO\COMODO Internet Security\
Uninstaller: MsiExec.exe /I{F1EC4151-805B-4097-B9BB-7D71A417AAF1}
(The Windows Installer is used for the installation, maintenance, and removal.)
Language: English (United States)
Files installed by COMODO Endpoint Security
| Program executable: | cistray.exe |
| Name: | COMODO Internet Security |
| Path: | C:\Program Files\comodo\comodo internet security\cistray.exe |
| MD5: | 9a05953dde2032a2248bd8731bc237fe |
Additional files:
-
cmderd.sys - COMODO Internet Security Eradication Driver
-
inspect.sys - COMODO Internet Security Firewall Driver
-
cmdguard.sys - COMODO Internet Security Sandbox Driver
-
cmdhlp.sys - COMODO Internet Security Helper Driver
-
Autoruns.exe - COMODO Internet Security Beta
-
CCE.dll
-
CCE.exe
-
cmdvirth.exe
-
framework.dll - COMODO Antivirus Scan Engine
-
platform.dll
-
signmgr.dll
-
cavscan.exe - COMODO Internet Security
-
cavshell.dll
-
cavwp.exe
-
cavwpps.dll
-
cfpconfg.exe
-
cis.exe
-
cisbf.exe
-
cisbfps.dll
-
cisevlog.dll - COMODO Endpoint Security
-
cisresc.dll
-
cmdagent.exe
-
cmdaruns.dll
-
cmdavcen.dll
-
cmdboost.dll
-
cmdcfg.dll
-
cmdcloud.dll
-
cmdcmc.dll
-
cmdcom32.dll
-
cmdcomps.dll
-
cmdfile.dll
-
cmdinstall.exe
-
cmdlogs.dll
-
cmdres.dll
-
cmdscope.dll
-
cmdstat.dll
-
cmdtrust.dll
-
cmdupd.exe
-
cmdupdps.dll
-
cmdurlflt.dll
-
KillSwitch.exe
-
msica.dll
-
recognizer.dll
-
virtkiosk.exe
-
7za.dll (by Igor Pavlov) - 7-Zip (7z Standalone Plugin)
-
cmdhtml.dll
Behaviors exhibited
Context Menu Handler
- cavshell.dll added to Windows Explorer under the name 'Comodo Antivirus' with a class of {4255A182-CAD9-4214-A19B-7BA7FB633BBD}.
3 Scheduled Tasks
- cfpconfg.exe is scheduled as a task named 'COMODO Scan {DBB22600-F6F5-41E4-866D-B11CBC208853}' (runs weekly on Saturdays at 12:00 PM).
- cis.exe is scheduled as a task named 'Turn On' (runs daily at 9:00 AM).
- cistray.exe is scheduled as a task with the class '{F533530B-90CD-4A0D-BE0C-5676B84616AF}' (runs on registration).
3 Scheduled Tasks (Boot/Login)
- CisTray.exe is automatically launched at startup through a scheduled task named COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10}.
- cfpconfg.exe is automatically launched at startup through a scheduled task named COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.
- cis.exe is automatically launched at startup through a scheduled task named COMODO Welcome {CEB54B45-2B5E-4FF5-9223-6735CD80FE69}.
2 Services
- cmdvirth.exe runs as a service named 'COMODO Virtual Service Manager' (cmdvirth) "COMODO Virtual Service Manager".
- cmdagent.exe runs as a service named 'COMODO Internet Security Helper Service' (CmdAgent) "COMODO Internet Security Helper Service".
Startup File (User Run)
- CisTray.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'COMODO Internet Security' and executes as C:\Program Files\Comodo\COMODO Internet Security\cistray.exe.
2 Startup Files (All Users Run)
- CisTray.exe is loaded in the all users (HKLM) registry as a startup file name 'COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10}' which loads as C:\Program Files\COMODO\COMODO Internet Security\cistray.exe.
- CCE.exe is loaded in the all users (HKLM) registry as a startup file name 'CCE' which loads as "C:\Program Files\COMODO\COMODO Internet Security\CCE.exe" -showlog.
How do I remove COMODO Endpoint Security?
You can uninstall COMODO Endpoint Security from your computer by using the Add/Remove Program feature in the Window's Control Panel.
- On the Start menu (for Windows 8, right-click the screen's bottom-left corner), click Control Panel, and then, under Programs, do one of the following:
- Windows Vista/7/8/10: Click Uninstall a Program.
- Windows XP: Click Add or Remove Programs.
- When you find the program COMODO Endpoint Security, click it, and then do one of the following:
- Windows Vista/7/8/10: Click Uninstall.
- Windows XP: Click the Remove or Change/Remove tab (to the right of the program).
- Follow the prompts. A progress bar shows you how long it will take to remove COMODO Endpoint Security.
OS VERSIONS
Win 10 57%
Win XP 7%
|
|
HOW IT STARTS
Automatically starts? Yes
(Found in the run registry)
|
|
USER ACTIONS
 |
Uninstall it 2%
Keep it 98%
|
|
Windows
Which Windows OS versions does it run on?
| Windows 10 |
57.14% |
|
| Windows 7 |
35.71% |
|
| Windows XP |
7.14% |
|
Which OS releases does it run on? |
| Windows 7 Professional |
28.57% |
|
| Windows 10 Pro |
21.43% |
|
| Windows 8.1 Pro |
14.29% |
|
| Windows 8.1 Pro with Medi... |
7.14% |
|
| Windows 7 Home Premium |
7.14% |
|
| Windows 8.1 |
7.14% |
|
Geography
80.65% of installs come from the United States
Which countries install it?
| United States |
80.65% |
| South Africa |
3.23% |
| Thailand |
3.23% |
| Taiwan |
3.23% |
| Germany |
3.23% |
| Canada |
3.23% |
| United Kingdom |
3.23% |
PC manufacturers
What PC manufacturers (OEMs) have it installed?
| Hewlett-Packard |
54.55% |
|
| Lenovo |
18.18% |
|
| ASUS |
9.09% |
|
| Toshiba |
9.09% |
|
| Acer |
9.09% |
|
Common models |
| HP HP EliteDesk 800 G2 TW... |
16.67% |
|
| TOSHIBA Satellite A665 |
8.33% |
|
| LENOVO 20369 |
8.33% |
|
| HP Compaq dc7800 Converti... |
8.33% |
|
| LENOVO 80FG |
8.33% |
|
| ASUSTeK VM60 |
8.33% |
|
About COMODO
Comodo groups provides computer software and SSL digital certificates as well as offers many products as freemium, but additional features or more featured editions are available for a fee.
Publisher URL: www.comodo.com