With people making videos on YouTube about CIS and purposely trying to infect a computer running CIS and adding things to run in the sandbox, those unknown things get submitted to Comodo for analysis and inclusion as malware. That is pretty cool actually
