Currently file modification is not learned in Clean PC Mode or Train with Safe Mode. This increases security but also increases the number of alerts. I think Comodo should alert (rather than learn) only if the file has a network or security policy or if another program is allowed to run it.