Wondering what CIS put’s on your system ?
Looking to see if the uninstall was clean ?
Or this could be come helpful if you are looking for what to clean manually.
Below i posted a list of files that the installer creates on your system.
The second post will be the registry changes.
Beware that this logging is taken from a Windows XP 32 bit version install !
(FOLDER) C:\Documents and Settings\All Users\Desktop
(+)(FILE) COMODO Internet Security.lnk
(+)(FOLDER) C:\Documents and Settings\All Users\Start Menu\Programs\COMODO
(+)(FOLDER) C:\Documents and Settings\All Users\Start Menu\Programs\COMODO\COMODO Internet Security
(+)(FILE) COMODO Internet Security.lnk
(+)(FILE) Uninstall or Upgrade.lnk
(+)(FOLDER) C:\Program Files\COMODO
(+)(FOLDER) C:\Program Files\COMODO\COMODO Internet Security
(+)(FILE) cavscan.dll
(+)(FILE) cavscan.exe
(+)(FILE) cavshell.dll
(+)(FILE) cfp.chinese.chm
(+)(FILE) cfp.chm
(+)(FILE) cfp.dll
(+)(FILE) cfp.exe
(+)(FILE) cfp.russian.chm
(+)(FILE) cfpconfg.dll
(+)(FILE) cfpconfg.exe
(+)(FILE) cfplogvw.dll
(+)(FILE) cfplogvw.exe
(+)(FILE) cfpupdat.dll
(+)(FILE) cfpupdat.exe
(+)(FILE) cfpver.dat
(+)(FILE) cisinfo.ini
(+)(FILE) cmdagent.exe
(+)(FILE) COMODO - Antivirus Security.cfg
(+)(FILE) COMODO - Firewall Security.cfg
(+)(FILE) COMODO - Internet Security.cfg
(+)(FILE) COMODO - Proactive Security.cfg
(+)(FILE) crashrep.exe
(+)(FILE) EULA.txt
(+)(FILE) framework.dll
(+)(FILE) HopSurf.exe
(+)(FILE) incompatsw.ini
(+)(FILE) LPSSetup.exe
(+)(FILE) registration.txt
(+)(FOLDER) C:\Program Files\COMODO\COMODO Internet Security\database
(+)(FILE) vendor.nme
(+)(FOLDER) C:\Program Files\COMODO\COMODO Internet Security\repair
(+)(FILE) bases.cav
(+)(FILE) cavscan.dll
(+)(FILE) cavscan.exe
(+)(FILE) cavshell.dll
(+)(FILE) cfp.dll
(+)(FILE) cfp.exe
(+)(FILE) cfp.theme
(+)(FILE) cfpconfg.dll
(+)(FILE) cfpconfg.exe
(+)(FILE) cfplogvw.dll
(+)(FILE) cfplogvw.exe
(+)(FILE) cfpupdat.dll
(+)(FILE) cfpupdat.exe
(+)(FILE) cmdagent.exe
(+)(FILE) cmdguard.sys
(+)(FILE) cmdhlp.sys
(+)(FILE) common.cav
(+)(FILE) crashrep.exe
(+)(FILE) dosmz.cav
(+)(FILE) first.cav
(+)(FILE) framework.dll
(+)(FILE) guard32.dll
(+)(FILE) gunpack.cav
(+)(FILE) heur.cav
(+)(FILE) incompatsw.ini
(+)(FILE) inspect.sys
(+)(FILE) mach32.dll
(+)(FILE) pe32.cav
(+)(FILE) pkann.dll
(+)(FILE) unarch.cav
(+)(FILE) unpack.cav
(+)(FILE) white.cav
(+)(FOLDER) C:\Program Files\COMODO\COMODO Internet Security\scanners
(+)(FILE) bases.cav
(+)(FILE) common.cav
(+)(FILE) dosmz.cav
(+)(FILE) first.cav
(+)(FILE) gunpack.cav
(+)(FILE) heur.cav
(+)(FILE) mach32.dll
(+)(FILE) mem.cav
(+)(FILE) pe.cav
(+)(FILE) pe32.cav
(+)(FILE) pkann.dll
(+)(FILE) unarch.cav
(+)(FILE) unpack.cav
(+)(FILE) unsfx.cav
(+)(FILE) white.cav
(+)(FOLDER) C:\Program Files\COMODO\COMODO Internet Security\Themes
(+)(FILE) cfp.theme
(+)(FOLDER) C:\Program Files\COMODO\COMODO Internet Security\Translations
(+)(FILE) cavscan.arabic.lang
(+)(FILE) cavscan.brazilian.lang
(+)(FILE) cavscan.Chinese.lang
(+)(FILE) cavscan.chinesetraditional.lang
(+)(FILE) cavscan.czech.lang
(+)(FILE) cavscan.danish.lang
(+)(FILE) cavscan.dutch.lang
(+)(FILE) cavscan.english.lang.template
(+)(FILE) cavscan.estonian.lang
(+)(FILE) cavscan.finnish.lang
(+)(FILE) cavscan.french.lang
(+)(FILE) cavscan.german.lang
(+)(FILE) cavscan.italian.lang
(+)(FILE) cavscan.japanese.lang
(+)(FILE) cavscan.polish.lang
(+)(FILE) cavscan.portuguese.lang
(+)(FILE) cavscan.romanian.lang
(+)(FILE) cavscan.russian.lang
(+)(FILE) cavscan.slovak.lang
(+)(FILE) cavscan.swedish.lang
(+)(FILE) cfp.arabic.lang
(+)(FILE) cfp.brazilian.lang
(+)(FILE) cfp.Chinese.lang
(+)(FILE) cfp.chinesetraditional.lang
(+)(FILE) cfp.czech.lang
(+)(FILE) cfp.danish.lang
(+)(FILE) cfp.dutch.lang
(+)(FILE) cfp.english.lang.template
(+)(FILE) cfp.estonian.lang
(+)(FILE) cfp.finnish.lang
(+)(FILE) cfp.french.lang
(+)(FILE) cfp.german.lang
(+)(FILE) cfp.italian.lang
(+)(FILE) cfp.japanese.lang
(+)(FILE) cfp.polish.lang
(+)(FILE) cfp.portuguese.lang
(+)(FILE) cfp.romanian.lang
(+)(FILE) cfp.russian.lang
(+)(FILE) cfp.slovak.lang
(+)(FILE) cfp.swedish.lang
(+)(FILE) cfpconfg.arabic.lang
(+)(FILE) cfpconfg.brazilian.lang
(+)(FILE) cfpconfg.Chinese.lang
(+)(FILE) cfpconfg.chinesetraditional.lang
(+)(FILE) cfpconfg.czech.lang
(+)(FILE) cfpconfg.danish.lang
(+)(FILE) cfpconfg.dutch.lang
(+)(FILE) cfpconfg.english.lang.template
(+)(FILE) cfpconfg.estonian.lang
(+)(FILE) cfpconfg.finnish.lang
(+)(FILE) cfpconfg.french.lang
(+)(FILE) cfpconfg.german.lang
(+)(FILE) cfpconfg.italian.lang
(+)(FILE) cfpconfg.japanese.lang
(+)(FILE) cfpconfg.polish.lang
(+)(FILE) cfpconfg.portuguese.lang
(+)(FILE) cfpconfg.romanian.lang
(+)(FILE) cfpconfg.russian.lang
(+)(FILE) cfpconfg.slovak.lang
(+)(FILE) cfpconfg.swedish.lang
(+)(FILE) cfplogvw.arabic.lang
(+)(FILE) cfplogvw.brazilian.lang
(+)(FILE) cfplogvw.Chinese.lang
(+)(FILE) cfplogvw.chinesetraditional.lang
(+)(FILE) cfplogvw.czech.lang
(+)(FILE) cfplogvw.danish.lang
(+)(FILE) cfplogvw.dutch.lang
(+)(FILE) cfplogvw.english.lang.template
(+)(FILE) cfplogvw.estonian.lang
(+)(FILE) cfplogvw.finnish.lang
(+)(FILE) cfplogvw.french.lang
(+)(FILE) cfplogvw.german.lang
(+)(FILE) cfplogvw.italian.lang
(+)(FILE) cfplogvw.japanese.lang
(+)(FILE) cfplogvw.polish.lang
(+)(FILE) cfplogvw.portuguese.lang
(+)(FILE) cfplogvw.romanian.lang
(+)(FILE) cfplogvw.russian.lang
(+)(FILE) cfplogvw.slovak.lang
(+)(FILE) cfplogvw.swedish.lang
(+)(FILE) cfpupdat.arabic.lang
(+)(FILE) cfpupdat.brazilian.lang
(+)(FILE) cfpupdat.Chinese.lang
(+)(FILE) cfpupdat.chinesetraditional.lang
(+)(FILE) cfpupdat.czech.lang
(+)(FILE) cfpupdat.danish.lang
(+)(FILE) cfpupdat.dutch.lang
(+)(FILE) cfpupdat.english.lang.template
(+)(FILE) cfpupdat.estonian.lang
(+)(FILE) cfpupdat.finnish.lang
(+)(FILE) cfpupdat.french.lang
(+)(FILE) cfpupdat.german.lang
(+)(FILE) cfpupdat.italian.lang
(+)(FILE) cfpupdat.japanese.lang
(+)(FILE) cfpupdat.polish.lang
(+)(FILE) cfpupdat.portuguese.lang
(+)(FILE) cfpupdat.romanian.lang
(+)(FILE) cfpupdat.russian.lang
(+)(FILE) cfpupdat.slovak.lang
(+)(FILE) cfpupdat.swedish.lang
(FOLDER) C:\WINDOWS\system32
(+)(FILE) guard32.dll
(FOLDER) C:\WINDOWS\system32\drivers
(+)(FILE) cmdguard.sys
(+)(FILE) cmdhlp.sys
(+)(FILE) inspect.sys
(+) Registry for all CIS settings is in
HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Comodo Antivirus
(+)(REG VAL) (Default) = REG_SZ, "{4255A182-CAD9-4214-A19B-7BA7FB633BBD}"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CavShell.CntMenu
(+)(REG VAL) (Default) = REG_SZ, "Comodo Antivirus Context Menu Class"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CavShell.CntMenu\CLSID
(+)(REG VAL) (Default) = REG_SZ, "{4255A182-CAD9-4214-A19B-7BA7FB633BBD}"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CavShell.CntMenu\CurVer
(+)(REG VAL) (Default) = REG_SZ, "CavShell.CntMenu.1"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CavShell.CntMenu.1
(+)(REG VAL) (Default) = REG_SZ, "Comodo Antivirus Context Menu Class"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CavShell.CntMenu.1\CLSID
(+)(REG VAL) (Default) = REG_SZ, "{4255A182-CAD9-4214-A19B-7BA7FB633BBD}"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}
(+)(REG VAL) (Default) = REG_SZ, "Comodo AntiVirus"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}\InprocServer32
(+)(REG VAL) (Default) = REG_SZ, "C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll"
(+)(REG VAL) ThreadingModel = REG_SZ, "Apartment"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}\ProgID
(+)(REG VAL) (Default) = REG_SZ, "CavShell.CntMenu.1"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}\Programmable
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}\TypeLib
(+)(REG VAL) (Default) = REG_SZ, "{96D27592-5FAA-4B65-AE65-C41AA290ABCD}"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}\VersionIndependentProgID
(+)(REG VAL) (Default) = REG_SZ, "CavShell.CntMenu"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Comodo Antivirus
(+)(REG VAL) (Default) = REG_SZ, "{4255A182-CAD9-4214-A19B-7BA7FB633BBD}"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\file\ShellEx\ContextMenuHandlers\Comodo Antivirus
(+)(REG VAL) (Default) = REG_SZ, "{4255A182-CAD9-4214-A19B-7BA7FB633BBD}"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Comodo Antivirus
(+)(REG VAL) (Default) = REG_SZ, "{4255A182-CAD9-4214-A19B-7BA7FB633BBD}"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{90EC0BDD-7FC9-47C1-ACE3-C3B2B9A8282F}
(+)(REG VAL) (Default) = REG_SZ, "ICntMenu"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{90EC0BDD-7FC9-47C1-ACE3-C3B2B9A8282F}\ProxyStubClsid
(+)(REG VAL) (Default) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{90EC0BDD-7FC9-47C1-ACE3-C3B2B9A8282F}\ProxyStubClsid32
(+)(REG VAL) (Default) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{90EC0BDD-7FC9-47C1-ACE3-C3B2B9A8282F}\TypeLib
(+)(REG VAL) (Default) = REG_SZ, "{96D27592-5FAA-4B65-AE65-C41AA290ABCD}"
(+)(REG VAL) Version = REG_SZ, "1.0"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{96D27592-5FAA-4B65-AE65-C41AA290ABCD}
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{96D27592-5FAA-4B65-AE65-C41AA290ABCD}\1.0
(+)(REG VAL) (Default) = REG_SZ, "Comodo Antivirus Shell Menu"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{96D27592-5FAA-4B65-AE65-C41AA290ABCD}\1.0\0
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{96D27592-5FAA-4B65-AE65-C41AA290ABCD}\1.0\0\win64
(+)(REG VAL) (Default) = REG_SZ, "C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{96D27592-5FAA-4B65-AE65-C41AA290ABCD}\1.0\FLAGS
(+)(REG VAL) (Default) = REG_SZ, "0"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{96D27592-5FAA-4B65-AE65-C41AA290ABCD}\1.0\HELPDIR
(+)(REG VAL) (Default) = REG_SZ, ""
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup\CDI
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup\CDI\1
(+)(REG VAL) InstallProductPath = REG_SZ, "C:\Program Files\COMODO\COMODO Internet Security"
(+)(REG VAL) Product Name = REG_SZ, "COMODO Internet Security"
(+)(REG VAL) Product Version = REG_SZ, "3.11.108364.552"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup\CDI\1\Shortcuts
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup\CDI\1\Shortcuts\1
(+)(REG VAL) RelativeFol = REG_SZ, "\COMODO\COMODO Internet Security\"
(+)(REG VAL) ShortcutName = REG_SZ, "Uninstall or Upgrade"
(+)(REG VAL) SpecialFolID = REG_DWORD, 23
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup\CDI\1\Shortcuts\2
(+)(REG VAL) RelativeFol = REG_SZ, "\COMODO\COMODO Internet Security\"
(+)(REG VAL) ShortcutName = REG_SZ, "COMODO Internet Security"
(+)(REG VAL) SpecialFolID = REG_DWORD, 23
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup\CDI\1\Shortcuts\3
(+)(REG VAL) RelativeFol = REG_SZ, ""
(+)(REG VAL) ShortcutName = REG_SZ, "COMODO Internet Security"
(+)(REG VAL) SpecialFolID = REG_DWORD, 25
(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
(+)(REG VAL) COMODO Internet Security = REG_SZ, ""C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h"
(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
(+)(REG VAL) {4255A182-CAD9-4214-A19B-7BA7FB633BBD} = REG_SZ, "Comodo Antivirus"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\COMODO Internet Security
(+)(REG VAL) Comments = REG_SZ, "A product from COMODO."
(+)(REG VAL) Contact = REG_SZ, "support[at]comodo.com"
(+)(REG VAL) DisplayName = REG_SZ, "COMODO Internet Security"
(+)(REG VAL) DisplayVersion = REG_SZ, "3.11.108364.552"
(+)(REG VAL) Publisher = REG_SZ, "COMODO"
(+)(REG VAL) UninstallString = REG_SZ, "C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe -u"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDAGENT
(+)(REG VAL) NextInstance = REG_DWORD, 1
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDAGENT\0000
(+)(REG VAL) Class = REG_SZ, "LegacyDriver"
(+)(REG VAL) ClassGUID = REG_SZ, "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
(+)(REG VAL) ConfigFlags = REG_DWORD, 0
(+)(REG VAL) DeviceDesc = REG_SZ, "COMODO Internet Security Helper Service"
(+)(REG VAL) Legacy = REG_DWORD, 1
(+)(REG VAL) Service = REG_SZ, "cmdAgent"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDAGENT\0000\Control
(+)(REG VAL) *NewlyCreated* = REG_DWORD, 0
(+)(REG VAL) ActiveService = REG_SZ, "cmdAgent"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDGUARD
(+)(REG VAL) NextInstance = REG_DWORD, 1
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDGUARD\0000
(+)(REG VAL) Class = REG_SZ, "LegacyDriver"
(+)(REG VAL) ClassGUID = REG_SZ, "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
(+)(REG VAL) ConfigFlags = REG_DWORD, 0
(+)(REG VAL) DeviceDesc = REG_SZ, "COMODO Internet Security Sandbox Driver"
(+)(REG VAL) Legacy = REG_DWORD, 1
(+)(REG VAL) Service = REG_SZ, "cmdGuard"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDGUARD\0000\Control
(+)(REG VAL) *NewlyCreated* = REG_DWORD, 0
(+)(REG VAL) ActiveService = REG_SZ, "cmdGuard"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDHLP
(+)(REG VAL) NextInstance = REG_DWORD, 1
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDHLP\0000
(+)(REG VAL) Class = REG_SZ, "LegacyDriver"
(+)(REG VAL) ClassGUID = REG_SZ, "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
(+)(REG VAL) ConfigFlags = REG_DWORD, 0
(+)(REG VAL) DeviceDesc = REG_SZ, "COMODO Internet Security Helper Driver"
(+)(REG VAL) Legacy = REG_DWORD, 1
(+)(REG VAL) Service = REG_SZ, "cmdHlp"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDHLP\0000\Control
(+)(REG VAL) *NewlyCreated* = REG_DWORD, 0
(+)(REG VAL) ActiveService = REG_SZ, "cmdHlp"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_INSPECT
(+)(REG VAL) NextInstance = REG_DWORD, 1
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_INSPECT\0000
(+)(REG VAL) Class = REG_SZ, "LegacyDriver"
(+)(REG VAL) ClassGUID = REG_SZ, "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
(+)(REG VAL) ConfigFlags = REG_DWORD, 0
(+)(REG VAL) DeviceDesc = REG_SZ, "COMODO Internet Security Firewall Driver"
(+)(REG VAL) Legacy = REG_DWORD, 1
(+)(REG VAL) Service = REG_SZ, "Inspect"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_INSPECT\0000\Control
(+)(REG VAL) *NewlyCreated* = REG_DWORD, 0
(+)(REG VAL) ActiveService = REG_SZ, "Inspect"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdAgent
(+)(REG VAL) DependOnService = REG_MULTI_SZ, "RpcSs "
(+)(REG VAL) Description = REG_SZ, "COMODO Internet Security Helper Service"
(+)(REG VAL) DisplayName = REG_SZ, "COMODO Internet Security Helper Service"
(+)(REG VAL) ErrorControl = REG_DWORD, 1
(+)(REG VAL) Group = REG_SZ, "COM Infrastructure"
(+)(REG VAL) ImagePath = REG_SZ, ""C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe""
(+)(REG VAL) ObjectName = REG_SZ, "LocalSystem"
(+)(REG VAL) Start = REG_DWORD, 2
(+)(REG VAL) Type = REG_DWORD, 272
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdAgent\Enum
(+)(REG VAL) 0 = REG_SZ, "Root\LEGACY_CMDAGENT\0000"
(+)(REG VAL) Count = REG_DWORD, 1
(+)(REG VAL) NextInstance = REG_DWORD, 1
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdGuard
(+)(REG VAL) DependOnService = REG_MULTI_SZ, "FltMgr "
(+)(REG VAL) Description = REG_SZ, "COMODO Internet Security Sandbox Driver"
(+)(REG VAL) DisplayName = REG_SZ, "COMODO Internet Security Sandbox Driver"
(+)(REG VAL) ErrorControl = REG_DWORD, 1
(+)(REG VAL) Group = REG_SZ, "FSFilter Anti-Virus"
(+)(REG VAL) ImagePath = REG_SZ, "System32\DRIVERS\cmdguard.sys"
(+)(REG VAL) Start = REG_DWORD, 1
(+)(REG VAL) Type = REG_DWORD, 2
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdGuard\Enum
(+)(REG VAL) 0 = REG_SZ, "Root\LEGACY_CMDGUARD\0000"
(+)(REG VAL) Count = REG_DWORD, 1
(+)(REG VAL) NextInstance = REG_DWORD, 1
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdGuard\Instances
(+)(REG VAL) DefaultInstance = REG_SZ, "GlobalAttach"
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdGuard\Instances\GlobalAttach
(+)(REG VAL) Altitude = REG_SZ, "321200"
(+)(REG VAL) Flags = REG_DWORD, 0
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdHlp
(+)(REG VAL) DependOnService = REG_MULTI_SZ, "Tcpip "
(+)(REG VAL) Description = REG_SZ, "COMODO Internet Security Helper Driver"
(+)(REG VAL) DisplayName = REG_SZ, "COMODO Internet Security Helper Driver"
(+)(REG VAL) ErrorControl = REG_DWORD, 1
(+)(REG VAL) Group = REG_SZ, "PNP_TDI"
(+)(REG VAL) ImagePath = REG_SZ, "System32\DRIVERS\cmdhlp.sys"
(+)(REG VAL) Start = REG_DWORD, 1
(+)(REG VAL) Tag = REG_DWORD, 9
(+)(REG VAL) Type = REG_DWORD, 1
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdHlp\Enum
(+)(REG VAL) 0 = REG_SZ, "Root\LEGACY_CMDHLP\0000"
(+)(REG VAL) Count = REG_DWORD, 1
(+)(REG VAL) NextInstance = REG_DWORD, 1
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Inspect
(+)(REG VAL) Description = REG_SZ, "COMODO Internet Security Firewall Driver"
(+)(REG VAL) DisplayName = REG_SZ, "COMODO Internet Security Firewall Driver"
(+)(REG VAL) ErrorControl = REG_DWORD, 1
(+)(REG VAL) Group = REG_SZ, "Streams Drivers"
(+)(REG VAL) ImagePath = REG_SZ, "System32\DRIVERS\inspect.sys"
(+)(REG VAL) Start = REG_DWORD, 0
(+)(REG VAL) Type = REG_DWORD, 1
(+)(REG KEY) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Inspect\Enum
(+)(REG VAL) 0 = REG_SZ, "Root\LEGACY_INSPECT\0000"
(+)(REG VAL) Count = REG_DWORD, 1
(+)(REG VAL) NextInstance = REG_DWORD, 1
(+)(REG KEY) HKEY_USERS\S-1-5-21-1229272821-651377827-1417001333-500\Software\ComodoGroup
(+)(REG KEY) HKEY_USERS\S-1-5-21-1229272821-651377827-1417001333-500\Software\ComodoGroup\COMODO Internet Security
(+)(REG KEY) HKEY_USERS\S-1-5-21-1229272821-651377827-1417001333-500\Software\ComodoGroup\COMODO Internet Security\CisMainDialog
(REG KEY) HKEY_USERS\S-1-5-21-1229272821-651377827-1417001333-500\Software\Microsoft\Windows\ShellNoRoam\MUICache
(+)(REG VAL) C:\Program Files\COMODO\COMODO Internet Security\cfp.exe = REG_SZ, "COMODO Internet Security"
(+)(REG VAL) C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe = REG_SZ, "COMODO Internet Security"