Prepare a way back
Save work. Prepare a restorable VM snapshot and independent backups. Retain recovery information. Quarantine is not a backup.
DOWNLOAD / RELEASE NOTES
Read first.
Then decide whether to test.
26H2-11-10001 · Personal experimental release. Read the documents below before continuing.
EXPERIMENTAL SOFTWARE — PLEASE READ
CC Security is currently experimental security software. We strongly advise against installing or running this product on everyday-use computers or in production environments.
If testing is necessary, please do so only in an isolated virtual machine with Windows Test Signing Mode (TESTSIGNING) enabled, all applicable driver-loading requirements satisfied, and a restorable snapshot available.
This product may cause system crashes, driver conflicts, false positives, data loss, or other unforeseen issues. Do not rely on it as your sole security solution.
Until sufficient validation has been completed, this product is intended for experimental and evaluation purposes only.
The release file
INSTALLER SHA-256
B9A00B8A226D89856E28AC908BAE78EEDCC6A02ACD4B0CBA5D504E5FC450E69AVerified against the supplied EXE. Google Drive content is delivered independently; verify the downloaded file again.
Review every document before downloading.
0 / 9 reviewedApplies to 26H2-11-10001
Read each document and confirm when finished.
Open each document, scroll to the end and confirm reading to unlock download options.
Before installation.
Verify the complete package
Check filename, size and SHA-256. Do not mix services, workers or drivers across revisions. Integrity does not prove freedom from defects.
Check the components
Complete authorized UAC prompts and requested restarts. Verify service, drivers, protection and audit mode. An open interface is not proof of protection.
EXPERIMENTAL SOFTWARE — PLEASE READ
CC Security is currently experimental security software. We strongly advise against installing or running this product on everyday-use computers or in production environments.
If testing is necessary, please do so only in an isolated virtual machine with Windows Test Signing Mode (TESTSIGNING) enabled, all applicable driver-loading requirements satisfied, and a restorable snapshot available.
This product may cause system crashes, driver conflicts, false positives, data loss, or other unforeseen issues. Do not rely on it as your sole security solution.
Until sufficient validation has been completed, this product is intended for experimental and evaluation purposes only.
CC Security Important Safety Notice
CC Security 26H2-11-10001 is experimental Windows security software for personal use, provided by an independent developer. It includes protection and cleanup features that can affect processes, files, services, drivers, and networking. Read this notice before downloading, installing, or authorizing operations. Confirm that you understand the test-environment requirements, false-positive risks, and data recovery risks, and have usable backups ready.
This notice explains actual capabilities and risks. It does not guarantee detection rates, compatibility, data integrity, or production readiness, and does not reduce any non-waivable rights you have under applicable law. The contact email is kelematubako@gmail.com.
1 Current Features and Limits
The current version retains behavioral protection, Intelligent EDR event correlation, relevant memory and activity checks, ransomware protection, tamper protection, advanced threat protection, protection history, quarantine management, and Silver Fox Trojan targeted cleanup. These names describe the purposes of the features. They do not mean that every technique or attack method is covered, or that the product has independent laboratory or government certification.
This version removes ClamAV signature-based real-time file scanning, signature checks when programs and files are opened, file and folder context-menu scanning, related scanning services, and signature-database updates. Silver Fox targeted cleanup and local behavioral detection must not be described as signature-based scanning of all files that remains available. The absence of an alert for a particular file does not mean the file is safe.
Event collection, rule matching, memory visibility, and execution enforcement are subject to operating conditions and resource budgets. Restricted access, disconnected components, load, timeouts, or other errors may leave an operation unchecked or a block unconfirmed, or cause a legitimate program to be blocked incorrectly. Service status, green icons, successful builds, and passed tests cannot individually prove that real threats have been completely blocked.
2 Current Validation Scope
This revision has completed build, installer, and signature checks, regression testing with harmless fixtures, integration of the actual local EDR engine, and interface checks using simulated services. This evidence describes behavior under the corresponding test conditions. It does not replace validation of service startup, driver loading, upgrade cleanup, permission boundaries, attack blocking, overall false-positive rates, or long-term performance on real devices.
As of the date of this notice, complete validation remains unfinished for this revision's end-to-end upgrade and uninstallation on real Windows 10 systems, cross-account UAC scenarios, and system responsiveness after scanning was removed. No measured protection rate or long-term stability conclusion applicable to all users has been published. Prefer an isolated virtual machine with restorable snapshots or a non-critical test device.
3 System Privileges and Drivers
The current release targets suitable x64 Windows 10 and Windows 11 test environments. This does not establish support for every operating system build, ARM64, enterprise security policy, or device combination. The interface depends on WebView2 Runtime. Visual effects and some features also depend on the runtime environment.
The drivers in this package use experimental test signatures and require the device to meet the applicable Windows test-loading requirements in advance. Test signing is not equivalent to Microsoft hardware certification, production driver signing, or approval of the product's security. The installer will not automatically enable Windows test-signing mode for you. If device policy does not permit it, stop installation and assess a suitable test environment. Do not casually weaken protection on an everyday device just to try the Software.
Installation, upgrades, uninstallation, and protected administrative operations may require UAC authorization and may register or stop system services, load or unload drivers, and modify CC's own installation markers and test-certificate configuration. Authorize only a complete release package whose source you have verified. Opening the standard interface does not mean all protection components are installed or connected.
4 False Positives and Automatic Remediation
Security rules may classify legitimate programs, system components, or installation and update activity as suspicious, and may also miss real threats. False positives may prevent applications from starting, interrupt work, disrupt installation or updates, terminate processes, or quarantine files. Do not skip evidence checks merely because a name, path, or detection label appears trustworthy or dangerous.
If you suspect a false positive, first retain the time of occurrence, product version, relevant detection reasons, and sanitized logs, then assess whether the related testing should stop. Do not broadly exclude system directories or disable other security protection to recover a single file. Do not restore content whose purpose and provenance you cannot verify.
Restoring or deleting quarantined items changes file state. Restoration may reintroduce risk, and deletion may eliminate the opportunity for recovery. A successfully quarantined file may have been removed from its original location. An encrypted quarantine vault is not an independent backup. Disk damage, lost keys, incompatible formats, permission changes, or replaced files may all affect recovery. Preserve encrypted data, metadata, and the corresponding keys together; do not separately delete or modify only part of them.
5 Silver Fox Trojan Targeted Cleanup
Targeted cleanup is intended for controlled remediation when a related infection is suspected or confirmed. It may suppress or terminate relevant processes, quarantine files, handle persistence items associated with the threat, and temporarily isolate the network. It may flag legitimate software incorrectly and is unsuitable for routine indiscriminate cleanup when there are no signs of infection.
Before starting, read the confirmation information in the interface, back up important data, and consider the impact of losing remote connectivity. During targeted cleanup, avoid simultaneously running other cleanup tools that modify the same files or system configuration. Distinguish successful, failed, and unconfirmed operations in the results. A "Completed" status does not mean that no remnants or subsequent risks remain.
Cleanup may fail to restore networking completely because of an exit, restart, permissions, service errors, or interference from other software. In that situation, first follow the bundled troubleshooting instructions and retain relevant restoration state and logs. Do not delete restoration state files to force a bypass of maintenance checks.
6 Compatibility with Other Software and Workloads
The project does not guarantee simultaneous operation with every antivirus product, EDR, VPN, anti-cheat system, encryption or backup product, or other file-filter driver. Monitoring, blocking, and recovery actions from multiple products may interfere with one another, increasing the likelihood of latency, resource use, false positives, or system problems.
If system responsiveness declines, applications stutter, false positives become frequent, or conflicts arise, first narrow the test scope and stop or uninstall CC Security using supported procedures, retaining necessary diagnostic information. Do not conceal the problem by disabling your primary security product, adding broad exclusions, or repeatedly forcing retries.
There is currently no fixed performance commitment covering CPU use, memory use, disk latency, or detection time across all devices. The number of background processes does not indicate protection strength. Assess the impact using actual behavior and test results.
7 Installation Upgrades and Uninstallation
Obtain the complete installer through official release channels and verify the published version and SHA-256. Integrity verification helps establish that a file matches the release record. It does not prove the Software is defect-free or suitable for your device. Do not mix services, workers, rules, and drivers from different revisions, or manually replace a single EXE to conceal mismatches between resident versions.
Before upgrading, stop targeted cleanup and confirm networking has been restored. The current upgrade process attempts to place the old protection service into maintenance mode, stop components that need replacement, and remove retired scanning services and context-menu entries. If components cannot be stopped, maintenance fails, or a restart is required, follow the instructions. A failed installation must not be treated as an effective update.
Uninstallation does not promise immediate removal of all data or reversal of Windows boot settings you changed yourself. The current design retains encrypted quarantine data, keys, settings, and evidence to preserve recovery opportunities. Perform further cleanup only after confirming recovery needs. If the desktop is inaccessible or driver or storage problems occur, protect the data first and use authorized system recovery methods. Do not expand the experiment further.
8 Download Page and Official Website Information
The official website should prominently identify the product as a "Personal experimental release" or "Technical preview", allowing people to see test-signing requirements, key risks, and this notice before downloading or taking action. Availability for download does not justify labeling unverified capabilities as "Fully compatible", "Zero false positives", "100% blocking", or "Certified".
The website's privacy information, Cookie choices, or close button cannot replace system authorization during installation or explicit confirmation of high-impact cleanup operations. Ordinary browsing, scrolling, or dismissing a notice does not constitute consent to optional tracking or a waiver of statutory remedies or personal information rights.
9 Support and Problem Reports
The project makes no commitment to round-the-clock coverage, fixed remediation deadlines, production service levels, or recovery from every incident. Contact kelematubako@gmail.com if problems arise. Begin with the version, operating system build, time of occurrence, symptoms, and the minimum necessary sanitized evidence. Vulnerabilities may be reported under the Security Vulnerability Disclosure Policy.
Do not include actual malicious samples, account passwords, recovery keys, complete memory dumps, or other people's information without authorization in an initial ordinary email. Feedback information is handled under the Privacy Policy. We do not interpret feedback as authorization for the Software to upload subsequent files or logs automatically.
10 Liability and Rights Reserved by Law
To the extent permitted by applicable law, this experimental Software is provided in its actual released state, without additional warranties of absolute security, uninterrupted operation, freedom from defects, compatibility with a particular environment, or fitness for a particular commercial purpose. Public descriptions of features and validation must nevertheless be accurate. The terms "Free" or "Experimental" must not be used to conceal known problems.
This notice does not exclude, limit, or require you to waive liability or remedies that cannot be excluded under applicable law, including liability arising from fraud, intentional harm, gross negligence, or unlawful conduct for which liability cannot legally be disclaimed. Mandatory consumer protection, privacy, and data security rights remain reserved. We will not claim that you bear every loss or waive all claims merely because you clicked Download, installed the Software, or dismissed a notice.
This notice operates alongside the End User License Agreement and third-party licenses and does not change rights granted to open-source components under their own licenses. Where a provision is unenforceable in a jurisdiction, applicable law governs to that extent. Legal rights and liability must be determined according to the specific facts and the findings of the competent authority.
11 Updates to This Notice
If features, driver-loading requirements, data handling, or test conclusions change materially, we should communicate the changes through the relevant release notes and an updated notice. Check the full version and revision currently installed. Do not automatically apply an earlier version's documentation to a newer version.
Key Legal and Public References
Microsoft guidance on loading test-signed drivershttps://learn.microsoft.com/en-us/windows-hardware/drivers/install/the-testsigning-boot-configuration-option
California Supreme Court discussion of limitations on liability for intentional torts in New England Country Foods v VanLaw Food Productshttps://courts.ca.gov/opinion/citings-archive/2025-04-24/s282968
Federal Trade Commission information security principleshttps://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business
CC Security Privacy Policy
This policy explains how CC Security software and official websites that explicitly refer to this policy handle information. It covers local security data on your device, feedback you voluntarily submit, and website data necessary for browsing and downloading. The current corresponding software version is 26H2-11-10001. We are the independent developer publishing this project under the CC Security name. The privacy contact email is kelematubako@gmail.com.
Core security analysis takes place locally on your device. Through the current Software, we do not automatically receive your files, process memory, security logs, or device telemetry. We do not sell personal information or share it for cross-context behavioral advertising. Emails and attachments you voluntarily send, and necessary network information processed by the website's delivery services, are separate information-processing contexts, explained below.
1 Scope
This policy applies to the current software version we provide and the official website's presentation and download pages that we publish and that explicitly link to this policy. Third-party websites, email services, operating systems, browsers, and runtime services have their own privacy arrangements. Use of a third-party component does not mean that all its services are under our control.
This policy is organized around applicable United States federal and California privacy requirements and does not exclude other mandatory rights you may have. The project's location in California or availability free of charge does not alone determine whether a privacy law applies. Actual applicability depends on business activities, information processing, and statutory conditions.
2 Information Processed on Your Device
To perform behavioral detection, event correlation, memory checks, ransomware protection, and quarantine remediation, the Software may locally read and record process names, process and thread identifiers, creation times, executable paths, command lines, file hashes, digital signatures, related registry and file operations, image loads, relevant memory regions, event times, detection reasons, and remediation results. Command lines, paths, and fault information may contain usernames, document names, account identifiers, tokens, or other sensitive content.
The Software also locally stores protection settings, exclusions, interface preferences, window positions, notification records, cumulative statistics, and targeted cleanup results. Quarantine operations save file payloads and their metadata locally. Decoy files deployed for file protection and their path lists are likewise stored on your device. Reading this data does not mean it is sent to the developer.
This processing serves to identify and block suspicious operations, correlate risk evidence, quarantine files, provide results and diagnostics, retain information needed for recovery, and save your settings. It is not used for advertising targeting, commercial profiling, assessing your credit, or making employment decisions. The current version has no user-account system and does not require you to submit identity information, payment information, or account credentials to us to enable local protection.
3 Local Storage and Cleanup
Service data is primarily stored in Windows at %ProgramData%\CC Security. Interface preferences and WebView2 user data are primarily stored at %LocalAppData%\CC Security. Some logs rotate by size, and some records are retained by count. Not all data automatically expires after a fixed number of days. Quarantined files are generally retained until you handle them through supported management features.
Quarantined payloads are stored encrypted, keys are protected by Windows data protection mechanisms, and access permissions are set on the service data directory. This does not mean all logs, file paths, and quarantine metadata are encrypted. Local software with sufficient privileges, administrators, or device managers may still access relevant information. We do not promise that local data can never be disclosed.
Uninstalling the current version retains encrypted quarantine data, keys, settings, and related evidence to avoid destroying recovery opportunities. Uninstallation does not delete all local data. For further cleanup, first follow the troubleshooting guide to back up data, check quarantined content, and complete any necessary restoration. Stop the relevant services before handling remnants. Do not casually delete data directories while services are running, or retain only encrypted quarantine data while losing keys and metadata.
We have no server-based administrative entry point to read, correct, or delete data remotely on your device. For information stored only on your device, we can provide instructions, but cannot promise to erase it remotely in direct response to an email.
4 Feedback You Voluntarily Send
If you email kelematubako@gmail.com, we receive the sender address, the name you provide, message body, time, and attachments. Begin with only the version, operating system build, time of the problem, error screenshots, or minimal sanitized log excerpts. We do not require passwords, recovery keys, government identification, complete memory dumps, or all your personal files.
We use feedback to respond to requests, investigate compatibility problems and false positives, validate and fix defects, handle privacy or security reports, and address necessary legal matters. Do not attach actual malicious samples, other people's information without authorization, or unnecessary sensitive data to an initial report. If further materials are genuinely required, we should separately explain what is needed and why. Voluntarily sending an email does not authorize continuous automatic uploads by the Software.
We use Gmail to receive email, and Google processes the communications under its service arrangements. When forwarding information upstream to resolve a problem, we prefer the minimum necessary de-identified or synthetic information. If identifiable original feedback must be provided upstream, we should explain this to you first and obtain consent where applicable, except for necessary disclosures permitted or required by law. Without your permission, we do not use identifiable feedback for public promotion or public case studies.
5 Browsing and Downloads on the Official Website
The current website plan is a presentation and download service without advertising, visitor analytics, or cross-site tracking. We do not intentionally embed advertising pixels, session replay, social tracking plugins, or device fingerprinting for profiling. Visitors do not need to register an account to read public information.
To deliver web pages and installers, hosting, content delivery, or download services may still process IP addresses, request times, request paths, technical information sent by the browser or operating system, errors, and necessary security logs. This differs from automatic uploading of security logs by CC software. We use data under our control only to deliver content, diagnose faults, prevent abuse, and maintain the service, rather than for advertising, cross-site profiling, or sale.
External download pages or links may be operated by another platform. When you follow them, that platform receives the information necessary to complete the visit and applies its own terms and privacy information. We do not misrepresent external pages as wholly controlled by CC or guarantee that visiting a third-party platform involves no independent data processing by that platform.
6 Cookies and Similar Technologies
The current official website does not use advertising or analytics tracking cookies. Cookies, localStorage, and similar browser storage must be explained according to their actual purposes. Merely changing the technology's name cannot justify describing tracking as involving no collection.
Where genuinely necessary, the website may use storage to maintain security or save privacy choices. If you actively choose a theme or language, it may also save that functional preference in the current browser. These preferences do not contain advertising identifiers used to recognize you across sites. You can manage optional preferences through the website's privacy settings or clear the relevant storage in your browser. Clearing it may require you to set your theme or privacy choices again.
The initial privacy notice explains how information is handled. Dismissing it, browsing pages, or continuing to scroll does not constitute consent to optional tracking. When optional tracking is not enabled, the website will not present a merely formal "Accept all cookies" button that creates a nonexistent tracking choice. If analytics or other non-essential services are introduced later, we will first update the explanation and provide meaningful choices and withdrawal mechanisms under applicable law and the settings rules published at that time.
7 Browser Privacy Signals
We do not engage in cross-site behavioral tracking, regardless of whether the browser sends a Do Not Track (DNT) signal. DNT does not itself cause the current website to initiate additional tracking and is not a basis for consent to tracking.
Global Privacy Control (GPC) is an opt-out preference signal distinct from DNT. We currently do not sell personal information or share it for cross-context behavioral advertising, so no such processing requires you to take an additional opt-out step. For websites referring to this policy, where responding to GPC is legally required, we will treat it as a valid signal to opt out of the relevant sale or sharing, without overriding it through a popup or stored preferences. You can check the relevant status in privacy settings.
8 Information Recipients and Disclosures
Recipients that may access relevant information include hosting or distribution providers supporting website transmission, download delivery, and necessary security operations; Google as the email service provider; relevant upstream projects or technical collaborators to the extent necessary to address your reported problem; and competent authorities or parties to legal proceedings to whom we are legally required to disclose information. The information received should be limited to what is necessary for the relevant purpose.
We do not automatically send local files, memory, or security events to these recipients merely because you use local protection. This policy does not replace the processing rules of independently operated platforms or operating system services. For arrangements under our control and services processing information for us, purpose and access restrictions should follow the requirements that actually apply.
Windows, WebView2 Runtime, and third-party installation or update components may connect to the network, verify signatures, update, or perform diagnostics through their own mechanisms. Local processing of CC's core analysis does not mean every component on the Windows device never connects to the internet, or that we can make the same commitment on behalf of Microsoft or other platforms.
9 Retention and Security
Section 3 explains retention of local records. For feedback we receive and website logs under our control, retention depends on the time needed to resolve requests, reproduce and fix problems, prevent abuse, handle disputes, and meet legal obligations. Identifiable copies are not retained long-term for unrelated purposes. When no longer needed and there is no legal reason to retain them, they should be deleted or appropriately de-identified. Providers' backups and independent records are governed by their service rules. We do not promise immediate removal of every copy beyond our control.
We use access restrictions and necessary safeguards appropriate to the project's actual processing to avoid unnecessary dissemination. However, email transmission, website hosting, and local storage cannot guarantee absolute security. Do not send unnecessary secrets or actual attack payloads through ordinary feedback channels. If an information security incident subject to applicable law occurs, we will handle notifications and follow-up matters as legally required.
10 Your Requests and California Rights
You may contact us by email to ask about information we hold about you, request correction or deletion of materials you voluntarily submitted, or object to how information is handled. Where possible, use the original contact email and specify the scope of the request. Necessary identity verification should be proportionate to the risk and request. We do not require additional sensitive identification documents or all device logs for ordinary requests.
To the extent the CCPA and its CPRA amendments actually apply, California residents may have rights to know and access, correct, delete, opt out of sale or sharing, limit certain uses of sensitive personal information, and avoid discrimination for exercising these rights. We handle requests according to applicable deadlines, verification requirements, and statutory exceptions. We do not categorically deny applicable rights on the grounds that this is a "Personal project" or "Free". Nor does this policy describe a project whose statutory eligibility has not been confirmed as having obtained CCPA certification.
For sales, advertising-related sharing, or restricted sensitive uses that do not currently occur, there is no activity you must first consent to before turning it off. To control logs or quarantined files that have never left your device, use local features. For emails or other information already held by us, submit the relevant request by email. We will not instruct you to delete quarantine recovery keys that are still needed in order to respond to a deletion request.
11 Children and Different Regions
The Software and official website are not specifically directed to children under 13. We do not knowingly collect such children's personal information through the website or feedback channels. If we discover such a situation, we will delete information, stop collection, or take other necessary action under applicable children's privacy rules. Parents or guardians may raise concerns through the contact email. Device use and administration must still be authorized by the device owner or lawful administrator.
Website hosting and email services may process information in the United States or other regions where providers operate. This policy does not promise that all information is stored in a particular state or, outside the device, in a particular country. Non-excludable rights under the law of your region remain reserved. Any future change in the scope of processing should first be checked against applicable local requirements.
12 Policy Updates and Contact
We will update the date at the top of a revised policy and communicate important changes through software release notes or a prominent location on the official website. New uploads, analytics, advertising, or other materially different uses will not be treated as authorized merely because you previously used the local Software. Where applicable law requires, notice and a valid choice or consent must be provided in advance.
For privacy questions and requests, contact kelematubako@gmail.com. You may use the subject "CC Security Privacy Request". Retain only the minimum information relevant to the issue. Do not send passwords, keys, or other people's information without authorization.
Key Legal and Public References
California Department of Justice guidance on CalOPPA and privacy policieshttps://oag.ca.gov/privacy/facts/online-privacy/privacy-policy
California Privacy Protection Agency guidance on CCPA rights and applicabilityhttps://cppa.ca.gov/faq
California Department of Justice CCPA guidance and opt-out choiceshttps://oag.ca.gov/privacy/ccpa
Federal Trade Commission data security principleshttps://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business
Federal Trade Commission children's privacy rulehttps://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa
CC SecurityEnd User License Agreement
This agreement sets out the scope and restrictions of your license to use CC Security. CC Security is experimental endpoint security software provided by an independent developer. Read this agreement before installing, running, or copying the software, together with the Important Safety Notice, Privacy Policy, and Third Party Software License Notices.
1 Parties and Scope
In this agreement, "we" or the "Licensor" means the software provider that distributes CC Security through official release channels and holds lawful authorization for the relevant proprietary content. "You" means the individual installing or using the software, or an authorized person lawfully acting on behalf of an organization. The contact email is kelematubako@gmail.com.
The "Software" includes CC Security's own programs, protection service, drivers, interface, and related documentation. Third-party components, open-source code, rules, and corresponding source code distributed with the Software are governed by their respective licenses. This agreement does not convert those materials into proprietary software or reduce the rights granted to you by third-party licenses.
This agreement applies to this release of CC Security 26H2-11-10001. If a future version includes different terms, the legally effective terms for that version apply. Verify the specific revisions and integrity of installers and source packages against the corresponding release notes and verification information.
2 License Grant and Reservation of Rights
Subject to compliance with this agreement, you may install and run the Software on Windows devices you own or are lawfully authorized to administer, and retain a reasonable number of backup copies for lawful use. This is a non-exclusive license to use the Software. It does not transfer copyright, trademark rights, or other intellectual property rights.
You must have lawful authorization for the devices you manage and the relevant data. You must not use the Software to intrude into other people's devices, damage data, circumvent their security measures, or provide unauthorized services in CC Security's name. The experimental release does not constitute a commitment to suitability for production systems, enterprise service levels, or ongoing technical support.
Except as expressly permitted by this agreement, third-party licenses, or applicable law, you must not sell, sublicense, separately extract and redistribute, rename, repackage, or publicly distribute CC's own non-open-source components without our written consent.
3 Restrictions on Reverse Engineering and Unpacking
For CC's own components not provided under an open-source license, you must not decompile, disassemble, reverse engineer, or analyze, unpack, split, or repackage the programs for the purpose of reconstructing source code or extracting protected implementations or proprietary resources, unless mandatorily permitted by applicable law or authorized by us in writing in advance.
You must not remove, falsify, or bypass integrity checks, access controls, license restrictions, or other protection mechanisms in the proprietary components. You must not remove copyright, source, third-party license, or trademark notices, or claim third-party works or the Software's original implementation as your own independent creation.
These restrictions do not prevent normal installation, updating, repair, or uninstallation, or prohibit reading publicly available software logs, settings, diagnostic information, and documentation. Extraction performed by the installer for normal installation, and necessary actions for backup or lawful inspection of release contents, are not automatically prohibited by the term "unpacking".
4 Open Source Licenses and Statutory Exceptions
The restrictions in this agreement on reverse engineering, unpacking, modification, and redistribution do not apply to rights you lawfully hold under GPL, MIT, ISC, Apache, or other applicable third-party licenses. They also do not exclude activities that applicable law prohibits restricting.
You may obtain, extract, read, modify, and redistribute the bundled open-source components and corresponding source code under their respective licenses. You must fulfill the applicable obligations concerning attribution, retention of licenses, provision of source code, and notices of modifications. Where terms conflict for a third-party component, that component's own license prevails.
Software display names and interface branding do not change third-party provenance. The Intelligent EDR Engine brand does not mean that all underlying code was independently developed by CC. See the Third Party Software License Notices for how to obtain corresponding source code, licenses, and provenance information. If these are unavailable, contact the email address in this agreement.
5 Administrator Privileges and System Changes
Installing the Software, deploying services and drivers, changing protection settings, and managing quarantine may require Windows administrator privileges or UAC confirmation. Verify the device, program source, and requested action. Do not approve an elevation request you do not understand.
The current experimental package contains test-signed drivers. Related features may work only if the device meets the applicable Windows loading requirements. The installer will not automatically enable Windows test-signing mode for you. Read the Driver and Compatibility Notes, and do not hastily disable existing security protection to meet installation requirements.
Real-time protection, targeted cleanup, and quarantine operations may deny program execution, terminate related processes, move or delete files, and, during targeted cleanup, temporarily isolate the network. Save your work and back up important data first. Closing the interface does not necessarily stop the background protection service.
6 Data and Privacy
This version performs its core detection and behavioral correlation locally. Data handling is governed by the Privacy Policy and the notices for individual features. This agreement does not itself constitute blanket authorization to upload personal files, samples, complete logs, or other personal information.
Before voluntarily emailing diagnostic materials to the contact address, review and minimize personal information, credentials, file contents, and trade secrets. Email services and third-party security software you install are governed by their providers' rules. Their actions are not equivalent to CC Security actively uploading data.
7 Experimental Status and Warranties
The Software is provided as is and as available. The experimental version may produce false positives, miss threats, conflict with drivers, degrade performance, cause blue screens or startup failures, or corrupt data. When the protection service is disconnected, drivers have not loaded successfully, the Software is only in audit mode, or sensors are unavailable, related features may fail to perform the expected blocking.
To the extent permitted by applicable law, we make no additional warranty that the Software is error-free, uninterrupted, fit for a particular purpose, or capable of identifying every threat. Passing test cases, a normal interface display, or the presence of component digital signatures does not guarantee any real-world threat interception rate or absolute system security.
8 Liability and Statutory Rights
Decide whether to use the experimental version based on the importance of the device, the state of your backups, and your tolerance for risk. To the extent permitted by law, we accept no liability for Software unavailability, compatibility issues, or indirect losses beyond that imposed by applicable law and valid agreements.
This agreement does not exclude or limit liability that cannot lawfully be excluded or limited. It does not require you to waive non-waivable consumer rights, data protection rights, statutory remedies, or rights granted by third-party open-source licenses. Mandatory legal provisions prevail where applicable.
9 Updates and Third Party Services
Versions, rules, runtimes, and drivers may be updated separately. Obtain complete, matching releases from trusted channels. Do not mix services, drivers, or EDR workers from different revisions. Use of the Software does not create a commitment to unannounced features, fix dates, or support periods.
Windows, WebView2, email, and other third-party services are the responsibility of their respective providers. Their corresponding terms govern trademarks, licenses, maintenance periods, and data handling. We do not thereby represent those providers or obtain their certification or warranties.
10 Termination and Uninstallation
You may stop using the Software and uninstall it following the Uninstallation and Troubleshooting Guide. If you violate the license, we may require you to stop unauthorized use to the extent permitted by law. This does not affect rights you have independently acquired under third-party licenses.
Before uninstalling, complete or stop targeted scans, restore networking isolated by the product, and address quarantined files you need to retain. Uninstallation does not restore all data that has been deleted or modified. Protection logs, encrypted quarantine data, and keys may be retained to avoid irreversible loss.
11 Interpretation and Changes
If a provision of this agreement is found invalid, that does not automatically affect other legally valid provisions. Conflicts involving open-source components, mandatory law, and this agreement must be resolved under the relevant law and component licenses, rather than by expanding restrictions on users.
Material license changes should be explained in the release documents for the relevant version. Updating this agreement must not retroactively revoke open-source rights users have lawfully acquired. Disputes should first be discussed through the contact email. Unresolved disputes will be handled by the authority with lawful jurisdiction.
12 Contact
For questions about software use, licensing authorization, obtaining third-party source code, or these terms, contact kelematubako@gmail.com. Include the product version, inquiry category, and necessary non-sensitive information to assist verification. This agreement does not require you to provide account passwords or remote-control access.
CC SecurityDriver and Compatibility Notes
CC Security's complete protection consists of a standard-privilege interface, a user-mode protection service, collection processes, and two Windows kernel drivers. Opening the interface does not mean the kernel components have loaded or actual blocking is effective. Before installation, review these notes and the Important Safety Notice. Prefer a virtual machine with restorable snapshots or a dedicated test device.
1 Current System Scope
Item | Current information |
|---|---|
Architecture | x64 Windows; no commitment to native x86 or ARM64 support |
Windows 10 | Minimum build target 19041; primary compatibility target is 22H2 build 19045 |
Windows 11 | Intended for x64 environments; validation is still required for the specific device and security policies |
Drivers | Experimental test signing; system loading requirements and installation eligibility must be met |
Interface | Requires WebView2 Runtime; visual effects depend on system composition capabilities |
Current evidence limits | Build, test-fixture, and interface checks have been performed; these are not comprehensive physical-device compatibility certification |
This version targets x64 Windows. The minimum build target is Windows 10 build 19041, with Windows 10 22H2 build 19045 among the primary compatibility targets. This is not comprehensive device compatibility certification. Windows 7, Windows 8, 32-bit Windows, native ARM64 environments, and Windows Server editions are outside the currently validated support scope.
Windows version, system security policies, virtualization-based security, graphics drivers, WebView2 Runtime, and other kernel drivers may all affect behavior. Retain system updates and trusted backups, and check the operating system's own maintenance eligibility. CC's Windows 10 compatibility work does not guarantee Microsoft's maintenance lifecycle.
2 Component Responsibilities
CCSecurityAgent is the user-mode protection service responsible for receiving events, correlating rules, performing permission-controlled administrative operations, and taking confirmed remediation actions. CCSecurityGuard.sys handles process, registry, object-handle, and related protection callbacks. CCSecurityScriptFilter.sys is a file-system filter driver for relevant NTFS file events and operation enforcement.
CCSecurityEDR.exe performs local rule matching. CCSecurityMemory.exe and CCSecurityActivity.exe provide corresponding memory or call-chain metadata. A collector starting, normal memory usage, or a successful EDR worker handshake establishes only the status of that stage. It does not prove the complete protection chain is effective.
File filtering currently focuses primarily on NTFS collection. Do not assume network drives, other file systems, access-restricted processes, or behaviors not collected have the same coverage as local NTFS. Some memory and image information is observed after the event and cannot support a claim of blocking before the first instruction executes.
3 Current Test Signing Requirements
The delivered kernel drivers are signed with a CC test certificate. They must not yet be described as Microsoft production-signed, WHQL-certified, or eligible as ordinary release drivers. Installing components requires administrator privileges. The scripts check the device's existing Windows TESTSIGNING state and do not automatically modify boot configuration to enable test mode.
Once test conditions are met, installation checks the bundled certificate and component signatures, imports the test certificate into the relevant local-machine certificate stores as required for deployment, and registers the protection service and drivers. Trusting a test certificate changes the system and should be done only in a test environment you understand and control. A digital signature alone does not prove a file is free of vulnerabilities.
Secure Boot, Memory integrity, organizational Group Policy, and other code-integrity policies may reject test-signed drivers. Do not disable existing protection, use vulnerable drivers to bypass restrictions, or import certificates of unknown provenance merely to run this experimental package. If the device does not qualify, stop deployment or use a separate test environment that meets the requirements.
4 Preinstallation Checks
1. Create a rollback snapshot for the virtual machine and independent, verified backups of important files. Retain disk-encryption recovery information and ensure you can enter the Windows Recovery Environment.
2. Verify installer provenance, integrity, version, and revision. Do not mix services, drivers, and EDR workers from different packages. Keep a complete installer known to work.
3. Confirm the device administrator has approved deployment of experimental kernel drivers and that a lawful, suitable test environment is already available. An account having administrator privileges does not establish that every system loading requirement is met.
4. Check whether other real-time security products or filter drivers are running. If compatibility is unknown, prefer a separate test machine rather than directly disabling existing security products.
5 Assessing Status After Installation
After starting CC Security, open "Virus and threat protection" to check the protection service connection and real-time protection status. Then open "Settings" > "About" to check the build and protection component information. Address a disconnected service, unavailable components, and audit mode separately. Do not judge solely by the Home icon.
Component deployment logs are stored at %ProgramData%\CC Security\component-install.log. Protection service diagnostics are in service-diagnostics.log in the same directory. For interface and elevation issues, see %LocalAppData%\CC Security\webview-diagnostics.log. Logs may contain local paths or usernames. Review and sanitize them before submitting feedback.
After an in-place installation of a new package, resident kernel components may still require unloading, reloading, or a restart to match the files on disk. Copying only the new UI EXE is not a complete upgrade. Restart as instructed by the installer, recheck status, and validate expected functionality in a separate test directory.
6 Interface Blur and Notifications
Desktop blur uses Windows composition capabilities. Windows 10 and Windows 11 use different compatibility paths. System transparency settings, high contrast, power policies, and the graphics environment may affect the result. The current Windows 10 path has been tested through a forced compatibility path, but this is not equivalent to physical-device testing across Windows 10 build 19045 devices.
Unavailable blur or card animation does not directly indicate protection-service failure. A healthy protection-service connection likewise does not guarantee correct visuals. First try disabling animation or frosted-glass effects and restoring the default appearance, then check protection status separately. Blocking alerts use native Windows notifications, whose display depends on system notification permissions and Do not disturb settings.
7 Faults and Discontinuing Use
If blue screens, startup problems, significant performance degradation, or conflicts with other drivers occur, stop triggering further tests and retain the version, logs, and necessary dump information. Do not attempt repair by repeatedly loading drivers, forcibly terminating system processes, or substituting unknown drivers.
If Windows remains accessible, uninstall normally following the Uninstallation and Troubleshooting Guide. If Windows cannot start, prefer rolling back a virtual-machine snapshot or using prepared recovery methods such as System Restore in the Windows Recovery Environment. Authorized maintenance personnel should handle offline registry work, disk encryption, or dump-file analysis.
Send compatibility issues to kelematubako@gmail.com. Include the Windows version and build, CC build and revision, whether you restarted, the specific error, and recovery actions already taken. Do not send account passwords, complete personal files, or memory dumps that have not been reviewed.
8 References
Microsoft test-signing guidance https://learn.microsoft.com/windows-hardware/drivers/install/the-testsigning-boot-configuration-option
Microsoft driver-signing options https://learn.microsoft.com/windows-hardware/drivers/dashboard/driver-signing-offerings
Microsoft WebView2 distribution guidance https://learn.microsoft.com/microsoft-edge/webview2/concepts/distribution
CC SecurityUser Manual
This manual describes the interface, protection settings, Silver Fox targeted cleanup, quarantine management, and common troubleshooting currently available in CC Security 26H2-11-10001. The Software is experimental. First read the Important Safety Notice, End User License Agreement, and Driver and Compatibility Notes, and preferably use a test environment that can be restored.
1 Installation and First Launch
Obtain the complete installer from a trusted release channel, verify the version, revision, and verification information, save your work, and create a backup. Run the installer and authorize it through the Windows UAC prompt. The current driver package is test-signed, so the device must already meet the applicable Windows test-environment requirements. The installer will not automatically enable test-signing mode.
Installation checks for and prepares the WebView2 Runtime, registers the protection service and relevant drivers, and attempts to connect the components. If prompted to restart, if the old service cannot enter maintenance mode, or if components are disconnected, follow the instructions first. Opening the interface alone does not mean installation has completed successfully.
After opening the interface for the first time, check the Home page status, then go to "Virus and threat protection" to verify real-time protection. Under "Settings", open "About" to view the build and component information. Buttons or switches that depend on the service may be unavailable while the service is disconnected.
2 Main Navigation
Entry | Main purpose |
|---|---|
Home | View protection status and the three main feature cards |
Virus and threat protection | Targeted cleanup, protection settings, and handled items |
Protection history | View confirmed blocks and targeted scan results |
Settings | Personalize appearance and access the About page |
The arrow at the upper left returns to the previous distinct page and is unavailable when there is no page to return to. The menu button collapses or expands the sidebar. Reopening a page after leaving it returns you to the top. The window can be resized and maximized; in narrower windows, the layout and related actions on the right may be rearranged.
The three Home cards lead to Virus and threat protection, Quarantine and blocked items, and Protection history. Quarantine management has no separate sidebar button. Open it from the Home card or "Handled items" on the protection page.
3 Understanding Protection Status
Displayed status | What it means |
|---|---|
Protection service disconnected | The interface has not obtained the service status; do not assume the background components are fully available |
Protection components need attention | Check installation, driver and collection status, and logs |
Protection disabled | Real-time protection is off; restore it as needed |
Audit mode | Records rule decisions without enforcing rule-based blocks |
Your computer is being protected | Status and settings meet the interface criteria, but capability and validation limits still apply |
"Your computer is being protected" expresses the service and settings status in the interface. It does not prove the system is infection-free, that every threat will be blocked, or that every driver path has been validated. Background protection depends on the service, drivers, rules, and enabled collectors working together.
The background service and user-session notification host may continue running after the window closes. To change protection, use the real-time protection switch or the corresponding tray action. To remove the Software, use the formal uninstallation process.
4 Real Time Protection and Detection Options
Go to "Virus and threat protection" and choose "Manage settings" under protection settings. The page has one master real-time protection switch controlling the existing behavioral protection, endpoint detection and response, ransomware protection, tamper protection, and advanced threat protection. There are no separate switches for individual components.
Changing protection settings may require UAC authorization. Treat a change as effective only after authorization is complete and the settings have been saved successfully. If authorization is canceled, the service disconnects, or the request fails, retain the message and check the actual state. Do not repeatedly click and assume the background state has changed.
Protection levels are Low, Medium, High, and Very high. Higher levels are generally more sensitive, but do not represent fixed detection rates. Audit mode records rule decisions without enforcing rule-based blocks and can help assess compatibility. It is not equivalent to full blocking protection.
"Monitor programs we trust" may increase false positives. Turning it off does not give every system tool or signed program an unconditional exemption. High-confidence behavior chains and existing command monitoring may still apply. Normal JIT activity, ordinary plugins, or a single privilege request must not simply be interpreted as completed injection.
Intelligent EDR Engine processes existing telemetry locally. The newly added correlations cover credential-store exports, destruction of identified recovery targets, clearing sensitive logs, and disabling auditing, but require evidence of the actual creator and payload. This does not mean a complete enterprise EDR, network-wide threat hunting, or every credential sensor has been deployed.
5 Silver Fox Trojan Removal
Targeted cleanup is at the top of the "Virus and threat protection" page. It is primarily intended for local remediation when infection is suspected or confirmed. It may use heuristic rules and can produce false positives. Save your work and back up important data before starting. Do not treat it as an ordinary status query without side effects.
Select "Start scan" or "Scan again", read the confirmation information on the page, and then decide whether to proceed. Execution may require UAC authorization. During scanning, the Software may terminate processes, quarantine files, handle temporary files, and temporarily isolate the network. Detection and remediation take place locally.
The current page shows scan progress, suppressed items, quarantined items, failures, and remediation details. To finish early, use "Stop scan" and wait for actions already underway to finish and networking to be restored. Stopping does not undo process terminations or quarantine operations already completed.
"Heuristic block" in the results is an interface label. It does not mean a family signature has confirmed the item as Silver Fox. Handle failure counts, restoration failures, and unconfirmed actions separately. Completion of a scan does not by itself mean the system is clean.
If product-created network isolation remains active, the page provides "Restore network". Authorize the action as prompted and confirm the result, checking actual connectivity if necessary. Until networking is restored, do not delete the lease file to bypass checks or uninstall the Software first.
6 Quarantine Blocked Items and Exclusions
Open "Quarantine and blocked items" from the Home card or "Handled items" on the protection page. Administrative access or operations require administrator authorization. The current interface uses a restricted background helper for elevation while retaining the original window. Administrative operations must not continue after UAC is canceled.
"Quarantine" stores encrypted files quarantined by the product. Select an entry to restore or delete it through the interface, and confirm before proceeding. Restoration may reintroduce risk, and deletion may be irreversible. Handle only entries you have verified; do not restore unknown files in bulk.
"Blocked items" shows dangerous operations confirmed as blocked, even if quarantine did not necessarily succeed. Entries may have no recoverable file. Blocking an operation, terminating its source process, and successfully quarantining a file are separate stages.
"Exclusions" manages file paths explicitly excluded from the relevant detection. Exclusions reduce coverage, so add only verified items with the narrowest possible scope. An exclusion does not restore a quarantined file. Do not exclude the entire Downloads folder, Windows, or all program directories to conceal false positives.
Quarantine restoration may fail because the original path is occupied, identity has changed, or permissions or keys are unavailable. Preserve the complete quarantine directory and metadata. Do not manually rewrite hashes, delete keys, or forcibly overwrite a new file with the same name. Original DPAPI-protected data may no longer be recoverable after changing the operating system.
7 Protection History and Native Notifications
"Protection history" displays confirmed blocking events and targeted scan results. For each entry, separately check which operation was blocked, whether a responsible source was selected, whether quarantine succeeded, and any failure reason. The confirmed-block list does not include every ordinary allow or audit event.
Some EDR history records retain ordered evidence used in the decision, with threat information available in the corresponding details. If an old record has no saved evidence, do not infer a complete attack chain from nearby logs. Cumulative counts may also differ from the number of recent entries visible in the list.
Blocking notifications use native Windows notifications. Check relevant permissions and Do not disturb or Focus settings in Windows notification settings. The absence of a banner does not necessarily mean no event occurred. Even when a banner appears, verify the actual remediation result. A pending blocking decision in a log must not be treated as a notification of a successful block.
8 Appearance and Personalization
"Settings" provides options for desktop blur strength, background lightness, card opacity, accent color, frosted-glass panels, interface floating effects, rounded corners, density, text size, and animation. Appearance settings apply immediately and are saved in the current user's local directory. Available options are determined by the current page.
The interface floating effect applies slight movement and tilt to designated large cards as a whole, including cards on Home, Settings and About, History, and quarantine category pages. Text and icons do not move independently. The effect subsides when controls are clicked or dragged and respects the system's reduced-motion setting.
Frosted-glass effects on Windows 10 depend on the composition environment. System transparency settings, high contrast, or graphics policies may reduce the effect or trigger a fallback. If visuals behave abnormally, first disable frosted-glass and floating effects and restore the default appearance, then check the protection service. Appearance failures and unavailable background protection should be diagnosed separately.
"About" is a separate content page under Settings for viewing the version and protection component descriptions and status. It does not offer individual component switches, and component names or icons are not evidence of actual functional validation.
9 Common Problems and Troubleshooting Order
Blank interface or failure to open: record the error and version first, confirm the installer is complete and WebView2 Runtime is available, then check webview-diagnostics.log in the user directory. Do not download and replace DLLs from unknown websites.
Service disconnected or settings cannot be saved: check whether installation completed, whether you restarted as prompted, and whether UAC was canceled, then review service and component logs. If "Repair protection components" is available, you may try it as directed. It does not guarantee a substitute for missing driver eligibility or a fix for every installation failure.
An ordinary file is blocked: retain the protection history and sanitized evidence, and determine whether an operation or the file itself was blocked. Check the reason, signature, and file identity before using a lawful exception with minimal scope. Do not begin by globally disabling protection or restoring quarantined files in bulk.
Blue screen, startup failure, unrestored networking, or uninstallation failure: stop further testing, preserve the state, and follow the Uninstallation and Troubleshooting Guide. Prefer rolling back a prepared snapshot or backup. Do not blindly delete drivers, certificates, quarantine keys, or network restoration files.
10 Logs Data and Contact
Machine-level data is normally under %ProgramData%\CC Security, including component-install.log, component-uninstall.log, service-diagnostics.log, settings, evidence, and encrypted quarantine data. Interface preferences and diagnostics are normally under %LocalAppData%\CC Security, including ui-preferences.json, WindowLayouts, and WebView2 user data.
This version performs core detection locally and does not require sending personal files, samples, or browsing history as a condition of basic protection. Voluntarily emailing logs is a separate action you take. First review paths, usernames, keys, and file contents. Do not send entire directories or memory dumps directly to others.
For usage problems and false-positive reports, contact kelematubako@gmail.com with the full version, revision or file hash, Windows build, time of occurrence, and minimal reproduction steps. For vulnerabilities, also see the Security Vulnerability Disclosure Policy. For licensing and source-code matters, see the Third Party Software License Notices.
CC SecurityUninstallation and Troubleshooting Guide
This guide helps you safely exit CC Security, retain necessary data, and address uninstallation failures, quarantine restoration, or network problems. First distinguish closing the interface, turning off real-time protection, and uninstalling services and drivers: these are three different actions. Deleting the program directory is not a substitute for formal uninstallation.
1 Before Uninstalling
1. Save your current work and stop starting new tests or targeted cleanup tasks. If "Silver Fox Trojan Removal" is running, use the stop action on the page and wait for actions already underway to finish and networking to be restored.
2. Under "Virus and threat protection" > "Handled items", open "Quarantine and blocked items". If you need to retain quarantined files, verify their risk and provenance before deciding whether to restore them. Do not restore suspicious files in bulk just to keep a program running.
3. With administrator privileges, back up local settings, evidence, and the entire quarantine data directory that you need to retain. Do not copy only an individual encrypted file while discarding metadata or keys.
4. Retain the current complete installer, source package for the same revision or verification information, and important fault logs. Create a virtual-machine snapshot or system-level backup first if necessary.
2 Normal Uninstallation
Open Installed apps or "Apps & features" in Windows Settings, find CC Security, and select Uninstall. Alternatively, use "Uninstall CC Security" in the Start menu. Read the Windows UAC prompt, verify the source, and authorize the action.
Uninstallation attempts to place the protection service into maintenance mode, stop and remove the registrations for CCSecurityAgent, CCSecurityGuard, and CCSecurityScriptFilter, remove the product's startup entries, and remove the relevant CC test certificates imported by this installation according to its records.
If stopping services or drivers is reported as incomplete, restart the test computer as instructed and retry. Do not directly delete .sys files still in use or remove other security products' services, filter instances, or certificates. If a restart is requested after completion, restart before checking the remaining state.
Successful uninstallation does not mean quarantined files have been restored automatically, all historical actions have been undone, or the system contains no other threats. Separately verify data needing restoration, network status, and Windows' own security protection.
3 Data Retained After Uninstallation
The current component uninstallation script intentionally retains encrypted quarantine data, keys, settings, and evidence in %ProgramData%\CC Security so that users do not lose recovery capability. This directory may also contain diagnostic logs, targeted cleanup state, and cumulative statistics.
Preserve .ccq data, corresponding JSON metadata, vault-key.dpapi, and other associated materials in the quarantine directory together. DPAPI protection is tied to the original Windows environment. Having backup files alone does not guarantee decryption after reinstalling Windows, moving to another device, or losing the relevant keys.
Interface preferences, window layouts, WebView2 local data, and webview-diagnostics.log are stored in %LocalAppData%\CC Security. Machine-level uninstallation may not remove all such user directories. Once you confirm they are no longer needed, you may separately remove product-specific directories. Do not delete the shared Microsoft WebView2 Runtime.
Deleting quarantine keys or data may make recovery permanently impossible. If restoration is still needed, first retain a complete backup and use a valid CC quarantine management process, rather than directly decrypting, running, or copying unknown files back to their original locations.
4 Uninstallation Blocked by Network Restoration State
Targeted cleanup may temporarily create the product's own network isolation rules. If a network restoration lease remains unfinished, the current uninstallation entry point blocks further progress to avoid leaving networking isolated after removal.
Return to the targeted cleanup area of "Virus and threat protection". If "Restore network" appears, use it and complete UAC authorization if required. Wait for the result, verify actual connectivity, then retry uninstallation. "Restored" on the page is a product status; where necessary, also verify the network connections that previously worked.
Do not manually delete network-cleanup-lease.json, associated recovery tasks, or arbitrary firewall rules to bypass the check. They may be needed to complete restoration. If restoration still fails, retain logs and state files so maintenance personnel can check the product's own lease. Do not reset the entire machine's firewall or delete other applications' rules.
5 Restoring Quarantined Files
In a matching version that is still usable, open "Quarantine and blocked items", switch to "Quarantine", select an entry that genuinely needs restoration, and use Restore. Administrative operations require administrator authorization. Read the confirmation prompt before restoring.
Restoration may reintroduce risk. It may fail if a new file with the same name occupies the original path, identity verification fails, keys are damaged, access is denied, or encrypted data is incomplete. Do not forcibly overwrite new files, rewrite entry hashes, or copy keys from other versions to bypass checks.
If the Software has already been uninstalled and you need quarantined content back, preserve the entire data directory and use a complete version compatible with the data format, or contact support for verification. Reinstallation is not a guarantee of recovery. Recovery is not promised for data confirmed deleted without an independent backup.
"Blocked items" records do not necessarily mean a recoverable quarantined file exists. "Exclusions" only changes the scope of subsequent detection and does not automatically restore files. Understand the three pages' purposes separately.
6 Protection Service or Interface Problems
If the service is disconnected, first retain the error message, restart status, and version information, then review component-install.log and service-diagnostics.log. If only the interface fails to open, also check WebView2 and webview-diagnostics.log in the user directory. Closing the window does not necessarily stop the background service.
If the old service cannot enter maintenance mode during installation or upgrade, the installer may report that its automatic startup has been suspended and request a restart. Restart as instructed, then repair or reinstall using the complete installer. Do not repeatedly replace only the UI, a single worker, or one driver.
If Windows or another security product blocks the installer or a component, first verify the file's provenance, signature, hash, and the other product's final verdict. Do not routinely troubleshoot by disabling protection, excluding an entire directory, or forcibly restoring build outputs from quarantine.
7 Blue Screens or Failure to Start Windows
Prefer a previously prepared virtual-machine snapshot, System Restore in the Windows Recovery Environment, or a verified system backup. If Safe Mode is accessible, you may attempt formal uninstallation with administrator authorization. Driver and service availability may differ between recovery environments.
Offline registry changes, disabling service startup, or disk-encryption work should be performed by maintenance personnel familiar with Windows recovery. First verify the target Windows partition, recovery keys, and backups. Do not guess drive letters, delete system drivers, or apply cleanup scripts intended for other products.
Retain the blue-screen stop code, relevant driver name, CC build and revision, and the sequence of actions before and after the upgrade. Dumps may contain fragments of personal files, credentials, or session information. Do not email complete dumps without reviewing them first.
8 Final Checks and Feedback
After restarting, confirm that CC's installation entry has been removed, networking and applications needing restoration work normally, and existing Windows security products are in the expected state. Check service registrations, residual files, retained data, and recovery completion separately. A missing desktop icon alone does not establish complete uninstallation.
For issues you cannot resolve, contact kelematubako@gmail.com. Begin with the version, operating system build, error screenshots, time of occurrence, and sanitized excerpts from relevant logs. Explain which quarantine data you want to retain and the actions already completed. Do not send passwords, recovery keys, or other people's data without authorization.
CC SecurityThird Party Software License Notices
CC Security includes its own implementations, third-party open-source components, and runtimes distributed under Microsoft terms. This document explains the provenance and licensing of the main components in the current version and how to obtain corresponding source code. Your rights in third-party components are governed by the full text of their respective licenses. The End User License Agreement for CC's own components cannot restrict those rights.
1 Applicable Version and How to Read This Document
This document applies to CC Security 26H2-11-10001, including the October 22, 2026 EDR command-correlation revision. For different revisions sharing the same version label, also check the release manifest, source package, and installer hashes. Do not assume binaries are identical based only on the interface version.
The component inventory is grouped by function and does not list every .NET system assembly as a separate product. Author, copyright, license, and modification notices in upstream source code must be retained. The summaries below aid navigation; they do not replace full license texts or provide additional assurances of upstream security.
2 Detection Engine and Rules
Component and version | Purpose | License and source |
|---|---|---|
Gene v2.3.0 | Local event rule matching | GPL 3.0github.com/0xrawsec/gene |
CC EDR adapter and 16 configurations | JSON lines integration and original correlation configurations | GPL 3.0 onlyEdr/LICENSE in the source code |
golang utils v1.3.2 | Utility code required by Gene | GPL 3.0github.com/0xrawsec/golang-utils |
go toml v1.9.3 | Engine configuration parsing dependency | Primarily MITSome files Apache 2.0 |
Sigma pinned revision 8a4813404ea3 | Selected and converted detection rules | DRL 1.1SigmaHQ/sigma |
Intelligent EDR Engine uses the actual Gene engine for local matching. There are currently 16 CC-authored correlation configurations; 013 through 016 are the independently expressed command-correlation configurations in this revision. Interface branding does not change the provenance or licenses of Gene and related dependencies. This integration is not the complete WHIDS product and does not mean that all its rules, management services, or sensors have been deployed.
Sigma rules are selected and converted according to the events and fields CC can actually process, while retaining each original rule's author, source, revision, and license information. There are currently 1,320 imported Sigma rules. CC's built-in rules, correlation configurations, and other policies are counted separately. The total must not be interpreted as complete coverage of the upstream rule repository.
3 Interface Runtimes and Icons
Component or material | Current version or scope | License information |
|---|---|---|
Microsoft .NET and Windows Desktop | 10.0.13 self-contained runtime | Open-source portions follow their respective project licensesRetain Microsoft and third-party notices |
WebView2 SDK and interop components | SDK 1.0.3719.77Windows SDK interop 10.0.19041.57 | Microsoft bundled licensesRuntime separately governed by Microsoft terms |
TraceEvent and managed dependencies | TraceEvent 3.2.8.NETCore.Client 0.2.510501 and others | MIT and other bundled package licensesRetain corresponding notices |
Microsoft Fluent System Icons | 14 iconsPinned commit 83b26348c811 | MIT and bundled NOTICE |
Lucide and derived Feather icons | Icon materials retained in the package | Lucide ISCRelevant Feather portions MIT |
Distinguish the Microsoft WebView2 SDK from the WebView2 Runtime. The SDK version identifies the build dependency, while the runtime actually installed on a device may differ because of Microsoft updates. WebView2 does not become CC-owned code because it is installed with CC. Its distribution and use follow the accompanying Microsoft licenses.
The .NET runtime and some underlying native libraries may also include third-party notices. Before copying or redistributing these components, consult each project's LICENSE and THIRD-PARTY-NOTICES and the Microsoft runtime terms. Do not infer from this table that all Microsoft binaries share a single open-source license.
4 Other Materials in the Installer and Source Archive
The installer is built with Inno Setup 6.7.3 and is subject to the Inno Setup License. Its authors include Jordan Russell and Martijn Laan. The Simplified Chinese installer translation is subject to the MIT license and kirakira copyright notice retained with the source. Using the installation system does not make CC the original author of Inno Setup.
The corresponding source archive also retains historical source materials for liquidGL 3.0.0 and liquid-glass-studio, including their original MIT licenses and pinned provenance information. These materials are not loaded by the current active interface. Their presence in the source directory does not establish that the current product uses their renderers.
Current desktop Gaussian blur uses CC's native Windows Composition background module. Using Windows platform APIs does not relicense Windows itself under an open-source license. The Go runtime and standard library included in the Go worker are governed by the Go project's BSD-style license and corresponding third-party notices.
5 Obtaining Corresponding Source Code and Full Licenses
The Sources directory in the complete installer provides the source archive delivered with this version, named CCSecurity-26H2-11-10001-source.zip. Extracting this archive, reading it, or modifying its third-party open-source portions under their applicable licenses is not subject to the general unpacking or reverse-engineering restrictions on CC's own components.
Within the source package, work/src/Edr/LICENSE, README.md, and provenance.json document the licenses and provenance of the EDR adapter and configurations. The vendor directory contains the corresponding source code and licenses for Gene, golang-utils, and go-toml. The go-toml LICENSE also states that certain files originating from Google civil use Apache 2.0; retaining only the MIT license is insufficient.
work/src/Hips/Rules/LICENSE.Detection.Rules.md and provenance.json retain the DRL 1.1 license and per-rule provenance for Sigma rules. work/src/UI/WebAssets/fluent retains the Fluent license and provenance. icons/LICENSE.txt retains the Lucide and Feather notices, and work/src/docs/TraceEvent-NOTICE.txt retains the TraceEvent notices. The Installer directory includes the Chinese translation license.
If release materials omit required licenses, notices, or corresponding source code, or if the included source does not match the revision of the binaries you obtained, send the version, revision, and file hashes to kelematubako@gmail.com to request clarification and missing materials. Personal documents, passwords, and remote-control access to your device are not required.
6 Third Party Rights Take Precedence
For GPL-covered programs and corresponding modifications, you lawfully hold the rights granted by that license, including running, studying, modifying, and redistributing them. Distribution also requires fulfillment of the corresponding source-code and license obligations. General terms for CC's own components must not impose additional restrictions on these components that conflict with the GPL.
Follow the original terms of MIT, ISC, BSD, Apache, and other licenses concerning grants of rights, attribution, notices, disclaimers, and other requirements. DRL 1.1 includes specific requirements for identifying original authors, sources, and licenses in rules and rule-matching information. This document does not combine different licenses into a single uniform restriction.
Third-party trademarks, project names, and copyrights remain the property of their respective rights holders. Listing a component or integrating it into the interface does not constitute official certification, joint-development endorsement, or a security warranty from an upstream product, Microsoft, OpenAI, or any other entity.
7 Excluded Projects and Future Changes
The EDR and active-defense designs of XIGUASecurity10x and PYAS were studied during this work, but their source code, original rule arrays, models, and allowlists were not included in the current CC release package. Research references to these projects do not constitute module authorization, and renaming or making minor changes cannot replace compliance with their license requirements.
When components are added or removed, these notices should be updated with the corresponding version. Lawfully acquired open-source rights cannot be retroactively revoked by branding changes or updates to these notices. Report omissions, incorrect attribution, or license conflicts through the contact email.
8 Full Licenses and Project Links
GNU GPL version 3 https://www.gnu.org/licenses/gpl-3.0.html
Gene https://github.com/0xrawsec/gene
Sigma and DRL https://github.com/SigmaHQ/sigma
Microsoft Fluent System Icons https://github.com/microsoft/fluentui-system-icons
Microsoft WebView2 distribution guidance https://learn.microsoft.com/microsoft-edge/webview2/concepts/distribution
Inno Setup License https://jrsoftware.org/files/is/license.txt
CC SecuritySoftware Update and Lifecycle Policy
This policy explains CC Security version identification, update installation, rollback preparation, and end-of-maintenance principles. The current product is experimental endpoint security software. No fixed update schedule, long-term support period, or production service level has been announced. Base upgrade decisions on the actual release documents, rather than an unpublished roadmap.
1 Identifying the Current Version
The current displayed product version is CC Security 26H2-11-10001, and the numeric Windows file version is 26.2.100.1. Only 26H2 appears next to the brand on the Home page, which is insufficient to distinguish builds. View the full version under "Settings" > "About".
Multiple revisions may share the same product version label. The October 22, 2026 EDR command-correlation revision differs from the earlier Windows 10 fix package. Identify them using revision notes, file hashes, or the release manifest. Matching labels do not establish identical package contents.
Core rules, the EDR worker, services, drivers, the interface, and third-party runtimes have their own dependencies. Increases in numeric versions or rule counts do not automatically indicate improved detection rates. Building, installing, loading drivers, and blocking real threats remain separate validation stages.
2 Update Sources and Acquisition
Obtain the complete installer through trusted release channels announced by the CC Security provider, and verify the version, revision, signatures, and SHA256 against the release notes. For mirrored, renamed, or repackaged files of unknown provenance, first contact kelematubako@gmail.com for verification.
Current releases are primarily delivered as complete installers. This policy does not indicate that the Software already has a public automatic-update server, differential upgrades, automatic rule subscriptions, or the ability to remotely push and execute actions. Such features should be considered available only once actually released and documented.
If a later version adds online updates or cloud features, the download source, verification, permissions, and data handling should be explained before activation. This policy alone cannot authorize automatic uploading of data previously processed locally.
3 Preparing for an Upgrade
1. Read the revision's changes and known issues. Confirm that the target Windows environment, administrator privileges, and driver-loading requirements remain applicable.
2. Save your work, complete or stop targeted cleanup, and restore any networking it isolated. Back up settings, necessary evidence, and the entire quarantine directory. Create a usable snapshot or system backup.
3. Retain the current installer and hash for diagnosis and any necessary controlled rollback. Backups must not contain only encrypted quarantine data while omitting keys and metadata.
4. Ensure you will use the complete, matching release payload rather than replacing individual services, workers, or drivers. Updating may require stopping services and restarting the test device.
4 Checks After Installation and Upgrade
The installer attempts to place the old service into maintenance mode and stop the relevant drivers. If it reports that components could not be stopped, the old service's automatic startup has been suspended, or a restart is required, follow the instructions to recover and retry. Avoid manually copying files in a way that conceals mismatches between resident component versions.
After completion, check the build, protection service, real-time protection, the state of enabled EDR functionality, and component connections. Recheck disabled-protection or audit-mode settings in the current interface. Logs and cumulative statistics should reflect actual data. A single green icon does not establish that every path has been validated.
If the new version behaves abnormally, retain the time of occurrence, version, hashes, and sanitized logs. Stop expanding testing before following the troubleshooting guide. Completion of the installer is not an absolute guarantee of actual protection, Windows compatibility, or migration of every historical configuration.
5 Rollback and Data Compatibility
Prefer a complete snapshot or verified data and program backups for rollback. Software directories, services, drivers, and user data may have different compatibility requirements. Older programs may not read newer quarantine formats or settings, and newer programs cannot guarantee repair of corrupted data.
The current EDR revision uses a worker handshake for 16 configurations. Do not mix an older worker using 12 configurations with the newer Hips/Agent. Other components must likewise be updated from the same complete release package. Replacing a single EXE is not a reliable rollback.
Do not delete quarantine data, keys, or network restoration state files to force a rollback through. If rollback involves security risks or old vulnerabilities, first assess recovery feasibility and risk. An older version running successfully does not establish that security has been restored.
6 Security Fixes and Third Party Updates
Vulnerability remediation is assessed according to actual impact, reproducibility, available resources, and upstream dependencies. There is currently no public commitment to a fixed remediation deadline. Issue confirmation, temporary mitigation, and a complete fix should be described separately. Security issues may be reported by email under the Security Vulnerability Disclosure Policy.
Microsoft WebView2, Windows, and other third-party components have their own update mechanisms and maintenance lifecycles. The SDK version in the CC installer is not the device's actual runtime version. A Microsoft runtime update does not mean CC's services, rules, or drivers have been updated at the same time.
Validate compatibility in a test environment before expanding deployment. Do not broadly freeze system security updates to preserve old software, or disable other security products to keep a problematic update running.
7 End of Maintenance and Feature Retirement
When ending maintenance for a branch, operating system version, or component, we should, where feasible, explain the affected scope, available replacement versions, data export or retention methods, and recommended uninstallation steps in official release documents. A long-term support period must not be assumed unless explicitly announced.
End of maintenance may mean that vulnerability fixes, compatibility changes, or new rules are no longer provided. An older version that still runs may have unpatched risks. Assess continued use based on the importance of the device, backups, and other security protection.
Software licenses, third-party open-source obligations, retained data, and user rights that cannot lawfully be waived do not automatically disappear when maintenance ends. Upgrades, retirement, or rebranding cannot retroactively revoke open-source rights you have lawfully acquired.
8 Release Issues and Contact
For update, version mismatch, rollback, or maintenance-lifecycle issues, contact kelematubako@gmail.com. Please provide the product version, revision or hash, operating system build, installation or uninstallation error, and whether you restarted. Do not send passwords, keys, or complete dumps that have not been reviewed.
CC SecuritySecurity Vulnerability Disclosure Policy
This policy explains how to report defects that may affect software security to the CC Security provider and how to coordinate validation, remediation, and public disclosure. Send vulnerability reports to kelematubako@gmail.com. Please begin with a reproducible technical description. Do not include actual malicious samples, personal files, account credentials, or large memory dumps in your initial report.
1 Scope
This policy covers CC Security's own interface, protection service, drivers, IPC permission boundaries, elevation helper, installation, upgrade and uninstallation processes, quarantine data handling, and product-specific configuration. You may report issues that could cause privilege escalation, arbitrary command execution, access beyond authorized permissions, unauthorized configuration changes, unintended file operations, or disclosure of sensitive information.
You may report the integration impact of third-party component defects to us, while also following the relevant upstream disclosure channels. Third-party websites, email services, Windows, other security products, and devices or networks you are not authorized to test do not fall within the authorization granted by this policy merely because they are listed as software dependencies.
Failure to detect an unknown sample, cosmetic interface issues, or ordinary compatibility differences do not necessarily constitute security vulnerabilities. If an issue involves a reliable protection bypass, an incorrect permission boundary, or a defect an attacker could exploit, explain the specific prerequisites and security impact.
2 Reporting and Testing Boundaries
We welcome reports of problems observed during normal-use validation on devices you own or are explicitly authorized to test. Research involving the kernel, system startup, file recovery, or destructive consequences should preferably use an isolated virtual machine with rollback snapshots and harmless test fixtures.
This policy does not authorize attacks on production devices, access to other people's data, persistent control of systems, social engineering, denial of service, or bypassing third-party security products. If you discover unauthorized access or sensitive data, stop expanding the impact and retain only the minimum evidence needed. Do not download additional data to demonstrate the scope of impact.
For reverse engineering, unpacking, or other restricted research beyond normal use involving CC's own non-open-source components, obtain explicit written authorization by email in advance. This does not restrict statutory exceptions or rights under third-party open-source licenses. You do not need prior permission merely to submit a vulnerability report.
3 Recommended Information for an Initial Report
1. The full product version and revision, and hashes of the installer or relevant files; the Windows version, build, architecture, and environmental conditions directly relevant to reproduction.
2. The affected component, required privileges, whether administrator access or local interaction is needed, and the expected behavior compared with what you actually observed.
3. Minimal reproduction steps, configurations or synthetic events that can be shared safely, and screenshots or sanitized logs. Prefer harmless files, fictitious paths, and test accounts.
4. Demonstrable impact and the strength of the evidence. Distinguish code-based hypotheses, reproduction with test fixtures, actual enforcement acknowledgments, and confirmed real-world consequences. Do not describe unverifiable observations as successful exploitation.
5. Your preferred contact information, whether you consent to public attribution, and any upstream projects or coordinating organizations you have already notified. Without permission to attribute the report, we do not interpret this policy as your consent to disclose your identity publicly.
Suggested email subject: "CC Security Vulnerability Report Product Version Brief Description". If the report contains sensitive exploitation details, send a summary first and agree on a transfer method. This policy does not advertise an encrypted reporting portal, PGP key, or automated ticketing system that has not been established.
4 Receipt and Validation
Where feasible, we will use the contact details in your report to acknowledge receipt, request necessary additional information, and assess reproduction conditions and impact. Reports that may involve ongoing attacks, privilege escalation, or data loss will be prioritized according to the actual risk.
The project currently makes no public commitment to a fixed response time, remediation deadline, round-the-clock coverage, or service level. An immediate lack of response does not mean the issue is resolved, the report is invalid, or additional testing is authorized. You may follow up while preserving the original email thread.
We will not ask you to run malicious payloads against real users, damage data, or disable their security protection to prove a vulnerability. Reporters should likewise avoid increasing actual harm to accelerate handling.
5 Coordinated Remediation and Public Disclosure
Once an issue is confirmed, both parties should coordinate the affected versions, remediation approach, validation method, and appropriate disclosure date as far as possible. If remediation depends on Windows or another upstream provider, coordinate separately with that provider and avoid publishing sensitive details that could directly endanger users who have not yet received a fix.
Public statements should accurately distinguish the scope of fixes, versions that remain affected, mitigations, and validation limits. A temporary mitigation is not necessarily a complete fix, and a test build should not automatically be described as suitable for every system.
We respect researchers' right to publish research lawfully and ask that we be given a reasonable opportunity to validate and remediate issues before disclosure. If early disclosure is necessary, contact has been unavailable for an extended period, or active exploitation exists, please explain the circumstances and attempt coordination. This policy does not make indefinite confidentiality an inherent condition of reporting.
6 Data Confidentiality and Attribution
Vulnerability materials may contain local paths, user identities, and security details. Submit only information you are entitled to share, and sanitize it first. Content sent through Gmail is also subject to that service's terms. This policy does not treat sending an email as authorization to upload all diagnostic information or personal data.
We should limit unnecessary dissemination when handling reports. When forwarding an issue to an upstream provider or coordinator, we should use the minimum necessary information and remove sensitive data before public announcements. Unless otherwise agreed in advance, retaining a reporter's name or providing public attribution should require their consent.
7 Rewards and Authorization
The project currently has no announced formal bug bounty program and does not promise money, gifts, CVE identifiers, public rankings, or other compensation. Any future program should separately publish its scope, conditions, and rules. This policy must not be interpreted as establishing an existing reward program.
This policy does not replace authorization from a device owner, waive obligations under applicable law, or guarantee that third parties will not assert their rights. We will not regard lawfully raising concerns or making a good-faith report as malicious in itself. Any additional research authorization is governed by its explicit written scope.
8 Contact and Policy Updates
Send security issues to kelematubako@gmail.com and retain a traceable email subject. For privacy, licensing, or ordinary usage matters, identify the category to help route the inquiry. Policy updates will be explained in the relevant release documents and cannot retroactively reduce researchers' lawfully acquired open-source rights.