CC SecurityUser Manual
This manual describes the interface, protection settings, Silver Fox targeted cleanup, quarantine management, and common troubleshooting currently available in CC Security 26H2-11-10001. The Software is experimental. First read the Important Safety Notice, End User License Agreement, and Driver and Compatibility Notes, and preferably use a test environment that can be restored.
1 Installation and First Launch
Obtain the complete installer from a trusted release channel, verify the version, revision, and verification information, save your work, and create a backup. Run the installer and authorize it through the Windows UAC prompt. The current driver package is test-signed, so the device must already meet the applicable Windows test-environment requirements. The installer will not automatically enable test-signing mode.
Installation checks for and prepares the WebView2 Runtime, registers the protection service and relevant drivers, and attempts to connect the components. If prompted to restart, if the old service cannot enter maintenance mode, or if components are disconnected, follow the instructions first. Opening the interface alone does not mean installation has completed successfully.
After opening the interface for the first time, check the Home page status, then go to "Virus and threat protection" to verify real-time protection. Under "Settings", open "About" to view the build and component information. Buttons or switches that depend on the service may be unavailable while the service is disconnected.
2 Main Navigation
Entry | Main purpose |
|---|---|
Home | View protection status and the three main feature cards |
Virus and threat protection | Targeted cleanup, protection settings, and handled items |
Protection history | View confirmed blocks and targeted scan results |
Settings | Personalize appearance and access the About page |
The arrow at the upper left returns to the previous distinct page and is unavailable when there is no page to return to. The menu button collapses or expands the sidebar. Reopening a page after leaving it returns you to the top. The window can be resized and maximized; in narrower windows, the layout and related actions on the right may be rearranged.
The three Home cards lead to Virus and threat protection, Quarantine and blocked items, and Protection history. Quarantine management has no separate sidebar button. Open it from the Home card or "Handled items" on the protection page.
3 Understanding Protection Status
Displayed status | What it means |
|---|---|
Protection service disconnected | The interface has not obtained the service status; do not assume the background components are fully available |
Protection components need attention | Check installation, driver and collection status, and logs |
Protection disabled | Real-time protection is off; restore it as needed |
Audit mode | Records rule decisions without enforcing rule-based blocks |
Your computer is being protected | Status and settings meet the interface criteria, but capability and validation limits still apply |
"Your computer is being protected" expresses the service and settings status in the interface. It does not prove the system is infection-free, that every threat will be blocked, or that every driver path has been validated. Background protection depends on the service, drivers, rules, and enabled collectors working together.
The background service and user-session notification host may continue running after the window closes. To change protection, use the real-time protection switch or the corresponding tray action. To remove the Software, use the formal uninstallation process.
4 Real Time Protection and Detection Options
Go to "Virus and threat protection" and choose "Manage settings" under protection settings. The page has one master real-time protection switch controlling the existing behavioral protection, endpoint detection and response, ransomware protection, tamper protection, and advanced threat protection. There are no separate switches for individual components.
Changing protection settings may require UAC authorization. Treat a change as effective only after authorization is complete and the settings have been saved successfully. If authorization is canceled, the service disconnects, or the request fails, retain the message and check the actual state. Do not repeatedly click and assume the background state has changed.
Protection levels are Low, Medium, High, and Very high. Higher levels are generally more sensitive, but do not represent fixed detection rates. Audit mode records rule decisions without enforcing rule-based blocks and can help assess compatibility. It is not equivalent to full blocking protection.
"Monitor programs we trust" may increase false positives. Turning it off does not give every system tool or signed program an unconditional exemption. High-confidence behavior chains and existing command monitoring may still apply. Normal JIT activity, ordinary plugins, or a single privilege request must not simply be interpreted as completed injection.
Intelligent EDR Engine processes existing telemetry locally. The newly added correlations cover credential-store exports, destruction of identified recovery targets, clearing sensitive logs, and disabling auditing, but require evidence of the actual creator and payload. This does not mean a complete enterprise EDR, network-wide threat hunting, or every credential sensor has been deployed.
5 Silver Fox Trojan Removal
Targeted cleanup is at the top of the "Virus and threat protection" page. It is primarily intended for local remediation when infection is suspected or confirmed. It may use heuristic rules and can produce false positives. Save your work and back up important data before starting. Do not treat it as an ordinary status query without side effects.
Select "Start scan" or "Scan again", read the confirmation information on the page, and then decide whether to proceed. Execution may require UAC authorization. During scanning, the Software may terminate processes, quarantine files, handle temporary files, and temporarily isolate the network. Detection and remediation take place locally.
The current page shows scan progress, suppressed items, quarantined items, failures, and remediation details. To finish early, use "Stop scan" and wait for actions already underway to finish and networking to be restored. Stopping does not undo process terminations or quarantine operations already completed.
"Heuristic block" in the results is an interface label. It does not mean a family signature has confirmed the item as Silver Fox. Handle failure counts, restoration failures, and unconfirmed actions separately. Completion of a scan does not by itself mean the system is clean.
If product-created network isolation remains active, the page provides "Restore network". Authorize the action as prompted and confirm the result, checking actual connectivity if necessary. Until networking is restored, do not delete the lease file to bypass checks or uninstall the Software first.
6 Quarantine Blocked Items and Exclusions
Open "Quarantine and blocked items" from the Home card or "Handled items" on the protection page. Administrative access or operations require administrator authorization. The current interface uses a restricted background helper for elevation while retaining the original window. Administrative operations must not continue after UAC is canceled.
"Quarantine" stores encrypted files quarantined by the product. Select an entry to restore or delete it through the interface, and confirm before proceeding. Restoration may reintroduce risk, and deletion may be irreversible. Handle only entries you have verified; do not restore unknown files in bulk.
"Blocked items" shows dangerous operations confirmed as blocked, even if quarantine did not necessarily succeed. Entries may have no recoverable file. Blocking an operation, terminating its source process, and successfully quarantining a file are separate stages.
"Exclusions" manages file paths explicitly excluded from the relevant detection. Exclusions reduce coverage, so add only verified items with the narrowest possible scope. An exclusion does not restore a quarantined file. Do not exclude the entire Downloads folder, Windows, or all program directories to conceal false positives.
Quarantine restoration may fail because the original path is occupied, identity has changed, or permissions or keys are unavailable. Preserve the complete quarantine directory and metadata. Do not manually rewrite hashes, delete keys, or forcibly overwrite a new file with the same name. Original DPAPI-protected data may no longer be recoverable after changing the operating system.
7 Protection History and Native Notifications
"Protection history" displays confirmed blocking events and targeted scan results. For each entry, separately check which operation was blocked, whether a responsible source was selected, whether quarantine succeeded, and any failure reason. The confirmed-block list does not include every ordinary allow or audit event.
Some EDR history records retain ordered evidence used in the decision, with threat information available in the corresponding details. If an old record has no saved evidence, do not infer a complete attack chain from nearby logs. Cumulative counts may also differ from the number of recent entries visible in the list.
Blocking notifications use native Windows notifications. Check relevant permissions and Do not disturb or Focus settings in Windows notification settings. The absence of a banner does not necessarily mean no event occurred. Even when a banner appears, verify the actual remediation result. A pending blocking decision in a log must not be treated as a notification of a successful block.
8 Appearance and Personalization
"Settings" provides options for desktop blur strength, background lightness, card opacity, accent color, frosted-glass panels, interface floating effects, rounded corners, density, text size, and animation. Appearance settings apply immediately and are saved in the current user's local directory. Available options are determined by the current page.
The interface floating effect applies slight movement and tilt to designated large cards as a whole, including cards on Home, Settings and About, History, and quarantine category pages. Text and icons do not move independently. The effect subsides when controls are clicked or dragged and respects the system's reduced-motion setting.
Frosted-glass effects on Windows 10 depend on the composition environment. System transparency settings, high contrast, or graphics policies may reduce the effect or trigger a fallback. If visuals behave abnormally, first disable frosted-glass and floating effects and restore the default appearance, then check the protection service. Appearance failures and unavailable background protection should be diagnosed separately.
"About" is a separate content page under Settings for viewing the version and protection component descriptions and status. It does not offer individual component switches, and component names or icons are not evidence of actual functional validation.
9 Common Problems and Troubleshooting Order
Blank interface or failure to open: record the error and version first, confirm the installer is complete and WebView2 Runtime is available, then check webview-diagnostics.log in the user directory. Do not download and replace DLLs from unknown websites.
Service disconnected or settings cannot be saved: check whether installation completed, whether you restarted as prompted, and whether UAC was canceled, then review service and component logs. If "Repair protection components" is available, you may try it as directed. It does not guarantee a substitute for missing driver eligibility or a fix for every installation failure.
An ordinary file is blocked: retain the protection history and sanitized evidence, and determine whether an operation or the file itself was blocked. Check the reason, signature, and file identity before using a lawful exception with minimal scope. Do not begin by globally disabling protection or restoring quarantined files in bulk.
Blue screen, startup failure, unrestored networking, or uninstallation failure: stop further testing, preserve the state, and follow the Uninstallation and Troubleshooting Guide. Prefer rolling back a prepared snapshot or backup. Do not blindly delete drivers, certificates, quarantine keys, or network restoration files.
10 Logs Data and Contact
Machine-level data is normally under %ProgramData%\CC Security, including component-install.log, component-uninstall.log, service-diagnostics.log, settings, evidence, and encrypted quarantine data. Interface preferences and diagnostics are normally under %LocalAppData%\CC Security, including ui-preferences.json, WindowLayouts, and WebView2 user data.
This version performs core detection locally and does not require sending personal files, samples, or browsing history as a condition of basic protection. Voluntarily emailing logs is a separate action you take. First review paths, usernames, keys, and file contents. Do not send entire directories or memory dumps directly to others.
For usage problems and false-positive reports, contact kelematubako@gmail.com with the full version, revision or file hash, Windows build, time of occurrence, and minimal reproduction steps. For vulnerabilities, also see the Security Vulnerability Disclosure Policy. For licensing and source-code matters, see the Third Party Software License Notices.