ADS "feature" in COMODO Firewall Free

COMODO changes date of EXE/BAT/CMD etc. on copy
https://forums.comodo.com/-t109389.0.html

CIS/CES 8 adds ADS to files which remain present if files (login to view)
https://forums.comodo.com/-t108102.0.html

I’m currently using CIS 8.4.0.5076 Free for Antivirus and Firewall on Windows 7 SP1 32-bit.

This issue is a pain in the ■■■■. I need to install a backup from December 2015 (9 months ago) and integrate the newer files. There should be product recalls for software like in the automotive industry.

I’m going back to Avast for Antivirus.

Does Comodo 8 Firewall Free have the same issue?

Does Comodo 7 Firewall Free have the same issue?

Hi APPLE123,
Simply disable file source tracking and the creation of ADS ceases.
Configuring Rules for Auto-Sandbox -Comodo Help

Kind regards.

Advanced Settings > Defense+ > Sandbox > Auto-Sandbox > [uncheck] Enable Auto-Sandbox
Advanced Settings > Defense+ > Sandbox > Auto-Sandbox > [uncheck] Enable file source tracking

The workaround doesn’t work correctly.

Here is my test batch file. I rebooted the computer before testing.

rem [E:] drive is a NTFS formatted HDD
rem [F:] drive is a DVD Burner loaded with a DVD+R

set DRIVE=E:

cd /d %DRIVE%\
copy F:\Applications\Dictionary\RHWEDT\EDT1.EXE %DRIVE%\

echo.                                                                           >  %DRIVE%\test.txt
echo output:                                                                    >> %DRIVE%\test.txt
echo.                                                                           >> %DRIVE%\test.txt
dir /tc F:\Applications\Dictionary\RHWEDT\EDT1.EXE | find "/" | sed "s/^/tc: /" >> %DRIVE%\test.txt
echo ta: not supported                                                          >> %DRIVE%\test.txt
dir /tw F:\Applications\Dictionary\RHWEDT\EDT1.EXE | find "/" | sed "s/^/tw: /" >> %DRIVE%\test.txt
dir     F:\Applications\Dictionary\RHWEDT\EDT1.EXE | find "/" | sed "s/^/    /" >> %DRIVE%\test.txt
echo.                                                                           >> %DRIVE%\test.txt
dir /tc %DRIVE%\EDT1.EXE                           | find "/" | sed "s/^/tc: /" >> %DRIVE%\test.txt
dir /ta %DRIVE%\EDT1.EXE                           | find "/" | sed "s/^/ta: /" >> %DRIVE%\test.txt
dir /tw %DRIVE%\EDT1.EXE                           | find "/" | sed "s/^/tw: /" >> %DRIVE%\test.txt
dir     %DRIVE%\EDT1.EXE                           | find "/" | sed "s/^/    /" >> %DRIVE%\test.txt
type %DRIVE%\test.txt
del  %DRIVE%\test.txt %DRIVE%\EDT1.EXE

set DRIVE=
  • first run on drive
output:

tc: 02/07/2001  04:21 PM           405,873 EDT1.EXE
ta: not supported
tw: 02/07/2001  04:21 PM           405,873 EDT1.EXE
    02/07/2001  04:21 PM           405,873 EDT1.EXE

tc: 02/07/2001  04:21 PM           405,873 EDT1.EXE
ta: 09/24/2016  10:31 AM           405,873 EDT1.EXE
tw: 02/07/2001  04:21 PM           405,873 EDT1.EXE
    02/07/2001  04:21 PM           405,873 EDT1.EXE
  • second run on drive
output:

tc: 02/07/2001  04:21 PM           405,873 EDT1.EXE
ta: not supported
tw: 02/07/2001  04:21 PM           405,873 EDT1.EXE
    02/07/2001  04:21 PM           405,873 EDT1.EXE

tc: 09/24/2016  10:48 AM           405,873 EDT1.EXE
ta: 09/24/2016  10:48 AM           405,873 EDT1.EXE
tw: 02/07/2001  04:21 PM           405,873 EDT1.EXE
    02/07/2001  04:21 PM           405,873 EDT1.EXE

Anyhow, I don’t trust Comodo Antivirus. I don’t want to bork my HDD because I forgot to change a default setting.

I’m going back to Avast for Antivirus.

Does Comodo 8 Firewall Free have the same issue?

Does Comodo 7 Firewall Free have the same issue?

Edit:

Please disregard my test batch file result. The behavior is not caused by COMODO.

Mentioned behavior is exclusive to version 8. It’s fixed with version 10.
For more details on the issue, please read : https://forums.comodo.com/resolvedoutdated-issues-cis/cisces-8-adds-ads-to-files-which-remain-present-if-files-distributed-m1367-t108102.0.html

Comodo Firewall 7 is ADS free: Comodo Firewall 12.2.2.8012 Download for Windows / Old Versions Page 2 / FileHorse.com

Thanks for replies.

I’m going with Avast for Antivirus and Comodo 7 Firewall Free for now.

Disabling source file tracking will not remove the ADS. You need to use a third party tool for this.

Does uninstalling CIS 8 remove the ADS? Or do I need a third party tool for that?

Sorry, I don’t have the time to read all the posts in the following thread.

CIS/CES 8 adds ADS to files which remain present if files (login to view)
https://forums.comodo.com/-t108102.0.html

Uninstalling CIS 8 does not remove ADS from files. You’ll need a separate tool to remove them.

Hi Guys,

As you know we have switched from ADS to central DB already with previous releases. CIS currently is not removing ADS which is created before. Right now, with the latest releases we do not create any ADS but also do not touch the ones that are created before. However, if you execute a certain file and correspondent ADS exists - CIS will remove that ADS.

For your information,

Kind Regards
Buket

Thank you for the heads up Buket. What do you mean with “However, if you execute a certain file and correspondent ADS exists - CIS will remove that ADS.”? Does it mean CIS will remove the ADS it made with a previous version when an executable gets executed.

Hi EricJH,

Yes, exactly !

Kind Regards
Buket

Thank you for clarifying. :slight_smile: