CIS v.8 Copying and Setting Date/Time of files

Since some time I noticed that Total Commander TC (in some cases only) does not copy “correctly” time & date of the file (Win 7, 64x, NTFS):

  • I copy a file from one dir to another (same logical drive)
  • compare the two directories with Shift F2 and the second file (the new one) shows as newer than the old one.

I see - the second file has a new “Modified time” (the current time), the “Created” and “Accessed” time are the same as in the first file. Apparently - because of the newer Modified time, TC shows the second fiel as “newer”.

This has never happened to me till now. It happens seldom - only with some files, most are being copied one to one without changing the “Modified” time (I talk about files in the same directories as in the first example).

TC does work as it just copies the file and then changes the timestamp accordingly. Most probably the reason for a wrong timestamp is related to antivirus interaction: I suppose the file is blocked by CIS at the time TC accesses the file for setting the timestamp.

This strange situation came up since I installed the last CIS 8, in CIS 7 there is no such problem - I could check it on another PC with CIS 7 installed, there I can not replicate the problem.

Although this does not say necessarily the problem is linked to CIS, it looks like CIS has smth. to do with it… ?

The same thing happened to me with other PC , I do not use TotalCommander but instead FreeCommander which is a great filemanager for free … I was going crazy trying to find out the problem… I suspected that Comodo was the problem … but I did not have any facts , just a theory …

I have 3 PCs with the same problems …

Windows XP SP3 with Avira and Comodo Firewall ( no HIPS )
Windows 7 SP1 with Avira and Comodo Firewall ( no HIPS )
Windows 8 with Avira and Comodo Firewall ( no HIPS )

I have Comodo Firewall 8 and Avira 2014

Zipped files are copied preserving timestamp but exe files are modified with the current timestamp of the system… no problem with previous version of Comodo… I hope to find fixed the issue…

Thanks…

Alessandro

Read the following bug report:

https://forums.comodo.com/format-verified-issue-reports-cis/cisces-8-adds-ads-to-files-which-remain-present-if-files-distributed-m1367-t108102.0.html

I’ll append a test I just did by edit to this post, but, in short, a copy of an executable (.exe) from one Folder to another on the same volume also appends the Comodo $CmdTcID stream tag and changes modified date on the new/copied file.

EDIT TO APPEND FOLLOWS:

File Copy Test

Environment: Host/Win10TP x64 Build 9879 with VirtualBox v4.3.12 (no Comodo installed Host Products)
Guest/WinXP Pro x32 with Comodo CIS v8.0.0.4344 and CD v36.1.1.21

Analyzer Tool: ADS Scanner 2.01 (on Guest) to check before/after effects of actions

From the Guest machine using Windows Explorer, copied file msmsgs.exe
from c:\Program Files\Messenger
to c:\

File Properties Date/Time (C-Created) (M-Modified) (A-Accessed)

Old: (C) Saturday, November 22, 2014, 3:43:19 PM
(M) Monday, April 14, 2008, 5:42:30 AM
(A) This time consistent with D/T of Properties Check

New: (C) Saturday, December 13, 2014, 2:30:15 PM
(M) Saturday, December 13, 2014, 2:30:15 PM
(A) This time consistent with D/T of Properties Check

ADS added on action: $CmdTcID tag name with size 64 Bytes

It happens to me with any kind of files :frowning:

I was only aware of those in the original report linked above:

(*.cpl, *.exe, *.dll, *.mui, *.ocx, *.sys, *.scr, *.drv, *.efi, *.fon)

Do you have others I can check and verify? Also, you can download and install ADS Scanner to run checks if it helps get your report into Format.

Would be a feature? :stuck_out_tongue: It sounds like a big problem for Comodo… other tricks to solve the issue are very dangerous and I cannot encourage them… I read the thread you linked… but I cannot see serious solutions… we need a rewritten version of comodo 8…

It’s a known issue. I would appreciate if you could update that one with additional information, if possible.

I will move this report to “Resolved/Outdated Issues” section.

Thank you.