File corruption on external drives

Comodo Internet Security - CIS AntiVirus Help - CIS
#1

Im getting file corruption with comodo antivirus enabled.
This only seems to happen on external drives.
I’ve been working out of my laptop for the last year or so and as a result have collected
a number of external USB HDD’s for storage.

Recently while moving files between 1 computer and another I ran into several corrupt files.
At first I thought it was the usb cable… maybe a short, but swapping to a new cable corruption continued.
Windows reports no drive errors in event viewer.

So I started conducting tests with 200 files totaling 75gb, I hashed the files (sha1)
after several days a pattern emerged, with AV enabled I always had at least 1 corrupt file,
With AV turned off no errors in about 2 dozen runs.

I’ve noticed this happening on both computers I tested, 2 different drives, and 3 different cables.
I use to use avast but about 1 1/2 years ago switched to using comodo on all my windows systems.
I’ve started auditing my other external drives for corruption and continue to find files bad… these drives are rarely used.
as they are for archival data.

Both computers tested was windows 7 based (basic 32bit [amd cpu] & home premium 64bit [intel cpu])

I’ve found 1 way that seems to eliminate the problem with AV still enabled, But it’s not ideal.
By default windows will disable write caching for external drives… so if you yank the plug without ejecting properly the chance
of file corruption is minimal… you can optionally enable write caching on external drives and this seems to alleviate or possibly eliminate the problem.
I think this is why I have only noticed corruption on external drives, not internal drive (C:)
It needs more testing but on the 5 runs with write caching on I had no errors on external drive.

Has anyone else ran into this?
The insidious thing about this windows reports no errors in the logs, chkdsk says every thing is great.
and unless it’s something easily tested like a archive (zip, rar, 7zip) you have to have file hashes to compare.
audio, video, text, etc, are harder to test with out a good hash to compare.

To be clear these tests was carried out without unpluging the drive, so it’s not a case of me yanking the cord without ejecting.
I have a theory that with AV enabled comodo is locking up parts of the file while scanning in real time and is causing corruption.
comparing bad files via hex editor usually showed a small continuous chuck of the file is garbled not the entire file.

The external drives are all NTFS formatted.

#2

Welcome to the Comodo Forums with an impressive first post. My utmost respect for your thorough testing. This is very much worth a bug report and I am looking forward to learn about your finding with write cashing enabled.

On a side note. Last night I was working on Windows 10 Insider last night and had downloaded the latest build. I had copied the install.esd to an another internal drive to convert it to an ISO image later. For unknown reason the installation folder for the new build had gotten erased when I tried to install. I downloaded the latest build again and when I checked the install.esd files to see if I they were the same or not. I noticed the they were slightly different. I don’t know why that was and didn’t think much about but seeing your post has me wondering some.

#3

I’ve continued to test this and keep coming up with the same results… write buffering on you’re ok, if it’s off you get frequent but not total file corruption with antivirus set to active (stateful/on access)

I was really hoping someone else had seen this and had a solution, It could be a combination of factors… so I can’t say with 100% certainty the problem is completely isolated to Comodo.

I ran across a thread on a different message board where similar happenings, there was some talk that microsoft security essentials might have been the cause, although I don’t have that installed… still this might be a common problem among antivirus or security programs at last on win7

How do I submit this to Comodo for investigation?
In the mean time I think I might load up a few other AV’s to see how things go.

#4

Thank you for the thorough testing you have done. Those are important findings. I will not stop you from testing other security solutions but I could understand if you would leave it there.

You can submit a bug report in the Bug Reports - CIS board following the format as described in FORMAT & GUIDE - just COPY/PASTE it!.

Reporting of bugs is strictly moderated to make sure Comodo gets clear bug reports. So, please make sure you closely follow protocol. That way your report will certainly be seen by Comodo staff.

Edit. I’ve sent a pm to two other mods that handle bugs and asked them to take a look and see if there is more information needed.