Just installed CIS a few days ago, version 6.0.264710.2708 with database 15604.
System is Win7-x64 pro SP1
After getting completely lost in the new user interface for a very long time, I decided to just have it run a full scan if only to get rid of the “not ok” status and try to decode the interface later.
Since no obvious or severe items were found, I decided to clear the log files to give it a fresh start from there on.
Now I just discovered that in folder “C:\ProgramData\Comodo\Cis\Quarantine\Temp” about 20 items exist with some really weird names like “{7D580576-C6AE-4427-90B6-689087D7E644}”.
Checking my “quarantined items” in CIS main window (button “quarantine”, the normal way) it returns… zero items, no matter how much I press the refresh button.
To me this seems like a conflict. ???
Ok, guessing that the weirdly named files are either copies of “to be processed items” OR the quarantined (=moved) files themselves, I decided to check what it actually was.
Curiously enough, some of the weirdly-named files are plain stupid text files, simple readable text, albeit with non-standard extensions like ‘key’, and even just plain old ascii ‘txt’ files.
Some of the other files I couldn’t identify upto now, some seem to be ‘exe’ files and some I just can’t find what they actually are or where they come from.
Now the questions:
Why are there (assumed to be) “quarantined” items in “C:\ProgramData\Comodo\Cis\Quarantine\Temp” that don’t show up in the list when I press the button “quarantine”?
Did clearing the log files have anything to do with them not showing up in the quarantine window?
Are they all just copies of files still residing in their normal place?
How can I figure out where they originally came from to verify nothing gets deleted inadvertently?
Is it safe to delete them manually without loosing any stuff?
Does CIS still process them in some background way, despite they don’t show up in the “quarantine” list?
Edit: In my search for the original files, I found some of the file-images residing in “C:\ProgramData\Comodo\Cis\Quarantine\Temp” to be originating in compressed files.
Is it possible CIS decompresses zip files in above named folder just for scanning purposes, but doesn’t delete the temporary extracted files afterwards?
This could explain why I’m having a really hard time finding the origin of the files, even with advanced search functions for “normal” files, and I’m not in the mood for verifying all my .zip and/or .rar files >:(
grtz
Peter