Timestamps on excutables broken on copy

A. Timestamps on excutables broken on copy

Steps to reproduce:

  1. Open two explorer windows (and switch both to details view with columns)
    Win+R C:\Program Files\COMODO\COMODO Internet Security
    Win+R %TEMP%

  2. Mark cis.exe (or any other excutable) in window one
    Remember “date modified” (something like 1/30/2015 1:27 PM)

  3. Press Ctrl+C

  4. Select window two (TEMP folder)

  5. Press Ctrl+V

  6. Result: a new file cis.exe with “date modified” set to actual date and time

  • wrong!
  1. Optional: press again Ctrl+V and say yes to overwrite question

  2. Now cis.exe in TEMP has “date modified” value of 1/30/2015 1:27 PM

  • correct

Remark 1
Repeat step 1 to 6 with eula.rtf or cmdcfg.dll and “date modified” is correct after step 6.

Remark 2
Repeat step 1 to 6 with cis.exe again (delete it in TEMP before each cycle) and “date modified” is sometimes correct after step 6 on fourth or fifth cycle.
If you wait too long between cycles “date modified” is always wrong (some caching mechanism in cis?).
This is a completely unpredictable behavior! Very annoying.

Remark 3
Kill cavwp.exe, cis.exe, cistray.exe and cmdagent.exe and repeat step 1 to 6 with cistray.exe and “date modified” is correct after step 6.

Remark 4
Does not happen if destination is FAT32 instead of NTFS.

Remark 5
I have installed firewall only and all antivirus-like stuff disabled (see below) so why is cis tampering executable files?
Please explain how to completely switch off anything except the firewall feature.
Any help is appreciated greatly.

B. YOUR SETUP
version & configuration:
Comodo Firewall Free 8.1.0.4426

  • HIPS disabled
  • Sandbox disabled
  • Viruscope disabled
  • File rating disabled (all checkboxes unchecked, but still growing list of unrecognized files - another bug? - how to switch off?)

Have updated (without uninstall) from CIS 7.:
if so, have you tried a a a clean reinstall - if not please do?:
No.
No I won’t. Next action - if no solution - will be uninstall.

Have you imported a config from a previous version of CIS:
No

OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
Windows 7 Pro x64
UAC at max
Admin
No VM

Other security/s’box software a) currently installed b) installed since OS, including initial trial security software included with system:
No.

Known issue: https://forums.comodo.com/format-verified-issue-reports-cis/cisces-8-adds-ads-to-files-which-remain-present-if-files-distributed-m1367-t108102.0.html;msg785679#msg785679

So still not fixed after four months?

Why not provide a manual installable hotfix for those who want?

Again:
Please explain how to completely switch off anything except the firewall feature.

Workaround:
Disable cmdguard with sysinternals autoruns in tab drivers.
Comodo is crying “defense+ not functioning properly” and “fix it1” … but the firewall is working perfect and no more broken executables.

For the next version please consider saving your data in a database file and not in alternate streams of my files.
It’s bad enough that Microsoft use these.

Since this is already a known issue i will move this to resolved. The next version should fix this issue which is currently in beta.

If you have any questions feel free to start a new topic in the help section.

Thanks