Modified dates in the future.

  • Thread starter Thread starter isgroep
  • Start date Start date
I

isgroep

Hi,

My company has a Windows 2000 Advanced Server SP4 fileserver with a
large RAID 5 array (hardware 6*72GB). This drive has 1 large
partition. My problem is that there are a lot of files on the
partition with a modified date in the future e.g. 2045, 2027 etcetera.
How is this possible?

Hardware:
Asus CUR-DLS mainboard
Mylex ExtremeRAID 2000
Seagate ST173404LC

Best regards,
Han Valk.

System Engineer
Telematica Instituut
The Netherlands
 
Dear Han,

Thank you for your post.

Are these files from other systems? This problem may occur if the original
system's BIOS or system time is incorrect.

If these files' Modified Date is just changed recently, please update your
anti-virus application's virus database and perform a full scan on the
whole hard disk to ensure that the system is not infected.

You may also use some of the online removal tools located at:

http://security2.norton.com/us/intro.asp?venid=sym&langid=us
http://vil.nai.com/vil/stinger
http://www.trendmicro.com/download/tsc.asp

Then, we can use a tool called filedate.exe to manually adjust these files'
Created Date, Modified Date and Accessed Date. I will send this tool to
your e-mail box ([email protected]).

For example, we can run:

filedate.exe <Directory>\<FileName> /MD10-02-03

This command will change the file's Modified date to Oct. 02, 2003.

After changing the Modified Date, let's keep monitoring these files to see
if they will be changed again.

Please let me know if anything is unclear. Thanks!

Regards,
Joe Wu
Product Support Services
Microsoft Corporation

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
From: "(e-mail address removed)" <[email protected]>
Newsgroups: microsoft.public.win2000.file_system
Subject: Modified dates in the future.
Date: Wed, 01 Oct 2003 16:04:13 +0200
Organization: Telematica Instituut
Lines: 20
Message-ID: <[email protected]>
Reply-To: (e-mail address removed)
NNTP-Posting-Host: ti64.telin.nl
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Trace: news.surfnet.nl 1065017052 14187 195.169.16.64 (1 Oct 2003
14:04:12 GMT)
X-Complaints-To: (e-mail address removed)
NNTP-Posting-Date: Wed, 1 Oct 2003 14:04:12 +0000 (UTC)
X-Newsreader: Forte Agent 1.93/32.576 English (American)
Path:
cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed00.sul.t-online.de!t-onlin
e.de!130.59.10.21.MISMATCH!irazu.switch.ch!switch.ch!surfnet.nl!news.surfnet
nl!not-for-mail
Xref: cpmsftngxa06.phx.gbl microsoft.public.win2000.file_system:12192
X-Tomcat-NG: microsoft.public.win2000.file_system

Hi,

My company has a Windows 2000 Advanced Server SP4 fileserver with a
large RAID 5 array (hardware 6*72GB). This drive has 1 large
partition. My problem is that there are a lot of files on the
partition with a modified date in the future e.g. 2045, 2027 etcetera.
How is this possible?

Hardware:
Asus CUR-DLS mainboard
Mylex ExtremeRAID 2000
Seagate ST173404LC

Best regards,
Han Valk.

System Engineer
Telematica Instituut
The Netherlands
 
Hi Joe,

I didn't receive the file because my posting alias is a fake address
to avoid spam. I've changed the Reply-To header to reflect the correct
address so if you would be so kind to send filedate.exe again?
I don't think it's a virus because we have virus protection
(TrendMicro ServerProtect) with the most recent updates.
Yes some of the files come from other systems but also files that
didn't come from other servers like files from users profiles
(ntuser.dat) suffer from the same problem. Our users' pc's are modern
computers with modern bios'.
I suspect there is something wrong with the filesystem, here's why:
- The date problem.
- When I do a search for these files using the gui from the root of
the drive the search just stops as if it was ready which it isn't.
- When I do a chkdsk in a dos box (read-only mode)) it quits during
stage 2 with 'An unspecified error has occurred'.

What do you think?

Best regards,
Han Valk

System Engineer
Telematica Instituut
The Netherlands
 
Dear Han,

Thank you for your post. I did not see your new e-mail address. If you
want, please drop me a note ([email protected]) and I will send you the
tool.

It is hard to tell if the file dates are due to a file system issue.
However, let's change the file dates to correct value and monitor the
system to see if it happens again.

Thanks!

Regards,
Joe Wu
Product Support Services
Microsoft Corporation

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
From: "(e-mail address removed)" <[email protected]>
Newsgroups: microsoft.public.win2000.file_system
Subject: Re: Modified dates in the future.
Date: Mon, 06 Oct 2003 15:37:50 +0200
Organization: Telematica Instituut
Lines: 121
Message-ID: <[email protected]>
References: <[email protected]>
<[email protected]>
Reply-To: (e-mail address removed)
NNTP-Posting-Host: ti64.telin.nl
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Trace: news.surfnet.nl 1065447470 6807 195.169.16.64 (6 Oct 2003 13:37:50
GMT)
X-Complaints-To: (e-mail address removed)
NNTP-Posting-Date: Mon, 6 Oct 2003 13:37:50 +0000 (UTC)
X-Newsreader: Forte Agent 1.93/32.576 English (American)
Path:
cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed00.sul.t-online.de!t-onlin
e.de!newsfeed.icl.net!newsfeed.fjserv.net!skynet.be!skynet.be!newshub1.home.
nl!home.nl!newsfeed.multikabel.nl!surfnet.nl!news.surfnet.nl!not-for-mail
Xref: cpmsftngxa06.phx.gbl microsoft.public.win2000.file_system:12373
X-Tomcat-NG: microsoft.public.win2000.file_system

Hi Joe,

I didn't receive the file because my posting alias is a fake address
to avoid spam. I've changed the Reply-To header to reflect the correct
address so if you would be so kind to send filedate.exe again?
I don't think it's a virus because we have virus protection
(TrendMicro ServerProtect) with the most recent updates.
Yes some of the files come from other systems but also files that
didn't come from other servers like files from users profiles
(ntuser.dat) suffer from the same problem. Our users' pc's are modern
computers with modern bios'.
I suspect there is something wrong with the filesystem, here's why:
- The date problem.
- When I do a search for these files using the gui from the root of
the drive the search just stops as if it was ready which it isn't.
- When I do a chkdsk in a dos box (read-only mode)) it quits during
stage 2 with 'An unspecified error has occurred'.

What do you think?

Best regards,
Han Valk

System Engineer
Telematica Instituut
The Netherlands
 
Back
Top