Developer Forum

Hi,

My company has a Windows 2000 Advanced Server SP4 fileserver with a
large RAID 5 array (hardware 6*72GB). This drive has 1 large
partition. My problem is that there are a lot of files on the
partition with a modified date in the future e.g. 2045, 2027 etcetera.
How is this possible?

Hardware:
Asus CUR-DLS mainboard
Mylex ExtremeRAID 2000
Seagate ST173404LC

Best regards,
Han Valk.

System Engineer
Telematica Instituut
The Netherlands

Dear Han,

Thank you for your post.

Are these files from other systems? This problem may occur if the original
system's BIOS or system time is incorrect.

If these files' Modified Date is just changed recently, please update your
anti-virus application's virus database and perform a full scan on the
whole hard disk to ensure that the system is not infected.

You may also use some of the online removal tools located at:

http://security2.norton.com/us/intro.asp?venid=sym&langid=us
http://vil.nai.com/vil/stinger
http://www.trendmicro.com/download/tsc.asp

Then, we can use a tool called filedate.exe to manually adjust these files'
Created Date, Modified Date and Accessed Date. I will send this tool to
your e-mail box ( XXXX@XXXXX.COM ).

For example, we can run:

filedate.exe <Directory>\<FileName> /MD10-02-03

This command will change the file's Modified date to Oct. 02, 2003.

After changing the Modified Date, let's keep monitoring these files to see
if they will be changed again.

Please let me know if anything is unclear. Thanks!

Regards,
Joe Wu
Product Support Services
Microsoft Corporation

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
From: " XXXX@XXXXX.COM " < XXXX@XXXXX.COM >
Newsgroups: microsoft.public.win2000.file_system
Subject: Modified dates in the future.
Date: Wed, 01 Oct 2003 16:04:13 +0200
Organization: Telematica Instituut
Lines: 20
Message-ID: < XXXX@XXXXX.COM >
Reply-To: XXXX@XXXXX.COM
NNTP-Posting-Host: ti64.telin.nl
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Trace: news.surfnet.nl 1065017052 14187 195.169.16.64 (1 Oct 2003
14:04:12 GMT)
X-Complaints-To: XXXX@XXXXX.COM
NNTP-Posting-Date: Wed, 1 Oct 2003 14:04:12 +0000 (UTC)
X-Newsreader: Forte Agent 1.93/32.576 English (American)
Path:
cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed00.sul.t-online.de!t-onlin
e.de!130.59.10.21.MISMATCH!irazu.switch.ch!switch.ch!surfnet.nl!news.surfnet
nl!not-for-mail
Xref: cpmsftngxa06.phx.gbl microsoft.public.win2000.file_system:12192
X-Tomcat-NG: microsoft.public.win2000.file_system

Hi,

My company has a Windows 2000 Advanced Server SP4 fileserver with a
large RAID 5 array (hardware 6*72GB). This drive has 1 large
partition. My problem is that there are a lot of files on the
partition with a modified date in the future e.g. 2045, 2027 etcetera.
How is this possible?

Hardware:
Asus CUR-DLS mainboard
Mylex ExtremeRAID 2000
Seagate ST173404LC

Best regards,
Han Valk.

System Engineer
Telematica Instituut
The Netherlands


{\rtf1\ansi\ansicpg1252\deff0\deflang1033{\fonttbl{\f0\fnil\fprq2\fcharset0 MS Sans Serif;}}
\viewkind4\uc1\pard\f0\fs20 Dear Han,
\par
\par Thank you for your post.
\par
\par Are these files from other systems? This problem may occur if the original system's BIOS or system time is incorrect.
\par
\par If these files' Modified Date is just changed recently, please update your anti-virus application's virus database and perform a full scan on the whole hard disk to ensure that the system is not infected

i Joe,

I didn't receive the file because my posting alias is a fake address
to avoid spam. I've changed the Reply-To header to reflect the correct
address so if you would be so kind to send filedate.exe again?
I don't think it's a virus because we have virus protection
(TrendMicro ServerProtect) with the most recent updates.
Yes some of the files come from other systems but also files that
didn't come from other servers like files from users profiles
(ntuser.dat) suffer from the same problem. Our users' pc's are modern
computers with modern bios'.
I suspect there is something wrong with the filesystem, here's why:
- The date problem.
- When I do a search for these files using the gui from the root of
the drive the search just stops as if it was ready which it isn't.
- When I do a chkdsk in a dos box (read-only mode)) it quits during
stage 2 with 'An unspecified error has occurred'.

What do you think?

Best regards,
Han Valk

System Engineer
Telematica Instituut
The Netherlands


On Wed, 01 Oct 2003 20:02:36 GMT, XXXX@XXXXX.COM (Joe Wu
[MSFT]) wrote:

Dear Han,

Thank you for your post. I did not see your new e-mail address. If you
want, please drop me a note ( XXXX@XXXXX.COM ) and I will send you the
tool.

It is hard to tell if the file dates are due to a file system issue.
However, let's change the file dates to correct value and monitor the
system to see if it happens again.

Thanks!

Regards,
Joe Wu
Product Support Services
Microsoft Corporation

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
From: " XXXX@XXXXX.COM " < XXXX@XXXXX.COM >
Newsgroups: microsoft.public.win2000.file_system
Subject: Re: Modified dates in the future.
Date: Mon, 06 Oct 2003 15:37:50 +0200
Organization: Telematica Instituut
Lines: 121
Message-ID: < XXXX@XXXXX.COM >
References: < XXXX@XXXXX.COM >
< XXXX@XXXXX.COM >
Reply-To: XXXX@XXXXX.COM
NNTP-Posting-Host: ti64.telin.nl
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Trace: news.surfnet.nl 1065447470 6807 195.169.16.64 (6 Oct 2003 13:37:50
GMT)
X-Complaints-To: XXXX@XXXXX.COM
NNTP-Posting-Date: Mon, 6 Oct 2003 13:37:50 +0000 (UTC)
X-Newsreader: Forte Agent 1.93/32.576 English (American)
Path:
cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed00.sul.t-online.de!t-onlin
e.de!newsfeed.icl.net!newsfeed.fjserv.net!skynet.be!skynet.be!newshub1.home.
nl!home.nl!newsfeed.multikabel.nl!surfnet.nl!news.surfnet.nl!not-for-mail
Xref: cpmsftngxa06.phx.gbl microsoft.public.win2000.file_system:12373
X-Tomcat-NG: microsoft.public.win2000.file_system

Hi Joe,

I didn't receive the file because my posting alias is a fake address
to avoid spam. I've changed the Reply-To header to reflect the correct
address so if you would be so kind to send filedate.exe again?
I don't think it's a virus because we have virus protection
(TrendMicro ServerProtect) with the most recent updates.
Yes some of the files come from other systems but also files that
didn't come from other servers like files from users profiles
(ntuser.dat) suffer from the same problem. Our users' pc's are modern
computers with modern bios'.
I suspect there is something wrong with the filesystem, here's why:
- The date problem.
- When I do a search for these files using the gui from the root of
the drive the search just stops as if it was ready which it isn't.
- When I do a chkdsk in a dos box (read-only mode)) it quits during
stage 2 with 'An unspecified error has occurred'.

What do you think?

Best regards,
Han Valk

System Engineer
Telematica Instituut
The Netherlands


On Wed, 01 Oct 2003 20:02:36 GMT, XXXX@XXXXX.COM (Joe Wu
[MSFT]) wrote:

files'
n
t


{\rtf1\ansi\ansicpg1252\deff0\deflang1033{\fonttbl{\f0\fnil\fprq2\fcharset0 MS Sans Serif;}}
\viewkind4\uc1\pard\f0\fs20 Dear Han,
\par
\par Thank you for your post. I did not see your new e-mail address. If you want, please drop me a note ( XXXX@XXXXX.COM ) and I will send you the tool.
\par
\par It is hard to tell if the file dates are due to a file system issue. However, let's change the file dates to correct value and monitor the system to see if it happens agai