1

There are some files are computer that are extremely old (like 2-3 years) even though the computer is pretty new. It is very possible that it isn't virus, right? What explanations?

4 Answers 4

3

It does not mean you have a virus. In fact, I doubt any virus files would have old data stamps unless you had been infected for a long time (since the date stamp).

When you are installing Windows, for example, there is not yet any mechanism that updates the files as they are written, so you get the original dates that were on the files when they were put on the installation media.

My system is almost surely not infected, but the date on my Notepad.exe is 7/13/2009.

You are probably fine, but if you have any reason to believe you are infected, by all means, run some scans.

2
  • Yeah, Date Created does not equal to "the date the files showed up on your computer."
    – surfasb
    Jul 30, 2011 at 0:03
  • I don’t think any of that applies anyway, because progtick is almost certainly talking about the Date Modified timestamp since Date Created is not visible in Explorer by default.
    – Synetech
    Jul 30, 2011 at 6:35
0

It's very possible to download files that gets to keep their date of creation metadata. This is particularly true for files contained in compressed archives, such as zip/rar/tar files. I would not worry about the dates of the files if I were you.

Use Microsoft's Security Essentials if you need to make sure you're not harboring infected files. It's free!

0

No, I don't believe this is a virus. As has been stated above me, it is most likely that the date you see is the actual date the original file was created, AKA when the program was written.

If you're worried about viruses, download Avast! Antivirus Free and MalewareBytes Antimalware, two completely free and very good pieces of software.

Malwarebytes: http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button

Avast: http://www.avast.com/free-antivirus-download

0

Which timestamp are you looking at, the Date Modified column right?

The modified timestamp simply indicates the date and time that the file was last modified. It is not updated when you install Windows because the files are not actually modified when they are copied to the hard-drive; they are identical to a copy when the file was first made.

What you want to look at is the Date Created column—it’s not visible by default; right-click the headers (where the buttons are) and select the Date Created item in the pop-up list.

The created timestamp is when the file was actually created, regardless of whether or not it is identical to another copy. This is updated to the current date when you install Windows (or download a file or whatever) to reflect when the file was written to the disk (it would have been better if it were named DateWritten).

NB: both timestamps can be programmatically altered, so they are not a good indication of any sort of malfeasance anyway; they are merely a bit of meta-data for assisting in file-management.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .