Heather said:
Lavasoft have just released the new free AdAware SE Personal edition.
For more details see
http://www.lavasoft.nu/software/adaware/
Heather
"Now scans and lists alternate Data-streams on NTFS volumes" (in the new
SE version).
What caught me by surprise is that Ad-Aware did not check the ADS
(alternate data stream), a "feature" of NTFS, until this new version.
This new support of an old NTFS feature also makes it suspect that
Spybot doesn't check ADS, either. I have tried to contact Symantec
regarding their Speed Disk and Anti-Virus products to check if they
interrogate the ADS of a file but never got a response (I also wanted to
find out how Speed Disk handled files under 1500 bytes in size that may
reside wholly within the MFT rather than as separate files). See
http://support.microsoft.com/?id=105763) which describes the attribute
(i.e., pointer) for the alternate data stream in the NT file system.
Most users don't even known about alternate data streams (where you can
have completely different content in each data stream) because Explorer,
the 'dir' command, and other common end-user tools never expose this
NTFS feature.
Even Microsoft's own SFC (system file checker) is deficient regarding
alternate data streams. While Windows File Protection will prevent the
replacement of protected system files, it does not prevent a user with
sufficient permissions from adding an alternate data stream to a system
file. SFC.exe will show the protected system files are okay but it
won't check the alternate data streams (which I consider a significant
security flaw). For non-protected system files, ANYONE can attach an
alternate data stream to a file. Even the Guest account can do that.
You can even add an ADS (alternate data stream) to a directory entry.
Microsoft provides nothing for tools to manage and report alternate data
streams of files. You have to go use 3rd party tools, like lads.exe by
Frank Heyne. If you copy a file that has alternate data streams to a
non-NTFS media, like a floppy, the alternate data stream simply gets
truncated or maybe you get a message saying there isn't enough room for
your 1-byte file (because there is 20MB in an alternate data stream
attributed to the file). You could, for example, download a text file
that looks inocuous because all you see in it is plain text but it has
an executable file in an ADS that is harmful. You see goodfile.txt but
a script might run "start goodfile.txt:wipedisk.exe". If the use of ADS
was really to provide additional attributes then Microsoft should have
made all content within an ADS to always be non-executable; i.e.,
something like "start goodfile.txt:wipedisk.exe" should abort with an
error like "Alternate data streams (ADSs) are not executable (file =
"goodfile.txt", ADS: "wipedisk.exe")", or just refuse to run any
executable that has a colon (":") in its filename (which may be what
happens now in Windows XP since "start test.txt:calc.exe", where the
Calculator program has been put into an ADS of test.txt, results in an
illegal syntax error message but the linked articles usually refer to
Windows 2000 although one mentioned XP, plus that doesn't stop the
content in the ADS from being programmatically extracted and executed).
I don't know if Symantec checks for ADSs even in their anti-virus
products to search through any "hidden" content. ADSs aren't new.
They've been around since NTFS showed up. However, I have yet to find a
reference in Symantec's KB about ADS. In the last 'references' link
below, the statement "Virus scanners only check the default data streams
of files" gets me very concerned that a virus could use ADS to bypass
anti-virus software (but there is no datestamp in this article to
determine its timeliness, and the W2K.Stream virus it mentions that
utilitizes ADS is dated by Symantec at
http://snipurl.com/7g73 back in
September 2000). It is also noted in this article, however, that the
real-time scanner for an anti-virus product should detect the virus when
it attempts to load into memory from the ADS of the infected file. So a
manual scan won't see the infection but the real-time scanner also
monitoring the memory will detect it getting loaded.
Some references:
http://www.ntfs.com/ntfs-multiple.htm
http://support.microsoft.com/?id=105763
http://www.windowsecurity.com/articles/Alternate_Data_Streams.html
Utilities to detect ADS:
http://www.heysoft.de/nt/ntfs-ads.htm
http://www.crucialsecurity.com/downloads.html (crucialADS utility)
http://www.sysinternals.com/ntw2k/source/misc.shtml#streams