Kav 5 is pissing me off

very bad idea.
you'll lose all the security permissions on the files in the process.
like I said, check the Cygwin list, there's probably a tool included in Cygwin just for dissociating the ADSs.

 

You can try "streams" from Sysinternals which should be capable to delete such ADS.
Link: http://www.sysinternals.com/ntw2k/source/misc.shtml#streams

"streams -s -d C:\" from the command line should to the trick.

regards, Joerg

 

Thanks Joerg, that seems to have done the trick!

 

Holy cases of thread resurrection batman.

 

What if your program files are on a different drive? Does it need to be ran there too? Thanks

 

This is sure an interesting thread! I had never even heard of alternate data streams until I read this thread. I am currently trialling KAV 5.0. So, I was immediately concerned. I downloaded Crucial ADS. It found 145 instances of files with ADS. So, I guess KAV fixed their problem.

Should I use the System Internals Stream program to delete the ADS from these 145 files? I'm wondering if some of the ADS is useful and should be left.

 

Leave them alone if everything is running fine. ADS' are just tags used to make the scan process more efficient. People are more pissed off about the fact that KAV installed them without asking permission first. Also in version 121 they were added to pretty much everything.

 

I don't think these are from KAV although I don't really know how to tell. How do I tell? Since there are not a lot of them and they are mostly certain programs but not all, Dell stuff and system restore files, I don't think KAV put them there. KAV would have tagged all the program files right? Why just some? What if some of them contain viruses? From the information I have read on ADS that can happen and no AV can detect it. What if there is some kind of tracking information put there and not by KAV?

 

Yes, you have to run it on each drive separately.

 

That removes all ADSs from all files on drive C...
Does anyone know the names of the ADSs that Kaspersky adds, something like:
C:\filename.exe:Kaspersky.md5
maybe then it would be possible to just clean out KAV's ADSs.

It's possible to check the name with the Sysinternals tool, I would do it myself but since it seems some other people have it installed already maybe they could pipe in...

 

It adds ADS to basically ALL files, not just a few as you will see if you run Streams. The ADS additions have various names, e.g. kav64xxx, kav 128xxx.

Steve