executable found hidden

Discussion in 'Trojan Defence Suite' started by jargonize, Feb 13, 2004.

Thread Status:
Not open for further replies.
  1. jargonize

    jargonize Registered Member

    Joined:
    Jun 18, 2003
    Posts:
    22
    tds-3 scan. executable found(in hidden data stream)
    ads hidden stream detected
    path-c:\regprot\regprot.exe:|summayinformation
    size 20568 bytes
    MZ Exe. unknown MZ
    my question is it seems to be part of another prog, not sure what it does. regprot is a registry alert prog. if i delete the prog will not run, right? if i leave it tds-3 will pick it up each time it scans, right? i don't think regprot trys to send info from this pc.

    jar
     
  2. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hithere jargonize ,
    RegProt is a DiamondCs program, and it's the first time i hear about a NTFS ADS stream there; please submit it to TDS submit@diamondcs.com.au and gavindcs@iinet.net.au to look into the stream and what it does.
    Is it first time you see this?
    MZ says already it's an executable and it's over 180 bytes big so it can be anything less innocent, let's wait for Gavin's answer.
    Is this the only alarm you get or are there more?
     
  3. jargonize

    jargonize Registered Member

    Joined:
    Jun 18, 2003
    Posts:
    22
    it picked up thie stream in the first part of the scan. so i tryed to delete just the stream by right clicking on it, well that didn't happen cause then i did a full scan, it picked up the stream twice. sorry to say the pc where tds-3 is installed is in the shop, when i get it back if i don't have to reformat, i'll try to send it to you. been using regprot for a while now and no problems. think i should uninstall it and redownload it?

    thanks for your reply
     
  4. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    For a stream no reason to reformat, Gavin will tell you if there are any extra measures needed if you're able to send him the file for deeper investigation for you.
    Might be nothing serious is wrong at all!
    If you have X you might be able to go back to a former restore point and see if you got rid of it then.
    If it is a nasty (after Gavin's advice) and system restore didn't help, and a cleaning / deleting via TDS didn't work either, uninstalling regprot and installing a fresh download would be something.
     
Thread Status:
Not open for further replies.