Help needed in regards to hidden streams

Discussion in 'Trojan Defence Suite' started by JDK, May 17, 2004.

Thread Status:
Not open for further replies.
  1. JDK

    JDK Registered Member

    Joined:
    May 17, 2004
    Posts:
    3
    Hi Guys,

    I am fairly new to TDS-3 and I have just recently tried to use the detection device of ADS hidden stream facility. I have set the "Ignore streams smaller than" to 128 bytes ( as recommended elsewhere in forum) and have thereby narrowed down the actual hidden streams to two streams. One of which I can associate to a screensaver I am using and with a size of 168 bytes.

    And the other one is associated to the browser I am using which is Mozilla and it has a size of 1725030 bytes

    Now my question is : are these 2 streams a security hazard and if so what should I do?

    Thanks for your help

    JDK
     
  2. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi JDK, I am concerned about the larger file, can you save it as a text file using "Dump stream to file"

    Thanks. Pilli
     
  3. JDK

    JDK Registered Member

    Joined:
    May 17, 2004
    Posts:
    3
    Hi Philli,

    When I try to save the file I have no option to save it as a text file. I can only save it as an .exe file.

    JDK

    +++++++++++++++

    Hi JDK, I am concerned about the larger file, can you save it as a text file using "Dump stream to file"

    Thanks. Pilli
     
  4. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Yes, Save it as a text file, it may be too large to post here, so if it is please send to submit@diamondcs.com.au for analysis.
    To save a s a text file just change the .exe extension to .txt

    JKDStream.txt :)

    Pilli
     
  5. JDK

    JDK Registered Member

    Joined:
    May 17, 2004
    Posts:
    3
    Hi Philli,

    I have now sent you the file " stream.txt"

    Thanks :)

    JDK
     
  6. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Thanks JDK, Hopefully you will get a reply from Gavin soon, though not until Perth's tomorrow in a few hours :)
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.