Help needed in regards to hidden streams

Discussion in 'Trojan Defence Suite' started by JDK, May 17, 2004.

Thread Status:
Not open for further replies.
  1. JDK

    JDK Registered Member

    Joined:
    May 17, 2004
    Posts:
    3
    Hi Guys,

    I am fairly new to TDS-3 and I have just recently tried to use the detection device of ADS hidden stream facility. I have set the "Ignore streams smaller than" to 128 bytes ( as recommended elsewhere in forum) and have thereby narrowed down the actual hidden streams to two streams. One of which I can associate to a screensaver I am using and with a size of 168 bytes.

    And the other one is associated to the browser I am using which is Mozilla and it has a size of 1725030 bytes

    Now my question is : are these 2 streams a security hazard and if so what should I do?

    Thanks for your help

    JDK
     
  2. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi JDK, I am concerned about the larger file, can you save it as a text file using "Dump stream to file"

    Thanks. Pilli
     
  3. JDK

    JDK Registered Member

    Joined:
    May 17, 2004
    Posts:
    3
    Hi Philli,

    When I try to save the file I have no option to save it as a text file. I can only save it as an .exe file.

    JDK

    +++++++++++++++

    Hi JDK, I am concerned about the larger file, can you save it as a text file using "Dump stream to file"

    Thanks. Pilli
     
  4. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Yes, Save it as a text file, it may be too large to post here, so if it is please send to submit@diamondcs.com.au for analysis.
    To save a s a text file just change the .exe extension to .txt

    JKDStream.txt :)

    Pilli
     
  5. JDK

    JDK Registered Member

    Joined:
    May 17, 2004
    Posts:
    3
    Hi Philli,

    I have now sent you the file " stream.txt"

    Thanks :)

    JDK
     
  6. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Thanks JDK, Hopefully you will get a reply from Gavin soon, though not until Perth's tomorrow in a few hours :)
     
Thread Status:
Not open for further replies.