NTFS Alternate Data Stream??

Discussion in 'Trojan Defence Suite' started by RIFLEMAN, Feb 16, 2004.

Thread Status:
Not open for further replies.
  1. RIFLEMAN

    RIFLEMAN Registered Member

    Joined:
    Feb 1, 2004
    Posts:
    50
    Hello. I have used TDS for a week now and just found it wasn't scanning my entire drive so I reconfigured it to do so. As it scans right now it has many alarms showing these NTFS Alternate data streams. I see a couple of email addresses that I sent mail to and also a few that I didn't. What in the heck are these things? I am pretty green when it comes to this stuff; but have suspected a problem for some time now. Is there anything in there I should be concerned about? Thanks for your time.

    :43:45 [Init] Trojan Defence Suite v3.2.0 (UNLICENSED)
    06:43:45 [Init] Started 16-02-04 06:43:45 Eastern Standard Time (UTC: 5), Internet Time @530.38
    06:43:45 [Init] Loading TDS-3 Systems ...
    06:43:45 [Init] Token successfully adjusted.
    06:43:45 [Init] • TDS Privileges : OK. Adjusted TDS-3 token privileges to maximum
    06:43:45 [Init] • Plugins : OK. Loaded 13
    06:43:45 [Init] • Exec Protection : Not Installed
    06:43:45 [Init] WARNING: Your Radius.TD3 database needs to be updated!
    06:43:45 [Init] Please download the latest from http://tds.diamondcs.com.au/radius.td3
    06:43:45 [Init] Licensed users can use the Update facility from the TDS menu
    06:43:46 [Init] Loading Radius Advanced Scanning Systems ... <R3 Engine, DCS Labs>
    06:43:51 [Init] • Radius Advanced Specialist Extensions on standby for 13 trojan families
    06:43:51 [Init] • Systems Initialised [31795 references - 11432 primaries/9084 traces/11279 variants/other]
    06:43:51 [Init] Radius Systems loaded. <Databases updated 11-02-2004>
    06:43:51 [Init] TDS-3 Ready. <Edit Canada>
    06:43:51 [Tip Of The Day] Visit the TDS-3 homepage at http://tds.diamondcs.com.au regularly to check for updates.
    06:43:51 [TDS] Good morning Rifleman Working early?
    06:43:55 [Mutex Memory Scan] Started...
    06:43:57 [Mutex Memory Scan] Finished (no trojan mutexes found).
    06:43:57 [Trace Scan] Started...
    06:44:06 [Trace Scan] Finished.
    06:44:06 [TDS-3] This is an EVALUATION demo of TDS-3. Please see the help file for help on registering.
    06:44:24 [Trace Scan] Started...
    06:44:33 [Trace Scan] Finished.
    06:44:42 [Memory Scan] Memory scan started, please wait a moment ...
    06:44:43 [Memory Scan] Memory scan complete.
    06:59:11 [Trace Scan] Started...
    06:59:21 [Trace Scan] Finished.
    06:59:21 [Service\Driver Scan] Scanning for services and drivers ...
    06:59:24 [Service\Driver Scan] Scanned 266 services and drivers.
    06:59:24 [File Scan] Scanning in C:\WINDOWS\ ...
    07:00:55 [File Scan] Scanned 1613 files: 0 alarms in 90.57813 seconds (Avg 18.81 files/sec)
    07:00:55 [Scan] Finished.
    07:02:38 [Trace Scan] Started...
    07:02:48 [Trace Scan] Finished.
    07:02:48 [Service\Driver Scan] Scanning for services and drivers ...
    07:02:51 [Service\Driver Scan] Scanned 266 services and drivers.
    07:02:51 [File Scan] Scanning in C:\WINDOWS\ ...
    07:12:16 [File Scan] Scanned 9161 files: 0 alarms in 564.0938 seconds (Avg 17.24 files/sec)
    07:12:16 [File Scan] Scanning in C:\ ...
    07:12:16 [NTFS ADS] Stream found - c:\aaw.exe:SummaryInformation
    07:12:17 [NTFS ADS] Stream found - c:\aaw.exe:(4c8cc155-6c1e-11d1-8e41-00c04fb9386d)
    07:12:18 [NTFS ADS] Stream found - c:\lrsetup.exe:SummaryInformation
    07:12:18 [NTFS ADS] Stream found - c:\lrsetup.exe:(4c8cc155-6c1e-11d1-8e41-00c04fb9386d)
    07:12:18 [NTFS ADS] Stream found - c:\zasetup_37_143.exe:SummaryInformation
    07:12:18 [NTFS ADS] Stream found - c:\zasetup_37_143.exe:(4c8cc155-6c1e-11d1-8e41-00c04fb9386d)
    07:21:15 [Script Error] ERR: Type mismatch: 'hello' (LINE: 1 COL:0)
    07:31:53 [Locked File] Couldn't open c:\recycler\qrspfaxogmtjuqjltvpaborobkqowmcmeewlajkipfqgnj\dc20.exe for read access, file is locked
    07:31:54 [Locked File] Couldn't open c:\recycler\qrspfaxogmtjuqjltvpaborobkqowmcmeewlajkipfqgnj\dc64.exe for read access, file is locked
    07:31:54 [Locked File] Couldn't open c:\recycler\qrspfaxogmtjuqjltvpaborobkqowmcmeewlajkipfqgnj\dc65.exe for read access, file is locked
    07:31:54 [Locked File] Couldn't open c:\recycler\qrspfaxogmtjuqjltvpaborobkqowmcmeewlajkipfqgnj\dc73.exe for read access, file is locked
    07:31:54 [Locked File] Couldn't open c:\recycler\qrspfaxogmtjuqjltvpaborobkqowmcmeewlajkipfqgnj\dc83.exe for read access, file is locked
    07:31:54 [Locked File] Couldn't open c:\recycler\qrspfaxogmtjuqjltvpaborobkqowmcmeewlajkipfqgnj\dc84.exe for read access, file is locked
    07:31:55 [NTFS ADS] Stream found - c:\recycler\s-1-5-21-1644491937-1788223648-839522115-1004\dc126.exe:SummaryInformation
    07:31:55 [NTFS ADS] Stream found - c:\recycler\s-1-5-21-1644491937-1788223648-839522115-1004\dc126.exe:(4c8cc155-6c1e-11d1-8e41-00c04fb9386d)
    07:31:58 [NTFS ADS] Stream found - c:\recycler\s-1-5-21-1644491937-1788223648-839522115-1004\dc214:
    07:31:58 [NTFS ADS] Stream found - c:\recycler\s-1-5-21-1644491937-1788223648-839522115-1004\dc215:
    07:31:58 [NTFS ADS] Stream found - c:\recycler\s-1-5-21-1644491937-1788223648-839522115-1004\dc227:
    07:42:38 [File Scan] Scanned 35719 files: 11 alarms in 1821.672 seconds (Avg 20.61 files/sec)
    07:42:38 [File Scan] Scanning in C:\WINDOWS\ ...
    07:51:08 [File Scan] Scanned 9161 files: 11 alarms in 509.4375 seconds (Avg 18.98 files/sec)
    07:51:08 [File Scan] Scanning in C:\ ...
    07:51:08 [NTFS ADS] Stream found - c:\aaw.exe:SummaryInformation
    07:51:08 [NTFS ADS] Stream found - c:\aaw.exe:(4c8cc155-6c1e-11d1-8e41-00c04fb9386d)
    07:51:09 [NTFS ADS] Stream found - c:\lrsetup.exe:SummaryInformation
    07:51:09 [NTFS ADS] Stream found - c:\lrsetup.exe:(4c8cc155-6c1e-11d1-8e41-00c04fb9386d)
    07:51:09 [NTFS ADS] Stream found - c:\zasetup_37_143.exe:SummaryInformation
    07:51:09 [NTFS ADS] Stream found - c:\zasetup_37_143.exe:(4c8cc155-6c1e-11d1-8e41-00c04fb9386d)
    08:01:16 [TDS] Good morning Robert.
    08:10:53 [Locked File] Couldn't open c:\recycler\qrspfaxogmtjuqjltvpaborobkqowmcmeewlajkipfqgnj\dc20.exe for read access, file is locked
    08:10:54 [Locked File] Couldn't open c:\recycler\qrspfaxogmtjuqjltvpaborobkqowmcmeewlajkipfqgnj\dc64.exe for read access, file is locked
    08:10:54 [Locked File] Couldn't open c:\recycler\qrspfaxogmtjuqjltvpaborobkqowmcmeewlajkipfqgnj\dc65.exe for read access, file is locked
    08:10:54 [Locked File] Couldn't open c:\recycler\qrspfaxogmtjuqjltvpaborobkqowmcmeewlajkipfqgnj\dc73.exe for read access, file is locked
    08:10:54 [Locked File] Couldn't open c:\recycler\qrspfaxogmtjuqjltvpaborobkqowmcmeewlajkipfqgnj\dc83.exe for read access, file is locked
    08:10:54 [Locked File] Couldn't open c:\recycler\qrspfaxogmtjuqjltvpaborobkqowmcmeewlajkipfqgnj\dc84.exe for read access, file is locked
    08:10:55 [NTFS ADS] Stream found - c:\recycler\s-1-5-21-1644491937-1788223648-839522115-1004\dc126.exe:SummaryInformation
    08:10:55 [NTFS ADS] Stream found - c:\recycler\s-1-5-21-1644491937-1788223648-839522115-1004\dc126.exe:(4c8cc155-6c1e-11d1-8e41-00c04fb9386d)
    08:10:59 [NTFS ADS] Stream found - c:\recycler\s-1-5-21-1644491937-1788223648-839522115-1004\dc214:
    08:10:59 [NTFS ADS] Stream found - c:\recycler\s-1-5-21-1644491937-1788223648-839522115-1004\dc215:
    08:10:59 [NTFS ADS] Stream found - c:\recycler\s-1-5-21-1644491937-1788223648-839522115-1004\dc227:
    08:21:52 [File Scan] Scanned 35853 files: 22 alarms in 1843.984 seconds (Avg 20.44 files/sec)
    08:21:52 [Scan] Finished.
    08:25:01 [Screen Text] Saved to C:\Program Files\TDS3\scr0.txt
    r perusal and some help? Thanks for the ime.
     
  2. Trojan scientist

    Trojan scientist Registered Member

    Joined:
    Feb 16, 2004
    Posts:
    16
    NTFS data streams usually arent anything to worry about , but there is a possibility for trojans to use this space to camp out in.


    ill let the real pros here dissect your logs , but to me it looks like its finding streams from files in the recycle bin, if thats what your recycler actually is, did you send your files to the bin afterwards and not empty them ??

    someone should also edit out your real ip from your tds logs also, just for safetys sake. :D , and you should update your radius file asap. :D



    also try these threads , full of great info on this subject:

    http://www.wilderssecurity.com/showthread.php?t=21276

    http://www.wilderssecurity.com/showthread.php?t=20665

    hope that helps a little. :cool:
     
  3. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    I have edited the IP etc.
    ADS streams are usually not a threat providing they are under 128 bytes in size, many image carry small data streams of around 88 bytes.

    HTH Pilli
     
  4. RIFLEMAN

    RIFLEMAN Registered Member

    Joined:
    Feb 1, 2004
    Posts:
    50
    Thanks Pilli--I never even saw my IP---. I would love to get my hands on the author of the trojan I got a few weeks ago. He has caused me much aggravation and I don't feel secure anymore. I hope the streams are all ok and think I will just keep my stuff updated and forget about the rest. I have very little data of value to a hacker--just my bandwidth.
     
  5. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Sometimes that is all they want, so many DDos attacks on reputable companies - No more than blackmail IMHO.

    I assume you have cleaned out any spyware and other nasties with AdAware or Spybot Search & Destroy?

    Also checkout Javacool's tools lower down the forums here.

    Best of luck with your cleanup. Pilli
     
  6. FanJ

    FanJ Guest

    Maybe it is also a good idea to delete all those email-addresses from the TDS log?
    I don't know whether they are real or not.....
     
  7. RIFLEMAN

    RIFLEMAN Registered Member

    Joined:
    Feb 1, 2004
    Posts:
    50
    Thanks guys. I have run every program under the sun and they all say I am clean so I guess I must be. I have been online for 2 years now and never had a virus or trojan. Not even popup ads were a problem. Then one click at the wrong site ruined my feeling of security online.
     
  8. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    If you want to be sure that you are clean Port Explorer will show you what connects in and out of your PC

    For another layer of protection try Process Guard, it will stop many keyloggers & most rootkits dead. :) And prevent any of your security programmesfrom being terminated such as your AV / AT and firewall.

    Also try some of DCS's free tools such as advanced Process Manipulation, AutoStart viewer etc.
    http://www.diamondcs.com.au/index.php?page=products

    Have fun. Pilli
     
  9. gkweb

    gkweb Expert Firewall Tester

    Joined:
    Aug 29, 2003
    Posts:
    1,932
    Location:
    FRANCE, Rouen (76)
    First time i have this too, nothing to worry about ?
    I just remember to have done a defragmentation just before with PerfectDiskj (both Smart and Offline), i think it can be related to it.

    Any thought ?
     

    Attached Files:

  10. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    What is KAVICHS? looks like a checkfile of some sort. I remember that one of the AV's used a thing like that appended to every file as a sort of checksum so that it took a lot less time to do a full scan.
    Just guessing but could it be defragmenter related?
     
  11. gkweb

    gkweb Expert Firewall Tester

    Joined:
    Aug 29, 2003
    Posts:
    1,932
    Location:
    FRANCE, Rouen (76)
    Indeed i done just before too a full system AV scan (NAV2004) and a defragmentation, could be a clue, may be DCS will have an idea ?

    Anyway, thx to have replying to my 2 posts so quickly Pilli, you have just earn a karma cookie ;)
     
  12. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Yum, I love the French ones! :D
     
  13. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    French karma cookies of real butter? ahhh!

    Is you read tsech (?) here is some explanation of which i think to understand those KAVICHS are part of the KAV program. here
    Butif you don't use KAV i don't know. I remember this stream name was mentioned before in another thread, but now seraching where?
     
  14. gkweb

    gkweb Expert Firewall Tester

    Joined:
    Aug 29, 2003
    Posts:
    1,932
    Location:
    FRANCE, Rouen (76)
    I have tested KAV indeed, so may be it is due to that.
    I am going to read your link Jooske :)

    EDIT : lol, unreadable !
     
  15. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    KAV Inspector ? this speeds up scans by making CRC checks and not scanning unchanged files. A nice place to store a checksum would be in a stream..

    Easiest solution is to use the stream options (in Scan Control) to ignore streams smaller than 256 bytes :)
     
  16. gkweb

    gkweb Expert Firewall Tester

    Joined:
    Aug 29, 2003
    Posts:
    1,932
    Location:
    FRANCE, Rouen (76)
    Thanks for the tip Gavin :)

    but i have Stream up to 228 bytes, would it be safe, i mean totally safe, to ignore stream under 228 bytes ?

    Anyway, does it exists tool to clean those stream which are useless now ?
     
  17. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Whoops ! :)
    256 bytes should be fine, if you were to have a danger in a stream it would more likely be 90KB rather than so small :)
     
  18. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi GK, There are two ways that I know of.
    1. Delete with TDS manually
    2. Transfer the files to a non NTFS partition and then transfer them back, I did this some years ago when I had thousands left by an AV I had tested :(

    A long while a go someone mentioned a tool for doing this but you will have to Google for it.

    It is not the most rewarding job I can tell you! :irony: :D
     
  19. gkweb

    gkweb Expert Firewall Tester

    Joined:
    Aug 29, 2003
    Posts:
    1,932
    Location:
    FRANCE, Rouen (76)
    thanks you Gavin and Pilli :)
     
Thread Status:
Not open for further replies.