NTFS Alternate Data Streams

Discussion in 'Trojan Defence Suite' started by SpongeBob, Apr 3, 2004.

Thread Status:
Not open for further replies.
  1. SpongeBob

    SpongeBob Registered Member

    Joined:
    Mar 28, 2004
    Posts:
    24
    I run WinXP Pro. I have just D/L and installed TDS-3, which I've been configuring. I set the options to "scan ntfs ADS hidden streams" and "show all ntfs ADS streams" which I assume is the safest thing to do. I ran a scan everything was fine except it turned up lots of these ADS streams files.

    These files are the summary information of files which is accessed by right clicking on the file, selection properties, etc, etc. I use this facility to keep file comments and/or descriptions in. I have explorer setup to show the comments column when viewing folders contents.

    Obviously these are not trojans, but they will keep turning up in a scan. So is there any way that I can exclude the file summary info from being scanned?

    Regards, Bob
     
  2. TheQuest

    TheQuest Registered Member

    Joined:
    Jun 9, 2003
    Posts:
    2,301
    Location:
    Kent. UK by the sea
    Hi, SpongeBob

    If you go to TDS's Scan Control>Stream Options, you can alter the size too about 150 to 250.

    Or you can go to Windows explorer>[or any folder] Tools>Folder Options>View>Do not cache thumbnails, and check it, that should stop it.

    Hope this is of some help.
    TheQuest :cool:
     
  3. SpongeBob

    SpongeBob Registered Member

    Joined:
    Mar 28, 2004
    Posts:
    24
    Thanks.. After I posted my question I found the stream options, but I was still unsure what was the best size to set it to... It doesn't give much information/recommendations.

    I wouldn't have known this was connected with ADS at all! I thought this was only for thumbnails, pictures etc, and not the file comments information. If I do this will I still be able to make use of/display file comments, which I use a lot?

    Thanks, Bob
     
  4. TheQuest

    TheQuest Registered Member

    Joined:
    Jun 9, 2003
    Posts:
    2,301
    Location:
    Kent. UK by the sea
    Hi, SpongeBob

    Here is a link to info on Data Stream's:-
    https://www.wilderssecurity.com/showthread.php?t=22026;start=msg131925#msg131925


    Yes you are right but a lot of stream's are thumbs.db, which is windows cache of the thumbnail's so it stop them stream's.

    Hope this is of some help
    TheQuest :cool:

    Edit:-More Info on Data Streams:-
    http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=data+streams&btnG=Google+Search
     
Thread Status:
Not open for further replies.