MLUG: RE: [MLUG] Alternative Data Streams
RE: [MLUG] Alternative Data Streams
Email address obfuscation in effect -- please click here to turn it off.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
On Mon, 11 Sep 2006, Harris, Michael C. wrote:

I realize this isn't a Windows list but this has been around for a long time (better than 10 years) a good detailed explanation and demonstration can be found at http://www.securityfocus.com/infocus/1822

This has been a common method used in malware, root kits, droppers etc for many years. Often files are hidden within alt data streams in trash can and temp file spaces in particular.

Make a file hidden and system in trash can directors and the system won't clean it up and it will be largely invisible. The alt stream directory content can hide there for a long time.


I guess this explains why people often can't figure out what's wrong with their PC and they end up reformatting and reinstalling the OS. I guess some of the better malware detectors know what to do.

Mike

_______________________________________________
members mailing list
EMAIL:PROTECTED
http://mlug.missouri.edu/mailman/listinfo/members