An oldie but goodie has reared its familiar head, this time in the manner of a posting to Bugtraq and Full Disclosure lists. Windows NTFS supports multiple streams of data for any given file (http://support.microsoft.com/kb/105763). While the functions that access ADSs are clearly defined by Microsoft, very few Windows tools can view these alternate data streams (ADS) without some added help. In addition, many third-party software developers ignore the possible presence of ADSs, thus providing a wonderful storage location for malicious code.

The Bugtraq posting http://www.securityfocus.com/archive/1/435962/30/0/threaded mentions a few antivirus tools that fail to detect known malware when stored as ADSs. The Internet Storm Center has not tested any of these claims, but we have no reason to dispute them as we have seen this time and time again.

Ryan Means wrote an excellent paper (GCWN honors) that discusses Alternate Data Streams in depth, presents a number of tools to locate and manipulate ADSs, and presents an extension to Windows Explorer to directly report the presence of ADSs. You can pull it from the SANS Reading Room at: http://www.sans.org/rr/whitepapers/honors/1503.php and the tool he wrote can be found at http://www.giac.org/certs/download.php?w=gcwn_0230_2