ClamWin Free Antivirus :: View topic

Posted: Thu Nov 30, 2006 3:43 pm

I see that a few antivirus products are now scanning for alternate data streams (ADS) on NTFS computers. Is there any need to do so? If so, does ClamWin do this?

Here is an informative article about ADS: https://www.diamondcs.com.au/index.php?page=archive&id=ntfs-streams

Regards,

Posted: Thu Nov 30, 2006 4:11 pm

Posted: Thu Nov 30, 2006 4:26 pm

we looked at ADS earlier and deemed them as a low threat. Here is the quote form the page you mentioned:

Quote:

Q. If I double-click on a file that has an executable stream attached to it, will the stream execute?
A. No. The stream can only be executed if called directly - typically this can only be done by a program. You'll never accidently execute a stream.

So in order to execute a code from an ADS there needs to be a loader program which ClamAV would be able to identify as a virus.

Posted: Thu Nov 30, 2006 5:32 pm

Thanks for the info, Alch. It seems that threats are sometimes exaggerated, and resources are limited, so it's prudent to concentrate upon what is most likely to occur. I heard that Intel wasn't even aware of ADS until fairly recently. Perhaps it will go away with Vista.

Regards,