TDS-2 NTFS ADS Log

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Candy, Jun 8, 2004.

  1. Candy

    Candy Private E-2

    This is in my TDS log under alarms

    NTFS Alternate Data Stream ADS Hidden Stream detected C:\Windows\explorer.exe summary information
    NTFS Alternate Data Stream ADS Hidden Stream detected C:\Windows\explorer.exe summary information
    NTFS Alternate Data Stream ADS Hidden Stream detected C:\Windows\explorer.exe summary information
    NTFS Alternate Data Stream ADS Hidden Stream detected C:\Windows\explorer.exe summary information
    NTFS Alternate Data Stream ADS Hidden Stream detected C:\Windows\explorer.exe summary information
    NTFS Alternate Data Stream ADS Hidden Stream detected C:\Windows\lmhsvc:dll summary information
    NTFS Alternate Data Stream ADS Hidden Stream detected C:\Windows\lmhsvc:dll summary information

    NTFS Alternate Data Stream ADS Hidden Stream detected C:\Windows\lmhsvc:dll summary information
    NTFS Alternate Data Stream ADS Hidden Stream detected C:\Windows\lmhsvc:dll summary information


    Candy
     
    Candy, Jun 8, 2004
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to MG's Candy,

    You need to read this: http://www.majorgeeks.com/vb/announcement.php?f=33

    and it would not hurt to look at these too:
    http://www.majorgeeks.com/vb/showthread.php?t=26149
    http://www.majorgeeks.com/vb/showthread.php?t=33201

    I'm not familiar with Trojan Defense Suite so I cannot comment on what you are seeing in those messages. But we really need you OS. lmhsvc.dll is a Microsoft file. On WinXP it belongs in c:\windows\system32 though. Obviously, explorer.exe is also a Microsoft program.
     
    chaslang, Jun 8, 2004
    #2
  3. Candy

    Candy Private E-2

    Hi,
    Thank you for the welcome. This TDS-3 shows rarely seen NTFS hidden streams that are used to cover files BENEATH regular files. These files are of intetrest to law enforcement because they often contain covert information. Mine showed as alarms which means TDS scan read trojans in these streams. This system is excellent and provides users with alot of information when their systems may have been hijacked.

    Sorry if i breached forum rules by posting this thread. I'll go read the guidelines now.


    Candy
     
    Candy, Jun 9, 2004
    #3
  4. Candy

    Candy Private E-2

    Sorry I have a Gateway 700XL Windows XP a P4 with 2.4gz and 252 Ram. I am running Panda Platinum Security, TDS-3, Smartwhois, RegCleaner, Caller Ip and Tokenmon.

    Candy
     
    Candy, Jun 9, 2004
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay Candy! Now we know a little more about your system. You did really break any rules posting here. It is just good procedure to give system info, things you have already tried, and info on problems (as detailed as possible) to avoid waisting a bunch of time in question and answers before we can dig in to the problem at hand.

    So are you having any particular problem or are you just wondering about your TDS output. As I said in my last message, having lmhsvc.dll in the c:\windows directory is not correct for WinXP. You may want to try right clicking on it and getting properties to see if you can get some info on the file. Also check your c:\windows\system32 for the same filename and see if they are actually the same.

    explorer.exe does belong in c:\windows so I wonder what's up with that message. Why do they report multiple lines with the same info too.
     
    chaslang, Jun 9, 2004
    #5
  6. Candy

    Candy Private E-2

    It comes up with MZ.exe under properties and now a new stream has been added. To help this along, I sent the file to diamond labs to look at. I have had trojans and other issues, which is why i tried this again, as it does a superb job and is usually very accurate. the file is hidden behind I believe $servicepackinstaller$ and windows system32 dll cache. Maybe this is something some other users with more stubborn problems may like to use to check.

    Candy
     
    Candy, Jun 9, 2004
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You didn't see any version information under properties?
    For example, the real lmhsvc.dll file will show:
    Company: Microsoft
    FIle Version: 5.1.2600.0 (xpclient.010817-1148)
    Internal Name: lmhsvc.dll

    and more.

    Are you saying it is named lmhsvc.dll but it is really MZ.exe?

    What about the explorer.exe?
     
    chaslang, Jun 9, 2004
    #7
  8. Adrynalyne

    Adrynalyne Guest

    I've always been interested in ADS, but I've never seen trojans or viruses use it...

    If this app can actually pinpoint where the ADS, is, if you have the resources (like a fat32 partition), copy the file its behind to there.

    ADS cannot live on FAT, so it should show up at that point, and be scannable by any antivirus.

    I found this as well:

    http://www.bitmart.net/r2k.shtml


    This may allow you to see it yourself and see if it truly exists.


    I found this as well for detecting ADS:

    http://www.heysoft.de/nt/ep-lads.htm



    I would be curious to see if these applications pick up the ADS that the trojan scanner did.

    http://www.heysoft.de/Frames/f_faq_ads_en.htm

    Here there is a faq for exposing the ADS for deletion.

    However he refers to an app named cat, off of some resource kit, and I didn't see if specify what resource kit exactly.
     
    Adrynalyne, Jun 9, 2004
    #8
  9. DavidGP

    DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

    DavidGP, Jun 9, 2004
    #9

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds