Alternate Data Streams: Naughty Pirates

Learn about Computer Security Other Security Products
#1

I am using an explorer replacement tool that I absolutely love. The problem is that last October, I ran ADS Spy and it alerted me that the license key file it uses contained an alternate data stream identified as “naughty pirates.” After running the cleaner, the problem seemed to be resolved, but in running it over this past week, after 2 updates to the program, it is absolutely back. The developer of the explorer replacement is assuring me that the ADS is nothing to be concerned about.

In explorer, the file size changes, but is typically around 712 kb. In ADS Spy, the actual size is reported as 2800 kb.

Is there a way to verify the safety of this file outside of ADS SPy to confirm or refute it comes bundled with spyware?
Thanks,
Sue

#2

submit to www.virustotal.com and www.virscan.org

#3

neither one of these services tests for alternate data streams, so did not recognize the actual file size or presence of naughty pirates.

#4

The websites may not but some of the AV’s running on it may.

You could try uploading it to CIMA:
http://camas.comodo.com/cgi-bin/submit
And Anubis:
http://anubis.iseclab.org/

#5

It would be possible to use ADS Manager to Export the ADS (name it naughtypirates.exe) and submit that file to an online service like mentioned by other members.

The file should be 2800 bytes in size.