Re: Removing ShKit Root Kit

[Jason <security () brvenik com>]

> Actually, deleting the host file deletes all associated data streams.
> If a file of the same name is created on the system, the ADS' will not
> remain:
>
> \> echo this is a test > notepad.txt
> \> echo testing again > notepad.txt:ads
> \> more < notepad.txt
> this is a test
> \> more < notepad.txt:ads
> testing again
> \> del notepad.txt
> \> more < notepad.txt:ads
> The system cannot find the file specified.
> \> touch notepad.txt
> \> more < notepad.txt:ads
> The system cannot find the file specified.
>
> Just my two cents; carry on.

I seem to recall an ADS being handled slightly differently and as a 
result was more prone to remain even after a delete of the host file, it 
was a matter of locating it.

my thoughts were more along the lines of

can the original file, even partially overwritten, be recovered with the 
ADS intact?

will clobbering the original file leave the ADS intact.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html