RE: strange windows behaviour.

["Pepijn Vissers" <vissers () fox-it com>]

//One trick that hackers are exploiting is to store executable 
//files as NTFS Streams.  You should check you registry for 
//programs set to run at startup with the following format
//      rundll32.exe C:\Some\Directory:trojan.dll
//NTFS Streams cannot be listed by the dir command.  What you 
//can do to verify the existence of one of the Streams is to do
//
//      notepad.exe C:\Some\Directory:trojan.dll
//
//If you see content, then the stream is really there.

Very true. There is a tool that will help you, called LADS (List
Alternate Data Streams), which is a modified 'dir'. Get it at
http://www.heysoft.de/nt/ep-lads.htm.

Best regards,
Pepijn Vissers

--
P. Vissers
Fox-IT Forensic IT Experts B.V.
www.fox-it.com

---------------------------------------------------------------------------
----------------------------------------------------------------------------