Ad-aware full scan and ADS

Just wondering if the full scan does the checking for bad ADS (alternate data streams) or if the ADS scan should be run in addition to the full scan.

 

I ran a full scan this evening...particularly didn't notice. /shrug

 

Its a separate thing altogether.
Problem with ads is no one tool seams to target all of them.
Merijn made a tool, but i haven't seen it used. Nor have i been able to see it being used, ads being hard to search for
CA's online seams to get them most times, but leave's other parts of the infections. Aboutbuster also does but Ive seen it miss more often that not.

Ive been using enumstreams(etc etc etc) then eventually send them to CA's online, Or an Ad-Aware scan/ads checked.
None of them will work unless the service (sometimes more than one) is stopped and process , lack of a suspicious process doesn't mean there isn't a service, and in some cases (not always) it appears both the service and the ads needs cleaned or the infection returns.
In other words Ive seen it got both ways, ads was involved the infection was cleaned and the hijack never returned, without cleaning ads, more often than not its the other way round, why because all the related files of that infection update/fix the other parts of itself. ie a hosts file is or should be a first suggestion.
Anyone willing that has a test box PM me Ill can forward it for study
Wish i could test it on an ntfs file system.

 

Lonny - I got NTFS systems to play with at work. I don't keep PM running though so email me.

kedalia - didn't notice what?

 

I did that and asked for a real one, but it glitched, dont know if it was sent.
Need a real address so i can send zipped files.
LOL PM or email me with one.

 

so sorry Newt....I meant that I didn't notice if the Full Scan checked for ADS or not.



Side note: I was running a Full Scan on my "problem child" laptop last night, and it kept hanging up after scanning like 44,419 or so. The path it was hanging up on was something around the lines of software/Microsoft/blah blah blah... I tried running a Smart Scan & it would lock up at the same point...oh well, more work to be done tonight!

 

kedalia - thanks. I don't think there is any way to tell just by watching the scan process and I couldn't find any documentation that helped out either.

Lonny nvail(remove-this)@ctc.net will get to me.