Security Incidents: RE: strange windows behaviour.

[Harlan Carvey <keydet89 () yahoo com>]

Paul,
 
> There's been a lot of discussion about this amongst
> av professionals.
> There's really no advantage to scanning streams
> because they are
> "inert".  In order for the trojan to do anything, it
> has to "come out of
> hiding" as it were, and when it does, av on access
> scanning will detect
> it **if it's a known trojan**.  While it's in the
> stream it's merely in storage, not being used.
Can you elaborate on "has to come out of hiding"? 
I've repeatedly demonstrated how an executable can be
written to an ADS and launched directly from that
location, without having to be copied to another
location, such as a temp file.  The same is true on
Win2K systems and above with VB and JavaScript files.

Thanks for anything you can provide.

Harlan

---------------------------------------------------------------------------
----------------------------------------------------------------------------