Streamarmor Scans Your PC For Alternate Data Streams - gHacks Tech News

Streamarmor Scans Your PC For Alternate Data Streams

Alternate data streams (ADS) are a feature of Microsoft's Windows NTFS file system that can be used to add data to existing files, for instance text to a text file that does not become visible if the original file is opened in a text editor.

The hidden nature of alternate data streams has made them attractive for malicious use among other things.

Attacks may hide malicious code in alternate data streams to make them harder to detect by the user of the operating system and security software.

Streamarmor

Streamarmor is an easy to use software program for the Windows operating system that scans the content of a hard drive for alternate data streams.

streamarmor alternate data streams

You may select a root directory for the scan, and have Streamarmor scan all files in the directory and subdirectories automatically.

The program checks each file for alternate data streams, and reports hits in its interface. The program has been designed to detect the actual file type rather than go by file extension for a variety of important file types. This ensures that the right file type is detected for these files.

You may furthermore configure the program to ignore known streams and streams with zero size to speed up the time it takes to scan and analyze.

While that is useful in itself, the rating it applies to each file makes it even more so. Streams are rated as dangerous, suspicious, or needs analysis for instance, so that it is easy enough to concentrate efforts on those first.

A snapshot of the data stream as well as additional information is displayed in the interface as well. You may sort the listing based on various parameters including name, threat level or content type.

Streamarmor uses the three online services Virus Total, Threat Expert and Malware Hash to scan streams found by the program. Just select one of the discovered streams in the program interface and hit the "check online" button to do that. Virustotal is selected by default, but you may activate the two other services in the program options.

Another useful option provided by StreamArmor is the ability to execute a stream in virtual environments directly from the program interface.

The alternate data streams can also be viewed completely or saved to a file on the local system. An export option allows you to save the report of the discovered streams as a html file.

Closing Words

Streamarmor is an excellent software to scan a computer system for alternate data streams. The integration of online threat scanners makes the program easy to work with. The tool is available for 32-bit and 64-bit editions of the Windows operating system.

Summary
software image
Author Rating
1star1star1star1stargray
no rating based on 0 votes
Software Name
StreamArmor
Operating System
Windows
Software Category
Security
Landing Page

We need your help

Advertising revenue is falling fast across the Internet, and independently-run sites like Ghacks are hit hardest by it. The advertising model in its current form is coming to an end, and we have to find other ways to continue operating this site.

We are committed to keeping our content free and independent, which means no paywalls, no sponsored posts, no annoying ad formats or subscription fees.

If you like our content, and would like to help, please consider making a contribution:

Comments

  1. Jojo said on March 29, 2010 at 8:29 pm
    Reply

    Nice program. I found 5 streams on all my drives.

    None looked to be problems but I got rid of them.

    1. Martin said on March 29, 2010 at 8:56 pm
      Reply

      I like that the program is easy to use and supports online look ups of threats. I’d personally would make a backup before deleting data streams, just in case.

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

Please note that your comment may not appear immediately after you post it.