[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-Disclosure] Removing ShKit Root Kit



Actually, deleting the host file deletes all associated data streams.
If a file of the same name is created on the system, the ADS' will not
remain:

\> echo this is a test > notepad.txt
\> echo testing again > notepad.txt:ads
\> more < notepad.txt
this is a test
\> more < notepad.txt:ads
testing again
\> del notepad.txt
\> more < notepad.txt:ads
The system cannot find the file specified.
\> touch notepad.txt
\> more < notepad.txt:ads
The system cannot find the file specified.

Just my two cents; carry on.


I seem to recall an ADS being handled slightly differently and as a result was more prone to remain even after a delete of the host file, it was a matter of locating it.

my thoughts were more along the lines of

can the original file, even partially overwritten, be recovered with the ADS intact?

will clobbering the original file leave the ADS intact.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html