StreamArmor is a tool for discovering hidden alternate data streams (ADS) and can also clean them completely from the system. It’s advanced auto analysis coupled with online threat verification mechanism makes it the best tool available in the market for eradicating the evil streams. StreamArmor comes with fast multi threaded ADS scanner which can recursively scan over entire system and quickly uncover all hidden streams. All such discovered streams are represented using specific color patten based on threat level which makes it easy for human eye to distinguish between suspicious and normal streams.

StreamArmor has built-in advanced file type detection mechanism which examines the content of file to accurately detect the file type of stream. This makes it great tool in forensic analysis in uncovering hidden documents/images/audio/video/database/archive files within the alternate data streams. StreamArmor is the standalone, portable application which does not require any installation. It can be copied to any place in the system and executed directly.

What are ADS (Alternate Data Streams)?

If you’ve had any experience with advanced malware or Windows forensics you’d already know what ADS are, but if you haven’t is a lesser known feature of the Windows NTFS file system which provides the ability to put data into existing files and folders without affecting their functionality and size. Any such stream associated with file/folder is not visible when viewed through conventional utilities such as Windows Explorer or DIR command or any other file browser tools.

If so inclined you can read more here:

• Windows NTFS Alternate Data Streams
• Hidden Threat: Alternate Data Streams

Platform

Windows XP, 2K3, Vista, Longhorn and Windows 7 (both 32 & 64 bit versions) On 64 bit platform, only 32 bit processes are supported.

You can download StreamArmor v1.0 here:

StreamArmor_v1.zip

Or read more here.

Ah, here at Darknet we have always been a fan of Sophos and the way they operate, a very efficient company and good to see good technical products still coming out of the UK!

Another good move by them, they have decided to offer a free rootkit detection tool called Sophos Anti-Rootkit..Yah I know, not a very imaginative name eh?

Called Sophos Anti-Rootkit, the software will detect and remove both known and unknown rootkits, and it will warn systems administrators if removing the software might harm operating system integrity.

Rootkits are a collection of tools used by hackers to gain administrative privileges on compromised machines. They are typically used to help hide other forms of malware — keyloggers or Trojan horse programs, for example — from antivirus software.

Rootkits got a LOT of press after the whole Sony rootkit fiasco, so it’s good to see a decent free tool being offered to the general public.

Sophos Anti-Rootkit works with the Windows NT, 2000, XP and Windows Server 2003 operating systems. The software features a graphical interface to help guide users through the process of detecting and removing the malicious software.

Since the Sony fiasco, the security industry has paid more attention to the rootkit problem, and there are now a number of free utilities designed to identify this type of software. Other tools include RootkitRevealer, GMER and IceSword.

We shall try out as soon as possible, after all we’ve had chkrootkit on *nix forever…about time someone did something similar for Windows.

You can download Sophos Anti-Rootkit here.

Source: ComputerWorld