Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Removing Alternate Data Streams
One thing you can't do on an NTFS Windows computer is turn off alternate data streams. Not only do a lot of applications use ADS; so does Windows itself. There's no way to disable ADS the way you can disable many unneeded Windows services.
Nor can you simply delete an alternate data stream without deleting the file to which it's attached. In fact, you can't use the Windows delete command to get rid of an ADS attached to a root directory (i.e. c:\:badstuff.exe).
Some ADS detection utilities, such as Streams, will automatically delete alternate data streams. However, many of them simply notify you of the existence of alternate data streams.
If your detection utility doesn't delete alternate data streams, you need to get creative. The great weakness of alternate data streams is that they're only supported on NTFS. The older FAT filesystems don't recognize ADS. If you copy a file from an NTFS drive to a FAT drive, any attached ADS will be eliminated. If you're on an ADS hunt, it might be worthwhile to set up a FAT partition on your system simply to wash files through. These days, most Windows systems use NTFS and aren't installed with any FAT partitions. However, programs such as Acronis Disk Director will let you create partitions of different file types, including FAT, out of unused space in an existing partition.
Another method of removing an ADS from a file is to do the following from the command line:
ren filename temp.exe - cat temp.exe > filename - del temp.exe
where filename is the name of the file with the ADS you want to eliminate.
If the alternate data stream is attached to a directory, you need a different method. Frank Heyne, the author of LADS, suggests a method that relies on using Notepad from Windows NT 4. The method is detailed in the LADS FAQ.