NTFS Virus Removal

.
.

3.If you find a suspicious data stream and want to clean it from the system, first perform a backup of the named stream file as well as all associated data streams. Verify that your backup software did in fact save the alternate stream file as well (some backup software is incapable of processing data streams but that's a topic for another advisory). If the alternate data stream was not backed up, you can map a drive to a remote NTFS partition and copy the file to the remote system. Stream files are maintained when you copy from one NTFS partition to another. To clean the alternate data stream from the named file, simply map a drive to a non-NTFS partition (for example NT using FAT, Windows 98 or Linux running SAMBA). You can then move the file to the remote system and then move it back. When the file gets written to disk on the remote system the alternate data stream files will not be saved. Note that this also removes any specific file permissions you may have set so make sure you document the settings using FileStat (also part of the Forensic ToolKit) or a similar utility prior to moving the file.

4.Call your virus scanner vendor and request that they add proper support for data streams.

You can access the entirearticle at the following link:

http://www.sans.org/newlook/alerts/NTFS.htm

(REMOVE SPACES from the pasted URLs.)

----------

(continued in comments...)

.
.
On January 31, 2002, SecurityTracker Archives posted the following: “Symantec's Norton Anti-Virus Fails to Scan Files With Certain Types of Long NTFS File Path Names”

“A vulnerability was reported in Norton Anti-Virus (andpotentially other virus scanning products). A local user or a virus may create a file with an NTFS file path name that cannot be scanned by the anti-virus engine.

It is reported that a file with a file path name containing more than 256 characters will not be scanned by the anti-virus scanner.

It is reported that a long folderpath can be substituted with a short file name using the "SUBST" command. A local user can change the current drive to the substituted drive to cause the path length to be reset to 3 characters (e.g., Q:\). This can apparently be repeated such that a very long file path name is created that appears to be a short file path name. It is reported that the anti-virus scanner cannot follow the deep path name.”
See the whole article at the following link:

http://www.securitytracker.com/alerts/2002/Jan/1003409.html

(REMOVE SPACES from the pasted URLs)

----------

(continued in comments...)

.
.
----------

Possible solutions:

1. There were several specific and “work around” solutions outlined in the aforementioned articles.

2. The solution is first to boot from DOS and scan the low level structures with F-PROT /HARD /DISINF after a clean floppy boot, then boot into NT and run F-PROT and F-MacroW within NT. Since NT knows its own file structure, F-PROT doesn't have to figure it out, and hence can disinfect as necessary.

See these links:

http://www.itd.umich.edu/virusbusters/fprot-winNT.html

http://www.itd.umich.edu/virusbusters/fprot-faq.html

3. Symantec and McAfee have both released specific instructions on how to deal with each individual virus that infected an NTFS partition. Be sure you specifically seek the NTFS solution, not the generic one. An example of an NTFS specific solution can be found at this link:

http://www.symantec.com/avcenter/venc/data/w32.kriz.fix.html

“If you are using NTFS, you must launch a NTFS DOS Read/Write driver before running FixFun.exe; otherwise, the tool will not be able to repair any files on the NTFS partition. This driver is not available from Symantec. Such drivers are available on the Web at various locations. Currently, two of themare

http://www.sysinternals.com/ntw2k/freeware/ntfsdospro.shtml

http://www.winternals.com/products/repairandrecovery/ntfsdospro.shtml

----------

(REMOVE SPACES from the pasted URLs.)

Best of luck to you,

Maxwell

.
.
And, finally, in addition to the suggestions mentioned above, here is a product that claims it's made specifically for NTFS virus protection. They state the following:

"Protector Plus is an anti-virus software designed for Windows NT. It has an on-access scan andclean program and a manual scan and clean program, to detect and remove all types of viruses. It can send messages to a pre-configured list of users when a virus is detected. Log files maintain a history of the virus activity detected and the corrective action taken. The software is easy to install and use. Monthly upgrades can be downloaded free of cost. This software works on both Windows NT version 3.51 and 4.0. The same software can be used on the server as well as theworkstation."

Link:

http://www.regnow.com/softsell/nph-softsell.cgi?item=1854-2&affiliate=12642

Free evaluation download:

http://www.pspl.com/download/wntec.htm

----------

To repair boot sector and partition damage:

http://www.data-recovery-software.com/bp.htm

----------

(REMOVE SPACES from the pasted URLs.)

Maxwell