See for Yourself
To witness the vulnerability of alternate streams, you can conduct a simple experiment that tries the five known methods by which viruses can be activated from alternate streams. All you need is a Win2K Professional system with NTFS installed.
The three file formats that malicious users most commonly use for computer viruses are .exe, .vbs, and .cmd. For this experiment, select or create on your system a file of each format. In our testing, we used the Calculator program (i.e., calc.exe) and wrote two programs, which we named test.vbs and test.cmd. To create test.vbs, we used the instruction
MsgBox "Hello World! (this is VBS file)"
To create test.cmd, we used the instruction
@Echo Hello World! (this is CMD file)
@Pause
If you don't include the @Pause statement in test.cmd, Win2K will immediately close the command-prompt window.
Next, choose one more .exe file that you'll use as a dummy file, and be sure to back up the file before you begin. We used the Notepad program (i.e., notepad.exe), from the Windows system directory, as the dummy file.
Now, use the following instructions to copy your three programs to an alternate stream in the dummy file:
type calc.exe > notepad.exe:calc.exe
type test.vbs > notepad.exe:test.vbs
type test.cmd > notepad.exe:test.cmd
Your dummy file, notepad.exe, now contains three alternate data streams: calc.exe, test.vbs, and test.cmd. Follow the instructions below to use the five known methods to run these alternate streams.
- Select Start, Run, and type this instruction for each stream (include no spaces in the command):
file:\\%windir%\notepad.exe:
<stream name>
For example,
file:\\%windir%\notepad.exe:test.vbs
file:\\%windir%\notepad.exe:calc.exe
file:\\%windir%\notepad.exe:test.cmd
Win2K should launch the .vbs and .exe programs in the alternate data stream with no trouble. Figures 2 and 3 show the results of running the test.vbs and calc.exe programs, respectively. The .cmd program should fail to run.
- At the command line, type this instruction for your .vbs stream:
wscript notepad.exe:<stream name>
For example,
wscript notepad.exe:test.vbs
In our test, this command opened the same dialog box that Figure 2 shows.
- Create three shortcuts on your Windows desktop, and link each of them to the corresponding stream in the dummy file. As we expected, our test displayed the test.vbs and calc.exe windows and test.cmd failed to start. This scenario proves that .exe and .vbs programs can reach alternate streams through shortcuts. Interestingly, the Notepad shortcuts' icons changed to icons that represent the programs in the alternate streams, as Figure 4, page 48, shows.
- In the Windows Startup folder, instruct Win2K to run the programs that reside in the alternate data streams. Then, reboot the computer or log on again. In our test, the test.vbs and calc.exe windows automatically appeared at startup. The test.cmd file failed to run.
- Modify the registry subkey that controls auto-run programs, as follows: HKEY_ LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\RunTest=%WIN DIR%\notepad.exe:stream name. For example, HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows\CurrentVersion\Run, followed by
- test1=%WINDIR%\notepad.exe:test
.vbs
- test2=%WINDIR%\notepad.exe:calc
.exe
- test3=%WINDIR%\notepad.exe:test
.cmd
Register
