A comment regarding HJT ADSpy. It will only show about I think 80 ADS files at any one time. It will remove those and if you run it again it will show the next eighty or so ADS files. If you have large amounts of ADS files you should rerun HJT ADSpy until it comes up with only legitimate files. I am speaking from experience as I had a OP with well over eight hundred ADS files left over from a series of botched cleanups of a CWS infection.

wow that was darn infected!!!!

found a tool to read and write ads
http://www.sysinternals.com/Utilities/Streams.html
Streams
The NTFS file system provides applications the ability to create alternate data streams of information. By default, all data is stored in a file's main unnamed data stream, but by using the syntax "file:stream", you are able to read and write to alternates.

get it before its microsoft gone!! its at sysinternals just bought out by ms!

Got it. Thanks for the tip, wawadave.

_________________

Microsoft MVP Consumer Security 2006, 2007 & 2008