Hidden.ADS infections - gs5sys

[planetboris]

Hello, Rogue Killer scans keep coming up with Hidden.ADS infections, even after being deleted. 

My latest RK scan results:

RogueKiller V12.8.0.0 (x64) [Nov  7 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 10 (10.0.14393) 64 bits version
Started in : Normal mode
User : Client [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Delete -- Date : 11/13/2016 20:41:55 (Duration : 00:24:23)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 135.19.0.18 70.80.0.66 24.200.0.1 ([Canada][Canada][-])  -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{f5360646-7351-40e3-9350-ddd70472812e} | DhcpNameServer : 135.19.0.18 70.80.0.66 24.200.0.1 ([Canada][Canada][-])  -> Not selected

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 3 ¤¤¤
[Hidden.ADS][Stream] C:\Users\Client\AppData\Roaming:gs5sys -> Deleted
[Hidden.ADS][Stream] C:\Users\Client\AppData\Local:gs5sys -> Deleted
[Hidden.ADS][Stream] C:\ProgramData:gs5sys -> Deleted

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD1002FAEX-00Z3A SCSI Disk Device +++++
--- User ---
[MBR] aa4fbfb426fcf5267b120e2e5d8e11d8
[BSP] 143fdc32b0aa50c7e931aecb7d91ff29 : Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 927815 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 1900167168 | Size: 450 MB
2 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 1901090816 | Size: 25599 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: WDC WD3202ABYS-01B7A0 +++++
--- User ---
[MBR] 96c730a9420de6f531c48a026eb3890c
[BSP] 6a4cdbb4432ea14b8cbaef9136369d0b : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 304207 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 ... OK
User = LL2 ... OK

Thanks and best regards
 

[Curson]

Hi planetboris,

This seems to be a false positive.
Could you please follow the following process to help us ?
Launch the command prompt windows (cmd) with admin rights and copy/paste the following command :

Code: [Select]

more < C:\Users\Client\AppData\Roaming:gs5sy >> %USERPROFILE%\Desktop\ADS.txtA new file named ADS.txt should has been created on your desktop.

Please attach it with your next reply.

Regards.

[planetboris]

Thanks very much for your reply. I copy-pasted:
 
more < C:\Users\Client\AppData\Roaming:gs5sy >> %USERPROFILE%\Desktop\ADS.txt

into cmd (admin ) but only received this response: The system cannot find the file specified.

[Curson]

Hi planetboris,

It seems that Windows is unable to list the content of a folder ADS this way.
Could you please list all the security softwares you are using ?

Regards.

[planetboris]

Hi,  Bit Defender is turned off because I have Emsisoft running

Zemana is also installed, I turned it off at Start Up, but ZAM shows up in background processes

I runs scans manually with SuperAntispyware, Herd Protect, RK (of course), Junk File removal tool, Eset online scanner, MalwareBytes, ADW cleaner

Thanks

[Curson]

Hi planetboris,

Thanks for your feedback.
Since you are using many security software, it's difficult to point a potential culprit among them.

I will check how to extract the ADS in order to analyze it and get back to you as possible.
Thanks for your patience.

Regards.

[planetboris]

Thank you for your time and energy. Very much appreciated. Looking forward to any solution.

Best regards

[planetboris]

Hi, I was able to get the RDS.txt file from

more < C:\Users\Client\AppData\Roaming:gs5sy >> %USERPROFILE%\Desktop\ADS.txt

gs5sy was missing letter s to make it gs5sys. No problem, I just added it.   Although before I ran that command into cmd admin I had completed another scan using RK and this time I didn't delete the Hidden.ADS, so that's why maybe now it showed up, Here is the attached file as requested. Hope it helps

Thanks again.

[Curson]

Hi planetboris,

Thanks for the fix and sorry for this mistake.
This ADS is a metadata for an application on your system.
Since it's totally harmless, it will be whitelisted in RogueKiller next release.

Thanks again for your feedback.
Regards.

[planetboris]

Ok, good to know! Thank again for all your help and for creating Rogie Killer, a fantastic product, and for making it available.

cheers

[Curson]

Hi planetboris,

You are very welcome.
Thanks for the kind words.

Regards.