"UnnamedStream_1" on U3 host start-up scanning. What is it?

[guimarães]

Hi!
Whenever I insert my U3 smart pen drive into my laptop the pendrive resident "U3Avast!" scanning process of the host takes too long. It goes normal during 50% of the scanning period and then suddenly slowns down and keeps showing "UnnamedStream_1" alternatively in between the files/processes it is scanning. Why is that? Does anyone know what that is supposed to be? I have already scanned the entire Hard Drive and nothing has been shown as a virus. No malware has been found either when I use different known antispyware apps.
- Avast! Virus shields: Active
- Avast! Engine 1.0.108
- Avast! Virus database version: 0776-0, 24Sep2007
Thanks in advance.
Guimarães.

[igor]

Do you have any resident scanner installed directly on the notebook?

[guimarães]

Igor,

I have AVG as the resident scanner. I always had AVG but my reported problem started recently from the latest U3Avast! updates. Based upon your question, for testing purposes I have just uninstalled AVG but the "UnnamedStream_1" thing still happens.
Thanks for your reply. I am looking forward to good news.
Guimarães. 

[igor]

Well, those UnnamedStream_1 items are just associated NTFS streams (or similar data), attached to the file. I don't think it's caused by any malware... I was more thinking about Kaspersky Antivirus , which (used to?) store some information in NTFS streams of every file.
But still, unless there's some complicated structure, I don't think it should slow down the scanning noticeably...

Can you try to scan e.g. the Windows folder of your disk (it's hard to guess where those files are from... maybe if you can catch any names in the progress field of the initial scan?) by an On-Demand scan from avast! U3 with Report file creation enabled (with all items, even "OK files", included) - and post a part of the file report here? (a part containing those UnnamedStreams)

[guimarães]

Igor,
Good afternoon from Rio de Janeiro.
I am attaching hereto a small part of the ScanReport which contains a sample of the "UnnamedStream_1" occurrences. The original file totals about 1.3MB if compressed and I can send it to you using a predefined e-mail address if you wish.
Curious is that it shows, for example, a 'dll' followed by the "UnamedStream_1" stamp and right after the same 'dll' with no additional stuff attached... And that happens to thousands of files. See example below:
C:\WINDOWS\system32\dllcache\blackbox.dll\UnnamedStream_1   OK
C:\WINDOWS\system32\dllcache\blackbox.dll   OK
C:\WINDOWS\system32\dllcache\browseui.dll\UnnamedStream_1   OK
C:\WINDOWS\system32\dllcache\browseui.dll   OK
Just as a matter of information: Free AVG, SpyBot and Free ZoneAlarm were running when the picture was taken but I do not think this issue could be a major problem.
Thanks in advance.
Guimarães.

[guimarães]

Addendum to above:
- Just to clarify: Free AVG and SpyBot S&D Tea Timer are installed on the host computer only but no scan on demand was being performed when the picture was taken. ZoneAlarm firewall is active.
- Recently I installed "Sandboxie" (www.sandboxie.com) on the host computer. Despite I cannot establish that the "UnnamedStream_1" ocurrences during the U3Avast! scanning process started right after that, I am adding such an information in order to help you with your analysis.
- I am attaching one more text file to this post. This one shows a part of the "UnnamedStream_1" ocurrences during the U3Avast! start-up scanning of the host computer at the very moment the U3 smart drive is inserted. Unbelievable!
- U3Avast! is all I needed to have my U3 smart pen drive protected. I just want to get rid of the "UnnamedStream_1" annoyance...
Thanks again.
Guimarães. 

[igor]

Well... don't know what to say. Are you sure that you don't have Kaspersky Antivirus installed on the computer? Or maybe it was installed in the past and then removed (probably incompletely)? Or maybe some other antivirus that uses Kaspersky engine? (which is certainly not AVG, however, unless they added something like that in the last version, which I doubt)

NTFS streams, associated with every file, are quite a recognizable symptom of that. And the deeply nested streams in the second log - even more; it's a symptom of something (like KAV) adding a NTFS stream to the temporary files avast! creates when extracting the previous ones...

I'm afraid you can't send that file to me - because the associated NTFS streams are not sent with the attachment (so I would receive it "plain", without any associated items).