Error 267 Directory Name is Invalid

[DavidR]

I did a search and found a few, but didn't find the one that I referred to by one of the Alwil team members.

Did you mean this thread? http://forum.avast.com/index.php?topic=58971.0
Igor replied there.

No, as in the reply it explained that this was an ads stream not a physical folder but the ads stream of that folder location.

As Igor mentions it is possible that malware can use the ads stream of files/folders and that is why avast scans the ads stream in NTFS formatted drives. But why the error is reported is the mystery, which hopefully now Igor is aware we may get a resolution.

[Asyn]

No, as in the reply it explained that this was an ads stream not a physical folder but the ads stream of that folder location.

As Igor mentions it is possible that malware can use the ads stream of files/folders and that is why avast scans the ads stream in NTFS formatted drives. But why the error is reported is the mystery, which hopefully now Igor is aware we may get a resolution.

Thanks for the feedback, so we have to wait, i guess...
asyn

[DavidR]

@ mdubin
You could also run a scan using SuperAntiSpyware (SAS) as that also scans alternative data streams, so it would be looking in the same areas and see if there are any reported issues there. However I don't know if SAS reports things that it has been unable to scan.

SUPERantispyware On-Demand only in free version.
Don't worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.
Also available a portable version of SAS, http://www.superantispyware.com/portablescanner.html, no installation required.

[mdubin]

David:

Thanks. I'll give Superantispyware a try also. I guess it cannot hurt to run several different scanners.

[Asyn]

David:
Thanks. I'll give Superantispyware a try also. I guess it cannot hurt to run several different scanners.

Sure, as long as they are free and no rogues...
asyn

[DavidR]

David:
Thanks. I'll give Superantispyware a try also. I guess it cannot hurt to run several different scanners.

Sure, as long as they are free and no rogues...

I'm hardly likely to give links to rogue software

[pk]

mdubin,

1) Please execute cmd.exe (Start->Run) and type: "more < C:\WINDOWS:2B2696B30AD92EF4". What you got?
2) Download http://public.avast.com/~kurtin/streams.exe, type "streams.exe c:\windows". What you got?

Thanks.

[Asyn]

I'm hardly likely to give links to rogue software

Sure..!!! I know that..!!! Didn't mean you give links to rogues.
So, if somebody got me wrong... Trust DavidR...!!!
asyn

[mdubin]

mdubin,

1) Please execute cmd.exe (Start->Run) and type: "more < C:\WINDOWS:2B2696B30AD92EF4". What you got?
2) Download http://public.avast.com/~kurtin/streams.exe, type "streams.exe c:\windows". What you got?

Thanks.

I am so pleased with the excellent support I am getting from this forum. Makes me feel much better about Avast!

When I get home this evening, I'll do this first and report back here on the results.

Then I'll look into some of the other suggestions such as SuperAntispyware and Gmer.

[mdubin]

mdubin,

1) Please execute cmd.exe (Start->Run) and type: "more < C:\WINDOWS:2B2696B30AD92EF4". What you got?
2) Download http://public.avast.com/~kurtin/streams.exe, type "streams.exe c:\windows". What you got?

Thanks.

1) I get a 6 lines each containing about 4 or 5 strange characters. There is about 4 blank lines between each of these lines. I have attached a text file showing what I got.

2) C:\WINDOWS:2B2696B30AD92EF4:$DATA      96

Hope this helps to solve the mystery.

Thanks.

mdubin

[pk]

Thanks for info.
Would you mind trying another test, please?

If you perform "Folder scan" in avast (it's the last scan type in avast) on "C:\Windows", do get that error too?

If yes, then:
1) run cmd.exe, type: "xcopy c:\Windows c:\Windows2 /T", press "d" as directory when it prompts a question.
2) try again "Folder scan" on "C:\Windows2", did you get that error too?
3) if yes, could you please download http://public.avast.com/~kurtin/rar.exe, type: "rar.exe a -os c:\archive.rar c:\windows2" and send me "c:\archive.rar" file to kurtin@avast.com

Thanks a lot!

[igor]

I asked the question about the folder scan in the other thread
(http://forum.avast.com/index.php?topic=58971.msg497695#msg497695)
and the answer was yes.

So, we know there's indeed an alternate data stream there... and given it's size, it seems rather unlikely to be malicious.
However, why should avast! have a problem opening it? I have quite a few streams on some of my folders, and everything scans fine...

[pk]

Igor, I tried to create some ntfs streams as well and avast didn't have problem with them. Let's try to isolate NTFS streams to "C:\Windows2" so we can look at them in our lab...

[mdubin]

Thanks for info.
Would you mind trying another test, please?

If you perform "Folder scan" in avast (it's the last scan type in avast) on "C:\Windows", do get that error too?

If yes, then:
1) run cmd.exe, type: "xcopy c:\Windows c:\Windows2 /T", press "d" as directory when it prompts a question.
2) try again "Folder scan" on "C:\Windows2", did you get that error too?
3) if yes, could you please download http://public.avast.com/~kurtin/rar.exe, type: "rar.exe a -os c:\archive.rar c:\windows2" and send me "c:\archive.rar" file to kurtin@avast.com

Thanks a lot!

I got the same error when I did the Folder Scan on c:\windows.

Then I did the xcopy as you stated in 1) above. Even though I could see all the all the folders under c:\windows2, there were no files copied, just the folders. The folder scan on c:\windows2 lasted just a second and it was clean. It only said 1 file tested, 609 folders. Was the xcopy correct? If so, then I did not get that error when I did the folder scan on c:\windows2.

[mdubin]

@ mdubin
You could also run a scan using SuperAntiSpyware (SAS) as that also scans alternative data streams, so it would be looking in the same areas and see if there are any reported issues there. However I don't know if SAS reports things that it has been unable to scan.

SUPERantispyware On-Demand only in free version.
Don't worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.
Also available a portable version of SAS, http://www.superantispyware.com/portablescanner.html, no installation required.

I did and there were no reported issues. Attached is the scan log from SuperAntispyware.