well nihil mentioned this:


I have seen this in action. Its called Alternate Data Stream or ADS, a few number of malware use it, so far i only bumped into 2 of them. Its a pain in the arse to...