Responding to an ADS Execution Shield Warning

If a program that Spy Sweeper recognizes as starting from an ADS (with the Alternate Data Stream (ADS) Execution Shield on), Spy Sweeper displays a warning message similar to the one in Figure 7 . ADS is a highly technical way to hide images, data, or code in a file and can be used to hide malicious code. The hidden content is impossible to detect using regularly-available tools, such as Windows Explorer.

images/ads.jpg" height="207" width="348" id="wp1326978" border="0" hspace="0" vspace="0"/>

Figure 7: Example Alternate Data Stream (ADS) Execution Shield warning

Respond to the warning based on your situation:

Yes—Use in all situations, unless you are sure that the program listed is a legitimate program you want to start. This option will stop the program from starting.
No—Use if only if you are sure that the program listed is a legitimate program. Few, if any, legitimate programs start from an ADS.