My Windows 10 machine has a large number of NTFS Alternate Data Streams named
Win32App_1 attached to various folders throughout the system drive. NoVirusThanks' Stream Detector detects them as being zero size
Does anyone know what may have created these streams?
Windows Defender offline scan detects nothing unwanted.
I'm also seeing a lot of
$DATA streams, although I already know those are simply Windows metadata streams for identifying the source of a file that was downloaded from the Internet. I'm not concerned about them at all.
I installed Windows 10 myself on a blank disk, so they weren't added by the manufacturer. I can't post examples because I already removed the streams.
Update as of 2017-04-18: I've just scanned my machine again, and the alternate data streams are back. Using
more < C:\path\to\alternate_data_stream:Win32App_1 shows the content of the stream to be nothing, consistent with the results reported by NoVirusThanks' Stream Detector. I have setup SysInternals' Process Monitor to look for processes that are creating/touching those alternate data streams, and will update this question if I see anything as a result of that monitoring.
Just FYI, I've already done a load of research into this. My first contact with alternate data streams was when NTFS was first announced in the early 90's. I'm not so much concerned about the actual ADS itself since they are all zero-size, but more or less is this potentially a "canary in the coalmine" for some malware.
I've started an open-source command-line utility that identifies and optionally removes NTFS Alternate Data Streams. The project is hosted at gitHub in case anyone finds it useful.
As of May 10th, I've been able to observe that other Windows 10 machines not owned or touched by me have the alternate data streams named Win32App_1 attached to various folders throughout the system drive. They appear to be related to Windows 10 itself. I expect they are used in some kind of cataloguing process.