Question about ADS spy

[btcomm1]

It says that malware makers started using ADS to hide their files. I keep a pretty clean system so when I scanned it only found a few things. For instance, it found C:\Program Files\playfirst\chessmaster challenge\chess.exe {4fb697cc-1da700dc-cbab-761-45c00e 03}

I can clearly go in and see chess.exe in windows explorer. So what exactly would it look like if some malware infected my system and hid it's files? Would it give me a path like C:\windowz.exe {abcssfds-asdfsfdasdf} and when I go to my c: drive I wouldn't see windowz.exe even with hidden files and folders showing? Or is it that second part {4fb697cc-1da700dc-cbab-761-45c00e 03} that would actually be the malware? Would malware show up in a form regognizeable or would it look like gobily goup like the {4fb697cc-1da700dc-cbab-761-45c00e 03} does?

 

[Medea]

This is a good article for reading up on ADS streams:
Dissecting NTFS Streams

It also lists different tools. Personally, I like ADS Spy.

 

[btcomm1]

Ok, I think I get it. I tried it out myself and if you use the command you can create a file named whatever.exe:whatever2.exe that is then invisible in the file system but with the right command you can run it. What I wonder is if there is a way to get processes to run without the first exe or without the :. I guess though that if there is a file running and you can't find it in the file system that ADS spy would be able to detect it and remove it.