Thank you for the info.  I would have thought the ISP client could handle
ADS.  The server should be running the University requires A/V program so I
would not think it is a infection.

IBM - your thoughts on this?

On Wed, Apr 11, 2018 at 9:05 PM, Harris, Steven <
steven.harris AT btfinancialgroup DOT com> wrote:

> Zoltan
>
> I think the problem is the colon in the file name.
>
> Windows has the capability to write multiple streams to the same file.
> The streams are differentiated by a colon and the the stream id.
>
> At least that’s the gist of it.  See https://www.owasp.org/index.
> php/Windows_::DATA_alternate_data_stream
> Often used by hackers to hide stuff apparently.
>
> Cheers
>
> Steve
>
> Steven Harris
> TSM Admin
> Canberra Australia
>
>
> -----Original Message-----
> From: ADSM: Dist Stor Manager [mailto:ADSM-L AT VM.MARIST DOT EDU] On Behalf 
> Of
> Zoltan Forray
> Sent: Thursday, 12 April 2018 3:40 AM
> To: ADSM-L AT VM.MARIST DOT EDU
> Subject: [ADSM-L] NTNamedStreamRead() openNamedStream errors
>
> Has anyone seen these kind of errors?  A user has been having these errors
> for a long time (they manage their own box and thus din't notice these
> errors for 9+ months)
>
>    TSM return code   : 104
>    TSM file          : ..\..\common\winnt\psmech.cpp (6583)
> 04/10/2018 22:58:04 ANS0361I DIAG: NTNamedStreamRead(): openNamedStream
> S:\arts-data\Private Directories\jwaltonen\Muse\
> Muse\Exceptions\AdobeMuse7.0-mul\Install Adobe
> Muse.app\Contents\Resources\Adobe
> Muse\Contents\Resources\META-INF\AIR\extensions\com.adobe.
> oobelib.extensions\META-INF\ANE\MacOS-x86\OOBELibANE.
> framework\Versions\Current:AFP_AfpInfo:
> RC=104
> 04/10/2018 22:58:04 ANS5250E An unexpected error was encountered.
>    TSM function name : openNamedStream
>    TSM function      : CreateFile() returned '2' for file ':AFP_AfpInfo'
>
> All Google hits are for a much older client - they are fairly current at
> 7.1.6.5 on a Windows 2012 server.
>
> --
> *Zoltan Forray*
> Spectrum Protect (p.k.a. TSM) Software & Hardware Administrator Xymon
> Monitor Administrator VMware Administrator Virginia Commonwealth University
> UCC/Office of Technology Services www.ucc.vcu.edu zforray AT vcu DOT edu -
> 804-828-4807 Don't be a phishing victim - VCU and other reputable
> organizations will never use email to request that you reply with your
> password, social security number or confidential personal information. For
> more details visit http://phishing.vcu.edu/
>
>
> This message and any attachment is confidential and may be privileged or
> otherwise protected from disclosure. You should immediately delete the
> message if you are not the intended recipient. If you have received this
> email by mistake please delete it from your system; you should not copy the
> message or disclose its content to anyone.
>
> This electronic communication may contain general financial product advice
> but should not be relied upon or construed as a recommendation of any
> financial product. The information has been prepared without taking into
> account your objectives, financial situation or needs. You should consider
> the Product Disclosure Statement relating to the financial product and
> consult your financial adviser before making a decision about whether to
> acquire, hold or dispose of a financial product.
>
> For further details on the financial product please go to
> http://www.bt.com.au
>
> Past performance is not a reliable indicator of future performance.
>



-- 
*Zoltan Forray*
Spectrum Protect (p.k.a. TSM) Software & Hardware Administrator
Xymon Monitor Administrator
VMware Administrator
Virginia Commonwealth University
UCC/Office of Technology Services
www.ucc.vcu.edu
zforray AT vcu DOT edu - 804-828-4807
Don't be a phishing victim - VCU and other reputable organizations will
never use email to request that you reply with your password, social
security number or confidential personal information. For more details
visit http://phishing.vcu.edu/