AlternateDataStreams: C:UsersPublicDRM:احتضان [48] is unusual, but the line alone does not prove malware. Farbar Recovery Scan Tool (FRST) is reporting a 48-byte NTFS alternate data stream attached to the object C:UsersPublicDRM. Identify that host object, inspect the stream safely, and check the rest of the system before deleting anything.
What FRST is reporting
FRST is a portable diagnostic and repair utility used by malware-removal specialists. It records registry loading points, services, drivers, scheduled tasks, files, browser and network settings, security information and other areas relevant to troubleshooting. Its reports are evidence for analysis, not an antivirus verdict. A line being listed or “found” does not mean FRST has classified it as malicious. See the FRST download page and FRST tutorial.
As an Amazon Associate I earn from qualifying purchases.
The sample breaks down as follows:
| Part | Meaning |
|---|---|
AlternateDataStreams: |
The report category. |
C:UsersPublicDRM |
The NTFS file-system object that owns the stream. It may be a file, directory, link or reparse point. |
:احتضان |
The named alternate data stream. The colon between the host and stream name is normal ADS syntax. |
[48] |
The stream size shown by FRST: 48 bytes, not a claim that the content is an executable. |
NTFS allows additional named data to be attached to a file-system object. Windows and applications can use these alternate data streams (ADS) for origin metadata such as Zone.Identifier, application or licensing information, document-management data, backups, security metadata, and compatibility with older or localized software. The non-Latin name is unusual, but Unicode by itself is not evidence of an attack. Likewise, C:UsersPublic is a shared profile location, not proof of compromise.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteIs this specific entry dangerous?
The original February 2024 support thread that contained this exact line did not establish that the 48-byte stream was malicious. The eventual advice concentrated on removing unauthorized or cracked Office software, collecting more diagnostic information and rerunning checks; the thread was later closed as resolved. That outcome does not make every similarly named stream safe or unsafe. Read the historical discussion at the original thread and its resolution page.
#1 Best Overall
ADS can be abused to hide payloads or configuration because ordinary directory listings may omit named streams. Modern security and forensic tools can enumerate them, so the entry is a lead for investigation rather than a diagnosis. Suspicion rises when the stream contains an executable, script, DLL, encoded data, commands, URLs or credentials; is attached to an unsigned or unexpected host; appeared immediately before suspicious behavior; or coincides with persistence, detections or unusual network activity.
Inspect the entry without destroying evidence
1. Preserve the report
- Save the original
FRST.txtand, if created,Addition.txt. - Record the FRST version, Windows edition and build, date, user account and scan location.
- Do not run a fixlist copied from a random post. A fixlist is written for one machine and can delete files, services or registry entries on another.
- If active compromise is suspected, disconnect from the network while preserving evidence, unless a managed incident-response process requires connectivity.
The Windows 10 Education N, version 22H2, build 19045.3930 details in the historical case describe that case only, not current Windows installations.
2. Confirm what DRM is
Open PowerShell as administrator and inspect the host object:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute$path = 'C:UsersPublicDRM'
Get-Item -LiteralPath $path -Force |
Format-List FullName,Length,CreationTime,LastWriteTime,Attributes,PSIsContainerNote whether it is a file, directory, link or reparse point. If it is missing, the FRST entry may be stale or the object may already have been removed.
3. Enumerate the named stream
For an existing object:
Get-Item -LiteralPath $path -Stream * -Force |
Format-List Stream,LengthLook for the stream named احتضان. If PowerShell cannot access it, use an elevated Command Prompt:
dir /r "C:UsersPublicDRM"Output varies with Windows version, permissions and whether the object is a file or directory.
4. Read or export it as untrusted data
For a stream expected to contain text:
Get-Content -LiteralPath $path -Stream 'احتضان' -RawFor a binary-safe copy:
Get-Item -LiteralPath $path -Stream 'احتضان' |
Get-Content -AsByteStream |
Set-Content -LiteralPath "$env:USERPROFILEDesktopDRM-احتضان.bin" -AsByteStreamTo display all bytes in a 48-byte stream:
$bytes = Get-Content -LiteralPath $path -Stream 'احتضان' -AsByteStream
[BitConverter]::ToString($bytes)Do not double-click or execute an extracted stream. Determine its type and origin first.
Recommended Free Tools
5. Check the owner, signature and detections
Get-AuthenticodeSignature -LiteralPath $pathFor an executable or DLL, record vendor metadata:
(Get-Item -LiteralPath $path).VersionInfo |
Format-List CompanyName,FileDescription,FileVersion,ProductNameScan the host with your installed security product and Microsoft Defender. A clean result lowers concern but does not prove that the stream is harmless; a detection or suspicious behavior changes the assessment substantially.
Best Value
6. Compare timing and surrounding findings
Compare the host’s creation and modification times with the stream’s available timestamps, the first unexplained symptom, recent downloads or installers, browser extensions and software updates. Review other FRST sections for scheduled tasks, services, drivers, startup entries, Run keys, WMI activity, browser changes and network settings. A stream that reappears only when known software runs is different from one created immediately before a new persistence mechanism.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to judge the result
| Assessment | Indicators |
|---|---|
| Probably benign or low concern | The host belongs to identifiable software; the stream is a short marker or metadata; expected signatures and old timestamps fit installation; no related detections, persistence or suspicious behavior exist. |
| Needs investigation | The host is missing or unexplained; data is encoded or binary with no owner; the name is random or misleading; the unsigned host is in a user-writable shared directory; or other FRST findings are suspicious. |
| High concern | Security software identifies the host or stream; the stream participates in persistence; an unsigned program launches from a temporary or profile directory; or there are credential-theft, ransomware, unauthorized-access or account-takeover symptoms. |
When removal is appropriate
Remove only the named stream after you have identified the host and confirmed that the stream is unwanted:
Remove-Item -LiteralPath $path -Stream 'احتضان'Do not delete the entire C:UsersPublicDRM object merely because FRST listed a stream. It may belong to legitimate software, and deleting it can break that software or remove evidence while leaving the real persistence mechanism intact. If the stream returns, identify which application recreates it rather than repeatedly deleting it.
When to get specialist help
Use a reputable malware-removal forum or incident-response provider when antivirus reports a detection, the stream contains executable or command data, persistence is present, or the computer shows credential theft, ransomware, remote-access or repeated-reinfection symptoms. Provide complete logs according to the service’s rules, but remove passwords, license keys, browser cookies and personal documents. Never apply an internet-supplied FRST fixlist to your machine without expert review.
The Bottom Line
An unfamiliar AlternateDataStreams line is an investigation lead, not a malware verdict. Preserve the FRST logs, identify C:UsersPublicDRM, inspect the 48-byte stream without executing it, correlate it with signatures, timestamps, detections and persistence, and remove only the confirmed unwanted stream.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
