Wednesday, September 2, 2009

Security warnings and NTFS ADS

Since Windows XP Service Pack 2, after downloading a file from the internet and running it, you have probably see a message box in this form:


The solution to get rid for good of this warning is to clear the check box or to open the properties of the file and unblock it:

If you have multiple files to unblock, you can use the streams.exe utility, by SysInternals.
What's happening behind the scenes? Since NT 3.51, NTFS has the possibility to store data into the so-called ADS or Alternative Data Streams, alternative containers of information associated to files. A file has a main stream called $DATA where its information is stored, but multiple streams can be created in the form file:stream. The information contained in a stream can be shown by opening a command line and using the command more:

more < file:stream

In the case of the downloaded executables, Windows adds a stream named zone.identifier, that contains the following information:
[ZoneTransfer]
ZoneId = 3


When ZoneId gets a value of 3, it means that the file was downloaded from the internet zone.