Posted on July 3, 2015 · Posted in Windows 7

How Windows Determines That the File Has Been Downloaded from the Internet

In one of the previous articles, we mentioned that when trying to open an executable file downloaded from the Internet Windows shows a security warning of running a potentially dangerous content (For details, see How to Disable Security Warnings in Windows). How does the system determines that the file has been downloaded from the Internet? Let’s try to find it out.

Open File - Security Warning : Do you want to run this file

All executable files downloaded from the Internet in a browser get a special marker. This rule is supported not only by Internet Explorer, but also by other popular browsers, like Mozilla Firefox and Google Chrome. When copying, renaming or moving a file to another NTFS partition, the marker still stays along.

This marker is an alternative NTFS file stream.

Note. The alternative NTFS data streams allow to create several extra data (metadata) streams for each NTFS file. By default, all file data are stored in the main stream, but it is possible to create for a file one or more additional streams and their size may even exceed the size of the primary file streem. The majority of applications (including Windows Explorer) work only with the standard stream and cannot read data from the alternative NTFS data streams.

To make sure that a special marker has been assigned to a file downloaded from the Internet, display the list of files for the directory containing distributions using the following command:

dir /r

NTFS alternative data stream - Zone.Identifier

As we can see, the alternative stream Zone.Identifier has been assigned to the executable files, like install_flash_player_16_active_x.exe:Zone.Identifier.

Open the alternative stream in Notepad:

Notepad.exe install_flash_player_16_active_x.exe:Zone.Identifier

ZoneTransfer section. ZoneId

We can see that this stream is a file containing a section [ZoneTransfer], in which a transfer zone ID (ZoneId) is specified. (These are the security zones that can be found in IE settings.) The transfer zone ID can contain one of the five values from 0 to 4.

  1. ZoneId=0: Local machine
  2. ZoneId=1: Local intranet
  3. ZoneId=2: Trusted sites
  4. ZoneId=3: Internet
  5. ZoneId=4: Restricted sites

Internet Explorer zones

When you download a file from a security zone, a browser assigns a corresponding ZoneId to it. When trying to run a file with ZoneId equal to 3 or 4 in its alternative NTFS stream, based on this ID the system detects that a file has been downloaded from the Internet or an untrusted source. Windows has been checking this marker of executable files since Windows XP SP2.

To delete this marker (the alternative stream) manually, you should only click Unblock in the file properties.

Unblock downloaded from Internet exe file

Make sure that this file doesn’t have the alternative stream now.

Clear zone identifier

Tip. To prevent assigning markers to the downloaded files, you can save the files downloaded from the Internet to a file system different from NTFS, like FAT, exFat, etc.

Actually, Windows doesn’t have any tools to deal with the alternative data streams. For instance, if you have to delete them from a number of files at once, you’d better use a third-party console tool by Mark Rusinovich — streams.

For example, to recursively delete the alternative streams of all executable files in c:\Download\, run this command:

c:\TOOLS\streams.exe -s -d c:\Download\*.exe

In the command prompt, you can see that the alternative stream of a file has been deleted: Deleted :Zone.Identifier:$DATA 

Important. Streams deletes all alternative streams of the specified files and doesn’t allow to target a certain stream. So, do not run the streams command as streams.exe -s -d c:\*.exe, since it can result in the system failure after the important information contained in the alternative NTFS streams has been deleted.

streams - clear file ntfs streams
In PowerShell 3.0, you can display the list of files with Zone.Identifier stream in a directory using this command:

Get-ChildItem -Recurse | Get-Item -Stream Zone.Identifier -ErrorAction SilentlyContinue | Select-Object FileName

The attribute is removed as follows:

Remove-Item .\install-file.exe -Stream Zone.Identifier

In Windows PowerShell 4.0, you can delete Zone.Identifier using a separate cmdlet:

Unblock-File install-file.exe

You can assign the marker to any file manually running this command:

notepad.exe install_flash_player_16_active_x.exe:Zone.Identifier

Since there is no stream, the system prompts to create a new file. Agree and copy the following text to the Notepad window:


Create zoneidentifier for exe fileSave the changes. Make sure that an alternative stream has been assigned to the file.

dir /r: show ntfs streams

Related Articles