Aggravating Denial Systems

Have you seen this prompt before?

Of course you have. Maybe you haven't if you use FAT32 still or haven't bothered patching XP to SP2 or you just don't use Windows. Whatever. I do and this prompt drives me nuts. I swore to destroy it. What I found was needless complexity.

Somewhere somehow Windows tags these files that you download with this information that your file is a filthy tramp. This is, of course, hearsay. If you inspect the properties of your file, you can see the clean/dirty status of said file.

Please note the Security section at the bottom of the window. You can prevent the Open File - Security Warning by clicking the Unblock button but this becomes tedious after the first time. I not only have a solution but the solution. You can skip to the end for a registry patch or you can read on for my justification and more Windows wackiness.

Upon greater examination, I found that Windows (actually Internet Explorer seems to be more of the culprit but they may as well be the same thing) stores this data in an alternate data stream. This is a lesser known feature (to gonks anyway) of the NTFS file system. For the especially paranoid, this could be a huge security risk, since it facilitates hiding data from Windows Explorer and the command prompt, the two most commonly used file management tools for Windows. Fun. Sarcasmed!

There are a few utilities that help you manage steams in both GUI and CLI flavors. I prefer this *.dll that creates a new tab in the file properties to view and delete the stream information on a given file.

This is all well and good but I was looking for a solution to prevent the creation of this data if that wasn't asking too much. I'll spare you the gory details and tedious trial and errors. Mostly errors. Virtualization and some registry tools (Registry Workshop is ideal but RegShot if free) greatly helped tracking this information down. The option to disable this is buried: Control Pannel, Internet Options, Security tab, Custom Level..., Miscellaneous: Launching applications and unsafe files. You then need to do this for each Zone: Internet, Local intranet, Trusted sites, and Restricted sites.

Naturally, It's much easier to apply these settings using a registry patch.

Windows Registry Editor Version 5.00

; the following sets values for the Attachment Execution Services (AES)
; if permitted, it should prevent the creation of Alternate Data Streams on downloaded files
; and prevent the Open File - Security Warning prompt

; * Zone 0 = My Computer
; * Zone 1 = Local Intranet Zone
; * Zone 2 = Trusted sites Zone
; * Zone 3 = Internet Zone
; * Zone 4 = Restricted Sites Zone

; * dword 0 = permitted
; * dword 1 = prompt
; * dword 3 = prohibited

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
"1806"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
"1806"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
"1806"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
"1806"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
"1806"=dword:00000003
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
"1806"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
"1806"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
"1806"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
"1806"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
"1806"=dword:00000003

I used Micosoft Knowledge Base Article 182569 to guide my patch writing. There are a lot more options there if you care to fiddle with it. Changing these settings may cause a warning depending on your systems configuration and security settings. I promptly added the stream tab *.dll and the registry patch to my XP unattended install disc so I'll never have to do this again.