Tips: Streams, Zones, Vista and Blocked Files in IE

  • Article

4/07/2007 Update

Rick O'Dell and Phil C. both emailed solutions for XP (Yes it happens in XP as well) and Vista that will prevent alternate streams from being saved period.

  1. Open a cmd window.
  2. gpedit.msc
  3. Goto: User Configuration > Administrative Templates > Windows Components > Attachment Manager
  4. Enable: Do not preserve zone information in file attachments.

Note: This won't remove alternate streams from existing files. Also this 'might' have side effects so use with caution. You can always disable the removal policy if you run into any issues.

---------------------------------------------------------------------------------.

Today was one of those not fun days where I lost literally hours and hours trying to overcome file blocking issues in Vista. Fortunately it has a happy ending and through the help of one of our awesome developers I was able to work through the problem. I am writing this in order to spare other the pain should they encounter the same issue.

As part of our courseware development we use an internal tool that allows us to review course content. This tool uses an embedded IE browser for preview. The files that are opened in the browser are HTML pages that include references to JS files and .HTC files. Today I installed this tool on Vista and then copied the generic course template files down from our courseware SharePoint site. As I ran the course for the first time, I got the following message.

I then went via explorer to find the file that it was attempting to open and I noticed in the property window "This file came from another computer and might be blocked to help protect this computer".

Before I pressed the "Unblock" button I went and then multi-selected all the files in the folder in hopes that I could unblock all of them in one fell swoop. That certainly soundedlike a good idea, but when I went to the property window for the multiple files….no dice. I then decided to press the unblock button and rerun my app. That actually worked the only problem was that I had about 60 such files that needed to be unblocked, so the app just gracefully moved to error out on the next file. As I realized the implications of what I was seeing I had two thoughts. My first thought was to totally lose it J. My second thought was to stay calm and see if there's a way I can work through this problem. I first send an email off to one our internal Vista distribution lists to see if anyone could help me. I then spent the next several hours trying everything from toying with IE settings, taking ownership of files, launching the application elevated with Admin permissions, even disabling UAC didn't work. I did several searches on the internet to see if anyone else was experiencing the same issues. To my surprise I found several users running Windows XP SP2 exhibited this behavior. None found a solution other than pressing the "Unblock" button for each file.

To make matters worse after being unsuccessful in all my attempts I received an email from Yevgeniy one of our devs that said "No there is no way to multi-select and unblock them all. You have to do it one at a time. Sorry." Now I really felt in between a rock and a hard place. I then took the matter offline with Yevgeniy and explained to him my situation and why I needed a better solution. Yevgeniy explained to me that the reason this error is occurring is that when you download files from the internet windows appends a "Zone Identifier" alternate data stream (supported in NTFS) to each file. If it's an archive, then when you expand it each file within will also have the identified appended. The Windows shell is aware of this stream and this is the reason why the message gets displayed in the file properties dialog. Once you "Unblock" the stream is removed. IE is also aware of this alternate stream and it won't allow any code / .htc files to execute if they have the stream appended. Through further prodding and investigation (Me prodding for a tool / hack and Yevginiy investigating) we found out there actually is a solution, and it's called "Streams". This nifty command line utility both retrieves and removes alternate stream information from files. Fortuanately it also supports a recursive mode where it will hit all the sub folders as well. After downloaded this little beauty I ran the following command from the shell : (-d for delete, -s for sub directories)

Streams –d –s c:\MSLDepot

Problem solved!

Comments

  • Anonymous
    December 23, 2006
    You are so awesome, thanks for the tip!

  • Anonymous
    March 02, 2007
    The comment has been removed

  • Anonymous
    March 02, 2007
    Thanks Peter. Actually solution if it is an archive / zip is to unblock the zip file BEFORE you extract it.

  • Anonymous
    March 07, 2007
    The comment has been removed

  • Anonymous
    March 09, 2007
    Dude, you rock! You just saved us some major headache!

  • Anonymous
    April 09, 2007
    hi glenn, can u please direct me to the download site for "streams"? im still having a blocked file headache...

  • Anonymous
    April 09, 2007
    aww.. never mind.... i just overlooked, it was a hyperlink all the time... thanks!

  • Anonymous
    April 09, 2007
    hi, streams did not help me... i just noticed, i dont have the unblock option in my file's general property. what can i do?

  • Anonymous
    April 09, 2007
    It won't be on every file. Only certain types of files. Try the parent folder. If you got the file from a zip, then try right clicking on the zip and setting the unblock. Then when you unzip it will have the alternate streams removed.

  • Anonymous
    July 07, 2007
    This is horrible news for backing up. I run XP SP2 and have discovered that a lot of files have RECENTLY been associating themselves with this block. I'm talking files on my PC from April 2005. They weren't blocked originally. I have just spent a good half hour unblocking around 300 files. The reason I needed to unblock? I had some issues with me DVD recorder and had to update the firmware and my preferred software doesn't recognize it and I'm too cheap to upgrade. So I'm using a one-button backup solution. Problem? The backup skips protected files. I have tens of thousands. I just think this is stupid. :/

  • Anonymous
    July 19, 2007
    Thanks Peter Henry and Glen Block Both the Jscript and the "Streams" utility work great.

  • Anonymous
    August 01, 2007
    Awesome utility and explanation.  saved me hours of work.

  • Anonymous
    September 13, 2007
    It was helpfull to us to unlock some 1000+ files, Thanx.

  • Anonymous
    September 22, 2007
    @Victor, PlumDeNom, and Key Glad the utility helped.

  • Anonymous
    October 19, 2007
    OK, so what if I can't open the streams.zip file because it's blocked? I click "unblock" on my zip files, but still can't copy to another directory.  Vista deletest them shortly after copying them.  Streams.zip didn't even have the unblock button. I find it hard to believe that MS would come out with an OS that prevents users from opening files downloaded from the internet.  Does this not seem a touch odd to anyone else?  What do less technical users (the other 4 billion) do?

  • Anonymous
    January 22, 2008
    Hey, any way to make that script recursive?  Somehow we have ended up with an entire tree blocked.

  • Anonymous
    January 22, 2008
    Getting Microsoft.VisualStudio.TestTools.TestManagement.ExecutionException: Test Run deployment issue: on Vista and how to solve it

  • Anonymous
    April 14, 2008
    The comment has been removed

  • Anonymous
    May 08, 2008
    here is a recursive version var shell=new ActiveXObject("WScript.Shell"); fso=new ActiveXObject("Scripting.FileSystemObject"); var total=0; var rf=fso.GetFolder('.');              // Current folder loop(rf, fso.GetAbsolutePathName('.')) function loop(f, path) {    var fe = new Enumerator(f.SubFolders);    for (; !fe.atEnd(); fe.moveNext())    {        loop(fe.item(), fso.BuildPath(path, fe.item().Name));    }    var fc=new Enumerator(f.files);    for (; !fc.atEnd(); fc.moveNext())    {        var fileName=fc.item().Name+':Zone.Identifier';        try        {            f1 = fso.OpenTextFile(path + "" + fileName,2); // If the Zone Identifier does not exist ..            total++;            f1.Close();        }        catch(e){}                           // .. we don't care    } } shell.Popup('Unblocked '+total+' files');

  • Anonymous
    June 19, 2008
    The comment has been removed

  • Anonymous
    June 19, 2008
    Hi Rick. Sorry to hear that this has caused you pain. I'll forward on your feedback to the right folks. Glenn

  • Anonymous
    June 19, 2008
    Rick, you know you can right click on a zip BEFORE you extract and from the properties dialog you can unblock all the files in one shot.

  • Anonymous
    September 01, 2008
    @Rick, I've spoken to Windows 7 folks. They are looking to address this.

  • Anonymous
    September 19, 2008
    You ROCK!!  I had this same issue, and the only workaround I'd found before this was to zip all of the individual "other zone" zips into a new zip... then, when I unzipped the mega-zip, all the little zips inside were considered to be in the right "zone" and were unblocked.  This method is MUCH faster and easier.  THANK YOU!!  

  • Anonymous
    October 06, 2008
    Thanks binyomin for the recursive version, that really helped me out. Thanks Glenn for the blog. btw, rick, agree with you... next laptop will be a Mac. MS, be humble and take a warning... people are getting sick of it, including this 15 year MS vet developer. You have to start making sense! You have to stop overdoing security! Vista (and so much more) doesn't make sense, doesn't add value, doesn't do basics like unzipping correctly... it really is unbelievable.

  • Anonymous
    October 07, 2008
    The comment has been removed

  • Anonymous
    November 29, 2008
    The unblock and recursive unblock js scripts are perfect.  The recursive one worked in my E drive.  I work in 3d and ever since I started using Vista Home Premium this "Unblock" thing has cursed me until now.  Thanks so so much!!  

  • Anonymous
    December 19, 2008
    The comment has been removed

  • Anonymous
    December 20, 2008
    @Or Not sure. Are you in a corp network, maybe with group policy they have locked down those settings. Glenn

  • Anonymous
    December 21, 2008
    The comment has been removed

  • Anonymous
    December 21, 2008
    @Or, My last post should have included "Check that you're not looking under ...'

  • Anonymous
    January 16, 2009
    i'm a novice - i downloaded streams.exe but now what? I double click on it and no window opens where i can type in any info. i want to unblock all the files that are blocked on my computer, and get rid of this "security" blocking feature all together. i don't know why it suddenly showed up on my XP.

  • Anonymous
    January 24, 2009
    Hi, The JS Script to unblock a file downloaded from internet was good. but is there a vbscript version of the same. If yes then do post it over here.

  • Anonymous
    January 30, 2009
    The comment has been removed

  • Anonymous
    February 02, 2009
    Blocked Files when getting files from the Internet

  • Anonymous
    March 16, 2009
    Hoje recebi uma mensagem de erro ao tentar executar testes unitários no Visual Studio 2008: Test Run

  • Anonymous
    May 06, 2009
    The comment has been removed

  • Anonymous
    July 30, 2009
    Thanks very much for the guide, you have saved me also countless hours as i have alot of TAFE documents and even online research .html and .pdf files i know are safe and hate wasting the time applying unblock to files i know are safe its a tiresome rigmorale. I use Firefox 3.51 and win xp professional and this tool streams i copied into system 32 folder and type into the run interface "streams [-s] [-d] <file or directory>" works a treat!

  • Anonymous
    August 17, 2009
    The comment has been removed

  • Anonymous
    November 04, 2009
    Excellent tip Glen - and thanks heaps again to Mark from Sysinternals! Saved a lot of hassle on my 500Gb USB drive (a little big for FAT Peter!) which has replaced my slab of DVDs. I shuffle it between work and home, XP, Vista Win 7 and download from whatever I'm plugged into. Streams ran through and removed the the Zone Identifier attribute which I'd never heard of until yesterday!   Definitely agree with Rickfreezerburn though - too much is hidden by MS now making me feel  like Inspector Clouseau!

  • Anonymous
    October 27, 2010
    The comment has been removed

  • Anonymous
    August 03, 2011
    I thought the unblock.js could really 'unblocked' a EXE file, but can't. How to create a unblock.js, simply create a new text.txt. Rename to unblock.js, right-click edit. Copy and Paste everything below into file: // Script to "UNBLOCK" all files in the current directory by pete.at.redtitan.com // (c) RedTitan Technology 2007 // http://www.pclviewer.com var shell=new ActiveXObject("WScript.Shell"); fso=new ActiveXObject("Scripting.FileSystemObject"); var total=0; var f=fso.GetFolder('.');              // Current folder var fc=new Enumerator(f.files); for (; !fc.atEnd(); fc.moveNext()){ var fileName=fc.item().Name+':Zone.Identifier'; try {   f1 = fso.OpenTextFile(fileName,2); // If the Zone Identifier does not exist ..   total++;   f1.Close(); } catch(e){}                           // .. we don't care } shell.Popup('Unblocked '+total+' files');