Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 594146" data-attributes="member: 32260">That is not how SmartScreen works. When you download files using the Internet Browser, the Alternate Stream named Zone.Identifier is attached to the file.If the file is OK, then it looks like:[ZoneTransfer]AppZoneId=4If the file is not OK then it looks like:[ZoneTransfer]ZoneId=3If the file is an executable: BAT, CMD, COM, CPL, DLL, EXE, JSE, MSI, OCX, SCR and VBE, then in the second case (ZoneId=3) you can see SmartScreen alert in the IE or Edge - if it is ignored, the file is downloaded.Alternate Stream can be attached to file only on NTFS drives. If you copy the file to the non NTFS source (FAT pendrive, FAT USB Disk, DVD) the Alternate Stream is lost.If you download a file by program downloader or torrent, then usually the Alternate Stream is not attached to the file.If you download files in ZIP or another (compression format), the ZIP file has got Alternate Stream attached, but not the files in the ZIP archive. If you decompress the file by Explorer context menu option (Windows inbuilt), it can add to decompressed files the Alternate Stream transferred from the ZIP file. If you decompress archive (ZIP, ARJ,&nbsp; 7Z, etc.) by another method, usually Alternate Stream is skipped, but it depends on the program.Files without Alternate Stream (Zone.Identifier) will be ignored by SmartScreen on the run.If you run downloaded file it is again checked by SmartScreen but only in the second case (ZoneId=3) with SmartsScreen Cloud. If the file is now OK, then Alternate Stream (ZoneId=3) is changed to AppZoneId=4 (no SmartScreen alert). If it is not OK the SmartScreen alert is showing up.Everybody can check this using NirSoft Alternatestreamview utility.</blockquote>

[QUOTE="Andy Ful, post: 594146, member: 32260"] That is not how SmartScreen works. When you download files using the Internet Browser, the Alternate Stream named Zone.Identifier is attached to the file. If the file is OK, then it looks like: [ZoneTransfer] AppZoneId=4 If the file is not OK then it looks like: [ZoneTransfer] ZoneId=3 If the file is an executable: BAT, CMD, COM, CPL, DLL, EXE, JSE, MSI, OCX, SCR and VBE, then in the second case (ZoneId=3) you can see SmartScreen alert in the IE or Edge - if it is ignored, the file is downloaded. Alternate Stream can be attached to file only on NTFS drives. If you copy the file to the non NTFS source (FAT pendrive, FAT USB Disk, DVD) the Alternate Stream is lost. If you download a file by program downloader or torrent, then usually the Alternate Stream is not attached to the file. If you download files in ZIP or another (compression format), the ZIP file has got Alternate Stream attached, but not the files in the ZIP archive. If you decompress the file by Explorer context menu option (Windows inbuilt), it can add to decompressed files the Alternate Stream transferred from the ZIP file. If you decompress archive (ZIP, ARJ, 7Z, etc.) by another method, usually Alternate Stream is skipped, but it depends on the program. Files without Alternate Stream (Zone.Identifier) will be ignored by SmartScreen on the run. If you run downloaded file it is again checked by SmartScreen but only in the second case (ZoneId=3) with SmartsScreen Cloud. If the file is now OK, then Alternate Stream (ZoneId=3) is changed to AppZoneId=4 (no SmartScreen alert). If it is not OK the SmartScreen alert is showing up. Everybody can check this using NirSoft Alternatestreamview utility. [/QUOTE]

Verification