How do I force windows 10 to stop blocking downloaded files?

Greetings, group. I'm having a bit of a blocked-file issue, as you
can guess from my "Subject". I ran this question through Google,
and I got 7 million hits, but 0 of the top 100 were relevant, and
I don't have the millennia it would take to examine the other 6,999,900.

So, how DOES one How force windows 10 to stop blocking downloaded files?
I'm running into a problem where it's blocking not only dangerous files
such as "*.exe", but also harmless files such as "*.jpg".

And just to be clear, I'm not talking about blocking DOWNLOADS; that's
not what's happening; the files download just fine. No, I'm talking about
Windows blocking FILES. That is, the file downloads, but has a Block
on it, so that you can't open the file. If you right-click each such
file in Windows explorer, and look at "properties", and extra section
appears at the bottom of the properties window saying "This file
was downloaded from another computer and may harm your computer, so
we blocked it", and a checked check-box marked "Blocked". You can
manually "unblock" each file by unchecking the check-box, but with
hundreds of files that takes bloody ages.

So, is there a way to prevent Windows 10 from doing this in the first
place? Perhaps a registry hack?

Failing that, is there a way to write a script (in, say, cygwin BASH,
or Perl, or DOS batch, or powershell, or VBS) that will recursively
UNBLOCK every blocked file in a directory tree?

Thanks in advance to anyone who can shed some light on this issue!


--
Cheers,
Robbie Hatley
Midway City, CA, USA
perl -E 'say "\154o\156e\167o\154f\100w\145ll\56c\157m";'
https://people.well.com/user/lonewolf/
https://www.facebook.com/robbie.hatley

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

On Fri, 5 Jul 2019 15:42:23 -0700, Robbie Hatley wrote:

That is, the file downloads, but has a Block
on it, so that you can't open the file. If you right-click each such
file in Windows explorer, and look at "properties", and extra section
appears at the bottom of the properties window saying "This file
was downloaded from another computer and may harm your computer, so
we blocked it", and a checked check-box marked "Blocked". You can
manually "unblock" each file by unchecking the check-box, but with
hundreds of files that takes bloody ages.


You can unblock multiple files at once from Windows PowerShell.
So you won't need to take bloody ages.

* Google search: https://www.google.com/search?q=%22Unblock-File%22

The top several hits are all relevant


1. Microsoft docs: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-6

2. Microsoft blog: https://devblogs.microsoft.com/scripting/easily-unblock-all-files-in-a-directory-using-powershell/



--
Kind regards
Ralph

"Robbie Hatley" wrote

| So, how DOES one How force windows 10 to stop blocking downloaded files?
| I'm running into a problem where it's blocking not only dangerous files
| such as "*.exe", but also harmless files such as "*.jpg".
|

There are various things to do, but I'm not sure with Win10.
My first thought: Don't use an MS browser to download. I
think Firefox may add the downloaded file marker, too, but
I'm not certain. Second thought: Set up a FAT32 partition
for this kind of thing. Unless it's changed, the marker is actually
an alternate data stream file -- a hidden file attached to the
download. ADS files are only possible on NTFS. Putting things
on FAT32 partitions removes them and blocks their production.

A 3rd option -- again I don't know if this still works in win10 --
is a Registry setting:

HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\Associations\LowRiskFileTypes

Also

HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\Associations\OrigLowRiskList

I set the string value there like so:

".zip;.rar;.cab;.txt;.exe;.reg;.msi;.htm;.html;.gi f;.bmp;.jpg;.avi;.mov;.mp3;.wav"

Robbie Hatley wrote:

Greetings, group. I'm having a bit of a blocked-file issue, as you
can guess from my "Subject". I ran this question through Google,
and I got 7 million hits, but 0 of the top 100 were relevant, and
I don't have the millennia it would take to examine the other
6,999,900.

That's how I felt about your first paragraph...

Robbie Hatley wrote:
Greetings, group. I'm having a bit of a blocked-file issue, as you
can guess from my "Subject". I ran this question through Google,
and I got 7 million hits, but 0 of the top 100 were relevant, and
I don't have the millennia it would take to examine the other 6,999,900.

So, how DOES one How force windows 10 to stop blocking downloaded files?
I'm running into a problem where it's blocking not only dangerous files
such as "*.exe", but also harmless files such as "*.jpg".

And just to be clear, I'm not talking about blocking DOWNLOADS; that's
not what's happening; the files download just fine. No, I'm talking about
Windows blocking FILES. That is, the file downloads, but has a Block
on it, so that you can't open the file. If you right-click each such
file in Windows explorer, and look at "properties", and extra section
appears at the bottom of the properties window saying "This file
was downloaded from another computer and may harm your computer, so
we blocked it", and a checked check-box marked "Blocked". You can
manually "unblock" each file by unchecking the check-box, but with
hundreds of files that takes bloody ages.

So, is there a way to prevent Windows 10 from doing this in the first
place? Perhaps a registry hack?

Failing that, is there a way to write a script (in, say, cygwin BASH,
or Perl, or DOS batch, or powershell, or VBS) that will recursively
UNBLOCK every blocked file in a directory tree?

Thanks in advance to anyone who can shed some light on this issue!

I would be tempted to download the file onto a FAT32 partition,
if you can manage that.

As I understand it, blocking is recorded with an Alternate Stream.

This is an NTFS feature similar to Apple resource and data fork.
Apple had a scheme, where a file has "two halves". One half might
store resources (icons maybe, or executable code), while the
other half contained data.

When those files were transferred to other systems, there was
a tendency to lose one of the forks. Think... FAT32.

Well, NTFS has this capability too. Only it is not an organized
scheme like the Apple one. You can create more than two Alternate
Streams, store your recipes or passwords or any old thing
in an Alternate Stream. An Alternate Stream can have a name
(making it easier to guess their context).

If you were to download onto a FAT32 volume, then the Alternate
Stream has to "take a hike" as there is no place to store it.
A FAT32 data file is "just a data file", no shenanigans allowed.

On my current machine, I have a RAM Drive which is 4GB in size
and it is formatted FAT32. And I can move a file there, for
the fun of it.

If you currently have blocked files, pop one into this
and see if there's a stream in there.

https://www.nirsoft.net/utils/altern...a_streams.html

https://www.tenforums.com/tutorials/...dows-10-a.html

*******

As for the notion that JPG files are safe...

At one time, the parsers for JPG and TIF, were not
hardened for common C code exploits (unsafe handling
of strings, stack overflows). The libraries were FOSS,
and software companies had a habit of refusing to
code review them before reuse. Today, nobody would
use a JPG library without reviewing it for common
complaints.

The problems the libraries had, are of the type that
today, the *compiler* warns you to not use those routines.
And this is what happens, when you use 20 year old code
without "sprucing it up" and removing the dangerous stuff.

Paul

Paul wrote:

As I understand it, blocking is recorded with an Alternate Stream.

That would be the Zone.Identifier attribute in the ADS, and ADS is only
available with NTFS, and only as of Windows XP SP-2. So, for example,
copying the downloaded file to a USB drive using FAT32 would strip the
NTFS attributes. However, FAT has a smaller time resolution than NTFS,
and bases its datestamp on the local time and timezone instead of
biasing against the UTC timezone.

Another way to strip the Zone.Identifier ADS attribute is to use an ADS
editor, like SysInternals' stream program (which deletes ALL ADS):

streams.exe -d fileOrFolder

-d deletes all streams. If you are exercising this on a folder, you
might want to include -s to recurse through all subfolders to delete
their ADSes, too. Run "streams /?" to get help. It is a console-mode
program, so run it inside a command shell.

Since these have to do with security zones, you could go into Internet
Options - Security - Local intranet, click Custom Level, and, I think,
disable the "Launching programs and unsafe files". Those are the ones
that got downloaded and have the NTFS Zone.Identifier = 3 in the ADS.

Zone.Identifier identifies the security zone by a number. Within the
attribute, there will be the following data (shown for the Intranet zone
which is number 3):

[ZoneTransfer]
ZoneID=3

The URL security zones a

Local Intranet Zone: URLZONE_INTRANET = 1
Trusted Sites Zone: URLZONE_TRUSTED = 2
Internet Zone: URLZONE_INTERNET = 3
Restricted Sites Zone: URLZONE_UNTRUSTED = 4
Local Machine Zone (*)

(*) As I recall, this one isn't listed in Internet Options - Security
until you do a registry edit. Since I didn't do that in my
current WinX build, I don't know what is the URLZONE_name or its
value (but guessing the value is 5). I don't remember why I chose
to unhide that security zone, as that was way back in WinXP.

When downloading a file, there is a "Always ask before opening this
file" (which, I believe, is by filetype, not something associated to
just that particular file after downloaded). If you enable this option,
the ADS gets deleted since you are enforcing local security by filetype
rather than relying on the security zone for where the file was sourced.

A simple way to check if the ADS Zone.Identifier attribute was added to
a file is to right-click on it in File Explorer. Under the General tab,
and for a file downloaded from the Internet and which has the
Zone.Identifier attributed added in its ADS, you'll see:

Security: This file came from another
computer and might be blocked to
help protect this computer.

Another way to see if there is a Zone.Identifier ADS attribute is to
open a command shell and run:

more %1:Zone.Identifier

where %1 is an environment variable for the 1st argument in a .bat batch
file. At the command line, replace %1 with the name of the file (use
the full path if the file isn't in the current folder in the command
shell). The syntax for ADS attributes is "file:adsAttrName".

Robbie Hatley wrote:

Greetings, group. I'm having a bit of a blocked-file issue, as you
can guess from my "Subject". I ran this question through Google,
and I got 7 million hits, but 0 of the top 100 were relevant, and
I don't have the millennia it would take to examine the other 6,999,900.

So, how DOES one How force windows 10 to stop blocking downloaded files?
I'm running into a problem where it's blocking not only dangerous files
such as "*.exe", but also harmless files such as "*.jpg".

And just to be clear, I'm not talking about blocking DOWNLOADS; that's
not what's happening; the files download just fine. No, I'm talking about
Windows blocking FILES. That is, the file downloads, but has a Block
on it, so that you can't open the file. If you right-click each such
file in Windows explorer, and look at "properties", and extra section
appears at the bottom of the properties window saying "This file
was downloaded from another computer and may harm your computer, so
we blocked it", and a checked check-box marked "Blocked". You can
manually "unblock" each file by unchecking the check-box, but with
hundreds of files that takes bloody ages.

So, is there a way to prevent Windows 10 from doing this in the first
place? Perhaps a registry hack?

Failing that, is there a way to write a script (in, say, cygwin BASH,
or Perl, or DOS batch, or powershell, or VBS) that will recursively
UNBLOCK every blocked file in a directory tree?

Thanks in advance to anyone who can shed some light on this issue!

Looks like you have Internet Explorer configured to be the JP[E]G
viewer, and it will apply its security policies in that case, even on
local files.

- Control Panel - Network and Internet - Internet Options
(or load IE and go into its Internet Options menu)
- Advanced tab.
- Scroll to the bottom to the Security section.
- In there are "Allow active content" options you can see if enabling
grant you to load those local files (that have been flagged as
Internet sourced) inside of IE.

https://filestore.community.support....7-136d2f9cad78
The "Allow active content" settings are first in the Security section.

Probably not a problem if you pick some other program as the handler to
view the image files that came from an Internet source. I haven't used
IE for many, MANY years yet I've downloaded many images that display
just fine in Chrome, Firefox, the default image viewer, XnView, and
other media viewers.

If you did not assign and are not viewing the Internet-downloaded local
image files in IE, you sure you've tried disabling your anti-virus
software to see if you can then see those images in whatever media
viewer you happen to be currently using?


NOTE: Also see my reply to Paul about security zones, especially for
downloaded files that will have the Internet Security Zone attached to
them via ADS (Alternate Data Stream) which is only available in NTFS.

On Fri, 5 Jul 2019 15:42:23 -0700, Robbie Hatley wrote:

So, how DOES one How force windows 10 to stop blocking downloaded files?

See https://devblogs.microsoft.com/oldnewthing/20140311-00/?p=1543



--
Kind regards
Ralph

"Paul" wrote

| As for the notion that JPG files are safe...
|

Not to make people nervous, but there was one issue back in 2004:

https://www.f-secure.com/v-descs/exp...rability.shtml

As usual, Microsoft's link is broken and leads to an ad.
They should probably win the prize for worst maintained
website. But at least the URL includes the number ID of the bug:

http://www.microsoft.com/technet/sec.../ms04-028.mspx

It was a bug in gdiplus.dll, which provided updated graphics
functionality to supplement the original system file, gdi.dll.
gdi.dll offers all the basic functions that work with bitmaps.
gdiplus.dll added support for newer things like JPG. But that
was 15 years ago now. Hopefully MS have been more thorough
about maintaining core DLLs than they are about keeping
their website organized.

"Ralph Fox" wrote

| So, how DOES one How force windows 10 to stop blocking downloaded files?
|
| See https://devblogs.microsoft.com/oldnewthing/20140311-00/?p=1543
|
The problem with that kind of webpage is that it assumes
people know how to use gpedit and it also assumes they
have gpedit, which is not on home systems. Group Policy
settings are just part of a wrapper program so that IT
people don't have to understand the Registry. The real
settings:

HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\Attachments\SaveZoneInformation
HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\Attachments\SaveZoneInformation

Set to 1 (even though that dopesn't seem right) to stop zone markers.

Also, stop problems with files not having Microsoft
authenticode digital signatures:

HKCU\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures
string: "no"
HKLM\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures
string: "no"
HKCU\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures
dword: 1
HKCU\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures
dword: 1

I would have posted those settings above but I don't have
Win10 here and I'm never sure what still applies. Microsoft
change things without notice because they don't consider
these settings to be documented. For instance, there's a
setting to make the local zone visible in IE settings, but MS
disabled it in Win7. I'm assuming a lot of such options are
broken in Win10.

On 2019-07-05 6:42 p.m., Robbie Hatley wrote:

Greetings, group. I'm having a bit of a blocked-file issue, as you
can guess from my "Subject". I ran this question through Google,
and I got 7 million hits, but 0 of the top 100 were relevant, and
I don't have the millennia it would take to examine the other 6,999,900.

So, how DOES one How force windows 10 to stop blocking downloaded files?
I'm running into a problem where it's blocking not only dangerous files
such as "*.exe", but also harmless files such as "*.jpg".

And just to be clear, I'm not talking about blocking DOWNLOADS; that's
not what's happening; the files download just fine. No, I'm talking about
Windows blocking FILES. That is, the file downloads, but has a Block
on it, so that you can't open the file. If you right-click each such
file in Windows explorer, and look at "properties", and extra section
appears at the bottom of the properties window saying "This file
was downloaded from another computer and may harm your computer, so
we blocked it", and a checked check-box marked "Blocked". You can
manually "unblock" each file by unchecking the check-box, but with
hundreds of files that takes bloody ages.

So, is there a way to prevent Windows 10 from doing this in the first
place? Perhaps a registry hack?

Failing that, is there a way to write a script (in, say, cygwin BASH,
or Perl, or DOS batch, or powershell, or VBS) that will recursively
UNBLOCK every blocked file in a directory tree?

Thanks in advance to anyone who can shed some light on this issue!

Settings, Apps, first option at the top.


--
Rabid Robot
Google is your enemy (https://kek.gg/u/z6fQ)
"I have told you these things, so that in me you may have peace. In this
world you will have trouble. But take heart! I have overcome the world."
- John 16:33

Mayayana wrote:


I would have posted those settings above but I don't have
Win10 here and I'm never sure what still applies.

You can run Win10 in a VM, you know.

For the best experience, you'll need a pretty hefty computer.
(4C 8T would be a start).

I run Win10 on my puny 2C 2T system, and I had to butcher
part of Win10 to make it run well. (Windows Update,
I cut the nuts off it, and I disabled Windows Defender,
and then two cores is enough :-) )

Only the Personalize part of Settings doesn't work
when the OS is not activated.

And *don't* use a licensed copy of the VM either.
Ask Todd about his experience with Microsoft Support.
You have to be pretty sharp on your VM maintenance,
to remain in control if you do that.

This is if you were, say, too lazy to install Win10
yourself in a VM. You can get a canned Win10. At least
one of these I got from that web page, was an Enterprise version.

https://developer.microsoft.com/en-u...dge/tools/vms/

Paul

On 05/07/2019 23:42, Robbie Hatley wrote:


So, how DOES one How force windows 10 to stop blocking downloaded files?

just hire an Indian technician who can fix your machine remotely. Make
sure you have done backups!!!!!!!!!!!!!!








--
With over 999 million devices now running Windows 10, customer
satisfaction is higher than any previous version of windows.

"Paul" wrote
| Mayayana wrote:
|
|
| I would have posted those settings above but I don't have
| Win10 here and I'm never sure what still applies.
|
| You can run Win10 in a VM, you know.
|

Sounds great. I haven't got around to it only
because I'm also thinking of hiking to the South Pole in a
pair of old socks and a bathing suit. I can't decide which
untertaking would be more fun.

In article , Mayayana
wrote:

|
| You can run Win10 in a VM, you know.
|

Sounds great. I haven't got around to it only
because I'm also thinking of hiking to the South Pole in a
pair of old socks and a bathing suit. I can't decide which
untertaking would be more fun.

definitely the latter.

running win10 in a vm is nothing special.