Editing NTFS Alternate Streams

If you run Windows XP SP2, you may have noticed that it displays a warning every time you try to run a file, downloaded from the Internet. Ever wondered how it tells downloaded files from local ones? Let's open a downloaded file in FlexHEX:

That's it! You can see that the Internet Explorer added a stream named 'Zone.Identifier', containing file zone ID. Easy to guess, 'ZoneId=3' means 'danger'. Delete this stream, and the file will magically become a good old local file, not in any way suspicious.

If you are interested to learn more about NTFS named streams, you can find a detailed discussion in the article NTFS Alternate Streams: What, When, and How To.