Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When some files are downloaded from the internet, they are blocked. Some files can still be opened even if they are blocked...

I can see whether a file is blocked by opening the file properties (right-click > properties) and looking at General tab > Security (right under the Attributes section).

See for reference:

What does it mean when a file is blocked? How does a file behave differently in a blocked state versus an unblocked state?

share|improve this question
up vote 2 down vote accepted

This is driven by the alternate data streams. Windows flags files as potentially untrusted if they have been downloaded (for example) from the internet zone and will disable execution.

As a side note, Sysinternals provide a free tool called 'streams' (via Microsoft) which allows you to remove (including recursively) all alternate streams from a file / directory.

As a second side-note, the reason Windows does this is because it's a fairly simple way to construct a trojan or virus. As discussion on this briefly here.

In 2009, the alternate data stream was used by a click fraud Trojan named FFSearcher. It used the stream name “Zone.Identifier” which is a stream name that Microsoft uses to mark executable files downloaded by Internet Explorer. Instead of a simple zone identifier however, the Trojan implanted a DLL file that contained the Trojan’s code.

share|improve this answer
If Windows blocks execution, how come I can run/open some files with the blocked flag enabled? – os2firefox May 2 '13 at 21:24
Trying to find anything to support, but from memory Windows will prevent execution of anything which attempts to modify or replace protected system files. This therefore doesn't extend to simply opening a file. – James May 2 '13 at 21:35
I imagine it also depends on the 'zone' ADS and associated level of 'untrustiness' according to Windows. This identifies where the file came from. – James May 2 '13 at 21:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.