# Excel: Disable “Some files can contain viruses” warning when opening file links

I have a large Excel table with a lot of local file hyperlinks to PDF files. These links are clicked often, and every time a warning pops up:

Opening <path\to\file.pdf>

Some files can contain viruses or otherwise be harmful to your computer. It is important to be certain that this file is from a trustworthy source.

Would you like to open this file?

This dialog is extremely annoying; is there a way to disable it?

What I've tried (none of it helped):

• In Registry, add DisableHyperlinkWarning REG_DWORD 0x00000001. I've tried it under following keys:

• Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common

• Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\Security

• Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common

• Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Security

• In Registry, enable trusted protocol via HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\xx.0\Common\Security\Trusted Protocols\All Applications. No "Office" key exists under "Microsoft".

• In Registry, go to Computer\HKEY_CLASSES_ROOT\.pdf, and add key EditFlags REG_DWORD 0x00010000

• Windows Start button ➔ Internet Options ➔ Security ➔ Trusted Sites. It is impossible to add a file:// link to a local folder.

• Excel ➔ Excel Options ➔ Trust Center ➔ Trusted Locations. Added folder under User Locations, restarted Excel, warning still pops up.

Excel version: "Microsoft Excel for Office 365 MSO (16.0.12527.21378) 64-bit"

• I don'thave Excel to test anything, but what is the source of the PDFs? If they were downloaded at some point, they may have Alternate Data Streams specifying a Zone Identifier. Quick check in a Command Prompt with dir /r and look for entry pairs like MS-SHLLINK.pdf and MS-SHLLINK.pdf:Zone.Identifier:$DATA. Can post complete answer if those exist. – Keith Miller Feb 28 at 17:47 • Try to use the Streams free app to delete the alternate data streams of all files in the folder. Use the syntax of streams -s -d <directory>. Take a backup of the folder before. – harrymc Feb 28 at 20:30 • Another useful utility is AlternateStreamView which both GUI and command-line interfaces. – harrymc Feb 28 at 20:33 • have you seen this microsoft answer ? They speak about deleting a registry value, which is: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\9.0\Common\Internet And DWORD: ForceShellExecute with Value 1 Read the whole thread as deleting that value might introduce other problems – 1NN Mar 1 at 11:34 • @1NN, that key doesn't exist for me (under 16.0 instead of 9.0). – jippyjoe4 Mar 2 at 4:37 ## 3 Answers Possibly the .pdf files have Alternate Date Streams with Zone Identifiers. To check, Open a PowerShell window in the directory containing the files, then copy & paste this command: (Get-Item *.pdf -Stream 'Zone.Identifier' -ea silent).FileName  If file names are returned by that command, they have ADS Zone Identifiers. And if you want to remove them from the files: Get-Item *.pdf -Stream 'Zone.Identifier' -ea silent | ForEach { Unblock-File -LiteralPath$_.FileName }


Get-Item * -Stream 'Zone.Identifier' -ea silent | ForEach{
[PSCustomObject]@{
'Name'   = ( Split-Path $_.FileName -Leaf ) 'ZoneID' = ( Get-Content -LiteralPath$_.PSPath -Raw )
}} | Out-GridView


Also, some .url files (those on Desktop?) have an ADS that encapsulates a .ico file. If you have .url shortcuts on your Desktop, try the following from the Desktop directory:

gci *.url | Where { (gi $_ -Stream *).Count -gt 1 } | ForEach{ (gi$_ -Stream *).PSChildName }


Output:

PS C:\...\Desktop>gci *.url | Where { (gi $_ -Stream *).Count -gt 1 } | ForEach{ (gi$_ -Stream *).PSChildName }
CTA  Bus Tracker.url::$DATA CTA Bus Tracker.url:favicon Morning Joe - Joe Scarborough, Mika Brzezinski, & Willie Geist.url::$DATA
Morning Joe - Joe Scarborough, Mika Brzezinski, & Willie Geist.url:favicon
Technet forums.url::$DATA Technet forums.url:favicon PS C:\...\Desktop>  If you want to extract at the icons: gi *.url -Stream favicon -ea silent | ForEach {$Splat = @{
'LiteralPath' = "$($_.FileName).ico"
'Value'       = Get-Content -Literal $_.PSPath -Raw -Encoding Byte 'Encoding' = 'Byte' 'FOrce' =$True
}
Set-Content @Splat
}


To search a folder and its subfolders for any files with ADS:

Get-CHildItem -Directory -Recurse | ForEach {

If ( ( $ADS = Get-Item "$($_.FullName)\*" -Stream * | ? Stream -ne ':$DATA' ).Count -ne 0 ) {
$ADS | ForEach { Get-Item -Literal$_.FIleName }
}
}

• I tried running (Get-Item *.mp4 -Stream 'Zone.Identifier' -ea silent).FileName but unfortunately it returned nothing. For me these are mp4 files generated with ffmpeg, rather than pdfs like the OP. So they are not from the internet. But I still get the hyperlink warning even after trying all of his suggestions. – jippyjoe4 Mar 2 at 4:33
• Then it may be caused by something othat than ADS -- it was a guess based on the the error message. If you're curious, you're almost sure to find files with ADS in your Downloads directory. A single wildcard with no extension will check all files: (Get-Item * -Stream 'Zone.Identifier' -ea silent).FileName. – Keith Miller Mar 2 at 5:57
• You're right, I was able to find something in my downloads folder. Unfortunately, the folder I'm pointing to is not that one, and even using the wildcard there still isn't a single item in there that has the ADS. So I'm really not sure what else to try at this point. – jippyjoe4 Mar 3 at 5:58
• @KeithMiller My PDFs don't have ADS; but thank you for this highly interesting information - I had no idea that NTFS have this feature! – alexanderlukanin13 Mar 3 at 5:59
• I appreciate the help with typos. Never was a great typist (almost like motor dyslexia, left hand gets ahead of right) but could see my mistakes when proofing. Now, central vision loss makes seeing whole words difficult and mistakes are easier to miss. – Keith Miller Mar 4 at 7:47

The "insert hyperlink" dialogue in Office 365 looks like a Zombie from Windows XP. And if in that dialogue you click on the 'browse the web' button, astonishingly, internet explorer will open. This makes me think that probably all hyperlinks in office are routed through the internet explorer's dll, so it might have to do something with your explorer-related security settings. In fact, Office 365 uses the information bar rather than popups for security warnings, this makes me think that your popup actually is inherited from internet explorer.

I couldn't replicate your issue, but these steps might point you (or someone else) in the right direction.

Open Control panel. Click on 'Network and Internet' -> 'Internet Options'.

In the 'Internet Properties' window which opens, go to the 'Security' tab. Both on 'Local intranet' and on 'Trusted sites', set the 'Security level for this zone' to "Low". Also, untick "enable protected mode", if it is selected.

• Do you know which setting specifically it is (of the settings in the "custom level" dialog)? My "Local Intranet" doesn't have the slider, so I'm not sure we have the exact same settings. But I set it to "low" for trusted sites and I'm still getting the popup in Excel, even after restarting. – jippyjoe4 Mar 4 at 6:17
• @jippyjoe4 Apparently "My Computer" is a separate hidden zone and can be edited via regedit, see docs.microsoft.com/en-US/troubleshoot/browsers/… – alexanderlukanin13 Mar 4 at 14:56

In the registry, I found this key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults The values for each protocol are very likely Zone Idnetifiers -- it would explain files with no ADS still acting like Zone 3 files.

Try:

1. changing the value of the file entry to 0 (Computer) or 1 (Local Intranet)
2. Restart
3. Test
• Unfortunately this didn't work for me, even after restarting (I set it to 0). – jippyjoe4 Mar 4 at 6:15