[HOME]8:04 AM December 3, 2016

Removing Alternative Data Streams - ADS How To Remove The Unblock Button From The Properties Tab Of Your Files

Alternative Data Streams or ADS - Basically it's hidden data attached to a file. Here are two articles that do a better job of explaining it than I could.

https://www.bleepingcomputer.com/tutorials/windows-alternate-data-streams/

http://ask-leo.com/what_are_alternate_data_streams_and_are_they_a_security_risk.html

What got me thinking about this was a problem with a previous post on my own site. I have it fixed now but I posted this article on my own site and I ended up with a string of what turned out to be Chinese letters at the end of the article - http://hitanykey.webs.com/nov20_b_2016.html

I suspected it had something to do with ADS but unfortunately never investigated the matter any further. I ran a program called AlternateStreamView (link below) and deleted what it found but instead of uploading this file to see if it was cleared out, I fixed it by just creating a new file and copy and pasting the info from the old. And then I deleted the old one. How this got attached to this one page is beyond my understanding. Scans of this file and my system showed nothing wrong.

Then I had another unusual thing happened, all of a sudden little lock symbols started to appear on the thumbnails of my pictures. I followed some info on line about how to get rid of these locks but I wasn't convinced that I had an infection or anything, just a case of Windows being Windows. I don't think it worked for me at the time but eventually all of the lock symbols vanished from my system.

Even now, when I right click on some of my pictures on my hard drive, in the General tab, at the bottom is some security info that says; This file came from another computer and might be blocked to help protect the computer. I don't know if this ever caused anybody problems but the easiest way to remove this message is just to click on Unblock, then Apply and OK. When you go to the properties after that you'll notice this information is no longer there.

Unblock button on general tab

If you have a lot of pictures and want to remove it then there is another way. Using a program called AlternateStreamView - http://www.nirsoft.net/utils/alternate_data_streams.html .

It allows you to view these streams and even delete them.

Run the program, choose the folder with the files you want to check.

In my example the Stream Name is :Zone.Identifier:$DATA. Most of the scans I have run show the same basic data. If I use this program to remove the stream it produces the same effect of just using the Unblock button.

ADS from picture

By the way, if you open up the file in a photo editing program then save it, even the same format, it also seems to get rid of this extra data. And I'm sure most malware scanners should be able to detect and fix any malicious data attached to any files.

Just FYI. Backup your data before making any changes. You've been warned.