Windows sysinternals

Chapter 11 File Utilities 327
The type and more commands do not accept stream syntax, but Cmd.exe and its redirection
operators do.
The most apparent use of alternate data streams by Windows is with downloaded files.
Windows’ Attachment Execution Service adds a Zone.Identifier stream that specifies the
security zone from which a file was downloaded so that Windows can continue to treat the
file as from that zone. One way to remove that indicator from a file is to open its Properties
dialog box in Explorer and click the Unblock button. However, that button and other user
interfaces to remove security zone information are often hidden from users by Group Policy.
Sysinternals Streams examines files and directories you specify and reports the names and
sizes of any alternate streams it encounters. You can search directory structures and list
all the files and directories with ADSes. Optionally, you can also delete those streams—for
example, to unblock downloaded content. Its command-line syntax is
streams [-s] [-d] file_or_directory
The file_or_directory parameter is mandatory and accepts wildcards. For example, the
command streams *.exe examines all file system objects ending in “.exe” in the current
directory and lists those that have ADSes with output like the following:
C:\Users\Abby\Downloads\msvbvm50.exe:
:Zone.Identifier:$DATA 26
In this example, the file msvbvm50.exe has a 26-byte ADS called “Zone.Identifier”. You
can see that stream’s content by running more < msvbvm50.exe:Zone.Identifier at a
command prompt.
The –s option examines directories recursively, and the –d option deletes ADSes that it finds.
For example, the command
streams -s -d C:\Users\Abby\Downloads
searches in and under Abby’s Downloads folder, reporting on and deleting any ADSes it
finds. Streams reports the names of alternate streams that it deletes.
Figure 11-2 shows Streams identifying the Zone.Identifier ADS on a downloaded
SysinternalsSuite.zip, and then deleting that stream. Deleting the Zone.Identifier stream
before extracting the utilities allows them to run without security warnings and allows the
Compiled HTML (.chm) files to display help content.
www.it-ebooks.info