Contents of ZIP file blocked?

Hi,

I sent a VBS file to a friend within a zip file, he saved it from within
Windows Mail to the D drive. When he tries to extract the VBS file from
the ZIP file, he gets a message saying Windows has blocked the file. He
gets the same message whether he's a LocalAdmin or standard user. He's
running x64 Home Premium. Defender is on.

If he right-clicks the file and chooses "Unblock" he can then extract
the files.

I'm interested to know what is going on behind the scenes? What
mechanism is blocking the file from being extracted; is it something in
Vista, or something in Defender, or something related to downloading
from Windows Mail? Is the blocking flag set on the actual file itself or
somewhere else, such as a database or registry?

--
Gerry Hickman (London UK)

Hi Gerry,

Protected Mode in Internet Explorer is the cause of the 'blocking' of zip
files and downloaded executables. It's 'protecting' the user from potential
harmful downloads.

--
Jane, not plain 64 bit enabled :-)
Batteries not included. Braincell on vacation ;-)
MVP Windows Shell/User

"Gerry Hickman" <gerry666uk@newsgroup.nospam> wrote in message
news:%23CRZZD$EIHA.4880@TK2MSFTNGP03.phx.gbl...

> Hi,
>
> I sent a VBS file to a friend within a zip file, he saved it from within
> Windows Mail to the D drive. When he tries to extract the VBS file from
> the ZIP file, he gets a message saying Windows has blocked the file. He
> gets the same message whether he's a LocalAdmin or standard user. He's
> running x64 Home Premium. Defender is on.
>
> If he right-clicks the file and chooses "Unblock" he can then extract the
> files.
>
> I'm interested to know what is going on behind the scenes? What mechanism
> is blocking the file from being extracted; is it something in Vista, or
> something in Defender, or something related to downloading from Windows
> Mail? Is the blocking flag set on the actual file itself or somewhere
> else, such as a database or registry?
>
> --
> Gerry Hickman (London UK)

Hi Jane,

Can you tell me what it does to the zip file; does it set a bit, if so,
what byte offset?

Jane C wrote:

> Hi Gerry,
>
> Protected Mode in Internet Explorer is the cause of the 'blocking' of
> zip files and downloaded executables. It's 'protecting' the user from
> potential harmful downloads.
>

--
Gerry Hickman (London UK)

Hi Gerry,

I'm not too sure exactly what if anything protected mode in IE does, apart
from 'sandbox' the zip or exe by making the user 'unblock' it via
Properties. Byte offsets are beyond my realm of knowledge

Basically it seems to treat any downloaded file (zip, exe, etc) as a
potential threat until told otherwise.

--
Jane, not plain 64 bit enabled :-)
Batteries not included. Braincell on vacation ;-)
MVP Windows Shell/User

"Gerry Hickman" <gerry666uk@newsgroup.nospam> wrote in message
news:ulHIdlNFIHA.4544@TK2MSFTNGP06.phx.gbl...

> Hi Jane,
>
> Can you tell me what it does to the zip file; does it set a bit, if so,
> what byte offset?
>
> --
> Gerry Hickman (London UK)

Hi,

Thanks, but I need to know EXACTLY what is being done to the file, I
can't believe no one here seems to know.

Jane C wrote:

> Hi Gerry,
>
> I'm not too sure exactly what if anything protected mode in IE does,
> apart from 'sandbox' the zip or exe by making the user 'unblock' it via
> Properties. Byte offsets are beyond my realm of knowledge
>
> Basically it seems to treat any downloaded file (zip, exe, etc) as a
> potential threat until told otherwise.
>

--
Gerry Hickman (London UK)

"Gerry Hickman" <gerry666uk@newsgroup.nospam> wrote in message
news:%23GB$qumFIHA.2004@TK2MSFTNGP06.phx.gbl...

> Hi,
>
> Thanks, but I need to know EXACTLY what is being done to the file, I can't
> believe no one here seems to know.

Nothing is being done to the file. It's an attribute that's set in the file
system. That's why unblock sometimes stays set when moving a file around
the local system, but lost when moved to certain external locations and
back.

At least that was the explanation from Microsoft.

"Jane C" <janecolman@invalid.iinet.net.au> wrote in message
news:74F45B89-9145-4E77-824D-D9676EC9F2E0@microsoft.com...

> Hi Gerry,
>
> I'm not too sure exactly what if anything protected mode in IE does, apart
> from 'sandbox' the zip or exe by making the user 'unblock' it via
> Properties. Byte offsets are beyond my realm of knowledge
>
> Basically it seems to treat any downloaded file (zip, exe, etc) as a
> potential threat until told otherwise.
>

That's right. Any file that originates from another machine such as the file
is in an email and saved to the HD or it is downloaded from a site and is
saved to the HD is going to have that Unblock button applied to the file.
And that's the caption next to the Unblock button stating the the *File has
come from another machine and is a security feature*.

http://itsvista.com/2007/01/itsvista...apps-on-vista/

Hi Seth,

> Nothing is being done to the file. It's an attribute that's set in the
> file system. That's why unblock sometimes stays set when moving a file
> around the local system, but lost when moved to certain external
> locations and back.

> At least that was the explanation from Microsoft.

Can you expand on your comments? What exactly is an attribute that's set
in the file system? Do you mean like the attrib command with r h a s;
does it use the same location as those attributes or is it an extension
specific to NTFS?

--
Gerry Hickman (London UK)

"Gerry Hickman" <gerry666uk@newsgroup.nospam> wrote in message
news:%23Tb5%23wzFIHA.3548@TK2MSFTNGP06.phx.gbl...

> Hi Seth,
>

>

>
> Can you expand on your comments? What exactly is an attribute that's set
> in the file system? Do you mean like the attrib command with r h a s; does
> it use the same location as those attributes or is it an extension
> specific to NTFS?

Sorry, I can't be more specific as that is all I know. An associate of mine
made the same query to Microsoft and that was their answer.

As I understand it, yes, it is similar to the attributes you mention, but
not viewable with the attrib command.

Hi Seth,

Yes, my concern is that it has not been documented properly by
Microsoft. (Just like the rest of Vista).

Seth wrote:

> "Gerry Hickman" <gerry666uk@newsgroup.nospam> wrote in message
> news:%23Tb5%23wzFIHA.3548@TK2MSFTNGP06.phx.gbl...

>
>
> Sorry, I can't be more specific as that is all I know. An associate of
> mine made the same query to Microsoft and that was their answer.
>
> As I understand it, yes, it is similar to the attributes you mention,
> but not viewable with the attrib command.
>

--
Gerry Hickman (London UK)