Offtopic note: If you post as guest, you need to wait until moderator approves the post. You don't see unapproved posts in queue if you come back to this page.
I once again ask you to check the security tags, however this time with proper instructions:
1. Download the "Streams" console utility by Sysinternals here:
https://learn.microsoft.com/en-us/sysinternals/downloads/streams
2. To use it you need to run it as "streams <file>" as described at the page from console. I use cmd.exe but you can use powershell too
Example 1: Tixati.exe has no Zone.Identifier:
C:\PATH\Streams>streams.exe "C:/tixati-portable/tixati_Windows64bit.exe"
streams v1.60 - Reveal NTFS alternate streams.
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
Example 2: Streams.zip I just downloaded has a Zone.Identifier:
C:\PATH\Streams>streams.exe "C:/PATH/Streams.zip"
streams v1.60 - Reveal NTFS alternate streams.
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
C:\PATH\Streams.zip:
:Zone.Identifier:$DATA 129
What does 129 mean? It's the size of the file in bytes. In my case the full file path is "C:/PATH/Streams.zip:Zone.Identifier". Let's see what data there's written inside (again, taking this example from the download page):
C:\PATH\Streams>more < "C:\PATH\Streams.zip:Zone.Identifier"
[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://learn.microsoft.com/
HostUrl=https://download.sysinternals.com/files/Streams.zip
I downloaded this file with Firefox and Firefox adheres to this Windows behavior policy. It noted the page's ReferrerUrl and the final download link. Such info is created for every file you download from the internet. What does ZoneId=3 stand for? Admittedly, that's a little harder and I'll omit some further research through educated guesses.
Following Microsoft's documentation, seemingly this is the page that lists different values here:
https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537179(v=vs.85)
Notably:
URLPOLICY_ALLOW 0x00 = Allow the action to take place silently.
URLPOLICY_DISALLOW 0x03 = Do not allow the action.
URLPOLICY_QUERY 0x01 = Prompt the user to determine if an action is allowed.
URLPOLICY_MASK_PERMISSIONS 0x0f = Mask that can be used for comparisons to get the bits that pertain to permissions.
0xF (a hexadecimal number) tells us, the 4 bits are used as a "yes/no" values - a so called "bit flag".
ZoneId = 3 (decimal) = 0x3 (hexadecimal) = 0111 (binary). What does this tell Windows?
URLPOLICY_ALLOW = NO, because it wants ZoneId=0
URLPOLICY_DISALLOW = YES, because it is hexadecimal 3
URLPOLICY_QUERY = YES, because the right-most bit is set to 1 (aka Least Significant Bit): 011
1.
So if I were to execute my Streams.zip, Windows would ask me (DISALLOW + QUERY) if this is really something I wanted to do.
Now after I've explained all of this, answer these two questions:
1. What is the ZoneId of your Tixati.exe?
2. What is the ZoneId of the .torrent file you try to open? I think the .torrent's file ZoneId is what causes your check.
Why would Windows ask you? When you run a program normally, to the OS it looks like this:
tixati.exe. However when you open a file like .torrent, it looks like this:
tixati.exe "some.torrent"; essentially Windows still thinks you're opening that other file even if tixati.exe is whitelisted from this check (ZoneId modified or removed).
