Bandizip adds Zone.Identifier copy feature for malware protection

Vulnerability Overview This webpage introduces a method for copying information to enhance malware protection. is information stored within the NTFS Alternate Data Stream (ADS) that records the origin of a file. By copying this information, automatic malware detection can be triggered when extracting files, and a warning will be displayed if suspicious malware is detected. Scope of Impact Affected File Types: .exe, .com, .msi, .scr, .bat, .cmd, .pif, .bat, .lnk, .zip, .7z, .rar, .gz, .tar, .tgz, .cab, .bz2, .iso, .img, .jfs, .udf, .wim, .bin, .j00, .js, .jse, .vbs, .vbe, .wsf, .url, .reg, .docx, .doc, .xls, .xlsx, .ppt, .pptx, .wiz Affected Scenarios: Files downloaded from the Internet may trigger a warning from Windows Defender SmartScreen upon extraction, alerting users that the file might originate from an untrusted source. Remediation 1. Enable Zone.Identifier Information Copying: - In Bandizip settings, check the option labeled "Copy Zone.Identifier information of an archive downloaded from the Internet during extraction." - This allows the information to be automatically copied during file extraction, displaying a warning if suspicious malware is detected. 2. Handling Warning Messages: - If a warning message is received, it is recommended not to run the file. - If the file is confirmed to be safe, click "More info" and select "Run anyway" to proceed with running the file. POC Code / Exploit Code Links ADS (Alternate Data Stream) Zone.Identifier Stream Name Microsoft SmartScreen What Causes the "File Downloaded from the Internet" Warning and How Can I Easily Remove It? Notes This feature is effective only for specific types of files, ensuring that information is correctly copied during extraction. Users should handle files downloaded from the Internet with caution, particularly when security warnings are received.

Goal Reached Thanks to every supporter — we hit 100%!

Bandizip adds Zone.Identifier copy feature for malware protection