Unverified publisher, for an app I have used for over 9 years

bawldiggle · 19 May 2017

When rebooting my PC after installing a portable (AHK) app, Windows showed this alert ...

Unverified publisher, for an app I have used for over 9 years-1_shiftoff-unverified-publisher.png

I have been using "ShiftOff" for >9 years on several XP desktops and now my third Win-7 machines.
ShiftOff is started by Startup and I have it whitelisted (folder and executable) in Bitdefender IS 2016.
The alert looks like Windows Essentials (?) , which I think I had disabled in my 2008 Toshiba, without any dramas for the past 9 years.
(The Toshiba has expired in the last 4 weeks or so)

Obviously Windows offers an option never ask me again if I want to run ShiftOff.exe at boot, by disabling ...

[ ] Always ask before opening this file

Q:1 Where does Windows store the settings when I chose to never ask me again ?
- and how do I access that list, the Registry ?
Q:2 Would elevating the EXE to run as admin, in
<file.exe> Properties -> Compatibility -> Privilege Level -> [x] Run this programs as administrator ...
... be a solution for any other programs run at startup. ?
I have some of my scripts (.VBS) that run at startup too.
I am in the process of setting up this Lenovo (2 years after I purchased it) and a lot more "stuff" to install.

Any informative input ... would be appreciated :)
Thank you

---------------
Windows 7 PRO x64
ShiftOff.exe home page

Pyprohly · 20 May 2017

Hello Bawldiggle,

bawldiggle said:

Q:1 Where does Windows store the settings when I chose to never ask me again ?
- and how do I access that list, the Registry ?

The “Open File - Security Warning” prompts are caused by something known as an alternate data stream (ADS) which is a resource forking feature of NTFS.

When you access a file in Explorer you’re getting the content of the primary data stream for that file. Each data stream on a file has a name and the name for the primary data stream is “:$DATA”.

Files blocked with a “Open File - Security Warning” will have a stream named “Zone.Identifier”. When you unblock a file, the “Zone.Identifier” ADS for that file is deleted.

Here’s an experiment for you, Bawldiggle. Open a command prompt and enter the following line, substituting the file name with a file that you know produces the “Open File - Security Warning” prompt. This will open the content of the “Zone.Identifier” stream in Notepad for you to read.

Code:

notepad "C:\Users\Pyprohly\Downloads\file.exe:Zone.Identifier"

bawldiggle said:

Q:2 Would elevating the EXE to run as admin, in
<file.exe> Properties -> Compatibility -> Privilege Level -> [x] Run this programs as administrator ...
... be a solution for any other programs run at startup. ?

Without testing, from memory I don’t believe this works, but if you create the shortcut using the laborious method outlined in the tutorial below you should be in luck.

Elevated Program Shortcut without UAC Prompt - Create

Callender · 20 May 2017

Also take a look at the tutorial here:

Windows 7: Open File Security Warning - Enable or Disable

Option One - Step 5 might meet your needs but those warnings exist for good reason. To prompt you when launching potentially untrusted files.

Some extra info here: How do I delete zone identifier files? Solved - Windows 7 Help Forums

bawldiggle · 28 May 2017

Deskpins.exe is an installed app and not portable

Unverified publisher, for an app I have used for over 9 years-deskpins-files.png

Hi Pyprohly (and "Callendar"), applogies for my belated response :)
my Lenovo crashed last Wed 24-May and BSOD? (I had a mouse pointer and could open "Task Manager" but no desktop). All I had done was to unistall Adobe Reader with Revo-PRO, and I didn't (still don't) know how to restore a "Restore Point", so Lenovo has been with repair shop until yesterday Sunday 4pm. I suspect RPs are not possible with BSOD or whatever state my PC was in
Frustrating

I have tried your ...

Code:

notepad "C:\Users\Pyprohly\Downloads\file.exe:Zone.Identifier"

... as ...

Code:

notepad "C:\Programs2\DeskPins (x86)\DeskPins.exe:Zone.Identifier"
... and ...
notepad "C:\Programs2\DeskPins (x86)\DeskPins.exe":Zone.Identifier

First expression returned an error.
Second expression populated Notepad with ... see attachment 1750 lines of gibberish.
I don't know what I am looking for ?
The Notepad result file name was "Desk Pins.exe" and could not be saved so I copied it to my Editor and saved it as TXT.

'--------------------------

Hi "Callendar" thank you for your response :)

I will look into your suggestions later today

Option One - Step 5 might meet your needs but those warnings exist for good reason. To prompt you when launching potentially untrusted files.

.... I don't want to be foolish and sabotage my security. The executable in point is very trusted and I agree with you I don't want a wholesale risk

I willl get back to you

Pyprohly · 29 May 2017

bawldiggle said:

my Lenovo crashed last Wed 24-May and BSOD? (I had a mouse pointer and could open "Task Manager" but no desktop). All I had done was to unistall Adobe Reader with Revo-PRO, and I didn't (still don't) know how to restore a "Restore Point", so Lenovo has been with repair shop until yesterday Sunday 4pm. I suspect RPs are not possible with BSOD or whatever state my PC was in
Frustrating

The thrills of PC.

bawldiggle said:

First expression returned an error.

What kind of error, “Cannot find file.exe:Zone.Identifier file”? It doesn’t have a Zone.Identifier stream then.

bawldiggle said:

Second expression populated Notepad with ... see attachment 1750 lines of gibberish.

The 1750 lines of gibberish is what you get when you open a binary file as a text file. Due to the way Notepad splits it’s arguments, the following lines are equivalent.

Code:

notepad "C:\Programs2\DeskPins (x86)\DeskPins.exe:Zone.Identifier":Zone.Identifier
notepad "C:\Programs2\DeskPins (x86)\DeskPins.exe:Zone.Identifier" :Zone.Identifier
notepad "C:\Programs2\DeskPins (x86)\DeskPins.exe:Zone.Identifier"

You’ve just uploaded DeskPins.exe as a text file.

This is what a Zone.Identifier stream’s content typically looks like. Increase the number and you’ll find Windows refusing to run the program.

Code:

[ZoneTransfer]
ZoneId=3

bawldiggle · 01 Jun 2017

Scanned DeskPins folder with "ADSScanner" ... no 'Zone.Identifier" streams (files) found.

Modified "User Account Control Settings" ... to ...

Unverified publisher, for an app I have used for over 9 years-uac-settings-changed.png

Now Deskpins.exe ...

Unverified publisher, for an app I have used for over 9 years-uac-deskpins.png

Now what can I do to run "DeskPins.exe" at Startup without UAC challenge and not compromise my PCs security ?

Callender · 01 Jun 2017

For now try getting rid of the warning like this:

Windows 7: Open File - Security Warning : Unblock File

Choose between Option One and Option Two.

bawldiggle · 03 Jun 2017

Hi Callendar :)

All I get is ...

Unverified publisher, for an app I have used for over 9 years-properties-dlg-no-unblock.png

and when is run manually

Unverified publisher, for an app I have used for over 9 years-uac-alert-shiftoff_p.png

I want to run ShiftOff.exe on startup.

Callender · 03 Jun 2017

From the screenshot in your Post #1 - unblock the file:

Then follow the steps in the Elevated Shortcut - Create tutorial to create an elevated shortcut in your startup folder here:

C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

(Replace Username in the path shown above with your username)