The recent versions of IE bring a new feature, it auto tag a downloaded file, and the OS will warn the user when opening a downloaded file.
How it could do this? There must be something writen into the file. yes, NTFS file system offers this feature, alternate data stream.
note: se winhex/ollydbg, find [ZoneTransfer], and find the reference, return “the caller” of this call