Here's a quick solution I found for preventing NTFS streams from being ill-created on a NTFS mount that is accessed by an XP guest OS.
Linux Host = Suse 10.3
Guest OS = Win XP SP2
My system has a large NTFS partition on it (I dual boot to XP too). I mount the NTFS partition in linux at /win/data. I share out the partition to my Guest OS via "net use q: \\vboxsvr\data".
While in virtual XP, if I run IE and download a file from the interweb directly to the Q: drive (the NTFS partition), the XP attachment manager will attempt to create a Zone.Identifier$DATA stream on the downloaded file. Since either the fuseblk (ntfs-3g) filesystem or vbox doesn't really understand streams, the stream is NOT correctly created on the file itself, but rather, another different file is created with the stream name.
For example, if I downloaded the file TestFile.zip, the NTFS partition will end up with TWO files:
The latter file is supposed to be a stream on the former file, but it ends up being created as a separate file. THE FILENAME CONTAINS A COLON WHICH IS INVALID IN WINXP.
My purpose is not to try to get this fixed - according to the vbox bug reports, this has been reported many times but the bugs get closed as "not going to be fixed".
Anyways, there's an easy way in the guest XP OS to prevent the streams from being created. Start up the group policy editor (gpedit.msc), and drill down to:
User Configuration -> Administrative Templates -> Windows Components -> Attachment Manager
Locate setting: Do not preserve zone information in the file attachments and ENABLE IT!
Now, when running in the virtual XP, any IE downloads that are written to an NTFS share will NOT have the Zone.Identifier stream created.
If you encounter this rare situation and have named stream files on your NTFS partition that contain a colon , you cannot delete these files from WinXP - you must remove them from linux using something like the rm command. WinXP will see the files but you cannot access them at all because WinXP gets messed up by the presence of the colon character in the filename.
For further information about NTFS streams, see the sysinternals utility "streams" which allows you to find all the files on an NTFS partition that contain those hidden streams and you can delete them too.