Controlled Folder Access Blocked?

I began getting this message since yesterday, every so often, but I can't
correlate when it began. I did do a custom scan on a file right before
this started to appear. I did look into the Controlled Folder settings,
but see nothing there to help me understand this. Here's the message:

Virus and threat protection
Unauthorized changes blocked
Controlled Folder Access blocked C:\Program...\iexplore.exe from making
changes to the folder %desktopdirectory%\(and then there's some Chinese
characters following here

Here's a screen shot:
https://postimg.org/image/rdoa1xe8b/

I do get it everytime I click on this link:

https://www.howtogeek.com/272201/all...l-get-windows-
10-for-free/

Boris wrote:

I began getting this message since yesterday, every so often, but I can't
correlate when it began. I did do a custom scan on a file right before
this started to appear. I did look into the Controlled Folder settings,
but see nothing there to help me understand this. Here's the message:

Virus and threat protection
Unauthorized changes blocked
Controlled Folder Access blocked C:\Program...\iexplore.exe from making
changes to the folder %desktopdirectory%\(and then there's some Chinese
characters following here

Here's a screen shot:
https://postimg.org/image/rdoa1xe8b/

An online search:

https://www.google.com/search?q=popu...nged%20blocked

found articles mentioning:

https://www.tenforums.com/tutorials/...dows-10-a.html
https://www.howtogeek.com/329532/how...folder-access/

On 20 Jan 2018, Boris wrote in
alt.comp.os.windows-10:

I began getting this message since yesterday, every so often, but
I can't correlate when it began. I did do a custom scan on a file
right before this started to appear. I did look into the
Controlled Folder settings, but see nothing there to help me
understand this. Here's the message:

Virus and threat protection
Unauthorized changes blocked
Controlled Folder Access blocked C:\Program...\iexplore.exe from
making changes to the folder %desktopdirectory%\(and then there's
some Chinese characters following here

Are you using the Insiders Preview? I recall reading somewhere recently
that the latest one has some half-baked new security feature that can
prevent you from saving things to certain locations, including the
Desktop. Maybe in this case it's doing something effective - a browser
should never save something from a web page without asking your
permission.

VanguardLH wrote in :

Boris wrote:

I began getting this message since yesterday, every so often, but I
can't correlate when it began. I did do a custom scan on a file
right before this started to appear. I did look into the Controlled
Folder settings, but see nothing there to help me understand this.
Here's the message:
Virus and threat protection
Unauthorized changes blocked
Controlled Folder Access blocked C:\Program...\iexplore.exe from
making changes to the folder %desktopdirectory%\(and then there's
some Chinese characters following here

Here's a screen shot:
https://postimg.org/image/rdoa1xe8b/

An online search:

https://www.google.com/search?q=popu...protection%20u
nauthorized%20changed%20blocked

found articles mentioning:

https://www.tenforums.com/tutorials/...defender-contr
olled-folder-access-settings-windows-10-a.html
https://www.howtogeek.com/329532/how...s-from-ransomw
are-with-windows-defenders-controlled-folder-access/

Well, I've been to those links before, and all three of those links cause
the 'controlled folders access' notification. I just wonder what
ieplore.exe is trying to change. And where is DesktopDirectory? Never
heard of that.

I'm running version 1709, build 16299.192, and as you know, this feature
is first seen in this version and is disabled by default. I turned it on
in all of my 1709 laptops, and it does the same thing.

This laptop is a Dell.

On my HP, I get the same notifications on all of the three links, above.

On my HP laptop, when I launch Thunderbird, I get "Controlled Folder
Access Blocked C:\Prog...\thunderbird.exe from making changes to the
folder %userprofile%\Desktop". I also have Thunderbird on the Dell, but
I don't get this notification on the Dell.

It seems that iexplore.exe wants to make changes to DesktopFolder
(whatever that is), while thunderbird.exe wants to make changes to
Desktop.

I'm not sure why anyone would want to enable this 'feature' if it
continually causes these notifications. It even notified when I launched
Windows Live Mail.

Think I'll disable this feature and chalk this up to another W10 mystery,
or bug (to be patched later?), or inconsistency.

KenW kenw@ noplace.com wrote in
:

On Sat, 20 Jan 2018 17:56:09 -0000 (UTC), Boris
wrote:

I began getting this message since yesterday, every so often, but I
can't correlate when it began. I did do a custom scan on a file right
before this started to appear. I did look into the Controlled Folder
settings, but see nothing there to help me understand this. Here's
the message:

Virus and threat protection
Unauthorized changes blocked
Controlled Folder Access blocked C:\Program...\iexplore.exe from
making changes to the folder %desktopdirectory%\(and then there's some
Chinese characters following here

Here's a screen shot:
https://postimg.org/image/rdoa1xe8b/

I do get it everytime I click on this link

Controlled Folder ? %Desktop Directory% ? that must be from your
security software. What program is it ? Those locations are not on my
Windows 10 and I never heard of them.
I would check any logs and run some programs like Eset online scanner.
There are a few around online that you can try.





https://www.howtogeek.com/272201/all...ll-get-windows
- 10-for-free/


KenW

Yeah, the notification is caused by Windows Defender. Apparently, it's
new to the Fall Creators Update, and is described he

https://www.howtogeek.com/329532/how...ur-files-from-
ransomware-with-windows-defenders-controlled-folder-access/

Nil wrote in
:

On 20 Jan 2018, Boris wrote in
alt.comp.os.windows-10:

I began getting this message since yesterday, every so often, but
I can't correlate when it began. I did do a custom scan on a file
right before this started to appear. I did look into the
Controlled Folder settings, but see nothing there to help me
understand this. Here's the message:

Virus and threat protection
Unauthorized changes blocked
Controlled Folder Access blocked C:\Program...\iexplore.exe from
making changes to the folder %desktopdirectory%\(and then there's
some Chinese characters following here

Are you using the Insiders Preview? I recall reading somewhere recently
that the latest one has some half-baked new security feature that can
prevent you from saving things to certain locations, including the
Desktop. Maybe in this case it's doing something effective - a browser
should never save something from a web page without asking your
permission.

No, I've never run an Insiders edition. Perhaps this was a half-baked
feature in the Insiders Preview, and it's still half-baked, in my
opinion.

Boris wrote:

Yeah, the notification is caused by Windows Defender. Apparently, it's
new to the Fall Creators Update, and is described he

I tried enabling it, but it objected to LibreOffice editing .ods and
..odt files in the Documents folder, so it got disabled again.

Boris wrote:

VanguardLH wrote:

Boris wrote:

I began getting this message since yesterday, every so often, but I
can't correlate when it began. I did do a custom scan on a file
right before this started to appear. I did look into the Controlled
Folder settings, but see nothing there to help me understand this.
Here's the message:
Virus and threat protection
Unauthorized changes blocked
Controlled Folder Access blocked C:\Program...\iexplore.exe from
making changes to the folder %desktopdirectory%\(and then there's
some Chinese characters following here

Here's a screen shot:
https://postimg.org/image/rdoa1xe8b/

An online search:

https://www.google.com/search?q=popu...protection%20u
nauthorized%20changed%20blocked

found articles mentioning:

https://www.tenforums.com/tutorials/...defender-contr
olled-folder-access-settings-windows-10-a.html
https://www.howtogeek.com/329532/how...s-from-ransomw
are-with-windows-defenders-controlled-folder-access/

Well, I've been to those links before, and all three of those links cause
the 'controlled folders access' notification.

Or you could disable that anti-ransomware feature.

I just wonder what ieplore.exe is trying to change.

You could use SysInternal's ProcessMon for that. Add a filter that
looks for file writes to the %desktopdirectory% path.

And where is DesktopDirectory? Never heard of that.

It's an environment variable (likely a User one). Open a command shell
(cmd.exe) and run:

echo %desktopdirectory%

The string value of the environment variable (delimited by the
percentage signs) is returned. If the variable is not define, 'echo'
will just return %desktopdirectory% as a string instead of a value.

You can review all environment variables (System and User) by running:

set

(no parameters).

James Wilkinson Sword wrote:
On Sat, 20 Jan 2018 22:26:34 -0000, Nil
wrote:

On 20 Jan 2018, Boris wrote in
alt.comp.os.windows-10:

I began getting this message since yesterday, every so often, but
I can't correlate when it began. I did do a custom scan on a file
right before this started to appear. I did look into the
Controlled Folder settings, but see nothing there to help me
understand this. Here's the message:

Virus and threat protection
Unauthorized changes blocked
Controlled Folder Access blocked C:\Program...\iexplore.exe from
making changes to the folder %desktopdirectory%\(and then there's
some Chinese characters following here

Are you using the Insiders Preview? I recall reading somewhere recently
that the latest one has some half-baked new security feature that can
prevent you from saving things to certain locations, including the
Desktop. Maybe in this case it's doing something effective - a browser
should never save something from a web page without asking your
permission.

So a Microsoft program is stopping another Microsoft program from doing
something stupid? Isn't that like using gaffa tape to stop your central
heating pipes leaking?


It's configurable.

Which is probably an indication it's a dumb idea. Any time a
feature requires excess adjustment by the user, it ends up
a flop.

https://www.bleepingcomputer.com/new...e-is-now-live/

It could be that Desktop items getting blocked, was
somehow related to visibility, like some change made
to Folder views or something.

I don't see a Desktop item in the configuration panels
in that article. And people are unlikely to all be
adding a folder like that manually, so it's got to be
a side effect of something else. Maybe a recent
update changed something not covered in the
Bleepingcomputer article ?

*******

The best way to avoid ransomware, is to stop double-clicking
email attachments.

The one guy in the newsgroups who got ransomware,
that's how it entered the system. A double-click
on an email attachment (an "invoice"), and he
was toasted. And no backups either :-( Total
destruction.

Paul

VanguardLH wrote in :

Boris wrote:

VanguardLH wrote:

Boris wrote:

I began getting this message since yesterday, every so often, but I
can't correlate when it began. I did do a custom scan on a file
right before this started to appear. I did look into the
Controlled Folder settings, but see nothing there to help me
understand this. Here's the message:
Virus and threat protection
Unauthorized changes blocked
Controlled Folder Access blocked C:\Program...\iexplore.exe from
making changes to the folder %desktopdirectory%\(and then there's
some Chinese characters following here

Here's a screen shot:
https://postimg.org/image/rdoa1xe8b/

An online search:

https://www.google.com/search?q=popu...20protection%2
0u nauthorized%20changed%20blocked

found articles mentioning:

https://www.tenforums.com/tutorials/...s-defender-con
tr olled-folder-access-settings-windows-10-a.html
https://www.howtogeek.com/329532/how...les-from-ranso
mw are-with-windows-defenders-controlled-folder-access/

Well, I've been to those links before, and all three of those links
cause the 'controlled folders access' notification.

Or you could disable that anti-ransomware feature.

That's what I did.


I just wonder what ieplore.exe is trying to change.

You could use SysInternal's ProcessMon for that. Add a filter that
looks for file writes to the %desktopdirectory% path.

Hadn't thought of that, but didn't reveal anything.

And where is DesktopDirectory? Never heard of that.

It's an environment variable (likely a User one). Open a command
shell (cmd.exe) and run:

echo %desktopdirectory%

The string value of the environment variable (delimited by the
percentage signs) is returned. If the variable is not define, 'echo'
will just return %desktopdirectory% as a string instead of a value.

Not defined. Returned %desktopdirectory%.


You can review all environment variables (System and User) by running:

set

Even 'set' did not return either this variable, let alone a value.

(no parameters).

Thanks for the tips.

Boris wrote:

VanguardLH wrote in :

Boris wrote:

VanguardLH wrote:

Boris wrote:

I began getting this message since yesterday, every so often, but I
can't correlate when it began. I did do a custom scan on a file
right before this started to appear. I did look into the
Controlled Folder settings, but see nothing there to help me
understand this. Here's the message:
Virus and threat protection
Unauthorized changes blocked
Controlled Folder Access blocked C:\Program...\iexplore.exe from
making changes to the folder %desktopdirectory%\(and then there's
some Chinese characters following here

Here's a screen shot:
https://postimg.org/image/rdoa1xe8b/

An online search:

https://www.google.com/search?q=popu...20protection%2
0u nauthorized%20changed%20blocked

found articles mentioning:

https://www.tenforums.com/tutorials/...s-defender-con
tr olled-folder-access-settings-windows-10-a.html
https://www.howtogeek.com/329532/how...les-from-ranso
mw are-with-windows-defenders-controlled-folder-access/

Well, I've been to those links before, and all three of those links
cause the 'controlled folders access' notification.

Or you could disable that anti-ransomware feature.

That's what I did.


I just wonder what ieplore.exe is trying to change.

You could use SysInternal's ProcessMon for that. Add a filter that
looks for file writes to the %desktopdirectory% path.

Hadn't thought of that, but didn't reveal anything.

And where is DesktopDirectory? Never heard of that.

It's an environment variable (likely a User one). Open a command
shell (cmd.exe) and run:

echo %desktopdirectory%

The string value of the environment variable (delimited by the
percentage signs) is returned. If the variable is not define, 'echo'
will just return %desktopdirectory% as a string instead of a value.

Not defined. Returned %desktopdirectory%.

https://docs.microsoft.com/en-us/pre...753915(v=ws.11)

Looks like a coder mispelled the environment variable's name. Its name
should be DesktopDir (case independent). From:

https://msdn.microsoft.com/en-us/lib...v=vs.110).aspx

perhaps a coder (which looks to be Chinese based on the scribbling at
the end of the path in your pic) misused the DesktopDirectory argument
name for the name of an environment variable. Of course, any process
can define an environment variable by any name but then you said running
"echo %desktopdirectory%" returned the string "%desktopdirectory%"
instead of a value.

Since the ransomware protection is catching iexplore.exe from writing to
a non-existent path, I'd check to see what is the full path to
iexplore.exe in that popup. The file might be under the standard path
or something else that just starts with the identifying string. Is it a
valid copy of iexplorer.exe that is trying to write to a non-existent
directory?

Also check what add-ons you installed into IE. Exit IE, check in Task
Manager that there are no instances of iexplore.exe running (kill any
that are still around), load IE in its safe mode, and check if you get
that popup again.

Have you [re]started Windows in its safe mode to eliminate any startup
programs from loading IE for their use? There are HTAs (HTML
Applications) use the IE libs to create their GUIs. ProcMon should also
let you watch for processes that attempt to access iexplore.exe (under
the path listed in the popup warning).

Defender is poor for malware coverage. What else have you used to scan
your computer for malware?

On 1/20/2018 2:26 PM, Nil wrote:
On 20 Jan 2018, Boris wrote in
alt.comp.os.windows-10:

I began getting this message since yesterday, every so often, but
I can't correlate when it began. I did do a custom scan on a file
right before this started to appear. I did look into the
Controlled Folder settings, but see nothing there to help me
understand this. Here's the message:

Virus and threat protection
Unauthorized changes blocked
Controlled Folder Access blocked C:\Program...\iexplore.exe from
making changes to the folder %desktopdirectory%\(and then there's
some Chinese characters following here

Are you using the Insiders Preview? I recall reading somewhere recently
that the latest one has some half-baked new security feature that can
prevent you from saving things to certain locations, including the
Desktop. Maybe in this case it's doing something effective - a browser
should never save something from a web page without asking your
permission.


You may have seen it here, about 2/3 down the page:
https://blogs.windows.com/windowsexp...-15228-mobile/

On 22 Jan 2018, Boris wrote in
alt.comp.os.windows-10:

You may have seen it here, about 2/3 down the page:
https://blogs.windows.com/windowsexp...-15228-mobile/

Could have been. I just read about it in the past couple of weeks,
but didn't realize that it was old new and that the feature was
already implemented. I checked on my one Win10 computer and I see
that it does have the feature, but it was turned off by default
(or at least I don't remember turning if off.) I think it will stay
that way. I don't really see the need for it and it has great potential
to confuse the user, like it did you. Fortunately, you can fine-tune it
if you want to keep using it, or you can turn it off altogether.

Paul wrote in news
James Wilkinson Sword wrote:
On Sat, 20 Jan 2018 22:26:34 -0000, Nil
wrote:

On 20 Jan 2018, Boris wrote in
alt.comp.os.windows-10:

I began getting this message since yesterday, every so often, but
I can't correlate when it began. I did do a custom scan on a file
right before this started to appear. I did look into the
Controlled Folder settings, but see nothing there to help me
understand this. Here's the message:

Virus and threat protection
Unauthorized changes blocked
Controlled Folder Access blocked C:\Program...\iexplore.exe from
making changes to the folder %desktopdirectory%\(and then there's
some Chinese characters following here

Are you using the Insiders Preview? I recall reading somewhere
recently that the latest one has some half-baked new security
feature that can prevent you from saving things to certain
locations, including the Desktop. Maybe in this case it's doing
something effective - a browser should never save something from a
web page without asking your permission.

So a Microsoft program is stopping another Microsoft program from
doing something stupid? Isn't that like using gaffa tape to stop
your central heating pipes leaking?


It's configurable.

Which is probably an indication it's a dumb idea. Any time a
feature requires excess adjustment by the user, it ends up
a flop.

https://www.bleepingcomputer.com/new...0s-controlled-
folder-access-anti-ransomware-feature-is-now-live/

It could be that Desktop items getting blocked, was
somehow related to visibility, like some change made
to Folder views or something.

I don't see a Desktop item in the configuration panels
in that article. And people are unlikely to all be
adding a folder like that manually, so it's got to be
a side effect of something else. Maybe a recent
update changed something not covered in the
Bleepingcomputer article ?

*******

The best way to avoid ransomware, is to stop double-clicking
email attachments.

Yep.


The one guy in the newsgroups who got ransomware,
that's how it entered the system. A double-click
on an email attachment (an "invoice"), and he
was toasted. And no backups either :-( Total
destruction.

I'm sure we've all received (obviouosly malware) invoices, and notices
that an online purchase has been shipped along with 'here's your tracking
link'. My favorite goes something like "We've encountered suspicious
activity with your bank account, and have frozen all transactions. Please
log in using the link below. If we do not hear from you within 24 hours,
we will be forced to close your account." It's usually from a bank I've
never heard of.

Paul

James Wilkinson Sword wrote:

Why are people so naive? Why do they click on links from mis-spelt
emails that go to a server which isn't the bank's? They deserve all
they get.


Some are well constructed.

If you're a Godaddy customer and see a Godaddy invoice
in your email box, you might not suspect a thing. Maybe
you've clicked on many other Godaddy invoices, and the
body text looks no different on this one.

You won't really know what works, until the
day you fall for one.

The message here is "attachments are poison" and
they're to be detached and scanned, not double-clicked.

Paul