If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
|
Thread Tools | Rate Thread | Display Modes |
#1
|
|||
|
|||
Controlled Folder Access Blocked?
I began getting this message since yesterday, every so often, but I can't
correlate when it began. I did do a custom scan on a file right before this started to appear. I did look into the Controlled Folder settings, but see nothing there to help me understand this. Here's the message: Virus and threat protection Unauthorized changes blocked Controlled Folder Access blocked C:\Program...\iexplore.exe from making changes to the folder %desktopdirectory%\(and then there's some Chinese characters following here Here's a screen shot: https://postimg.org/image/rdoa1xe8b/ I do get it everytime I click on this link: https://www.howtogeek.com/272201/all...l-get-windows- 10-for-free/ |
Ads |
#2
|
|||
|
|||
Controlled Folder Access Blocked?
Boris wrote:
I began getting this message since yesterday, every so often, but I can't correlate when it began. I did do a custom scan on a file right before this started to appear. I did look into the Controlled Folder settings, but see nothing there to help me understand this. Here's the message: Virus and threat protection Unauthorized changes blocked Controlled Folder Access blocked C:\Program...\iexplore.exe from making changes to the folder %desktopdirectory%\(and then there's some Chinese characters following here Here's a screen shot: https://postimg.org/image/rdoa1xe8b/ An online search: https://www.google.com/search?q=popu...nged%20blocked found articles mentioning: https://www.tenforums.com/tutorials/...dows-10-a.html https://www.howtogeek.com/329532/how...folder-access/ |
#3
|
|||
|
|||
Controlled Folder Access Blocked?
On 20 Jan 2018, Boris wrote in
alt.comp.os.windows-10: I began getting this message since yesterday, every so often, but I can't correlate when it began. I did do a custom scan on a file right before this started to appear. I did look into the Controlled Folder settings, but see nothing there to help me understand this. Here's the message: Virus and threat protection Unauthorized changes blocked Controlled Folder Access blocked C:\Program...\iexplore.exe from making changes to the folder %desktopdirectory%\(and then there's some Chinese characters following here Are you using the Insiders Preview? I recall reading somewhere recently that the latest one has some half-baked new security feature that can prevent you from saving things to certain locations, including the Desktop. Maybe in this case it's doing something effective - a browser should never save something from a web page without asking your permission. |
#4
|
|||
|
|||
Controlled Folder Access Blocked?
VanguardLH wrote in :
Boris wrote: I began getting this message since yesterday, every so often, but I can't correlate when it began. I did do a custom scan on a file right before this started to appear. I did look into the Controlled Folder settings, but see nothing there to help me understand this. Here's the message: Virus and threat protection Unauthorized changes blocked Controlled Folder Access blocked C:\Program...\iexplore.exe from making changes to the folder %desktopdirectory%\(and then there's some Chinese characters following here Here's a screen shot: https://postimg.org/image/rdoa1xe8b/ An online search: https://www.google.com/search?q=popu...protection%20u nauthorized%20changed%20blocked found articles mentioning: https://www.tenforums.com/tutorials/...defender-contr olled-folder-access-settings-windows-10-a.html https://www.howtogeek.com/329532/how...s-from-ransomw are-with-windows-defenders-controlled-folder-access/ Well, I've been to those links before, and all three of those links cause the 'controlled folders access' notification. I just wonder what ieplore.exe is trying to change. And where is DesktopDirectory? Never heard of that. I'm running version 1709, build 16299.192, and as you know, this feature is first seen in this version and is disabled by default. I turned it on in all of my 1709 laptops, and it does the same thing. This laptop is a Dell. On my HP, I get the same notifications on all of the three links, above. On my HP laptop, when I launch Thunderbird, I get "Controlled Folder Access Blocked C:\Prog...\thunderbird.exe from making changes to the folder %userprofile%\Desktop". I also have Thunderbird on the Dell, but I don't get this notification on the Dell. It seems that iexplore.exe wants to make changes to DesktopFolder (whatever that is), while thunderbird.exe wants to make changes to Desktop. I'm not sure why anyone would want to enable this 'feature' if it continually causes these notifications. It even notified when I launched Windows Live Mail. Think I'll disable this feature and chalk this up to another W10 mystery, or bug (to be patched later?), or inconsistency. |
#5
|
|||
|
|||
Controlled Folder Access Blocked?
KenW kenw@ noplace.com wrote in
: On Sat, 20 Jan 2018 17:56:09 -0000 (UTC), Boris wrote: I began getting this message since yesterday, every so often, but I can't correlate when it began. I did do a custom scan on a file right before this started to appear. I did look into the Controlled Folder settings, but see nothing there to help me understand this. Here's the message: Virus and threat protection Unauthorized changes blocked Controlled Folder Access blocked C:\Program...\iexplore.exe from making changes to the folder %desktopdirectory%\(and then there's some Chinese characters following here Here's a screen shot: https://postimg.org/image/rdoa1xe8b/ I do get it everytime I click on this link Controlled Folder ? %Desktop Directory% ? that must be from your security software. What program is it ? Those locations are not on my Windows 10 and I never heard of them. I would check any logs and run some programs like Eset online scanner. There are a few around online that you can try. https://www.howtogeek.com/272201/all...ll-get-windows - 10-for-free/ KenW Yeah, the notification is caused by Windows Defender. Apparently, it's new to the Fall Creators Update, and is described he https://www.howtogeek.com/329532/how...ur-files-from- ransomware-with-windows-defenders-controlled-folder-access/ |
#6
|
|||
|
|||
Controlled Folder Access Blocked?
Nil wrote in
: On 20 Jan 2018, Boris wrote in alt.comp.os.windows-10: I began getting this message since yesterday, every so often, but I can't correlate when it began. I did do a custom scan on a file right before this started to appear. I did look into the Controlled Folder settings, but see nothing there to help me understand this. Here's the message: Virus and threat protection Unauthorized changes blocked Controlled Folder Access blocked C:\Program...\iexplore.exe from making changes to the folder %desktopdirectory%\(and then there's some Chinese characters following here Are you using the Insiders Preview? I recall reading somewhere recently that the latest one has some half-baked new security feature that can prevent you from saving things to certain locations, including the Desktop. Maybe in this case it's doing something effective - a browser should never save something from a web page without asking your permission. No, I've never run an Insiders edition. Perhaps this was a half-baked feature in the Insiders Preview, and it's still half-baked, in my opinion. |
#7
|
|||
|
|||
Controlled Folder Access Blocked?
Boris wrote:
Yeah, the notification is caused by Windows Defender. Apparently, it's new to the Fall Creators Update, and is described he I tried enabling it, but it objected to LibreOffice editing .ods and ..odt files in the Documents folder, so it got disabled again. |
#8
|
|||
|
|||
Controlled Folder Access Blocked?
Boris wrote:
VanguardLH wrote: Boris wrote: I began getting this message since yesterday, every so often, but I can't correlate when it began. I did do a custom scan on a file right before this started to appear. I did look into the Controlled Folder settings, but see nothing there to help me understand this. Here's the message: Virus and threat protection Unauthorized changes blocked Controlled Folder Access blocked C:\Program...\iexplore.exe from making changes to the folder %desktopdirectory%\(and then there's some Chinese characters following here Here's a screen shot: https://postimg.org/image/rdoa1xe8b/ An online search: https://www.google.com/search?q=popu...protection%20u nauthorized%20changed%20blocked found articles mentioning: https://www.tenforums.com/tutorials/...defender-contr olled-folder-access-settings-windows-10-a.html https://www.howtogeek.com/329532/how...s-from-ransomw are-with-windows-defenders-controlled-folder-access/ Well, I've been to those links before, and all three of those links cause the 'controlled folders access' notification. Or you could disable that anti-ransomware feature. I just wonder what ieplore.exe is trying to change. You could use SysInternal's ProcessMon for that. Add a filter that looks for file writes to the %desktopdirectory% path. And where is DesktopDirectory? Never heard of that. It's an environment variable (likely a User one). Open a command shell (cmd.exe) and run: echo %desktopdirectory% The string value of the environment variable (delimited by the percentage signs) is returned. If the variable is not define, 'echo' will just return %desktopdirectory% as a string instead of a value. You can review all environment variables (System and User) by running: set (no parameters). |
#9
|
|||
|
|||
Controlled Folder Access Blocked?
James Wilkinson Sword wrote:
On Sat, 20 Jan 2018 22:26:34 -0000, Nil wrote: On 20 Jan 2018, Boris wrote in alt.comp.os.windows-10: I began getting this message since yesterday, every so often, but I can't correlate when it began. I did do a custom scan on a file right before this started to appear. I did look into the Controlled Folder settings, but see nothing there to help me understand this. Here's the message: Virus and threat protection Unauthorized changes blocked Controlled Folder Access blocked C:\Program...\iexplore.exe from making changes to the folder %desktopdirectory%\(and then there's some Chinese characters following here Are you using the Insiders Preview? I recall reading somewhere recently that the latest one has some half-baked new security feature that can prevent you from saving things to certain locations, including the Desktop. Maybe in this case it's doing something effective - a browser should never save something from a web page without asking your permission. So a Microsoft program is stopping another Microsoft program from doing something stupid? Isn't that like using gaffa tape to stop your central heating pipes leaking? It's configurable. Which is probably an indication it's a dumb idea. Any time a feature requires excess adjustment by the user, it ends up a flop. https://www.bleepingcomputer.com/new...e-is-now-live/ It could be that Desktop items getting blocked, was somehow related to visibility, like some change made to Folder views or something. I don't see a Desktop item in the configuration panels in that article. And people are unlikely to all be adding a folder like that manually, so it's got to be a side effect of something else. Maybe a recent update changed something not covered in the Bleepingcomputer article ? ******* The best way to avoid ransomware, is to stop double-clicking email attachments. The one guy in the newsgroups who got ransomware, that's how it entered the system. A double-click on an email attachment (an "invoice"), and he was toasted. And no backups either :-( Total destruction. Paul |
#10
|
|||
|
|||
Controlled Folder Access Blocked?
VanguardLH wrote in :
Boris wrote: VanguardLH wrote: Boris wrote: I began getting this message since yesterday, every so often, but I can't correlate when it began. I did do a custom scan on a file right before this started to appear. I did look into the Controlled Folder settings, but see nothing there to help me understand this. Here's the message: Virus and threat protection Unauthorized changes blocked Controlled Folder Access blocked C:\Program...\iexplore.exe from making changes to the folder %desktopdirectory%\(and then there's some Chinese characters following here Here's a screen shot: https://postimg.org/image/rdoa1xe8b/ An online search: https://www.google.com/search?q=popu...20protection%2 0u nauthorized%20changed%20blocked found articles mentioning: https://www.tenforums.com/tutorials/...s-defender-con tr olled-folder-access-settings-windows-10-a.html https://www.howtogeek.com/329532/how...les-from-ranso mw are-with-windows-defenders-controlled-folder-access/ Well, I've been to those links before, and all three of those links cause the 'controlled folders access' notification. Or you could disable that anti-ransomware feature. That's what I did. I just wonder what ieplore.exe is trying to change. You could use SysInternal's ProcessMon for that. Add a filter that looks for file writes to the %desktopdirectory% path. Hadn't thought of that, but didn't reveal anything. And where is DesktopDirectory? Never heard of that. It's an environment variable (likely a User one). Open a command shell (cmd.exe) and run: echo %desktopdirectory% The string value of the environment variable (delimited by the percentage signs) is returned. If the variable is not define, 'echo' will just return %desktopdirectory% as a string instead of a value. Not defined. Returned %desktopdirectory%. You can review all environment variables (System and User) by running: set Even 'set' did not return either this variable, let alone a value. (no parameters). Thanks for the tips. |
#11
|
|||
|
|||
Controlled Folder Access Blocked?
Boris wrote:
VanguardLH wrote in : Boris wrote: VanguardLH wrote: Boris wrote: I began getting this message since yesterday, every so often, but I can't correlate when it began. I did do a custom scan on a file right before this started to appear. I did look into the Controlled Folder settings, but see nothing there to help me understand this. Here's the message: Virus and threat protection Unauthorized changes blocked Controlled Folder Access blocked C:\Program...\iexplore.exe from making changes to the folder %desktopdirectory%\(and then there's some Chinese characters following here Here's a screen shot: https://postimg.org/image/rdoa1xe8b/ An online search: https://www.google.com/search?q=popu...20protection%2 0u nauthorized%20changed%20blocked found articles mentioning: https://www.tenforums.com/tutorials/...s-defender-con tr olled-folder-access-settings-windows-10-a.html https://www.howtogeek.com/329532/how...les-from-ranso mw are-with-windows-defenders-controlled-folder-access/ Well, I've been to those links before, and all three of those links cause the 'controlled folders access' notification. Or you could disable that anti-ransomware feature. That's what I did. I just wonder what ieplore.exe is trying to change. You could use SysInternal's ProcessMon for that. Add a filter that looks for file writes to the %desktopdirectory% path. Hadn't thought of that, but didn't reveal anything. And where is DesktopDirectory? Never heard of that. It's an environment variable (likely a User one). Open a command shell (cmd.exe) and run: echo %desktopdirectory% The string value of the environment variable (delimited by the percentage signs) is returned. If the variable is not define, 'echo' will just return %desktopdirectory% as a string instead of a value. Not defined. Returned %desktopdirectory%. https://docs.microsoft.com/en-us/pre...753915(v=ws.11) Looks like a coder mispelled the environment variable's name. Its name should be DesktopDir (case independent). From: https://msdn.microsoft.com/en-us/lib...v=vs.110).aspx perhaps a coder (which looks to be Chinese based on the scribbling at the end of the path in your pic) misused the DesktopDirectory argument name for the name of an environment variable. Of course, any process can define an environment variable by any name but then you said running "echo %desktopdirectory%" returned the string "%desktopdirectory%" instead of a value. Since the ransomware protection is catching iexplore.exe from writing to a non-existent path, I'd check to see what is the full path to iexplore.exe in that popup. The file might be under the standard path or something else that just starts with the identifying string. Is it a valid copy of iexplorer.exe that is trying to write to a non-existent directory? Also check what add-ons you installed into IE. Exit IE, check in Task Manager that there are no instances of iexplore.exe running (kill any that are still around), load IE in its safe mode, and check if you get that popup again. Have you [re]started Windows in its safe mode to eliminate any startup programs from loading IE for their use? There are HTAs (HTML Applications) use the IE libs to create their GUIs. ProcMon should also let you watch for processes that attempt to access iexplore.exe (under the path listed in the popup warning). Defender is poor for malware coverage. What else have you used to scan your computer for malware? |
#12
|
|||
|
|||
Controlled Folder Access Blocked?
On 1/20/2018 2:26 PM, Nil wrote:
On 20 Jan 2018, Boris wrote in alt.comp.os.windows-10: I began getting this message since yesterday, every so often, but I can't correlate when it began. I did do a custom scan on a file right before this started to appear. I did look into the Controlled Folder settings, but see nothing there to help me understand this. Here's the message: Virus and threat protection Unauthorized changes blocked Controlled Folder Access blocked C:\Program...\iexplore.exe from making changes to the folder %desktopdirectory%\(and then there's some Chinese characters following here Are you using the Insiders Preview? I recall reading somewhere recently that the latest one has some half-baked new security feature that can prevent you from saving things to certain locations, including the Desktop. Maybe in this case it's doing something effective - a browser should never save something from a web page without asking your permission. You may have seen it here, about 2/3 down the page: https://blogs.windows.com/windowsexp...-15228-mobile/ |
#13
|
|||
|
|||
Controlled Folder Access Blocked?
On 22 Jan 2018, Boris wrote in
alt.comp.os.windows-10: You may have seen it here, about 2/3 down the page: https://blogs.windows.com/windowsexp...-15228-mobile/ Could have been. I just read about it in the past couple of weeks, but didn't realize that it was old new and that the feature was already implemented. I checked on my one Win10 computer and I see that it does have the feature, but it was turned off by default (or at least I don't remember turning if off.) I think it will stay that way. I don't really see the need for it and it has great potential to confuse the user, like it did you. Fortunately, you can fine-tune it if you want to keep using it, or you can turn it off altogether. |
#14
|
|||
|
|||
Controlled Folder Access Blocked?
Paul wrote in news
James Wilkinson Sword wrote: On Sat, 20 Jan 2018 22:26:34 -0000, Nil wrote: On 20 Jan 2018, Boris wrote in alt.comp.os.windows-10: I began getting this message since yesterday, every so often, but I can't correlate when it began. I did do a custom scan on a file right before this started to appear. I did look into the Controlled Folder settings, but see nothing there to help me understand this. Here's the message: Virus and threat protection Unauthorized changes blocked Controlled Folder Access blocked C:\Program...\iexplore.exe from making changes to the folder %desktopdirectory%\(and then there's some Chinese characters following here Are you using the Insiders Preview? I recall reading somewhere recently that the latest one has some half-baked new security feature that can prevent you from saving things to certain locations, including the Desktop. Maybe in this case it's doing something effective - a browser should never save something from a web page without asking your permission. So a Microsoft program is stopping another Microsoft program from doing something stupid? Isn't that like using gaffa tape to stop your central heating pipes leaking? It's configurable. Which is probably an indication it's a dumb idea. Any time a feature requires excess adjustment by the user, it ends up a flop. https://www.bleepingcomputer.com/new...0s-controlled- folder-access-anti-ransomware-feature-is-now-live/ It could be that Desktop items getting blocked, was somehow related to visibility, like some change made to Folder views or something. I don't see a Desktop item in the configuration panels in that article. And people are unlikely to all be adding a folder like that manually, so it's got to be a side effect of something else. Maybe a recent update changed something not covered in the Bleepingcomputer article ? ******* The best way to avoid ransomware, is to stop double-clicking email attachments. Yep. The one guy in the newsgroups who got ransomware, that's how it entered the system. A double-click on an email attachment (an "invoice"), and he was toasted. And no backups either :-( Total destruction. I'm sure we've all received (obviouosly malware) invoices, and notices that an online purchase has been shipped along with 'here's your tracking link'. My favorite goes something like "We've encountered suspicious activity with your bank account, and have frozen all transactions. Please log in using the link below. If we do not hear from you within 24 hours, we will be forced to close your account." It's usually from a bank I've never heard of. Paul |
#15
|
|||
|
|||
Controlled Folder Access Blocked?
James Wilkinson Sword wrote:
Why are people so naive? Why do they click on links from mis-spelt emails that go to a server which isn't the bank's? They deserve all they get. Some are well constructed. If you're a Godaddy customer and see a Godaddy invoice in your email box, you might not suspect a thing. Maybe you've clicked on many other Godaddy invoices, and the body text looks no different on this one. You won't really know what works, until the day you fall for one. The message here is "attachments are poison" and they're to be detached and scanned, not double-clicked. Paul |
|
Thread Tools | |
Display Modes | Rate This Thread |
|
|