Windows Defender (or something??) deleting all my downloads?! WTF?!

[QuixoticOne]

So I've been using Vista on a couple of systems since SP1 came out, and I'm aghast at a new behavior I'm seeing from what I'm presuming is Windows Defender.

I'm not on the system(s) affected right now, and didn't make any screen shots to get the dialog or the exact wording, but I'm sure this will be familiar to any 'power user' who has seen it before.

I'm a programmer and sysadmin and have used Windows-whatever & UNIX for decades, so I don't think I'm being too clueless or too astray in my expectations that it should NOT do this.

Basically I used IE7 to download some software from trusted sites like, say, Mozilla for Firefox, Thunderbird, programs like SCRIBUS, etc.

I'm running as a restricted (standard) user normally, though I believe it has done the same thing to me when I've been logged in as an Administrator account.

The downloads proceed, finish, and then about one minute later I get a pop-up saying something to the effect that "Windows has detected that this file is potentially harmful and has blocked access to it [OK]". There is no option to NOT block access to the file. When I do select [OK] (the ONLY option in the dialog) the file is DELETED from the hard disc. The dialog just says "Windows has....", nothing about defender specifically.

When I look in Defender's settings under Control Panel it shows NO quarantined files or any apparent indication that it HAS taken any such actions. I guess I could check the event logs but haven't done that yet. Reviewing the Defender options (they'd been pretty much at default) I didn't see anything that seemed tantamount to "DELETE ALL EXECUTABLES OTHER THAN MICROSOFT'S WITHOUT A TRACE OR OTHER CHOICE". In fact I recall seeing an activated option to TRUST software that was digitally signed by a provider.

For instance the following VERY well known and reputable program, digitally signed by Mozilla was immediately deleted as being 'potentially harmful' in that way:
http://releases.mozilla.org/pu...%20Setup%202.0.0.9.exe

I believe it has happened with Firefox as well, and a few related Mozilla downloads for Firefox.

WTF? How can they get away with blacklisting and deleting without a trace MAJOR 3rd party software that was EXPLICITLY downloaded from a TRUSTED zone site with IE7 into a non-restricted directory i.e. not a location under the control of IE's downloads sandbox???

"Potentially harmful" to what, Microsoft's bottom line, if people want to download Firefox, Thunderbird, OpenOffice, et. al. instead of using the Microsoft tools???

Admittedly I could turn OFF Defender (though actually on the one system that I swear I DID do that on, it KEPT happening even afterward), but that's not the point. The point is why isn't there a MAJOR uproar about this BROKENNESS of the DEFAULT settings for Defender and IE7? It would basically make downloading reputable 3rd party programs literally IMPOSSIBLE for 99% of the people out there who aren't clueful enough to get around the problem via reconfiguring Defender or whatever at a low level with Administrator elevated access etc.

It sure LOOKED (at first glance) like the options in Defender for various kinds of actions for files were either to IGNORE them or to apply the "Default" action or to REMOVE them. Well I certainly don't think I or anyone else wants actual potential malware to be unconditionally IGNORED. But for things that aren't 100% verifiably on the MALWARE hash list, how about SCANNING them and then NOTIFYING the user that they're UNKNOWN and ASK if they should be quarantined or something BY DEFAULT?

In all my decades of IT I have NEVER seen such a BROKEN anti-virus / anti-malware default setup as this. I can see why Microsoft is getting investigated / fined by the DOJ and EU for anti-competitive behaviors. I have no problem with them integrating IE/Media player into the OS bundle, but to actively PREVENT you from installing known-safe known-reputable digitally signed & user-trusted 3rd party applications from their major competitors BY DEFAULT is like lawsuit-worthy.

Anyway nothing (bad/flaky) really surprised me anymore about Microsoft software so I have put investigating this technically on the back burner to actually getting work done, but hopefully someone can tell me it's just a bug or that I somehow missed some really obvious option that 99% of the other people in the world would have known about to make it NOT this broken by default or whatever.

I'm sure there are WORKAROUNDS, but, again, I'm just sanity checking here, is this kind of INSANITY really the DEFAULT they INFLICT upon their users? WTF?

 

[QuixoticOne]

One other scary possibility I'm worried about but haven't checked out yet.

Say I have a file server computer, and another Vista box that maps drives from the file server PC.

If I start using Explorer or whatever to browse the shares and look around at directories in the shared drives I assume that folder access might trigger Defender to start looking at the contents of those folders as 'new' programs on the 'system'.

So now is it going to start DELETING (or trying to) random stuff from my file servers just because it doesn't recognize the signature or whatever on random programs and such that are on the mapped drives?

FYI this deletion behavior does NOT occur WHEN the program is actually launched, it does NOT prevent you from launching the program on-access IF you're fast enough to run it before it happens to index it / scan it or whatever after you download the file. You can also make a copy of the file successfully if you're quick.

Again, 100% opposite of what I'd expect / want from a malware defense. I'd want to be sure ON ACCESS ATTEMPT to RUN or COPY it that a given program is clean, but just having something sitting in a directory that you haven't even TRIED to copy/run it gets deleted? Yeah that's real security.

I can only imagine it'd possibly start rampantly doing this on USB drives or whatever you mount to the PC too.

Unbelievable. Oh and I'm pretty sure it isn't any 3rd party anti-malware / anti-virus thing doing this because I DO get alerts from THOSE programs that IDENTIFY what program is doing the scanning / blocking, and they also are very clear about logging anything that DOES show up infected / quarantined / possibly unsafe etc.

 

[stash]

I didn't get through all of your rant, but I've never heard of or seen that behavior with anything shipped by Microsoft. I also downloaded that file with no issues.

I'd love to see a screenshot of the message or the verbatim message. Honestly it sounds like some sort of malware to me.

 

[mechBgon]

and I'm aghast at a new behavior I'm seeing from what I'm presuming is Windows Defender.

That doesn't sound like Defender at work. A Windows Defender alert looks like this: pic :camera:

I likewise downloaded the Thunderbird file without any problem, and haven't had any problems downloading files of any sort on Vista for about a year now, signed or unsigned. That includes gigabytes of actual malware, too :evil: Did you perhaps change Vista to non-default behavior in some way? Disabled UAC or changed environmental variables or ??? Installed any extra desktop search engines?

I'd be interested to know the details of your security software, whether you're a member of a domain or not, etc, as well. You say two different systems do this?

 

[BehindEnemyLines]

As stash said, a few screenshots would definitely be helpful given how Defender deletes your downloads. That shouldn't be too difficult with what you are describing.

 

[QuixoticOne]

Looks like it's not necessarily Defender "itself" though who knows maybe some of the 'logic' that is doing this is shared with it. Defender claims to be OFF on the system I just tested this on.

What it is starting to look like is a weird bug / 'feature' in IE7.

Here is the screen shot of the blocking dialog and being about to 'delete' the file:

http://img504.imageshack.us/img504/566/ss003rp0.jpg

Here is what you get when you click on the link in the dialog:

http://img214.imageshack.us/img214/4691/ss008pb1.jpg

When you click on the link in the dialog it shows a help page about WINDOWS MAIL and it not letting you open certain files by their extensions (keep in mind this was done in IE7, I've never even used Windows Mail). When you click on the blurb in the help screen it does mention internet explorer doing a similar thing and there being some 'information bar' below the address bar that shows information about blocked files or whatever. I didn't see any such information bar in IE7 even after I looked for one briefly.

While I was checking this out it looks like I found some bug in the ctrl-printscreen screen shot utility that generated seemingly corrupted JPEGs about half of the time which don't include all of the original screen data or which are some weird mix of screen data or something. I'll have to look at that later.

I've also seen some weirdness like the file once it was 'blocked' and deleted (it disappeared from File Explorer open in that folder right as I closed the blocking notice dialog) at some later point in time the 'deleted/blocked' file seemed to come back through NO action of mine. Maybe I am wrong about this, but I'm pretty sure I didn't download it again since I was just going through the whole process getting screenshots to illustrate the problem / bug. The next time I downloaded the file and it deleted it on me it seemed to stay 'gone' despite me looking for it for a couple of minutes including with administrator level file explorers with options set to show hidden / system files etc. Weird, very weird.

Anyway the one theory I have is as follows:
a) Set your internet zone security settings to basically disable almost EVERYTHING, including file downloading.

b) Open an IE7 browser, Navigate to some random site like the thunderbird download site and find a file to download.

c) Right-click the file URL and click "Save As", it'll tell you downloads are forbidden, as they should be / are expected to be given that the current site isn't on the trusted sites list with download permission set.

d) Open up the IE7 security settings window and add the site domain which is in the URL you'll be downloading from to the 'Trusted Sites' list which has looser security settings permitting downloading files from those domains.

e) Right-click the file URL and click "Save As", pick a folder to save the download in, and watch it download up until the end of the download.

f) Right as or right *after* the download completes and you have a copy of the file on your disc, you get that dialog saying that the file is potentially harmful and so on.


At least on one try this SEEMS to correlate to the blocking event happening and when the site is ALREADY trusted and open in a 'fresh' IE7 window the blocking didn't occur at least twice.

IE7 seems determined to open up 'trusted' sites in a totally different actual window than untrusted sites so maybe in its weird protected mode code it has some bug that treats the download as like an unsafe mail attachment even though at the time it downloads the file the site IS set to be at a trusted security level as you can see from the screenshots and as is confirmed by the fact that it LETS you download the file which it wouldn't do if the site wasn't trusted (given my settings).

I knew there was a reason I liked firefox over IE... this is just nutty / buggy weirdness.

 

[QuixoticOne]

Yes, both my Vista SP1 systems, X64 Home Premium, X32 Business did this when I was downloading Thunderbird, stuff for Firefox, Scribus, etc. etc. from the official and secure download sites.

I've installed Avast, Comodo on these systems, but I've pretty much ruled out they're not involved in blocking the file(s) since they've given no evidence of behaving in the fashion I've observed in their usual scanning / blocking / notifying actions.

Defender is "OFF" on one system and "ON" on the other.

The main non-default security changes I did to the boxes Microsoft software was to lock down IE7 by removing almost all capabilities for the "Internet Zone" sites including file download. I also removed a few unnecessary capabilities from the "Trusted Sites" zones but enabled things like file downloading. I put the site URLs like microsoft, mozilla, et. al. either temporarily or permanently into the Trusted Sites list when I actually wanted to download programs from those sites and proceeded with my downloads.

Then I'd get this weird auto-deleted files behavior. Nothing "obvious" about my settings should produce this behavior, especially if it is nothing to do with Defender but is related to IE7. Though based on my further experimentation it does seem like it is some kind of security zone / protected mode related 'bug' or 'feature' in IE7. It's certainly not erring on the side of security by letting me fully download and even copy / execute malware that it is THEN going to decide shouldn't be on my disc and subsequently auto-deleted!

I'm in no domain, just a workgroup, I haven't messed with group policy settings much on the PCs, etc. All updates for the OS and IE are applied. I had virtually no 3rd party software (except AV / Firewall) on at least one of the systems when I started getting this behavior on it. And the fact that it repeated to the 2nd independent system made me pretty sure it was something to do with Microsoft and nothing I added.

Since I could download tons of stuff from Microsoft but got blocked basically 100% of the time on things from Mozilla and other main open source sites I had to wonder if this could be a little bit of intentional Microsoft discouragement for using those programs in Defender... though maybe it is just a bug to do with my locking down IE in a way more severe than the default would be (even though I did all the right things to UNLOCK it for the sites I was actually downloading from -- q.v. my previous post).

Originally posted by: mechBgon

and I'm aghast at a new behavior I'm seeing from what I'm presuming is Windows Defender.

That doesn't sound like Defender at work. A Windows Defender alert looks like this: pic :camera:

I likewise downloaded the Thunderbird file without any problem, and haven't had any problems downloading files of any sort on Vista for about a year now, signed or unsigned. That includes gigabytes of actual malware, too :evil: Did you perhaps change Vista to non-default behavior in some way? Disabled UAC or changed environmental variables or ??? Installed any extra desktop search engines?

I'd be interested to know the details of your security software, whether you're a member of a domain or not, etc, as well. You say two different systems do this?

 

[mechBgon]

You are correct that IE7 on Vista will (often) insist on opening different security zones in different instances of IE.

Try going to Internet Options > Advanced tab and click the Reset button to reset all settings to default. Also:

1) are you on a domain

2) what security software do you use

3) is UAC still enabled (yes = preferable)

4) try downloading a non-executable file, does it see the same treatment. e.g. an image file, text file, etc.


If I recall correctly, with UAC on and Protected Mode enabled, downloads should get saved initially to a special folder associated with IE's super-low-rights status, then moved to where you actually wanted them saved afterwards. The devil's in the details sometimes, and it must be, because no one else has had this complaint around here that I've ever seen.

edit: I see that the post right above this one answers most of my questions, and given the substantial changes made to IE's settings, that's probably where the answer lies.

 

[mechBgon]

So far I'm not having success in replicating the problem.

I set Internet Zone security to HIGH, added *.mozilla.org to the Trusted Zones list after disabling the SSL checkbox, set Trusted Zones to Medium-High security, opened a fresh instance of IE and went to mozilla.org, then navigated down to the Thunderbird 2.0.0.9 file and downloaded it to a folder on my Desktop. It downloaded fine and didn't do any disappearing tricks.

Maybe your Windows Event Viewer logs would have some clues as to what's going on?