0

I read some stuff online about cryptocurrency mining and wanted to give it a go, so I downloaded a miner which I know to be trustworthy called XMR-Stak. I downloaded it from the official GitHub page, no shady websites or anything. Chrome flagged up a warning, but from what I've read it does that for pretty much all crypto miners so I ignored it. I copied the miner into my documents folder, set up the pool config file and ran it. Windows Defender immediately closed the program and said my system was at risk and wanted to delete the program. I allowed Windows Defender to do whatever it wanted with the file but it just left it there. I can't run the program because Windows Defender blocks it and I can't delete it because it is "corrupt and unreadable".

Here's the kicker, Windows Defender completely blocked all write attempts to my entire documents directory. I can't delete, rename or edit ANY of my documents (which are mostly word files). I can read all the files and I can copy them out then edit them, but I can't save anything to the directory. I just get a popup saying the files are corrupt and unreadable, error: 0x80070570. I can't even make a new text document or a new folder, I just get the same popup.

All my data is safe because I can just copy it out of the directory or read it perfectly fine there (So it clearly isn't "corrupt or unreadable") but this is an incredible inconvenience because it has rendered the entire directory and everything in it completely useless. I have programs on my system that store their config files there, so they all crash when doing anything because they need full access to their files.

I have admin permissions on the system but I can't move or do anything to the files because Windows won't let me touch them. I have restarted multiple times, the hard drive is new and not failing. Please, if anyone knows of a solution to this problem that will leave all the files intact I will be incredibly grateful. I don't care if it deletes the crypto miner, I just want write access to my files again.

TL;DR: I ran a program in my documents folder, Windows Defender blocked the program and blocked access to all my files at the same time. I can read them and copy them, I just can't write/rename/delete/move/edit anything in the directory.

  • This may or may not apply in this specific case, but just because you found something on GitHub doesn't mean it's automatically trustworthy. GitHub is a legitimate site where all sorts of code is hosted, mostly good/useful/harmless, but some not. A quick Google shows that this project has prompted [hopefully] false Windows Defender malware warnings before. In the Windows Defender GUI, what does the History tab show you? Lastly, it's usually a good idea to give software its own folder to run in. Most likely, Windows Defender decided to lock down the entire directory: My Documents! – FosseWay Jan 23 '18 at 17:45
  • @FosseWay Hi, thanks for responding. I think the program is clean, a guy who knows way more about this stuff than I do recommended it to me and I trust him. That said, you bring up a valid point, but I don't think the program itself is what's causing the problem. – Marc Gabrek Jan 23 '18 at 17:49
0

I have this problem which started today, 6/2/2018.

I tried to fix this problem by adding Office 14 (WINWORD.EXE and EXCEL.EXE) to the list of approved programs. This did not fix the problem.

I then discovered that Windows defender made all of the files in my documents directory Read Only. I used the Advanced setting and changed them, only to have Windows Defender restore the Read Only attribute. I changed the Windows Defender default of "Check apps and files" to "Off". I also turned the Ransomware Protection (Controlled Folder Access) to Off.

I again removed the directory attribute of Read Only and can now use my files. I restored the Ransomware Controlled Folder Access to On to see what would happen. I can write to the documents directory. I wonder if it will work properly after I restart.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.