Unauthorised Changes Blocked

Matt316 · 13 Nov 2021

Hi,

I have protected folders on, and the following keep popping up. Can anyone let me know if these are services I should let pass.

svchost - access to various including latest cdrom0
IAStorDataMgrSvc.exe - access to various including latest harddisk\DR0
serachindexer.exe - first time, access to harddiskvolume3

There are others or variations from the above, but I can't access the list unless one pops up.

I thought one of the ways to protect my computer is to have protected folders on, but these constant warnings are a pain.

Matt

dalchina · 13 Nov 2021

The genuine IAStorDataMgrSvc.exe file is a software component of Intel® Rapid Storage Technology (RST) by Intel Corporation.

searchindexer.exe (if correctly spelt) - part of Windows search indexing
svchost - does many things. You will have many instances of this.

FWIW those all look valid.

Matt316 · 13 Nov 2021

Thanks dalchina. As you might have guessed, I was typing not cut&pasting. The main one that keeps coming up is the IAStor... I can't find out much about this and it seems to try accessing all sorts of locations. But some sites seem to suggest that it and the svchost could possibly have been taken over by malware. I don't want to just release them without knowing something more positive about them. Is there any way to check them?

Matt

dalchina · 13 Nov 2021

You can identify each of them via task manager, rt click, properties, and upload them to Virustotal.

svchost could be more of a challenge I suppose... not tried that.

And of course you can run a full AV scan.

Matt316 · 13 Nov 2021

Sorry, but I don't know how to 'upload them to Virustotal'. Are you happy to give instructions?

dalchina · 13 Nov 2021

Google Virustotal
result:
VirusTotal

Look at the page:

Click the button.

I've never used Defender's controlled folder access etc so no doubt someone who has will advise on that.

There are tutorials e.g.
Add Allow App through Controlled Folder Access context menu Windows 10
Add Protected Folders to Controlled Folder Access in Windows 10

Matt316 · 13 Nov 2021

Ahh. Am I correct in assuming you mean upload the IAStor... exe file?

dalchina · 13 Nov 2021

Yes.. it's a well-known way of getting a multi-engine scan of a suspicious file.

Matt316 · 21 Nov 2021

I now find I can't get access to the Protection History to let safe programs access folders. When I click on the notification balloon or go through 'settings'\'update and security'\'windows security'\'virus and threat protection' and then click on 'Protection History', the Protection History page pops up saying 'No recent actions', stays for a couple of seconds then disappears. This has been getting worse and worse recently, as it used to do this, but just as it was about to disappear, the list would pop up. Now the list does not pop up but the window disappears. This means I am unable to allow any further programs to access any folders. 'Block History' does the same thing.

Matt