Doctor10Fan Posted September 24, 2020 ID:1409305 Share Posted September 24, 2020 Hello, I recently updated my Nvidia drivers and since then have gotten a message saying that Windows Defender has blocked NvidiaContainer.exe from creating %userprofile%/Videos/tdbswd56spcap. I'm pretty sure it's benign but want to be 100% sure. Attached are my FRST logs, my Malwarebytes log, and finally my Adwcleaner log (scan and clean as I had some Lenovo software on my computer). Thanks! Malwarebytes.txtFRST.txtAddition.txtAdwCleaner[S11].txt Link to post Share on other sites More sharing options...
Doctor10Fan Posted September 24, 2020 Author ID:1409321 Share Posted September 24, 2020 I was having some issues with my most recent windows 10 update so I rolled back. Should I rerun FRST? Also Adwcleaner is still finding Lenovo.IMController though it's been quarantined and deleted. Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 24, 2020 ID:1409425 Share Posted September 24, 2020 Hi The items flagged by Adwcleaner are in the Lenovo "Preinstalled Software" That is not malware and IMHO, is not a threat. The scan result from Malwarebytes for Windows has found no malware. nada. . Looking at the section of FRST that lists Windows events for the Windows Defender, it has this Windows Defender: =================================== Date: 2020-09-24 08:26:10.4800000Z Description: C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe has been blocked from modifying %userprofile%\Videos\Tdbswd56spcap by Controlled Folder Access. Detection time: 2020-09-24T12:26:10.479Z Path: %userprofile%\Videos\Tdbswd56spcap Process Name: C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe Security intelligence Version: 1.323.1742.0 Engine Version: 1.1.17400.5 Product Version: 4.18.2008.9 Question: Do you recall doing some video downloads around the time 12:26:10.479Z ? Another factor, this Windows is set to use Controlled Folder Access. If you would turn that off, the block event from Windows Defender would not happen Link to post Share on other sites More sharing options...
Doctor10Fan Posted September 24, 2020 Author ID:1409428 Share Posted September 24, 2020 Nope - this just started happening when I downloaded the new driver for my NVidia card through GeForce Experience. Thanks for looking into this for me! Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 24, 2020 ID:1409452 Share Posted September 24, 2020 Please turn off the Windows option on Controlled Folder Access. Beyond that, the issue is from MS Windows Defender. You should check & inquire at a Microsoft venue such as https://answers.microsoft.com Link to post Share on other sites More sharing options...
Doctor10Fan Posted September 24, 2020 Author ID:1409457 Share Posted September 24, 2020 Will do. Thanks. Anything need to be done regarding a FRST fixlist? I assume I'd need to run FRST again if so given the rollback. Link to post Share on other sites More sharing options...
Solution Maurice Naggar Posted September 25, 2020 Solution ID:1409602 Share Posted September 25, 2020 Hi. I see no need for a fixlist. The issue is all about Windows Defender, plus also as I noted, the fact of having Controlled Folder Access being on. Turn it off Controlled Folder Access. Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 30, 2020 ID:1410894 Share Posted September 30, 2020 Hello. Kindly provide a status update. Link to post Share on other sites More sharing options...
Doctor10Fan Posted September 30, 2020 Author ID:1410901 Share Posted September 30, 2020 Hi. Turned Controlled Folder Access off and it went away as expected. Just wasn't sure why it was happening in the first place but oh well. Thanks Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 30, 2020 ID:1410915 Share Posted September 30, 2020 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Please review the following for Tips to help protect from infection Thank you Link to post Share on other sites More sharing options...
Recommended Posts