Windows 10: Anti-ransomware protection in Fall Creators Update

It would be the app that was saving the file that was blocked, most likely - not explorer. The text in the notification is abbreviated to fit, so the full path and name of the .exe isn't always readable - it may have just looked like it said 'explorer'. You get the full text in the Event Log though, see my earlier post #24 for where to look.

 

You would be nuts to whitelist explorer.exe in any case.

You may as well whitelist everything as it can replace other objects with different ones of the same name.

That is why it (and XCOPY and robocopy) are blocked by default.

 

When you want anti-ransomware protection, deny access to Users and SYSTEM to any backup folder. Tested on wannacry.
Users, obviously and SYSTEM, because ransomware usually gains system rights, not admin, so it is very easy to avoid.
Windows method works by denying access to every software except allowed, it is better to just deny access to all.

 

Probably you should deny Trusted Installer as well. Any Administrator process can do what it wants though so if you run as part of Administrator group there is no point restricting anything really.

 

Trusted Installer and Administrators, are very unlikely to be used by ransomware. Ransomware uses SeTcbPrivilege, which gives it SYSTEM rights, that is more elevated than admins, so when blocked, admins can have access, but SYSTEM not.

 

Oh come on you (or any malware) can use this Launch processes with TrustedInstaller privilege

If you don't run under a standard account you only have yourself to blame.

 

Hackers might, but malware is generally dumb.
Petya, Wannacry, Badrabbit, all use SeTcbPrivilege.