Windows 10: Why did Ransomware Protection Controlled Folder Access blocked wmplayer.exe?

Like the question and picture says, today I was watching a video I edited and when I closed the player, Ransomware Protection that I have turned on informed me that Controlled Folder Access blocked wmplayer.exe from accessing %userprofile%\Music. When I looked at the history, it also blocked in the past things like paint from accessing pictures or OBS from accessing videos etc, but it seems like it whitelisted those apps by itself. Why would it block wmplayer.exe from accessing Music of all places? I know the Ransomware Protection is messy and does lots of weird stuff but I just wanna make sur

:)

 

Ransomware Protection: How to use Controlled folder access?

Nowadays, ransomwares are considered great risks for users. They infect system and encrypt your files and ask you to pay money to gives you the key to decrypt them. Even if you made payment, there
is no guarantee to get back all your files and paying them would make cybercrime ecosystem stronger and they use this money to improve their resources to infect more people. In general, having a proper backup plan and creating regular backup and making sure
Windows Defender (or any other anti-malware product) is fully updated is the best way to protect yourself against ransomwares. You should also take caution on clicking on suspicious links or opening suspicious files.

In case you are using
Windows Defender as your default antimalware in Windows 10, you have feature called
Controlled folder access which provides great protection against ransomwares. You could access it by opening
Windows Security (just open Start or Search
and type for Windows Security) and then go to Virus & threat protection
and scroll down and you should see Manage ransomware protection and click on it and it should open menu where you see
Control folder access option like picture below.









When you turn it on, it will start protecting you against ransomwares and default setting is recommended one but you could change it as like. Let’s take a look at options in this
Controlled folder access:

Block history:
When Windows Defender block access to any changes to files, it will show you notification and you could see list of blocked actions here. In case, if you want to investigate incorrect blocking or check how well it protects you, this is great place
to check it out.

Protected folders:
by default, it will protect windows system folders, however if you want it to protect additional folders or you have any important folder which you want it to be protected, you may add it in this menu. Note that it only protects folders which are listed
here.

Allow an app through Controlled folder access:
There is mechanism to automatically allow trusted application to make legitimate changes to folders but sometimes due to behavior of certain application or if application is not trusted,
Control folder access might block its change. In this case, you could add application to allowed app. Please make sure you only add applications which you trust and you are sure they are not malicious.

Important Notes:

Controlled folder access is
not replacement for antimalware or any protection product and it is only additional protection layer against ransomwares.

If your system is already infected with ransomwares,
Controlled folder access could not
protect and recover your files. It is protection step before your system get infected and it will start protecting your system when you enabled it.

In case you are using Windows 10 and you won’t see this option, you are using older build of Windows 10 and you will have to upgrade to the latest build and make sure
Windows Defender is your default antimalware product.

 

Windows Security - Controlled Folder Access - Recently Blocked App List

Hello,

I thank you for your response. I know how to add and remove apps to and from the controlled folder access. My question is how to remove an app from the "Recently Blocked Apps" list. In Windows 1809 they made it easier to add apps to the controlled folder
access without having to navigate to the exe. They added a Recently Blocked Apps list you can select from. The steps for Windows 1809 are:

1. Open the Windows Security and click/tap on the Virus & threat protection icon.

2. Click/tap on the Manage ransomware protection link under the Ransomware protection section.

3. Click/tap on the Allow an app through Controlled folder access link.

4. Click/tap on Yes when prompted by UAC to approve.

5. Click/tap on Add an Allowed App (+) sign

6. Click or tap Recently Blocked Apps from the drop down menu. (NEW)

7. Click or tap on the (+) button for the app you want to add from the list. (NEW)

It is this Recently Blocked Folders List I am trying to edit to remove apps I have not authorized and that have been deleted from my PC and are still in this list. I know you can select an allowed app from the controlled folder access list and you will
see a REMOVE button, which in 1809 will put the app back in the Recently Blocked Apps list if it was there originally. But that same process does not work on the Blocked Apps list.

My question still remains:

How do you delete an app from the "Recently Blocked Apps" list in Windows Security for Windows 1809?

 

Allow rundll32.exe in Windows 10 ransomware protection settings?

When trying to import photos from my phone, Windows' ransomware protection (controlled folder access) blocked rundll32.exe from writing to my Pictures photo.

Would it be OK to put rundll32.exe on the list of allowed apps, or is there (can there be) malware/ransomware that uses rundll32.exe to do its thing?

I don't know enough about what rundll32.exe can or can't do in order to sensibly judge the risks I'm taking by allowing it to write to the Users folders...