Windows 11 Virus Detected, cannot download file

Hi Kelvin — let’s troubleshoot this step‑by‑step. The symptoms you describe (downloads blocked even with AV paused) commonly point to Windows security features (Controlled Folder Access, SmartScreen / reputation blocking), a browser/extension issue, or a managed policy that prevents writes — not just the third‑party antivirus. I’ll list quick checks (safe) then deeper tests/fixes. Follow one step at a time and tell me what you see.
Quick questions before we start

1. Which browser(s) are you using (Edge, Chrome, Firefox)?
2. Which WhatsApp client — WhatsApp Web in a browser, or the WhatsApp Desktop app?
3. Is this a school/work‑managed laptop (Azure AD / Intune / domain) or a personally owned machine?
4. What exactly happens when you try to download (any error text, “blocked by admin”, file never appears, save dialog disappears)? A screenshot helps.

Immediate quick checks (5 minutes)

1. Try a different browser or Incognito/Private window. If downloads work in a different browser, it’s likely a browser extension/settings problem.
2. Open Windows Security → Virus & threat protection → Protection history and look for recent blocks — you’ll often see entries showing which app (browser/WhatsApp) was blocked and why. This often tells the root cause.

If the protection history shows downloads were blocked, proceed with the Controlled Folder Access / SmartScreen checks below.
Controlled Folder Access (CFA) — very common cause

• CFA (Ransomware protection) blocks apps that aren’t explicitly allowed from writing to protected folders (Downloads, Documents, Desktop). Pausing AV won’t change CFA if it’s managed by policy. Check and temporarily disable CFA:
  • Windows Security → Virus & threat protection → Ransomware protection → Controlled folder access → Turn OFF (or Add an allowed app: add your browser exe and WhatsApp exe). If CFA is managed by policy, you’ll see an admin message.
• If CFA fixes the download, re‑enable it and instead add the browser/WhatsApp as an Allowed app (Allow an app through Controlled folder access).

Check Windows Defender / SmartScreen and reputation protection

• SmartScreen can block downloads from webmail or messaging sites. Temporarily turn off:
  Windows Security → App & browser control → Reputation‑based protection → turn off “Block downloads” / “Check apps and files” temporarily. Test the download, then re‑enable.

If the device is managed (IT policies)

• A school/work policy can lock CFA or prevent changes. If you see “Some settings are managed by your administrator,” contact your IT or provide that message here — policies may be the reason you cannot allow apps. You can also check whether CFA is controlled by registry/GPO with:
  reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access" /s
  If keys exist, the setting is enforced by policy.

Diagnostic commands (run in Admin PowerShell) — paste output if you want me to interpret

• Check AV status:
  Get-MpComputerStatus | Select AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,IsTamperProtected
  Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select displayName,productState
  These tell us whether Defender or another AV is active / tamper protected (which can block changes).

Other useful checks

• Try to download a small known file (for test) from a well‑known site (or a sample file) to see if the browser even starts the download. If the save dialog appears but the file never completes, check disk free space and folder permissions (right‑click Downloads → Properties → Security).
• If downloads fail only for files marked from the Internet, Explorer/Preview behavior changed in recent updates: files with the Internet Zone mark can be treated more restrictively (won’t be previewed and sometimes need explicit Allow via context menu). That’s a separate protection but can explain “won’t open” behavior after a download.

If you’re comfortable trying targeted fixes now

1. Open Windows Security → Virus & threat protection → Ransomware protection → Controlled folder access → Off (test). If downloads work, add apps to the allowed list and re‑enable CFA.
2. If turning CFA off doesn’t help, temporarily disable SmartScreen (App & browser control) and test. Re‑enable afterwards.
3. If the laptop is managed and you cannot change these settings, send me the exact “managed by” message or a screenshot — I’ll tell you which GPO/Intune setting to have your admin change.

Safety notes

• Don’t leave CFA or SmartScreen permanently disabled — these protect against ransomware and malicious downloads. Only disable briefly for testing, then fix by whitelisting the safe app(s) or asking IT to change policies.

If none of the above works

• Tell me the exact error text or paste a Protection History entry from Windows Security. Also say which browser and whether it’s WhatsApp Web or Desktop. With that I’ll give the precise next steps (registry checks, adding allowed apps, or Group Policy guidance).

Want me to walk you through the steps live (commands & screenshots)? Say which of the above you’ve tried and I’ll give the exact menu clicks or PowerShell commands.

I have checked the items you mentioned, laptop is not managed by school, but still cannot download file, it works well previously, but since last week, user cannot download file anymore, can you provide any possible cause?

Kelvin Cheung said:

In Windows 11 laptop, I cannot download files from Email and Whatsapp (both web version and Whatsapp app), even I have paused the antivirus protection, the files are still uphold and cannot be downloaded. Please help on this issue? Thank you

Click to expand...

If you suspect you might still be infected, you may way to run 3rd-party scanners like ESET Online Scanner, Emsisoft Emergency Kit, etc. Otherwise, you may want to seek help with malware removal in specialized forums.