Windows 11 Virus Detected, cannot download file

[Kelvin Cheung]

In Windows 11 laptop, I cannot download files from Email and Whatsapp (both web version and Whatsapp app), even I have paused the antivirus protection, the files are still uphold and cannot be downloaded. Please help on this issue? Thank you

 

[ChatGPT]

Hi Kelvin — let’s troubleshoot this step‑by‑step. The symptoms you describe (downloads blocked even with AV paused) commonly point to Windows security features (Controlled Folder Access, SmartScreen / reputation blocking), a browser/extension issue, or a managed policy that prevents writes — not just the third‑party antivirus. I’ll list quick checks (safe) then deeper tests/fixes. Follow one step at a time and tell me what you see.
Quick questions before we start

1. Which browser(s) are you using (Edge, Chrome, Firefox)?
2. Which WhatsApp client — WhatsApp Web in a browser, or the WhatsApp Desktop app?
3. Is this a school/work‑managed laptop (Azure AD / Intune / domain) or a personally owned machine?
4. What exactly happens when you try to download (any error text, “blocked by admin”, file never appears, save dialog disappears)? A screenshot helps.

Immediate quick checks (5 minutes)

1. Try a different browser or Incognito/Private window. If downloads work in a different browser, it’s likely a browser extension/settings problem.
2. Open Windows Security → Virus & threat protection → Protection history and look for recent blocks — you’ll often see entries showing which app (browser/WhatsApp) was blocked and why. This often tells the root cause.

If the protection history shows downloads were blocked, proceed with the Controlled Folder Access / SmartScreen checks below.
Controlled Folder Access (CFA) — very common cause

• CFA (Ransomware protection) blocks apps that aren’t explicitly allowed from writing to protected folders (Downloads, Documents, Desktop). Pausing AV won’t change CFA if it’s managed by policy. Check and temporarily disable CFA:
  • Windows Security → Virus & threat protection → Ransomware protection → Controlled folder access → Turn OFF (or Add an allowed app: add your browser exe and WhatsApp exe). If CFA is managed by policy, you’ll see an admin message.
• If CFA fixes the download, re‑enable it and instead add the browser/WhatsApp as an Allowed app (Allow an app through Controlled folder access).

Check Windows Defender / SmartScreen and reputation protection

• SmartScreen can block downloads from webmail or messaging sites. Temporarily turn off:
  Windows Security → App & browser control → Reputation‑based protection → turn off “Block downloads” / “Check apps and files” temporarily. Test the download, then re‑enable.

If the device is managed (IT policies)

• A school/work policy can lock CFA or prevent changes. If you see “Some settings are managed by your administrator,” contact your IT or provide that message here — policies may be the reason you cannot allow apps. You can also check whether CFA is controlled by registry/GPO with:
  reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access" /s
  If keys exist, the setting is enforced by policy.

Diagnostic commands (run in Admin PowerShell) — paste output if you want me to interpret

• Check AV status:
  Get-MpComputerStatus | Select AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,IsTamperProtected
  Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select displayName,productState
  These tell us whether Defender or another AV is active / tamper protected (which can block changes).

Other useful checks

• Try to download a small known file (for test) from a well‑known site (or a sample file) to see if the browser even starts the download. If the save dialog appears but the file never completes, check disk free space and folder permissions (right‑click Downloads → Properties → Security).
• If downloads fail only for files marked from the Internet, Explorer/Preview behavior changed in recent updates: files with the Internet Zone mark can be treated more restrictively (won’t be previewed and sometimes need explicit Allow via context menu). That’s a separate protection but can explain “won’t open” behavior after a download.

If you’re comfortable trying targeted fixes now

1. Open Windows Security → Virus & threat protection → Ransomware protection → Controlled folder access → Off (test). If downloads work, add apps to the allowed list and re‑enable CFA.
2. If turning CFA off doesn’t help, temporarily disable SmartScreen (App & browser control) and test. Re‑enable afterwards.
3. If the laptop is managed and you cannot change these settings, send me the exact “managed by” message or a screenshot — I’ll tell you which GPO/Intune setting to have your admin change.

Safety notes

• Don’t leave CFA or SmartScreen permanently disabled — these protect against ransomware and malicious downloads. Only disable briefly for testing, then fix by whitelisting the safe app(s) or asking IT to change policies.

If none of the above works

• Tell me the exact error text or paste a Protection History entry from Windows Security. Also say which browser and whether it’s WhatsApp Web or Desktop. With that I’ll give the precise next steps (registry checks, adding allowed apps, or Group Policy guidance).

Want me to walk you through the steps live (commands & screenshots)? Say which of the above you’ve tried and I’ll give the exact menu clicks or PowerShell commands.

 

[Kelvin Cheung]

I have checked the items you mentioned, laptop is not managed by school, but still cannot download file, it works well previously, but since last week, user cannot download file anymore, can you provide any possible cause?

 

[ChatGPT]

Thanks — helpful detail. Since the laptop is personal (not managed) and downloads stopped suddenly last week, the most likely causes (in order) are:

• Controlled Folder Access (CFA) / Ransomware protection blocking the browser/WhatsApp from writing to Downloads.
• SmartScreen / reputation‑based protection blocking the download action or marking files as unsafe.
• A browser extension or browser setting (or a corrupted browser profile) preventing downloads.
• Leftover/hidden AV/EDR driver or tamper protection (even if you “paused” the AV the on‑disk driver or tamper protection can still block writes).
• Downloads folder permission / disk space issue or a Windows update that changed security behavior (files flagged with “Mark of the Web” may be treated more strictly).

Below are safe, ordered checks and exact commands you can run. Do them in order and report the first step that shows a change.

• Quick check — different browser & Incognito
• Open an Incognito / Private window (Edge/Chrome/Firefox) and try downloading a small known file (example: a small PDF from a trusted site).
• If it works in a different browser or private mode, disable extensions in your normal browser and retry. This isolates browser/profile issues.
• Check Windows Security → Protection history
• Open Settings → Windows Security → Virus & threat protection → Protection history.
• Look for recent blocks that name the browser or WhatsApp and show the reason (Controlled folder access, SmartScreen, blocked file). This often points straight to the cause.
• Test Controlled Folder Access (CFA)
• Temporarily test by turning CFA OFF (only to test):
• Windows Security → Virus & threat protection → Ransomware protection → Controlled folder access → Off.
• Try the download. If downloads now work, re‑enable CFA and add the browser and WhatsApp as allowed apps (Allow an app through Controlled folder access).
• If the CFA toggle is grayed/managed, run (Admin PowerShell) to see if a policy is present:
• reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access" /s
  If keys exist the setting is enforced by policy (rare on a personal PC, but possible if previously enrolled or left-over).
• Confirm AV / tamper status (run in Admin PowerShell)
• Run these two commands and paste results here if you want me to read them:
• Get-MpComputerStatus | Select AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,IsTamperProtected
• Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select displayName,productState
  These show whether Defender or another AV is active and whether tamper protection is blocking changes. If a third‑party AV remains registered it can still block writes even if “paused.”
• Test SmartScreen / App & browser control
• Temporarily disable the relevant checks:
• Windows Security → App & browser control → Reputation‑based protection → temporarily turn OFF “Check apps and files” and “Block downloads.”
• Try the download. If it works, re‑enable protections and add exceptions where possible. (Do not leave SmartScreen off permanently.
• Try a different download destination
• Change the browser download folder to a simple folder like C:\Temp (create it first) and try the download. If writing to C:\Temp works, the Downloads folder permissions are suspect — check: right‑click Downloads → Properties → Security and make sure your user account has Full Control.
• Safe‑mode with Networking / new local user (isolation)
• Boot to Safe Mode with Networking and try the download. If it works in Safe Mode, a third‑party service/driver is interfering.
• Alternatively, create a new local user (Settings → Accounts → Family & other users → Add account without Microsoft account), sign in there and test. If downloads work in a fresh profile, the problem is profile/config or extension related.
• Check for recent Windows updates or an update‑related change
• If this started last week, check Update history (Settings → Windows Update → Update history) for anything installed the same day the problem began. Some security fixes changed how files marked “from the Internet” are handled (preview pane / Mark of the Web), which can affect how files are treated after download (more restrictive blocking).
• If nothing so far helps — capture small diagnostics
  Run these (Admin PowerShell / CMD) and paste back the outputs:
• icacls "%userprofile%\Downloads"
• fsutil volume diskfree C:
• powershell: Get-Process -Name chrome,msedge,firefox | Select-Object Name,Path (to show which browser executable the browser is running from)
• Last resorts (only if you’re comfortable)
• Temporarily uninstall the third‑party AV (use vendor removal tool), reboot, and test. Many stubborn driver/EDR components require full uninstall + reboot. If uninstall helps, reinstall and configure exclusions.
• In‑place repair (Media Creation Tool / ISO run from within Windows) can resolve corruption if system components were damaged by an update — try this only after backups.

Safety notes

• Don’t leave CFA or SmartScreen disabled permanently; they protect against ransomware / malicious downloads. Only disable briefly for testing and then add safe exceptions or re‑enable protections.

What I need from you next

• Results of the quick tests: did a different browser or Incognito work?
• The Protection History entries (a screenshot or the exact text) if present.
• The outputs of the two PowerShell AV checks I gave earlier (or paste them here).

Send those and I’ll give the exact next command(s) or the one‑click fix based on the root cause.

 

[Popcorn8892]

In Windows 11 laptop, I cannot download files from Email and Whatsapp (both web version and Whatsapp app), even I have paused the antivirus protection, the files are still uphold and cannot be downloaded. Please help on this issue? Thank you

If you suspect you might still be infected, you may way to run 3rd-party scanners like ESET Online Scanner, Emsisoft Emergency Kit, etc. Otherwise, you may want to seek help with malware removal in specialized forums.