Advice Request SmartScreen malfunction

Microsoft Defender
23 Replies 2,333 Views
Share practical recommendations that address the author's needs.
Parkinsond

Parkinsond

Level 67
Verified
Top Poster
Well-known
SS fails to scan downloaded files by Edge, without any firewall restrictions!
Capture.PNG
Capture2.PNG
Capture3.PNG
 
Parkinsond said:
SS fails to scan downloaded files by Edge, without any firewall restrictions!
View attachment 291517View attachment 291518View attachment 291519
Click to expand...
Hello Parkinsond,

Thanks for posting on malwaretips.com with those detailed screenshots – that helps a lot in understanding your setup. It looks like you're running into an issue where Microsoft Defender SmartScreen is failing to scan a downloaded file ("MAS_AIO.cmd") via Edge, and it's giving you that warning about not being able to check it. This typically happens when SmartScreen can't connect to Microsoft's cloud services to verify the file's reputation, often due to network, firewall, or connectivity issues.

From your screenshots, your Windows Defender Firewall is enabled across all profiles (Domain, Private, Public), with default settings allowing outbound connections that don't match a rule. However, there are a couple of disabled outbound rules for apps like OnlyOffice and PotPlayer, which might not directly affect this, but it's worth double-checking if there are any other rules or third-party software interfering.

Quick note on the file: "MAS_AIO.cmd" appears to be related to the Microsoft Activation Script (a tool often used for activating Windows or Office). While it's not inherently malware, tools like this can sometimes be flagged by security software as hacktools or potentially unwanted programs (PUPs). Proceed with caution – if you're unsure about its source, it's best to avoid running it.

Troubleshooting Steps:
  • Check your internet connection: Ensure you have a stable connection. Try downloading the file again or visiting a site like Microsoft – AI, Cloud, Productivity, Computing, Gaming & Apps to confirm connectivity to Microsoft services.
  • Temporarily disable the firewall: As a test, turn off Windows Defender Firewall temporarily (via Control Panel > System and Security > Windows Defender Firewall > Turn Windows Defender Firewall on or off). Then, try downloading and scanning the file again. If it works, you may need to add an exception for Edge or SmartScreen processes (like "msedge.exe" or "smartscreen.exe").
  • Run the Network Troubleshooter: Go to Settings > Update & Security > Troubleshoot > Additional troubleshooters > Internet Connections or Network Adapter, and run them.
  • Check Edge settings: In Edge, go to Settings > Privacy, search, and services > Security, and ensure SmartScreen is enabled. Also, clear your browser cache or try in InPrivate mode.
  • Scan the file manually: Since SmartScreen failed, upload the file to VirusTotal (VirusTotal) for a multi-engine scan to check for any threats. You can also right-click the file in File Explorer and select "Scan with Microsoft Defender" for a local scan.
  • Proxy/VPN check: If you're using a VPN, proxy, or any network filtering software, disable it temporarily to see if that's blocking the connection.

If none of these resolve it, could you provide more details? For example:
- What version of Windows are you on?
- Is this happening with all downloads or just this file?
- Any third-party antivirus/firewall software installed (e.g., from another vendor)?

Let us know how it goes – we're here to help!

Best regards,
Your MalwareTips Assistant
 
Parkinsond said:
SS fails to scan downloaded files by Edge, without any firewall restrictions!
View attachment 291517
Click to expand...

I had a similar issue some time ago. It was related to NextDNS.
It is probably Edge's bug.
I disabled and then enabled the settings again, and the issue disappeared.
 
Andy Ful said:
I managed to solve the issue and still use NextDNS.
Click to expand...
Tried to disable SS in both Edge and WS; no luck.
Tried PC restart; no luck.
I even noticed SAC did not stop MAS cmd from launching into full language; disabled and applied WDAC, WDAC applied constricted language mode.
 
Parkinsond said:
Tried to disable SS in both Edge and WS; no luck.
Tried PC restart; no luck.
I even noticed SAC did not stop MAS cmd from launching into full language; disabled and applied WDAC, WDAC applied constricted language mode.
Click to expand...

If you see this alert in Edge, your Edge downloads files without MotW. So, SAC will not block scripts.
Does the non-Edge web browser download files with MotW?
 
Parkinsond said:
Edge is downloading files with motw; when I check properties, I see "unblock" option.
Click to expand...

If so, that is OK. SAC will block scripts downloaded by Edge.
You can test it by downloading any EXE by Edge and creating a shortcut to this file. The shortcut should be blocked by SAC.
 
Tested as follows:
  1. File downloaded by Edge from the URL:
  2. Explorer opened on the Downloads folder, checked that the file MAS_AIO.cmd has MotW.
  3. Tried to run the MAS_AIO.cmd, and it was blocked by SAC.
  4. Checked if the file still has MotW. Yes, it has.
The above has also been done for the copy of MAS_AIO.cmd with the same result.

Could you delete MAS_AIO.cmd from your Downloads folder and repeat my test?
 
Andy Ful said:
Tested as follows:
  1. File downloaded by Edge from the URL:
  2. Explorer opened on the Downloads folder, checked that the file MAS_AIO.cmd has MotW.
  3. Tried to run the MAS_AIO.cmd, and it was blocked by SAC.
  4. Checked if the file still has MotW. Yes, it has.
The above has also been done for the copy of MAS_AIO.cmd with the same result.
Could you delete MAS_AIO.cmd from your Downloads folder and repeat my test?
Click to expand...
I suspect SAC has faced malfunction with SS; a while ago, I had the same results (the cmd file being blocked by SAC).
Meanwhile, SAC still blocking any shortcuts created for mp4 files with motw!
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top