UNSOLVED

Carl3397

updated

3 years ago

C

Carl3397

1 Rookie

6 Posts

1

28059

April 13th, 2018 15:00

Controlled Folder Access blocking OSprofileCollector

First time posting...hope I'm in the right board.

A few days ago, I started getting notifications on my laptop “Unauthorized Changes Blocked”.  This was caused by a Windows Defender virus protection function called “Controlled Folder Access”.  Controlled Folder Access was blocking OSprofileCollector.exe.  There is a way to “allow an app through” for trusted apps however, I can’t seem to find any information on OSProfileCollector in the Dell Community or internet to determine if this is malware, spyware or a legitimate program. 

 Here are details found on Event Viewer:

C:\Program Files\Dell\SARemediation\agent\OSProfileCollector.exe has been blocked from modifying %userprofile%\Music by Controlled Folder Access.

               Detection time: 2018-04-13T21:44:36.937Z

              User: LAP-DELL\carl3397

              Path: %userprofile%\Music

              Process Name: C:\Program Files\Dell\SARemediation\agent\OSProfileCollector.exe

              Signature Version: 1.265.543.0

              Engine Version: 1.1.14700.5

              Product Version: 4.14.17613.18039

 

OSprofileCollector was not listed in Programs And Features either.  If this is a legitimate program, I can add it to list of trusted apps (allow through) and be rid of these annoying notifications.  Any help is appreciated!

 Dell Inspiron 13- 7378

Windows 10 version 1709

OS Build 16299.371

  • joe53

    5 Journeyman

    5772 Posts

    17269 Points

    21661

    0

    Posted April 13th, 2018 21:00

    Hi Carl3397, and welcome to the forum

    There is a legitimate program on my Windows 10 called OSProfileCollector.exe with the same file path you quote. I believe it is part of Dell Update. It is not listed in my Apps and Features either (but Dell Update is).

    Windows Defender's "Controlled Folder Access" feature is meant to prevent files and folders being changed during a ransomware attack. Of course Dell Update when running will make changes to files and folders. It is likely that one of these changes was interpreted as a (false positive) attack by Windows Defender.

    If your computer is otherwise behaving well, I think you can allow this app through.

     

  • joe53

    5 Journeyman

    5772 Posts

    17269 Points

    21440

    0

    Posted May 24th, 2018 18:00

    Hi again.

    I don't use Windows Defender (WD) for Win 10 as my antimalware/AV. It is disabled (but not uninstalled) automatically by my use of Malwarebytes 3 over the past 2 years. When I went into the WD settings, I found that Control Folder Access was indeed turned off, as you would expect for this module of a disabled WD. Which would explain why I did not see what you did. I am surprised that more folks did not report this glitch, given the widespread use of Dell Update. It is possible this was a false positive that was detected and corrected quickly.

    As an aside, if this was a case of a false positive detection by WD, it does not change my positive opinion of WD in general. All AVs and antimalwares suffer from the occasional false positive detection, sometimes (rarely) with catastrophic results. I continue to recommend WD as an acceptable alternative to paid protection.

  • joe53

    5 Journeyman

    5772 Posts

    17269 Points

    21405

    0

    Posted May 26th, 2018 17:00

    It is absolutely ok to use WD with Malwarebytes free. I did it for years.

    As a general rule, one should avoid running 2 AVs or anti-malware programs in real-time (constantly running in the background) to avoid conflicts that actually can degrade protection. However Malwarebytes Free is an on-demand scanner that provides no real-time protection.

  • joe53

    5 Journeyman

    5772 Posts

    17269 Points

    18066

    0

    Posted January 5th, 2019 01:00

    Hi WYn Yu I agree that this Dell Update feature is unnecessary and is probably harvesting info for uncertain purposes. No doubt buried in some EULA I agreed to I gave Dell permission to gather this (hopefully and most likely anonymous) info. I see no nefarious activity here. I have found some legitimate uses for Dell Update to solve problems on an "on demand" basis, using a manual scan, and would suggest users not uninstall it. That said, I certainly do not wish it running in the background, downloading software updates automatically that I have not vetted.

    For those who wish to disable (but not uninstall) automatic Dell Updates for Win 10, the best way to go is to go into services.msc and change the status of "Dell Update" from "Automatic" to "Disabled".

    1) Press the Windows + R key to open the Run window

    2) Type "services.msc" (without the quotation marks) in the Open: box. Click the [OK] key.

    3) In the Services Window, scroll down to Dell Update Service, and click on it. In the far left column click on "Stop the service".

    4) Double click on the Dell Update Service line again, and a Dell Update Service Properties window will open.

    5) In the middle of that window, click on the dropdown arrow for the Startup type box, and change "automatic" to either "manual" or "disabled". Click [OK] and close.

    This should solve the irritation of recurrent notifications and nags from WD, skimming of info back to Dell, and the silent installation of potentially unwanted updates.

  • joe53

    5 Journeyman

    5772 Posts

    17269 Points

    1459

    0

    Posted January 8th, 2022 04:00

    Thanks Robn for the feedback on an old issue.

    Glad to see old advice is still of use.

    Joe

  • Carl3397

    1 Rookie

    6 Posts

    21449

    0

    Posted May 24th, 2018 12:00

    Thanks for taking the time to reply to my post.

    I'm curious if you have Control Folder Access enabled on your Dell?  Did you also encounter osprofilecollector.exe being blocked and had to allow the app through?

    I'm wondering why I didn't see other people post about this problem?

  • Carl3397

    1 Rookie

    6 Posts

    21415

    0

    Posted May 25th, 2018 12:00

  • Carl3397

    1 Rookie

    6 Posts

    21417

    0

    Posted May 25th, 2018 12:00

    Joe53,

    Regarding false positives, I get multiple occurrences of osprofilecollector being blocked on a daily basis.

    Also, I have both WD and Malwarebytes Free 3.5.1 running on my PC.  Is that not recommended?
     
    Thanks again for the reply.
  • WYn Yu

    1 Message

    19705

    1

    Posted January 4th, 2019 02:00

    The question for me is -- why is Dell even reading and even modifying the data in those Controlled Folders? These folders contain personal information -- user documents, photos and such, which would be irrelevant to an "update" function/program/feature. It seems to me that Dell is intruding on their customers' privacy. I had assumed that hardware manufacturers would respect user privacy. Best to find a way to disable this "update" function. And while this and my 2 previous laptops were Dells, I will look at other brands for my next purchase.
  • Bico70

    1 Rookie

    7 Posts

    11924

    0

    Posted March 26th, 2019 10:00

    Hi Carl, during this last week i'm having the same problem with my Dell XPS 7760. It's very annoying, did you solve the problelm and how? Thank's