none
Why Defender blocks shell .. .CopyHere RRS feed

  • Question

  • Hello community,

    for several weeks, running Defender (Virus & Threat Protection - Real-Time Protection ON) significantly blocks running .CopyHere. Depending on the file size that takes sometimes 20-30sec.


    System: Win10 Pro 64Bit, 1803

    How can this be remedied?

    greeting
    rawa

    Here is the example code (VBA):

    Sub TestZIP()
      Dim objShell As Object
      Dim sSFile As Variant
      Dim sDFile As Variant
      Dim dTime As Double

      sDFile = ThisWorkbook.Path & "\"
      sSFile = ThisWorkbook.Path & "\Test2.xlsx.zip\docProps"

      Set objShell = CreateObject("Shell.Application")

      dTime = Timer

      Call objShell.Namespace(sDFile).CopyHere(objShell.Namespace(sSFile).Items)
      Debug.Print Timer - dTime

      Call Kill(sDFile & "core.xml")
      Call Kill(sDFile & "app.xml")

    ' Times Defender activ
    ' 9,56640625
    ' 3,056640625
    ' 5,0546875
    ' 3,8984375
    ' 5,14453125
    ' 4,76953125

    ' Times Defender deactivate
    ' 0,3515625
    ' 0,376953125
    ' 0,35546875
    ' 0,3828125
    ' 0,38671875
    ' 0,416015625
    End Sub

    Friday, October 26, 2018 1:02 PM

All replies

  • Hi, 

    Did you perform any actions before the issue occur?

    Does .copyhere run run successfully when you turn off Windows Defender?

    What's your system build? Try to run "winver" to check the details.

    Please go to Settings\Update & Security\Windows Update to check and install the lastest update package. 

    Please also check the error code recorded in Event Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.

    Bests, 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, October 29, 2018 9:42 AM
    Moderator
  • Hi, 

    Did you perform any actions before the issue occur?    -- No

    When you turn off Windows Defender, does .copyhere run run successfully?   -- Yes, see times in first post

    What's your system build? Try to run "winver" to check the details.  -- Win10 Pro 64Bit, 1803 (Build  17134.285)

    Please go to Settings\Update & Security\Windows Update to check and install the lastest update package.   -- Defin: 1.279.922.0 - last update 1.Nov.2018

    Please also check the error code recorded in Event Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.   -- most events are "information", a few events "warning" with ID1002 "... scan was stopped before it completed."

    Bests, 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Hi Joy-Qiao,

    thanks for reply. Please see my answers next to your questions above.

    Bests,
    rawa



    • Edited by scrawa Thursday, November 1, 2018 8:43 AM
    Thursday, November 1, 2018 8:40 AM
  • Hi community,

    can someone confirm this behavior of Windows Defender I has describe in first post?

    Bests

    rawa

    Tuesday, November 6, 2018 6:54 AM
  • Hi rawa, 

    I found .copyhere command line have been end of client support since Windows 7. So it would be not compatibility well with the lastest Windows 10 system version. 

    For the official information, please check: System.Shell.Folder.copyHere method

    Bests, 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, November 14, 2018 8:20 AM
    Moderator