Downloaded Zip Folders - Once Extracted you can only see folders no documents

Question

Been seeing an issue lately were different clients get a zipped folder via a download, could be onedrive or dropbox using windows 10 pro. Once it is downloaded the folder will show it has data, and you can see files and folders while it is still zipped. Once the folder is extracted it shows 0 data and you can only see folders and no files at all. I did some more testing on the pc having the issue, and I logged in with an admin account and I was able to extract the files. So I'm thinking a bad profile right? Log back in as the user and it starts working again. The user that it started working on again just called again and is having the same issue. I just downloaded the folder to my windows 11 pro machine and I am getting the same results. If the zipped folder is copied to a Server 2019 share, and I login to the server with an admin account I am able to extract the folders and files just fine. Just tested this again today and the server has no issues seeing the extracted files. The PC and the Server are both using Sentinel One as AV, I confirmed with the SOC team it is not flagging the files or deleting them. My windows 11 pc is also using S1 and we are all using M365 for Office. This feels like a M365 update issue, or maybe even windows. Anyone else experiencing this issue?

Answer 1

Yesterday I enabled "Launch Folder Windows in Separate Process" for a user who was having the issue and it helped right away. Today however he reports that extracting zip files is not working again.  FYI. the registry key path for enabling this setting is found here: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] >> "SeparateProcess"=dword:00000001  Yesterday I received an update from SentinelOne on the issue:

*This issue is not extremely common with windows explorer and Zip files. This issue was brought to the attention of SentinelOne sometime back. We think it's an issue with the AMSI and SentinelOne causing crashes resembling OS issues. When this does occur a policy override is needed.
The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product that's present on a machine.
Please test disabling AMSI on the endpoint where you are experiencing the issue.

Disable the AMSI for that specific endpoint as specified below using sentinel ctl.

Open an administrative command prompt and go to:
C:\Program Files\SentinelOne\Sentinel Agent version\

run the following commands:
sentinelctl config amsiConfig.registerAsIoavProvider false -k "passphrase"

sentinelctl config amsiConfig.registerAsAmsiProvider false -k "passphrase"

The following policy override will resolve this issue:

{
"amsiConfig": {
"registerAsAmsiProvider": false,
"registerAsIoavProvider": false
}
}

This is a known issue that we are working to resolve. There is no ETA currently, however, we advise to use 7zip for the meantime while this gets worked on.*

I told them that I fully disabled SentinelOne for a workstation where this issue was seen and still had the issue. They replied:

If you disabled the agent and the issue persists, that means it's not S1 causing the issues with unzipping. To be 100% sure, I would temporarily completely uninstall S1 from that endpoint and test unzipping.

I have not yet uninstalled SentinelOne.

Answer 2

I am seeing the same issue on multiple computers which also have Sentinelone installed. Im not sure if S1 is the issue or not but im currently testing that. What I have found is that if I kill explorer.exe while the end user is experiencing the issue and then relaunch explorer.exe, zip files work for a little while. I too am thinking it's a windows update issue but i haven't found a fix yet. disk cleanup = didn't help sfc /scannow = didn't help "DISM /Online /Cleanup-Image /RestoreHealth" = didn't help when the issue is happening: zips downloaded from websites like sharepoint/onedrive/sharefile have issue locally created zips have same, regardless of the location of the zip file issue happens regardless of the browser being used to download a zip file no odd browser extensions are installed no new programs installed recently standout as possibly causing the issue Again, the issue is temporarily resolved by killing explorer.exe and relaunching it. For now, I created a 'relaunch-explorer.bat" file for one of the end users having this issue; he can use that to make zips work.

Answer 3

This has followed me through an update to Windows 11 too. I've thrown up my hands and now use a 2 line BAT file to restart Explorer when I don't feel like messing with 7zip to open a Zip file.

taskkill /im explorer.exe /f

start explorer.exe