Exceptions in exploit protection

Question

I have a few exception settings in windows defender exploit protection these are: ExtExport.exe ie4uinit.exe ieinstall.exe ielowutil.exe ieUnatt.exe iexplore.exe mscorsvw.exe msfeedssync.exe mshta.exe ngen.exe ngentask.exe PresentationHost.exe PrintDialog.exe PrintIsolation.exe runtimebroker.exe splwow64.exe spoolsv.exe SystemSettings.exe almost all of them Override Mandatory ASLR. Is it normal? Thanks...

Answer 1

These are apparently written by the program installers. If you remove them from the exception list you may need to reinstall the program and observe which exceptions it reinstalls. If you don't want the exception or want it explained you'd need to contact the program's Support.

To make sure there's no infection To check most thoroughly for infection and any resulting System damage, Download, install and run a full scan with the most powerful on-demand free scanner Malwarebytes:

https://www.malwarebytes.com/mwb-download/ Make sure to only choose the Free version.

In the Malwarebytes Settings (gear icon) > Security tab set it to include scanning for Rootkits.

If necessary run it in Safe Mode with Networking (to have internet), or Safe Mode accessed by one of these methods: https://www.digitalcitizen.life/4-ways-boot-saf.... These require a password and not PIN to access.

Clean up anything found, restart PC and then run again until it comes up clean.

Then download, install and run a full scan with AdwCleaner:

http://www.bleepingcomputer.com/download/adwcle...

Remove whatever it finds.

Check for anything found but is still left over in Settings > Apps > Apps & Features, and C:\Program Files and C:\Program Files(86) to uninstall or delete them. I can guide you how to do this if there are problems.

Also in each of your browser's Extensions, Home Page settings, Search service or Add-On's as shown here: https://www.computerhope.com/issues/ch001411.htm

to disable anything you didn't add yourself and are sure you need. Ask back if in doubt.

Then check for damaged System files by running System File Checker and DISM from Step 10 in this checklist:

https://answers.microsoft.com/en-us/windows/for...

If completing all of Step 10 in above Checklist doesn't fix it then run a Repair Install which reinstalls WIndows while keeping your files, programs and most settings in place, by installing the Media Creation Tool from this link: https://www.microsoft.com/en-US/software-downlo..., open the tool and choose Upgrade This PC Now. This will solve most problems and also bring it up to the latest version which you need anyway and by the most stable method.

If you want to keep Malwarebytes as an on-demand scanner then you can turn off its Real Time trial version using the slider buttons on it's front panel. I recommend it as the #1 tool for your toolbox. For best WIndows performance, use built-in Defender which gives adequate real-time protection.

Feel free to ask back any questions. Report back results for more steps if necessary.

______________________________________________

Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.

Answer 2

Hi,

Did you authorize these exceptions or were they written in by a program installer?

No, it is brand new windows 11 no programs installed.

Is this an organization PC that's subject to Group Policy?

No. It is my personal computer and licence.

Mandatory ASLR already enabled also thanks for the other things. It helped a little bit. I dont mean firewall. There are exceptions (named program settings) for exploit protection under exploit protection settings and some system programs excepted for aslr in there.

Answer 3

Hi EdCh. I'm Greg, 10 years awarded Windows MVP, here to help you.

Did you authorize these exceptions or were they written in by a program installer?

Is this an organization PC that's subject to Group Policy? Those cases are not handled here at all. As your System Administrator or at our sister forums for IT Professionals, Q&A forums here: https://docs.microsoft.com/en-US/answers/index....

If you didn't specifically authorize these exceptions the I'd remove them and go back to mandatory ALSR as recommended here:

https://techcommunity.microsoft.com/t5/windows-...

Manage Defender Firewall exceptions here:

https://www.veritas.com/content/support/en_US/a...

Based on the answers you post back I may have other suggestions.

______________________________________________

Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.