Windows 10: Enable or Disable Windows Defender PUA Protection in Windows 10

As an "update" here, I just enabled PUA protection through Powershell with no error messages during the process. However after the restart Defender was Red "X" tagged & telling me my system was at risk. No explanation. Defender was very slow and sluggish to open. A scan did not clear the issue. After disabling the PUA Protection & a restart, everything is back to normal.

 

Another Update: Following Creator's Update and resolution of a minor conflict between WD and Malwarebytes, I've enabled the PUA Protection option again and so far, no issues.

Thanks to any and all for ...

 

I can confirm that PUA can be enabled on Home. Testing that it's working can be problematic though. Testing virus detection is easy with the EICAR test file. https://www.microsoft.com/security/p...ICAR_Test_File

There's no equivalent 'test file' for PUAs that I can find, so to test detection you need something that has a real PUA in it. Turns out that I had one, an installer that I'd downloaded (but never run) back when this PC was running Win7/MSE. This was successfully detected by Defender as https://www.microsoft.com/security/p...DVideoDownload

However, I noticed a strange 'feature' of Defender's PUA detection. It seems to be turned off for files in my User folder and its subfolders. While the EICAR test shows that viruses are detected there, this PUA had been sitting for years undetected. Copying this installer to anywhere other than my User folder (such as C:\Temp\) results in the PUA being automatically detected.

Temporarily turning off Defender's real-time protection allowed me to copy the file without detection. Then testing the context menu 'Scan with Windows Defender...' showed the same behaviour. The PUA was detected when the file was in any folder except my User folder. I presume it would be detected regardless of folder as soon as I ran the installer, but I haven't been brave enough to test that yet. *Smile

Is this behaviour by design, do you think? Or could it be a setting inherited from Microsoft Security Essentials that's no longer shown in Defender's settings?

 

I'm glad you posted this one. Thanks. Not a day has gone by since I enabled this protection, but what I've wondered about it. Malwarebytes popped up a box about blocking some re-directed things before. But WD is not very informative about what's happening.

 

That's what a 'test machine' is for (see My Computers, System Two).

This exhibited the same behaviour for Defender, the installer was not detected as having a PUA when in the User folder, but was detected anywhere else. Running the installer from my user folder resulted in Defender blocking a PUA, this time it was found under a different name 'Spigot' but apparently it's the same thing...

https://www.microsoft.com/security/p...4&enterprise=0

Interestingly, the installer was then allowed to run to completion. It installed the software successfully, apparently minus its PUA payload. Testing over, it's time to restore a system image, I think...

 

Apparently yes....

https://docs.microsoft.com/en-us/win...nder-antivirus

 

Hi Shawn
For some reason Powershell suggestion in this tut does not work on my computer, though your REG File does.
This in on Build 1703....see attachments.

 

I just tested in build 16299.15, and it's still working for me.

I noticed you have Kaspersky installed, and wonder if that may be related if it disabled Windows Defender.

 

I clean forgot I was trying out Kaspersky free only on the one computer out of four computers in the house.
Still it appears odd that the REG file worked but not Powershell as Defender is turned off.
Thank you for the explanation....would PUAP still work?

 

I'm not sure it will with WD turned off.

 

Can this restrict us from downloading files that are detected as PUA's but are actually non harmful files? I enabled PUA protection for WD a while back but have just encountered my first issue with Display Driver Uninstaller being detected as a PUA and not downloadable. Are there any means to proceed with certain downloads anyway?

 

Hello Kol12,

Not unless you temporarily disable PUA protection.

Was the source of the uninstaller official, or from some third party site that may have repackaged it with the PUA?

 

Hi Brink,

It is the official DDU download page: Display Driver Uninstaller (DDU) V17.0.7.5 Released. - Wagnardsoft Forum

I can't remember which method I used to enable PUA now but I will try to disable it to get this file and maybe mention something of it on Wagnard forums.

 

Just as a test, are you able to download it below from here in a ZIP file?

 

Got the same detection from WD with that also...