I'm glad you posted this one. Thanks. Not a day has gone by since I enabled this protection, but what I've wondered about it. Malwarebytes popped up a box about blocking some re-directed things before. But WD is not very informative about what's happening.
That's what a 'test machine' is for (see My Computers, System Two).
This exhibited the same behaviour for Defender, the installer was not detected as having a PUA when in the User folder, but was detected anywhere else. Running the installer from my user folder resulted in Defender blocking a PUA, this time it was found under a different name 'Spigot' but apparently it's the same thing...
https://www.microsoft.com/security/p...4&enterprise=0We have seen this application use the following file names:
YTDSetup.exe
Interestingly, the installer was then allowed to run to completion. It installed the software successfully, apparently minus its PUA payload. Testing over, it's time to restore a system image, I think...
Apparently yes....
https://docs.microsoft.com/en-us/win...nder-antivirusHow it works
PUAs are blocked when a user attempts to download or install the detected file, and if the file meets one of the following conditions:
- The file is being scanned from the browser
- The file is in the %downloads% folder
- The file is in the %temp% folder
Hi Shawn
For some reason Powershell suggestion in this tut does not work on my computer, though your REG File does.
This in on Build 1703....see attachments.
Last edited by Brink; 07 Oct 2017 at 17:11. Reason: attached images
I just tested in build 16299.15, and it's still working for me.
I noticed you have Kaspersky installed, and wonder if that may be related if it disabled Windows Defender.
Can this restrict us from downloading files that are detected as PUA's but are actually non harmful files? I enabled PUA protection for WD a while back but have just encountered my first issue with Display Driver Uninstaller being detected as a PUA and not downloadable. Are there any means to proceed with certain downloads anyway?
Hello Kol12,
Not unless you temporarily disable PUA protection.
Was the source of the uninstaller official, or from some third party site that may have repackaged it with the PUA?
Hi Brink,
It is the official DDU download page: Display Driver Uninstaller (DDU) V17.0.7.5 Released. - Wagnardsoft Forum
I can't remember which method I used to enable PUA now but I will try to disable it to get this file and maybe mention something of it on Wagnard forums.
Quote
