What to do about something new the Porter found

Start with the verdict#

Each newcomer under New since you last looked has a verdict, and the reasons for it. Alerts come first.

OK#

It's validly signed, by the maker named, or it matches the checksum its maker published.

1. Check that the signer is who you expected: an installer for a program from Thing Co should be signed by Thing Co.
2. If you put it there, or installed it, Acknowledge it.

Check#

Nothing proves who made it. Most programs that aren't signed are harmless, especially small tools and scripts, but it's worth knowing what it is.

1. Read the facts: its name and folder, where it was downloaded from, and, for an entry, the program it runs.
2. Read its note, for what it probably is. Remember the note is a guess.
3. Ask yourself whether you put it there: a download you made, a program you installed, a startup entry for something you use.
4. If you did, Acknowledge it. If you didn't, or you're not sure, leave it listed and look into it: see If you don't know what it is.

Alert#

Something is wrong with it:

• Defender found something in it.
• Its signature is broken: the file was changed after it was signed.
• Its signature isn't valid, or isn't trusted.
• It doesn't match its maker's checksum: it isn't the file the maker published.

What to do:

1. Don't open or run it.
2. If it's a download, delete it yourself, and download it again from its maker's own site.
3. If it's a startup entry, a task, a service or an installed program you don't recognise, run a full scan with Windows Security, and remove the program from Settings > Apps.
4. Once it's dealt with, Acknowledge it.

If you don't know what it is#

• Search for its file name, and its signer. Its maker's own site is the best source.
• A startup entry: turn it off in Task Manager, under Startup apps, and see whether you miss it.
• An installed program: uninstall it from Settings > Apps.
• A port open to other machines: it's a program accepting connections from your network. If you don't know it, close it, and uninstall it.

When it comes back#

Something you acknowledged comes back if it changes: a startup entry that runs another program, a service that changes account, a download that's replaced. That change is worth a look of its own.