Windows Security · The Windows Security App · Lesson 2 of 5

SmartScreen and Reputation Checks

How Windows judges a download, and what a publisher's signature tells you.

When Windows doesn't know an app

You have seen the blue "Windows protected your PC" box before. Now let's see how it decides.

That box comes from Microsoft Defender SmartScreen. SmartScreen is a reputation check. Reputation means what Microsoft already knows about a file, an app or a website. Has it been seen on millions of PCs with no trouble? Has it been reported as harmful? Or is it brand new and almost nobody has it?

Antivirus asks, "Is this file known to be bad?" SmartScreen asks a different question: "Is this file known to be good?" A brand new file with no history gets a warning, even if no virus has been found in it. That matters, because new malware often hasn't been spotted yet.

SmartScreen works in a few places:

• In Microsoft Edge, before a download finishes. Edge may say a file isn't commonly downloaded, or that it was blocked as unsafe.
• In Windows, when you open a program you downloaded. This is where "Windows protected your PC" appears, with a Don't run button.
• On websites in Edge, with a red page for known phishing or scam sites.

On the blue box, a small link called More info shows the app's name and its publisher, the company that made it. It also reveals a Run anyway button. That button is there for rare cases, like a small tool a friend wrote. Most people never need it.

If the publisher says Unknown publisher and you got the file from a pop-up, an ad or an odd website, choose Don't run. Then delete the file from Downloads.

On the practice computer, download the video converter, read both warnings and check the publisher. Choose Don't run and delete it. Then compare it with an installer from a known publisher.

Publishers and digital signatures

How does Windows know who made an app? Through a digital signature.

A digital signature is like a tamper-proof seal on a jar. The maker seals the file with a secret key that only they hold. Windows can check the seal. If it is intact, two things are true:

• The file really came from that publisher.
• Nobody changed the file after it was sealed.

To get a signature, a company must prove who it is to a trusted company that hands out certificates. A certificate is the digital ID card that goes with the seal.

You can see a signature yourself. Right-click a downloaded program, choose Properties, and look for a Digital Signatures tab. It shows the signer's name. If there is no tab, the file isn't signed. When an app asks to make changes, the User Account Control box from earlier also shows a Verified publisher, or says the publisher is unknown.

Now the important part. A signature tells you who made the file. It does not promise the file is safe. Criminals sometimes get certificates too, or steal them. So use the publisher's name as one clue among others:

• Does the name match the app? A video app signed by a random company name is a red flag.
• Did you get it from the maker's official website or the Microsoft Store?
• Did you go looking for it, or did a pop-up push it on you?

You can check these settings under App & browser control in Windows Security, then Reputation-based protection. Keep Check apps and files and SmartScreen for Microsoft Edge on. Potentially unwanted app blocking is also worth turning on. It stops junk apps that flood you with ads.