“Windows Protected Your PC” on an Official Installer: Is It Safe?

Short answer: "Windows protected your PC" is a Microsoft Defender SmartScreen warning, and it can appear on a genuine installer. SmartScreen judges a file by reputation: how well known the file's hash is and whether it is signed by a publisher with a good record. Microsoft says unsigned files start with zero reputation on every new version, and even a signed new file can be flagged until it builds history. Several official installers are unsigned. In our own check of 25 programs, Kodi, digiKam, OpenSCAD, Scribus and the K-Lite Codec Pack had no signature, and so did the official 7-Zip 26.05 x64 installer. The warning alone does not tell you the file is fake. Check three things before you choose "Run anyway": the publisher name in the signature, the file's SHA-256 against the publisher's own value, and the domain you downloaded it from.

Official-source review — 8 November 2026 UTC: We checked Microsoft Learn's SmartScreen overview, its SmartScreen reputation and code signing pages for app developers, the Microsoft Support pages on Smart App Control and on App & browser control, the Microsoft Learn reference for Get-AuthenticodeSignature and Get-FileHash, and the Malwarebytes report on fake 7-Zip downloads. The signature and hash results below come from our own earlier file checks: 25 official installers on 17 and 18 October 2026, and the 7-Zip 26.05 x64 installer on 23 October 2026. We did not run any installer, and we did not record which files triggered a SmartScreen prompt on our PC. We did not test Smart App Control.

Why does "Windows protected your PC" appear on an official installer?

Because SmartScreen is not a virus scan. It is a reputation check. Microsoft's SmartScreen overview says it checks downloaded files against a list of known unsafe programs, and also against a list of files that are well known and downloaded often. If a file is not on that second list, SmartScreen shows a warning that advises caution. The same page says that if a URL, file, app or certificate has an established reputation, you see no warning. If there is no reputation, the item is treated as higher risk.

Microsoft's page on SmartScreen reputation for app developers names the two signals:

• Publisher reputation: is the file signed, and is the certificate from a known, trusted publisher?
• File hash reputation: has this exact file been downloaded by users without signs of malicious behaviour?

That page explains three common reasons a real installer gets flagged:

• The file is unsigned. Microsoft says an unsigned file shows "Windows protected your PC", and you must choose "Run anyway" before it can run. Reputation for unsigned files builds for each new version, starting from zero.
• The release is new. Even when signed, a newly created file can show a warning until its hash or certificate gathers enough positive history. Microsoft gives no exact threshold and says it can take several weeks.
• The certificate is new. A valid certificate still shows the app as unrecognized until reputation builds. Microsoft also says EV certificates no longer bypass SmartScreen, so a pricier certificate does not remove the warning.

So an unsigned or brand-new release can trigger the warning with a perfectly genuine file.

Which official installers are unsigned?

In our study of 25 official Windows installers, we downloaded each file from the publisher's own site or download server and read its signature with Get-AuthenticodeSignature. Five had no signature. All five matched the hash their publisher lists. We later found the same for 7-Zip.

For these programs, an unsigned file is normal, and the hash is the check that matters. Windows shows "Unknown publisher" for them because there is no signature to read a name from. One limit: this table describes the builds we checked. A publisher can start or stop signing in a later release.

Does a signed installer mean it is safe?

No. A signature tells you who signed the file. It does not tell you that the signer is the real publisher of the program. The 7-Zip case shows why. On 9 February 2026, Malwarebytes reported that a trojanized installer from 7zip.com, a site not run by the 7-Zip developer, was Authenticode-signed with a now-revoked certificate issued to Jozeal Network Technology Co., Limited. It installed a working 7-Zip File Manager, so nothing looked wrong.

The genuine 7-Zip 26.05 x64 installer we checked was unsigned. So in this case the fake was signed and the real file was not. A signed file with the wrong company name is a stronger red flag than an unsigned file with the right hash. Always read the name, not just the word "valid".

How do I check the publisher name in the signature?

Microsoft's developer guidance says that for signed apps, the SmartScreen prompt displays the publisher name, and users should proceed only after verifying the source. You can also read the signature yourself before you open the file. In PowerShell, run:

Get-AuthenticodeSignature .\installer.exe | Format-List Status, SignerCertificate

Microsoft Learn says Get-AuthenticodeSignature gets the Authenticode signature information for a file, and that for an unsigned file the information is returned with blank fields. When we checked the official 7-Zip 26.05 installer, the status came back as NotSigned.

What to look for:

• Status Valid, and the name matches the publisher. In our study, for example, Krita and Kdenlive were signed by K Desktop Environment e.V., and Firefox by Mozilla Corporation.
• NotSigned, for a program you know ships unsigned. Move on to the hash check.
• Signed by an unrelated company. Do not run it.

Our step-by-step guide on how to check a Windows installer's digital signature also covers the Properties and Digital Signatures tab, if you prefer not to use PowerShell.

How do I compare the SHA-256 with the publisher's hash?

A hash is a fingerprint of the file's contents. Microsoft Learn's page on Get-FileHash says changing even one character in a file changes its hash, and that if two files have identical hashes, their contents are identical. The default algorithm is SHA-256. Run:

Get-FileHash .\installer.exe -Algorithm SHA256

Then compare the result with the value on the publisher's own site, character by character. If you would rather not use PowerShell, our SHA-256 checker hashes the file in your browser. Each program page linked in the table above lists the SHA-256 we measured.

One caution for Scribus. Its only published checksum in our study was MD5. Get-FileHash supports MD5 with -Algorithm MD5, but Microsoft says MD5 and SHA1 are no longer considered secure and should be used only for simple change validation. A matching MD5 still catches a damaged or swapped download from an ordinary fake site. It is weaker proof than SHA-256.

How do I know the download domain is official?

A hash only helps if it comes from the real publisher. If a fake site gives you both the file and the "official" hash, they will match. So start from the program's own home page and follow its download link from there.

Lookalike names are common. 7-zip.org is the real 7-Zip site, and its download buttons point to the ip7z GitHub account. 7zip.com, without the hyphen, is not run by the developer. Our download site checker tells you whether a domain matches the known official source for a program, and our guide to fake download sites explains the patterns to watch for.

Checklist before you click "Run anyway"

1. Stop if you are at work. If the PC is managed by an employer, ask IT. Microsoft says enterprise policy may block the bypass on purpose.
2. Find where the file came from. It should be the publisher's site, or a download server or GitHub page that the publisher's site links to.
3. Read the signature. Run Get-AuthenticodeSignature or open the Digital Signatures tab.
4. If it is signed, check the name. It must be the company or project behind the program. Any other name is a reason to stop.
5. If it is unsigned, check whether that is normal for this program. The table above shows what we found.
6. Hash the file. Run Get-FileHash or use our SHA-256 checker.
7. Compare it with the publisher's value. Take the value from the official site, not from the page you downloaded from if that page is not official.
8. Proceed only if everything matches. If the hash is different, delete the file and download it again from the official source.

If you are unsure at any step, do not run the file. Microsoft's SmartScreen overview also says you can submit a file to Microsoft for review if you believe a warning was shown in error.

What if Smart App Control blocks the installer?

Smart App Control is a different Windows 11 feature, and it is stricter. Microsoft's developer page says it may supersede SmartScreen's app reputation check, and that it blocks unsigned files unless the file has a positive reputation. The Smart App Control FAQ says there is currently no way to allow an individual app past it.

So on a PC with Smart App Control on, an unsigned official installer may simply not run, and Microsoft gives no per-app exception for it. The App & browser control page says Smart App Control is available only on new Windows 11 installs, and that if it is turned off, you cannot return to evaluation mode without resetting or reinstalling Windows. Weigh that carefully. We do not recommend turning off Windows protections to install one program.

What this page does not do

We do not tell you to turn off SmartScreen or Smart App Control. We do not say any file is free of malware. A matching hash proves the file is the publisher's release, not that the release is harmless. We did not test which of the installers above trigger a SmartScreen prompt today, because that depends on reputation that changes over time. We report what Microsoft documents and what our own file checks found. Our verification method explains how we measure hashes and signatures.

Questions

Is "Windows protected your PC" a virus warning?

Not by itself. Microsoft describes it as a reputation warning for files that are not well known. It can appear on a genuine file and on a malicious one, so check the file before you decide.

Will the warning go away for a new version later?

Microsoft says reputation builds with downloads over time, with no exact threshold. For unsigned files, every new version starts from zero again.

Does an EV certificate stop the warning?

No longer. Microsoft says EV certificates no longer bypass SmartScreen and now build reputation the same way as other certificates.

Can I trust a file because SmartScreen did not warn me?

No warning means the file or its signer has reputation. It is not a full safety check. Still confirm the domain, the signer name and the hash.

Sources

• Microsoft Learn: Microsoft Defender SmartScreen overview
• Microsoft Learn: SmartScreen reputation for Windows app developers
• Microsoft Learn: Code signing options for Windows app developers
• Microsoft Support: Smart App Control frequently asked questions
• Microsoft Support: App & browser control in the Windows Security app
• Microsoft Learn: Get-AuthenticodeSignature
• Microsoft Learn: Get-FileHash
• Malwarebytes: Fake 7-Zip downloads are turning home PCs into proxy nodes (9 February 2026)