2

I run a full (not quick) scan of Windows Defender every night. Somehow, between two nights ago and last night an instance of PUA:Win32/InstallCore got placed on my PC. Windows Defender removed it, but how does anything get put on my PC without my asking/telling it to do so? I didn't update anything in the previous 24 hours.

I try to practice safe-computing. I never click on email links or open email from unknown people. I only open attachments that I'm expecting from known sources. I have no automatic updates allowed - I only run Windows Update manually; I only update browsers manually, I only update programs I have subscriptions to - e.g., Adobe Creative Cloud, etc, manually. On the rare occasions where I install 3rd-party utilities, e.g., VLC Media Player or Libre Office I download them from their developer website or Microsoft store, never from any third-party distributor; I scan the heck out of them with Defender and MalwareBytes before opening and running them; I never accept any free accessories or bundles.

If a file can be written to my PC without my knowing it until a subsequent malware scan, then there must be a defect in my defenses or protocol. How do I find it?

5
  • A common trend is to compromise companies who provide software or services to other companies. I think there was a wormable exploit in Windows 10 fixed just the other day that only need a malformed packet sent to the target machine to gain control. This affected Windows 10 Servers, too.... so if they infect a server of a reputable site they can infect all their users as well. Every computer is hackable... especially any computer connected to the internet. The one thing you are doing which is probably bad is not letting automatic updates happen.
    – pcalkins
    May 14, 2021 at 22:15
  • Thanks... The one thing you are doing which is probably bad is not letting automatic updates happen ... I wish I had an alternative. This PC is used for video and music production and related art projects, which in my retirement and in the pandemic I do most of my waking hours. At night it runs various malware and hardware scans and orchestrates network backups across a bunch of devices. I usually leave my project files open overnight. So it runs and is in use 24/7, so updates are very disruptive. I try to set aside a few hours a week to run updates.
    – user316117
    May 14, 2021 at 23:11
  • It's probably a false positive (due to some signature update) or just one of those 3rd party software that can be installed if you don't pay extremely close attention during the installation of other software. A PUA is not even an actual threat, it's a gray category and it is definitively not installed through any vulnerability because a) you are not public addressable b) there are more profitable malwares to install. Maybe you can check win defender log to see what was actually removed May 15, 2021 at 9:29
  • "3rd party software that can be installed if you don't pay extremely close attention during the installation"... gets me all the time. I just automatically click through and then find I've got some nonsense installed I forget to un-tick. (Often by default the option is chosen and you have to explicitly uncheck it.)
    – pcalkins
    May 17, 2021 at 22:35

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.