Install the program family bucket? ! Quickly try Win10's built-in blocker

After Win10 1703, the built-in Windows Defender in the system can be said to be more and more useful. This is not the editor for the Microsoft site, but Defender has all the functions it should have. The virus database is updated directly through Windows Update. It feels like no one can fight it except Kaspersky.

But there are still many small partners who will choose software such as housekeeping as the main security method. It may be that the current Defender does not have the ability to intercept rogue software that is bundled in the installer (.exe) or silently installed in the background. .

But this is all in the past tense. No, it’s just being idle at work. Looking through the technical code, Microsoft has added a deep interception function to Windows Defender after the 1803 update. It’s just out of the testing phase (or waiting for the fall season). It will be added after the version is updated), it has not been officially launched, don’t you believe it? Open Powershell and run the following codes in sequence:

$Preferences = Get-MpPreference

$Preferences.PUAProtection

Look at the result, is it displayed as "0"? This means that the in-depth detection and interception function is not enabled.

The opening method is also very simple. In Powershell, enter

Set-MpPreference -PUAProtection 1

Then, use the above two commands to check and you will know. By the way, if you think this function takes up system resources, you can turn it off by replacing the last number of the above command with 0.

After so much preparation, what is the effect of this hidden function? First, let Xiaobian Zhang use various browsers to download software installation files that may have bundling behavior. The result is the following situation, which is directly killed, and there is no possibility of keeping it.

As for certain software installations, silently installing other family bucket-like behaviors in the background (that is, releasing relevant files into a temporary folder and sneaking installations), this is the end, and it is directly judged as a malicious behavior and killed.

After enabling this function, under the strict monitoring of Windows Defender, there will be basically no more bundling installations, downloading to be implanted Trojan horses, or other promotion software installation packages. Although there are still some slippages, but comparison Those guys who claim to be safe but do things like the whole family are full of sincerity, right?

What are you waiting for? Wow to use!