Can't install: This app has been blocked for your protection

[Liauwo]

[Liauwo]

every other app and installer works except this one, this is a first for me

[m417z]

Sadly, I got these two emails yesterday. They don't contain much info, I'm not sure whether it's a mistake or a deliberate action by Microsoft. I'm looking for a solution, and I hope that it'll be resolved soon.

For now, please try this unsigned installer, let me know if it works for you:
https://github.com/ramensoftware/windhawk/releases/download/v1.6.1/windhawk_setup_nosig.exe

Update: A better workaround for now is to downgrade to Windhawk v1.6 which luckily doesn't seem to be impacted, and is almost identical to v1.6.1.

Update 2: Download the latest version from https://windhawk.net/ and update. The latest version of Windhawk doesn't have this problem.

You can help by contacting Microsoft using this form (choose "Incorrectly detected as malware/malicious") or any other way you can think of.

[NodatustheLupine]

I have also been (and still am) dealing with this issue

[m417z]

@NodatustheLupine when do you see this message? Have you tried the setup file from my previous comment here?

[kevingosse]

@m417z Same issue with your linked installer. Windows Defender deletes the file as soon as it's downloaded by Chrome.

[m417z]

@kevingosse so it's not the same message as in the first screenshot, right? Can you post a screenshot of how it looks?

[kevingosse]

[kevingosse]

@m417z I tried installing version 1.6.0 and there's no issue with this one. Are you using a different certificate or something?

[m417z]

I see. That's a different issue, it looks like a false positive detection by Defender. You can report it as a false positive here, it'll help:
https://www.microsoft.com/en-us/wdsi/filesubmission/?persona=HomeUser

I tried installing version 1.6.0 and there's no issue with this one. Are you using a different certificate or something?

No, both use the same certificate. Perhaps on your computer, it's still not revoked. Have you tried this installer?
https://github.com/ramensoftware/windhawk/releases/download/v1.6.1/windhawk_setup.exe

[kevingosse]

No, both use the same certificate. Perhaps on your computer, it's still not revoked. Have you tried this installer? https://github.com/ramensoftware/windhawk/releases/download/v1.6.1/windhawk_setup.exe

Yeah, for this one I get the same error as the first message.

[m417z]

Interesting, it's the same certificate, but somehow Microsoft specifically revoked the v1.6.1 one. That's a good catch, and good to know v1.6 can be used for now as a workaround. It's almost identical to v1.6.1.

[kevingosse]

Interesting, it's the same certificate, but somehow Microsoft specifically revoked the v1.6.1 one. That's a good catch, and good to know v1.6 can be used for now as a workaround. It's almost identical to v1.6.1.

There's a chance the certificate has been revoked because of the false-positive.

[m417z]

Yes, that's possible. I'm trying to find a way to contact Microsoft about this.

[Cinabutts]

bruhhhh! I was in the middle of modding then this shit started happening. i had the same message popup(Except mine just pointed to the windhawk.exe), Windhawk was literally already running.. I had just got done changing something in a mod then i think i closed the ui and upon clicking the tray icon(which hadn't disappeared yet, it has now after restarting and testing on another account) it said the same thing.. its odd though that i CAN run it now via the task in Task scheduler "WindhawkRunUITask" but it does not open a tray icon BUT its still clearly running in the background as i have my taskbar/startmenu modded and they appear.. i had 0 interaction with windows security/defender.. If theres any way i can help im all ears.

Happened around: October 26, 2025, at 3:22 PM
Windhawk v1.6.1
Windows 11 Pro Insider Preview(Dev Channel)
Build 26100.ge_release.240331-1435