Why it gets blocked

SmartScreen does not inspect the file contents. It asks how often it has seen this signature and this exact binary before. Most open-source clients never buy an EV code-signing certificate, and a brand-new release has almost no download history, so you get the blue "Windows protected your PC" dialog.

A Defender detection is a different signal. Labels like Trojan:Win32/Wacatac.B!ml end in !ml, meaning the verdict came from a machine-learning model rather than a signature match. False positives on proxy tooling are common. Common, however, is not the same as harmless, so do the next step.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes

Verify the source before anything else

  1. Check the address bar. The download page must be the project’s own GitHub Releases page. Search-ad results and re-uploaded cloud-drive copies are where trouble starts.
  2. Compare filename and size against the Assets list on the release page. A few hundred KB of difference is worth stopping for.
  3. If the release publishes a SHA256, run Get-FileHash .\installer.exe -Algorithm SHA256 in PowerShell and compare the string character by character.
  4. Upload the file to VirusTotal. Two or three minor engines flagging an open-source client is normal; a dozen engines agreeing on the same family name is not.

Getting past SmartScreen

Once you are satisfied, run the installer and click "More info" in the bottom-left of the blue dialog. Only then does the "Run anyway" button appear. It is collapsed by default, which is why many people think "Don’t run" is the only option.

The alternative is to right-click the file, open Properties, and tick "Unblock" at the bottom of the General tab if it is there. That checkbox only appears when the file carries a mark-of-the-web tag; no checkbox means Windows was never going to block it.

When Defender has already deleted it

Open Windows Security, go to Virus & threat protection, then Protection history. Find the entry, expand it, and choose Allow on device under Actions. The file returns to its original location, so you rarely need to download it again.

If you plan to keep a folder around long term — an extracted portable build, for example — add a folder exclusion under Virus & threat protection, Manage settings, Exclusions. Keep the scope tight. One program directory is enough; never exclude your whole Downloads folder or the C: drive.

On a managed work laptop these controls are often greyed out. That is Group Policy, and registry workarounds are both unreliable and likely against your IT policy. Ask the admin instead.

Security note: only make exceptions for files whose source and hash you checked yourself. Avoid repacked or "cracked" builds circulating on forums — a proxy client sees all of your traffic, so a tampered build is far worse than a tampered ordinary app.