How to Remove PUA:Win32/Presenoker on Windows 10

To remove PUA:Win32/Presenoker on Windows 10, open Windows Security > Virus & threat protection > Protection history, expand the detection, and choose Remove. If Windows first offers only Quarantine, quarantine it, then return to the item and remove it. Uninstall the related unwanted app if one is installed, then run a scan if the alert returns.

PUA means “potentially unwanted application.” Microsoft’s threat entry says Defender detects and removes Presenoker, but technical details are unavailable. The detection name alone does not identify the file, and a familiar app name does not prove it is safe. Review the file path and status before deciding what to remove. Microsoft Security Intelligence: PUA:Win32/Presenoker

1. Find the Presenoker alert in Windows Security

1. Select Start, type Windows Security, and open the app.
2. Choose Virus & threat protection, then select Protection history. In some Windows 10 builds, Protection history appears as a link on the Virus & threat protection page.
3. Expand the card labeled PUA:Win32/Presenoker. Review the affected item, file location, date, and current status. Windows may ask for administrator permission to show threat details.

2. Remove or quarantine the detected item

Use the action that matches the status shown on the expanded card:

• Threat found or action needed: Choose Remove if it is offered. If the available action is Quarantine, select it and then choose Start actions if prompted. Quarantine blocks the file from running; it is not the same as deleting it.
• Threat quarantined: Expand the card, open Actions, and choose Remove. Microsoft says a quarantined item is blocked but remains on the device until removed.
• Threat blocked or removed: Defender has already blocked and removed the item, so no additional removal action is needed for that event.

Choices vary by detection. Avoid Restore or Allow on device unless you have verified that the exact file is legitimate. Restoring returns it to its original location, where Defender can detect it again; allowing an unsafe item can put your device and data at risk. See Microsoft’s Protection history guide.

3. Uninstall the app that brought it in

An installed program may leave another copy behind. Use the file path in Protection history to identify the associated app. If it is unwanted, open Start > Settings > Apps > Apps & features, select it, and choose Uninstall. Check the publisher and name first; unfamiliarity alone is not a reason to remove a program. If the alert points to an installer you downloaded but never installed, delete that installer instead of opening it again.

Do not manually delete files from Windows system folders or turn off Defender to stop the notification. If you are unsure which item is safe to remove, leave it quarantined while you investigate. Microsoft’s instructions for uninstalling apps in Windows cover the standard removal options.

4. Scan again if the warning returns

Protection history can retain a card after Defender acts; check its status and date. Microsoft says history keeps events for two weeks. A new detection after removal suggests another copy remains in Downloads, a removable drive, a synced folder, or the installer’s source app.

1. Open Windows Security > Virus & threat protection > Scan options.
2. Select Full scan, then Scan now. Let the scan finish and review any new Protection history cards.
3. If Defender cannot remove the item or the same detection keeps returning, save your work and run Microsoft Defender Offline scan from Scan options. The PC restarts to scan outside the normal Windows session.

Microsoft recommends an offline scan for malware that repeatedly returns or is difficult to remove. For scan details, follow its guidance on troubleshooting malware detection and removal.

If you think the detection is a false positive

Recognition alone is not enough. Confirm the download came from the publisher’s official site and that the signature and file details match. If you still believe Defender flagged a safe file, submit it to Microsoft Security Intelligence for analysis. Keep it quarantined while you check; allow the exact file only if you can verify it is legitimate.

Keep PUA protection on

To reduce future unwanted downloads, open Windows Security > App & browser control > Reputation-based protection settings and review Potentially unwanted app blocking. Enable app and download blocking where available; download blocking applies to Edge. This setting does not remove a current alert. See Microsoft’s Windows 10 PUA protection instructions.

Windows 10 support ended on October 14, 2025. Windows Security can still handle this detection, but most Windows 10 devices no longer receive regular security updates unless covered by an applicable Extended Security Updates program or special edition. Plan to move to a supported Windows version for ongoing protection. Microsoft’s Windows 10 support notice explains the change.