PUA:Win32/Packunwan: What It Is, Adsunwan, Removal

PUA:Win32/Packunwan is a Microsoft Defender potentially unwanted app detection, not a normal Windows file name. If Defender shows Packunwan, remove the detected item unless you can clearly tie it to a trusted installer you expected. If the alert says PUA:Win32/Adsunwan, use the same cleanup logic: check the affected item path, delete the source package that produced it, and scan again after reboot.

What is PUA:Win32/Packunwan?

Microsoft Security Intelligence lists Packunwan as a Defender PUA detection. Its public description is generic, but it says Defender detects and removes the threat and warns that affected devices may show slow performance, added or modified files, desktop setting changes, freezes, crashes, or reduced storage space [1].

For a home user, the important part is not only the one file Defender quarantined. Packunwan often appears around packages: a downloaded installer, extracted archive, setup wrapper, mod, activator, or bundled utility. If the source package remains on disk, the alert can return when Windows scans the same folder again.

Packunwan vs Adsunwan

Packunwan and Adsunwan are separate Microsoft Defender PUA names, not confirmed aliases. Search data often mixes them because the advice is similar: identify the affected item path, remove the unwanted package, and check whether anything installed alongside it. Microsoft also has an official Adsunwan detection page with the same broad PUA-style warning and symptom list [2].

If your alert says Adsunwan, do not rename it as Packunwan in reports or support requests. Keep the exact Defender name, the affected item path, and the detection time. That evidence helps you decide whether the warning came from a known installer, a questionable download, or an active unwanted app.

Is Packunwan a virus or a false positive?

Packunwan is a PUA detection, so the right response depends on where it came from. Treat it as risky by default, then verify the source.

If Packunwan appears in r2modman, Thunderstore, WEBFISHING, or winmm.dll

Some Packunwan reports come from game-mod setups rather than ordinary installers. A common pattern is a Microsoft Defender alert after launching WEBFISHING with r2modman or Thunderstore mods, with affected items such as C:\Program Files (x86)\Steam\steamapps\common\WEBFISHING\winmm.dll or %AppData%\r2modmanPlus-local\WEBFISHING\cache\NotNet-GDWeave\2.0.14\winmm.dll. GDWeave’s own Thunderstore page says its install places a GDWeave folder and winmm.dll next to the game files, so the file name alone is not enough to prove malware [3].

Still, do not allow the alert automatically. Mod loaders and DLL-based game patches run code inside the game process, and malicious or repacked mods can abuse that same path. Check whether the mod came from the in-manager Thunderstore flow or a known GitHub release, whether the profile contains unfamiliar packages, and whether Defender names only the expected GDWeave path or also finds archives, installers, browser downloads, Temp files, startup entries, or another detection such as PUA:Win32/Vigua.A.

How to remove PUA:Win32/Packunwan

1. Open Windows Security and go to Virus & threat protection then Protection history.
2. Open the Packunwan or Adsunwan entry and copy the affected item path.
3. Choose Remove or Quarantine. Avoid Allow unless you are testing in a controlled lab.
4. Delete the original archive, installer, extracted folder, crack, mod, cheat, or wrapper that produced the alert.
5. Uninstall suspicious apps added on the same day from Windows Settings.
6. Check browser extensions, notification permissions, download folders, and temporary folders for the same source name.
7. Review Startup Apps and Task Scheduler for entries created near the detection time.
8. Restart Windows, update Defender, and run a full scan.
9. Run Gridinsoft Anti-Malware as a follow-up cleanup scan to check bundled apps, browser changes, startup entries, scheduled tasks, hidden files, and leftovers that can trigger repeat alerts.

What if Packunwan keeps coming back?

Repeated Packunwan detections usually mean one of four things: the original download is still present, a browser or launcher redownloads the same package, an updater or scheduled task restores it, or Windows Security is showing an old history item. Start with the affected item path. If the path points to Downloads, Temp, a browser cache, or an extracted archive, delete the whole source folder and scan again.

If the alert points to an installed program, remove the app normally first, then check leftover folders in Program Files, AppData, ProgramData, Startup Apps, and Task Scheduler. If Defender says no action is available, check whether the item was already quarantined or allowed earlier under Protection history.

What not to do

• Do not download random Packunwan removal tools from videos or forum replies.
• Do not delete Defender history first; it may remove the path evidence you need.
• Do not keep the crack, activator, game cheat, or installer because “only one file” was quarantined.
• Do not restore or allow the alert unless you can prove the file came from a trusted vendor and you understand the risk.

FAQ

References

1. Microsoft Security Intelligence. “PUA:Win32/Packunwan threat description.” Microsoft, published May 28, 2021, accessed June 13, 2026. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA%3AWin32%2FPackunwan
2. Microsoft Security Intelligence. “PUA:Win32/Adsunwan threat description.” Microsoft, published May 28, 2021, accessed June 13, 2026. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA%3AWin32%2FAdsunwan&ThreatID=298190
3. Thunderstore / NotNet. “GDWeave.” Thunderstore WEBFISHING Mod Database, accessed June 19, 2026. https://thunderstore.io/c/webfishing/p/NotNet/GDWeave/v/2.0.14/