PUA:Win32/Packunwan: Remove, Adsunwan, or False Positive?

PUA:Win32/Packunwan is a Microsoft Defender PUA alert that should be removed unless the affected path clearly belongs to a trusted installer, game mod, or vendor file you expected. Check Protection History first: cracks, repacks, fake installers, cheat tools, suspicious archives, Downloads, Temp, and browser-cache paths are removal cases. A signed official installer or known mod file needs verification before restore. If the alert says PUA:Win32/Adsunwan, use the same workflow: keep the exact name, copy the path, delete the source package when risky, and rescan after reboot.

What is PUA:Win32/Packunwan?

Microsoft Security Intelligence lists Packunwan as a Defender PUA detection. Its public description is generic, but it says Defender detects and removes the threat and warns that affected devices may show slow performance, added or modified files, desktop setting changes, freezes, crashes, or reduced storage space [1].

For a home user, the important part is not only the one file Defender quarantined. Packunwan often appears around packages: a downloaded installer, extracted archive, setup wrapper, mod, activator, or bundled utility. If the source package remains on disk, the alert can return when Windows scans the same folder again.

Packunwan vs Adsunwan

Packunwan and Adsunwan are separate Microsoft Defender PUA names, not confirmed aliases. The practical checks overlap: identify the affected item path, remove the unwanted package, and check whether anything installed alongside it. Microsoft also has an official Adsunwan detection page with the same broad PUA-style warning and symptom list [2].

If your alert says Adsunwan, do not rename it as Packunwan in reports or support requests. Keep the exact Defender name, the affected item path, and the detection time. That evidence helps you decide whether the warning came from a known installer, a questionable download, or an active unwanted app.

Is Packunwan a virus or a false positive?

Packunwan is a PUA detection, so the right response depends on where it came from. Treat it as risky by default, then verify the source.

If Packunwan appears in r2modman, Thunderstore, WEBFISHING, or winmm.dll

Some Packunwan reports come from game-mod setups rather than ordinary installers. A common pattern is a Microsoft Defender alert after launching WEBFISHING with r2modman or Thunderstore mods, with affected items such as C:\Program Files (x86)\Steam\steamapps\common\WEBFISHING\winmm.dll or %AppData%\r2modmanPlus-local\WEBFISHING\cache\NotNet-GDWeave\2.0.14\winmm.dll. GDWeave’s own Thunderstore page says its install places a GDWeave folder and winmm.dll next to the game files, so the file name alone is not enough to prove malware [3].

Still, do not allow the alert automatically. Mod loaders and DLL-based game patches run code inside the game process, and malicious or repacked mods can abuse that same path. Check whether the mod came from the in-manager Thunderstore flow or a known GitHub release, whether the profile contains unfamiliar packages, and whether Defender names only the expected GDWeave path or also finds archives, installers, browser downloads, Temp files, startup entries, or another detection such as PUA:Win32/Vigua.A.

How to remove PUA:Win32/Packunwan

1. Open Windows Security and go to Virus & threat protection then Protection history.
2. Open the Packunwan or Adsunwan entry and note its status, detection time, and exact affected item path.
3. Use the available Remove or Quarantine action for an unwanted item. If there is no action button, check the status as described below; do not restore the file just to remove it again.
4. Remove only the identified unwanted file and its dedicated source package, such as that installer or archive and its own extracted folder. Do not delete the whole Downloads, Temp, browser profile, or game library.
5. If the affected file belongs to an installed unwanted app, uninstall that actual app through Windows Settings. Packunwan is a detection label and may not appear as an app name; installation date alone is not a reason to uninstall an unrelated program.
6. Check browser extensions, notification permissions, download folders, and temporary folders for the same source name.
7. Review Startup Apps and Task Scheduler for entries created near the detection time.
8. Restart Windows, update Defender, and run a full scan.
9. Run Gridinsoft Anti-Malware as a follow-up cleanup scan to check bundled apps, browser changes, startup entries, scheduled tasks, hidden files, and leftovers that can trigger repeat alerts.

If Packunwan returns after reboot or appears from Downloads, Temp, a browser cache, Startup, Task Scheduler, an r2modman cache, or a bundled installer, Defender may have removed the visible file while the source package, scheduled task, browser change, or bundled module still recreates it. A full Gridinsoft Anti-Malware scan checks those leftovers together instead of making you hunt each location manually.

What if Packunwan keeps coming back?

Compare the detection time, status, and affected item before treating a repeated Packunwan card as reinfection. A new event can come from an original download that remains, a browser or launcher fetching the same package again, or an installed component recreating it. For a file in Downloads, Temp, a browser cache, or an extracted archive, remove the exact unwanted item and only the dedicated package it belongs to, then scan again. A shared folder containing that item is not the removal target.

If the path identifies an installed unwanted program, use its normal uninstall entry. Do not guess the app name from the Packunwan label or delete entire Program Files, AppData, or ProgramData folders. If the same file returns with a new timestamp, keep the path and scan report for a targeted persistence check.

No Remove button? Expand the event and read its state [4]:

• Blocked/removed: check the time and a fresh scan; there may be no current file left to act on.
• Quarantined: keep it quarantined and use Remove if offered. Do not restore it to expose a missing button.
• Action needed or remediation incomplete: follow the card’s available action or additional steps. If cleanup fails, retain the exact error and affected path for support.
• Previously allowed: remove the item from Allowed threats, then rescan.
• An unwanted app is still installed: identify it from the affected path and uninstall that app normally.

Clearing Protection History is not malware removal. Do not delete Defender service/history folders, take ownership of protected folders, or disable protection to make an event disappear.

What not to do

• Do not download random Packunwan removal tools from videos or forum replies.
• Do not delete Defender history first; it may remove the path evidence you need.
• Do not keep the crack, activator, game cheat, or installer because “only one file” was quarantined.
• Do not restore or allow the alert unless you can prove the file came from a trusted vendor and you understand the risk.

FAQ

References

1. Microsoft Security Intelligence. “PUA:Win32/Packunwan threat description.” Microsoft, published May 28, 2021, accessed June 13, 2026. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA%3AWin32%2FPackunwan
2. Microsoft Security Intelligence. “PUA:Win32/Adsunwan threat description.” Microsoft, published May 28, 2021, accessed June 13, 2026. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA%3AWin32%2FAdsunwan&ThreatID=298190
3. Thunderstore / NotNet. “GDWeave.” Thunderstore WEBFISHING Mod Database, accessed June 19, 2026. https://thunderstore.io/c/webfishing/p/NotNet/GDWeave/v/2.0.14/
4. Microsoft Support. “Protection History in the Windows Security App.” Accessed October 1, 2026. Protection History states and actions