What you see

After you download Mouse Jiggler, Windows 10 and 11 may show a blue or grey screen: “Windows protected your PC”, with Microsoft Defender SmartScreen as the source. The publisher is listed as unknown. That is the normal screen for a new, unsigned .exe downloaded from the internet.

It is not an antivirus detection of a threat, and it is not a bug in the installer. The changelog and the download page already mention it.

Why SmartScreen does this

SmartScreen has two jobs that get mixed up:

  • Reputation. Files that many people have run without reports get a reputation. A new hash from a new publisher starts at zero.
  • Signature. An Authenticode certificate puts a verified publisher name on the file. Ours does not have one yet: a public code-signing certificate costs money and, from Morocco, Microsoft’s own Azure signing service is not available to individual developers.

Browsers also mark the download with a “Mark of the Web” (an NTFS Zone.Identifier). Windows then treats the file as coming from the internet, which makes SmartScreen more likely to ask you to confirm.

Until the files are signed, every new build resets that reputation. Re-downloading the same published file does not; rebuilding it does.

What to do (once, for this file)

  1. On the SmartScreen screen, click More info.
  2. Check that the file name matches what you downloaded (MouseJiggler-1.2.0-setup.exe, or one of the two portable names).
  3. Click Run anyway.
  4. Optional but useful: verify the SHA-256 fingerprint before or after, so you know the bytes match ours.

PowerShell, in the folder of the file:

Get-FileHash .\MouseJiggler-1.2.0-setup.exe -Algorithm SHA256

Compare the hex string with the fingerprints listed on the download page. If they differ, do not run the file: you do not have our build.

What not to do

  • Do not turn SmartScreen off in Windows Security for the whole PC. That only lowers protection for every other download.
  • Do not add random exclusions “to be safe”. One confirmation for this file is enough.
  • Do not download Mouse Jiggler from a mirror we do not control. This site serves the files; the hashes are published next to them.

Is the app safe in the ways we can prove?

  • The Windows app does not connect to the internet and collects no data. Settings stay in %APPDATA%\MouseJiggler\settings.json.
  • The installer runs for your user only, without administrator rights.
  • This website counts download clicks privately; it does not put a tracker in the .exe.

We cannot honestly say “SmartScreen is wrong, ignore it forever”. SmartScreen is doing its job on an unsigned file. We can say: this is our file if the hash matches, and here is how to run it without disabling the filter.

Will the warning go away?

Yes, once the three published files are signed with a code-signing certificate and enough people have run that signed publisher without reports. We tried Azure Artifact Signing; it is not open to individual developers in Morocco. The next path is a regular individual (IV) or organisation certificate from a public CA, then we re-publish the same version signed. Until that is done, the steps above remain the right ones.

An EV certificate no longer buys an instant SmartScreen pass on its own; reputation still has to build. Signing still replaces “Unknown publisher” with a real name, which is the useful part.

If Windows still blocks it

On some work PCs, SmartScreen or WDAC is set to block unknown publishers with no “Run anyway”. That is a company policy. Mouse Jiggler cannot and should not override it. Ask IT, or use a PC you are allowed to install software on.