You download the Gerbv installer for Windows, double-click it, and instead of an installation wizard you get a blue Windows message saying the PC was protected and an unrecognised app was prevented from starting. That is Microsoft Defender SmartScreen doing its job — and the worst possible responses are the two instinctive ones: abandoning the install entirely, or clicking through the warning blindly for every download from now on. There is a third, correct response, and it takes about two minutes: verify the file first, using its published cryptographic hash, and only then decide. This guide walks that sequence in order — source, hash, then the SmartScreen choice — for Gerbv 2.13.0 on Windows. The full installation walkthrough that follows a successful launch is install Gerbv on Windows, and the installer itself should come from the download page.
Why SmartScreen stops installers like this one
As general Windows guidance: SmartScreen checks programs you run from the internet against reputation information. Large commercial installers accumulate reputation quickly; small open-source projects, whose installers are new and downloaded by comparatively few people, often have little or no reputation at first — so Windows warns not because it found anything wrong with the file, but because it does not yet know the file. That distinction matters. The warning is a request to verify, not a verdict of danger, and equally not a formality to dismiss automatically. The safe behaviour is to supply the verification SmartScreen cannot: proof that the file on your disk is bit-for-bit the file the project published. For an open-source project with published hashes, that proof is available to anyone, for free, in a minute — which is exactly why the hash step below is not optional decoration.
Step 1: Confirm where the installer came from
Before any hash work, confirm the installer is the file you meant to download: gerbv-2.13.0-win64.exe, the Windows installer for Gerbv 2.13.0, obtained by following the download page’s link to the project’s release. If the file arrived from anywhere else — a random search result, a file-sharing mirror, an email attachment — stop here and re-download it through the download page instead of verifying a stranger. A hash check proves a file matches a published value; it cannot make an unwanted source trustworthy if you also copied the expected hash from that same source. Source first, hash second, in that order, always.
Step 2: Verify the SHA-256 hash — before running anything
The published SHA-256 for the Gerbv 2.13.0 Windows installer (15,062,430 bytes) is:
2bafa388c485a9bcecef40e8537cd90287e626f29ce20502ab472faf3cd349fb
Windows can compute the same value for your downloaded file without any extra software. Open PowerShell in the folder containing the installer and run:
Get-FileHash .\gerbv-2.13.0-win64.exe -Algorithm SHA256
Compare the output with the value above, character for character — or compare the beginning and end carefully if you paste both into a text editor. Three outcomes are possible. Exact match: the file is the published installer, untouched in transit; proceed to Step 3 with a clear conscience. No match: do not run the file, whatever SmartScreen or anyone says. Delete it and re-download through the download page; a mismatch means the bytes are not the release, whether through corruption or substitution, and Run anyway cannot fix that. You cannot get a result: the file is in a different folder from the PowerShell window, or the name differs — correct the path rather than skipping the check.
Step 3: Proceed past SmartScreen — only with a verified file
With a verified installer, the SmartScreen screen is handled as general Windows guidance describes for programs you have chosen to trust on evidence: on the SmartScreen prompt, choose More info, which expands the dialog and reveals a Run anyway option, then choose Run anyway and continue into the normal installation covered by the Windows install guide. Read the expanded dialog once before clicking — it names the app Windows could not recognise, and that name should be the installer you just verified. If the name is anything else, close the dialog and find out why a different program is trying to run. After installation, Gerbv should launch as a normal desktop application; Windows 10 is the tested platform for the current builds, they are 64-bit only, and Windows 7 support in Gerbv ended beyond release 2.8.0 — on a Windows 7 machine, no SmartScreen technique makes the current installer the right choice.
What not to do
Do not disable SmartScreen, or Defender, to make the warning go away — that trades a two-minute verification habit for a permanent hole, and it protects the next, genuinely unknown download even less than this one. Do not run an installer whose hash mismatches because the download site looked professional. And do not treat this guide as a blanket licence for Run anyway: the option is justified here by a specific sequence — known source, published hash, exact match — and any download that cannot complete that sequence has not earned the click. Prefer the ZIP build? Gerbv portable for Windows covers the MSYS2 ZIP variant, which extracts and runs without an installer at all — verify its hash the same way before first launch.
Prevention, for every future download
Make the sequence a reflex for small-project software generally: download from the project’s own release channel, verify the published hash before the first run, and let SmartScreen’s warning be the reminder that triggers the check rather than an obstacle to defeat. Two minutes, every time, is the entire cost of never having to guess whether an installer is genuine.
Frequently asked questions
Does a SmartScreen warning mean the Gerbv installer is malware?
No. As general Windows guidance, the warning means the program has little reputation information, which is common for small open-source installers. It is a prompt to verify — which the published SHA-256 hash lets you do conclusively before running anything.
The hash of my download does not match. What should I do?
Do not run the file. Delete it, re-download the installer through the download page so the source is the project’s release, and verify again. Run anyway is only justified after an exact hash match.
Should I turn SmartScreen off to avoid this in future?
No. Leave SmartScreen enabled. Verify each small-project download by its published hash, then use More info and Run anyway for that verified file only — the protection stays for everything else.