What is PUP?

What is PUP?

A potentially unwanted program (PUP) is software that is not clearly malicious but that most users would not want if they understood what it does. PUPs usually arrive with nominal consent: a pre-checked box in a free program's installer, an express install that accepts extra offers, or a long license agreement the user scrolls past. Because the user technically agreed, security vendors label this software "potentially unwanted" rather than malware. Microsoft uses the similar term potentially unwanted application (PUA).

Common types of PUPs

• Adware that injects ads or opens pop-ups.
• Browser toolbars and extensions that track browsing or add sponsored search results.
• Search and homepage changers that replace the default search engine or new-tab page, often called browser hijackers.
• "System optimizers," registry cleaners and driver updaters that report alarming numbers of problems and demand payment to fix them.
• Bundleware: installers that add several unrelated programs at once.
• Bloatware: unwanted trial software preinstalled on new computers or phones. Not all of it is classified as a PUP, but it is removed the same way.

Symptoms

• The browser homepage, new-tab page or search engine changed without the user choosing it.
• New toolbars, extensions or desktop shortcuts the user does not remember installing.
• Pop-up ads, including outside the browser.
• Slower startup and more entries in the startup list.
• Fake warnings about critical errors that push a paid cleanup tool.

Removing PUPs

1. Uninstall the unwanted programs from the Apps page in Settings or from Programs and Features. Sorting by install date often reveals everything that arrived in one bundle.
2. Remove unknown browser extensions, then reset the browser settings to restore the homepage and default search engine.
3. Check startup apps in Task Manager and review scheduled tasks for leftover updaters.
4. Run a full scan with anti-malware that has PUP detection turned on.
5. If the system still misbehaves, treat it as a malware case and follow the full malware removal process.

Prevention

• Download software only from the vendor's official site or a trusted app store.
• Choose the custom or advanced install option and uncheck bundled offers.
• Turn on potentially unwanted app blocking. In Windows Security it is under App & browser control, in the reputation-based protection settings.
• Give users standard accounts so installs require an administrator, and use application control where appropriate.

PUP on the CompTIA A+ exam

PUP is on the shared A+ acronym list and fits Core 2 malware and browser troubleshooting topics.

• If a user installed free software and now has a new toolbar, a different search engine and pop-ups, think PUP or adware that came bundled with it.
• The usual fix sequence is uninstall, remove extensions, reset the browser and scan.
• If the scenario includes encrypted files, stolen credentials or remote control by an attacker, it is malware, not just a PUP.
• Prevention answers include custom install options, trusted download sources and least-privilege user accounts.