PUP ALERT: Potentially Unwanted Programs

A PUP By Any Other Name is Still a Dog

Have you noticed that some anti-malware programs are flagging items as potentially unwanted programs? If you're wondering exactly what that means, and how these things are different from viruses, read on.

The consensus among definitions of “PUPs” is that they sneak into your system, usually riding on the coattails of legitimate programs you've downloaded. They pretend to be something they are not, or don’t fully disclose some of the things they’re going to do. Dirty-underhandedness is the hallmark of a PUP. There is no “potential” in my opinion. I don’t want sneaky software on my machine, period.

Some PUPs are nothing but adware. They track where you go online, report back to headquarters, and clutter your screen with targeted ads. They may also change your browser’s home page, usually to one that’s serving ads but sometimes to rogue sites that secretly download and install more adware on your machine. Some of the worst offenders tamper with ad-blocking and security software settings. Is there anything potentially WANTED about PUPs?

And yet, what PUPs do is legal in most cases. According to PUP developers, everyone who installed their software did so with explicit consent and full understanding of what it was going to do. If their software invaded your privacy or changed how your computer behaved, it was done with your permission. Why? Well, you checked a box (or left a pre-checked box checked) which clearly confirmed that you had read and understood the company’s license agreement and agreed to it. Obviously, this argument is disingenuous, but it suffices for legal purposes.

PUPs have been around for a long time. In the mid-1990 there were pitched battles between developers of PUPs and antivirus software; the former strenuously objected to being labeled “viruses” or “Trojans” or “malware.” Some PUP developers threatened to sue for libel, tortious interference with business, and other hyperbolically indignant claims. The belligerent stance of PUP developers is most likely to blame for the insipid, vague label, “potentially unwanted program.”

Here's a Dog Show You Shouldn't Miss

PUP developers have bought veneers of legitimacy by paying well-known, respected software developers to incorporate their malware (there, I said it again) into widely used and freely distributed software. Here are a few examples:

Adobe’s free Flash Player is booby-trapped with McAfee Security Scan, and Adobe Shockwave Player carries Norton Security Scan. Both scanners are time-wasting demos of what McAfee and Norton could do for you if you pay for their full security suites. (But of course you know that for most users, there's absolutely no good reason to PAY for antivirus software, right? See my list of FREE antivirus software.)

Way too many download sites bundle the Ask.com toolbar and browser hijacker with every "free" download. The “opt in” checkbox is checked by default, and it’s easily overlooked. It’s extremely difficult to uninstall this toolbar. This malware (that’s three times) is peddled by IAC/InterActiveCorp, best known for dating services such as Match.com, OKCupid.com, and Tinder, the casual-hook-up site.

Skype, now owned by Microsoft, tries to switch your default browser to Internet Explorer and your default search engine to Bing during its installation process.

Google Earth will try to switch your default browser to Chrome and your home page to Google Search.

File-sharing clients, which are infamous in their own right, are infamous for dumping PUPs onto their users. The BitTorrent client even tries to install Skype, which then does its own nasty things.

Where Do PUPs Come From?

Beneath the global brands that spread PUPs are hundreds, perhaps thousands of lesser-known developers of free and freemium software who take bribes from PUP developers to deliver their DOGs (Definitely Objectionable Goods) to your hard drive.

Their desperation for cash is understandable; most users never pay a dime to support the apps they use every day. But it means that every download of free software must be viewed with great suspicion; and no matter how careful you are, some PUPs are going to slip through.

The makers of anti-malware and security software are putting more effort into detecting and eradicating PUPs these days. But for the most part, PUP defenses are not activated by default when you install anti-malware software; you have to dig into the program settings to find and activate PUP defenses. Here is how to do it for some of the most popular anti-malware suites:

AVG gets kudos for enabling basic PUP and spyware defenses by default, targeting those that pose security risks. But to address PUPs that are “only” nuisances, you must open the AVG console; click Options and select Advanced Settings. Double-click Computer Protection and then select Antivirus. Check the box that says, “Report enhanced set of potentially unwanted programs.”

Avast does not have PUP defenses enabled by default, but it’s easily enabled. Open the Avast console and click the Settings gear icon. Right there on the General tab you’ll find a checkbox to “Scan for potentially unwanted programs.”

Kaspersky products ignore “harmless” PUPs to focus on “elevated riskware,” defined as programs that increase your system’s vulnerability to compromise. That includes things like keyloggers and remote access software, but not toolbars and other software that requires users’ permission to install. Inexplicably, elevated riskware detection is not enabled by default.

To enable elevated riskware detection in Kaspersky Anti-Virus or Internet Security, open the program and click Settings; select the Additional tab; and then click Threats and Exclusions. Finally, check the box next to “Click Detect other software that can be used by criminals to damage your computer or personal data.”

If you still have problems with PUPs after enabling your security suite’s PUP defenses, you should try other anti-malware tools such as MalwareBytes Anti-Malware (MBAM). Did I mention my list of FREE antivirus software?

Your thoughts on this topic are welcome. Post your comment or question below...