PUP Reconsideration Information

Help! I'm a legitimate software vendor/advertiser/toolbar maker! My stuff isn't malicious, why are you listing it as a PUP?

This is the list of bad behaviors that we use to identify PUPs. This list evolves with the emergence of new PUPs, and may be subject to change. Some applications are classified as a PUP for having multiple violations, others for having just one, though more serious, violation. Each PUP is evaluated on a per case basis, prior to classification.

PUP Reconsideration request form

Malwarebytes PUP Criteria

Obtrusive advertising

Does your advertising obstruct the content? Is the "x" (close option) too close to the advert, in a non-standard location, or tiny, or pale gray on a white background, or black on a black background? Is the close option only available once the content has been displayed?

Out of context advertising

Is your application displaying adverts that aren't relevant to the user, about unrelated products, or interfering with web browsing?


Does your application generate pop-ups?


Does your application generate pop-unders?

Ad insertion

Does your application insert adverts in webpages you do not own or explicitly control, such as the top or bottom of a browser window?

Ad Overlays

Does your application paste adverts on top of the legitimate adverts present on a webpage?

Ad replacement

Does your application replace the native adverts present on a webpage with one you have partnered with?

Ads with no clearly identified attribution

Are your adverts not displaying where they are originating from?

Ads that are not clearly identifying themselves as such

Are your adverts not clearly labeled as advertisements?

Redirection to a competitor's site

Does your application redirect traffic from the desired webpage to a competitor's website?

Altering search results

Does your application alter the search results that a user receives?

Inserting search results

Does your application alter the search result with insertions?

Toolbars that bring no value

Is your application a toolbar where the value proposition is skewed in favor of the maker of the toolbar vs. its user?

Hijacking search engines

Does your application change the default search engine in the browser?

Hijacking the home page

Does your application change the default home page of the browser or all browsers?

Inserting bookmarks

Does your application insert unsolicited bookmarks in the bookmark manager of the browser?

Creating excessive shortcuts on the desktop

Does your application create more than two shortcuts on the desktop?

Bundling programs that use installers where several applications are bundled together

Is your application only available as part of a bundler, with other, less desirable applications?

Malicious bundling

Is your application in a bundle where some of the accompanying applications are malicious or already classified as a PUP?

Pre-populated checkboxes

Are all the options in your application pre-populated, effectively requiring the user to manually opt-out of options?

The liberal use of "Recommended" next to an option radio button or checkbox

Do you use "Recommended" next to radio buttons, or checkboxes?

Programs that do not have a standard uninstall procedure

Does your application require a non-standard method to uninstall?

Programs that have no uninstall procedure

Does your application not have an uninstall procedure?

Programs that use non-standard install locations

Does your application install itself in a non-standard location (not in the Programs folder)?

Programs that require the download of an uninstaller to remove

Does your application not have a standard uninstaller? Do you have to contact your website and download a separate application to remove it? Is this application only made available by emailing your support staff?

Browser add-ons that do not show up in the add-on manager

Is your application a browser add-on and, once installed, does not provide a standard uninstall procedure?

Browser add-on that have a grayed out uninstaller

Is your application a browser add-on, and once installed, the uninstall option is disabled or grayed out?

Browser add-ons that are misleadingly named

Is your browser add-on clearly named, and easily identifiable in the browser configuration where it can be uninstalled?

Browser add-ons that install across multiple browsers

Does your application install across all the browsers present on the machine, where there is low value to the user, except for advertising?

Watchdog process, buddy process, startup key, AppInit_dll?

Does your application have a watchdog process, or registry entry, or any mechanism designed to make uninstallation more difficult by reinstating the main application if it is removed?

Has a critical mass of users referred to your program as malicious?

Has a critical mass of users referred to your program as malicious, as evidenced by numerous complaints, general dissatisfaction, and removal guides?

Registry Cleaners, Optimizers, Defragmenters.

Microsoft has officially stated that they do not support the use of registry cleaners as shown here: https://support.microsoft.com/en-us/kb/2563254 Many of these are installed as part of “bundlers” or “wrappers” and the end user is left with a program that performs a scan at startup and presents a report in an alarmist fashion, stating that a large number of errors are present in the registry. Our testing has shown that these programs will always find errors in the registry, even on a freshly installed operating system. As such this behaviour qualifies for a PUP classification.

Driver Optimizer, Updater, etc.

Similar in scope to the registry cleaners, driver optimizers promise to update the drivers needed for the PC’s peripherals to properly function, such as the sound card, chipset, and USB devices. Many of these are installed as part of “bundlers” or “wrappers” and the end user is left with a program that performs a scan at startup and presents a report in an alarmist fashion, stating that a driver needs to be updated. More recent versions of Windows, such as Windows 7 and up now update drivers through the windows update process, and while newer drivers may be available for your devices they may not yield any noticeable performance improvement. These types of programs ask for payment prior to performing a driver update that is ultimately unnecessary.

PUP Reconsideration request process

If you want to submit your application for reconsideration, please email legal@malwarebytes.org