PUP Reconsideration Information

Help! I'm a legitimate software vendor/advertiser/toolbar maker! My stuff isn't malicious, why are you listing it as a PUP?

This is the list of bad behaviors that we use to identify PUPs. This list evolves with the emergence of new PUPs, and may be subject to change. Some applications are classified as a PUP for having multiple violations, others for having just one, though more serious, violation. Each PUP is evaluated on a per case basis, prior to classification.

PUP Reconsideration request form

Malwarebytes PUP Criteria

Obtrusive advertising

Does your advertising obstruct the content? Is the "x" (close option) too close to the advert, in a non-standard location, or tiny, or pale gray on a white background, or black on a black background? Is the close option only available once the content has been displayed?

Out of context advertising

Is your application displaying adverts that aren't relevant to the user, about unrelated products, or interfering with web browsing?


Does your application generate pop-ups?


Does your application generate pop-unders?

Ad insertion

Does your application insert adverts in webpages you do not own or explicitly control, such as the top or bottom of a browser window?

Ad Overlays

Does your application paste adverts on top of the legitimate adverts present on a webpage?

Ad replacement

Does your application replace the native adverts present on a webpage with one you have partnered with?

Ads with no clearly identified attribution

Are your adverts not displaying where they are originating from?

Ads that are not clearly identifying themselves as such

Are your adverts not clearly labeled as advertisements?

Redirection to a competitor's site

Does your application redirect traffic from the desired webpage to a competitor's website?

Altering search results

Does your application alter the search results that a user receives?

Inserting search results

Does your application alter the search result with insertions?

Toolbars that bring no value

Is your application a toolbar where the value proposition is skewed in favor of the maker of the toolbar vs. its user?

Hijacking search engines

Does your application change the default search engine in the browser?

Hijacking the home page

Does your application change the default home page of the browser or all browsers?

Inserting bookmarks

Does your application insert unsolicited bookmarks in the bookmark manager of the browser?

Creating excessive shortcuts on the desktop

Does your application create more than two shortcuts on the desktop?

Bundling programs that use installers where several applications are bundled together

Is your application only available as part of a bundler, with other, less desirable applications?

Malicious bundling

Is your application in a bundle where some of the accompanying applications are malicious or already classified as a PUP?

Pre-populated checkboxes

Are all the options in your application pre-populated, effectively requiring the user to manually opt-out of options?

The liberal use of "Recommended" next to an option radio button or checkbox

Do you use "Recommended" next to radio buttons, or checkboxes?

Programs that do not have a standard uninstall procedure

Does your application require a non-standard method to uninstall?

Programs that have no uninstall procedure

Does your application not have an uninstall procedure?

Programs that use non-standard install locations

Does your application install itself in a non-standard location (not in the Programs folder)?

Programs that require the download of an uninstaller to remove

Does your application not have a standard uninstaller? Do you have to contact your website and download a separate application to remove it? Is this application only made available by emailing your support staff?

Browser add-ons that do not show up in the add-on manager

Is your application a browser add-on and, once installed, does not provide a standard uninstall procedure?

Browser add-on that have a grayed out uninstaller

Is your application a browser add-on, and once installed, the uninstall option is disabled or grayed out?

Browser add-ons that are misleadingly named

Is your browser add-on clearly named, and easily identifiable in the browser configuration where it can be uninstalled?

Browser add-ons that install across multiple browsers

Does your application install across all the browsers present on the machine, where there is low value to the user, except for advertising?

Watchdog process, buddy process, startup key, AppInit_dll?

Does your application have a watchdog process, or registry entry, or any mechanism designed to make uninstallation more difficult by reinstating the main application if it is removed?

Has a critical mass of users referred to your program as malicious?

Has a critical mass of users referred to your program as malicious, as evidenced by numerous complaints, general dissatisfaction, and removal guides?

PUP Reconsideration request process

If you want to submit your application for reconsideration, please email legal@malwarebytes.org