What is a Potentially Unwanted Program (PUP)?

 A potentially unwanted program (PUP) is a program that might be unwanted, even if consumers might have given their approval to download it. PUPs, which include malware, adware, and dialers, are frequently downloaded along with programs that the consumer desires. PUPs can cause a computer to run poorly, causing aggravation at best and security issues at worst.

PUPs frequently come included with free software. A download prompt that asks the user to read the terms and conditions and click a box to continue the download may occur when installing a valid piece of software. The user can be prompted by another box to download extra, undesirable software. It's possible that the box has already been checked, and the opt-out options may be purposefully vague. Without paying close attention, the user may consent to download the unsolicited and perhaps harmful software if they rush through this process. When the original, desired software is installed, these programs then download and set up themselves.

PUPs function

Due to their numerous minor offenses against the user, certain software bundles are PUPs, whilst others only commit one major offense. For instance, PUPs might clog up a user's browser, monitor their web browsing habits, and display further unwanted apps. A PUP can also do the following actions after installation:

1)    excessive user promotion

Pop-up windows produced by the PUP show a lot of advertisements. Additionally, it might be a hijacker of the browser, rerouting web search results, installing toolbars, and displaying advertisements on web pages.

2)    Cut back on system resources.

The PUP consumes system resources by starting up automatically and carrying out whatever task it was programmed to complete, potentially slowing down a user's computer.

3)    Gathering of user data.

 PUPs are spyware that can gather user data without their permission. Keystrokes from a keyboard, for instance, can be tracked in order to steal personal information and learn more about the user.

4)    obscure the uninstalling procedure.

PUPs could be made to make it difficult to delete them manually from a user's PC. They might not have a simple uninstall process or they might not uninstall entirely.

How to remove PUPs: -

Although PUPs might be challenging to eradicate, users can try to do it manually or automatically using antimalware solutions.

Antimalware protection tools can scan a device and eliminate the application to automatically find and eliminating PUPs. However, a victim will need to pay closer attention if they decide to manually remove a PUP. The program might have been designed to not completely delete, or the user might be prompted to accept additional terms and conditions that lead to the installation of another PUP while the first program is being uninstalled.

Conclusion

PUPs, undesirable toolbars, plugins, and various other forms of bloatware are all removed by K7 antivirus software. Additionally, it finds unnecessary programs, unused programs, and other items that take up a lot of space and removes them to make gigabytes of additional space available.

Install K7 antivirus software to secure your system from all sorts of malware and spyware.

Comments

Post a Comment

Popular posts from this blog

AMOS (MacOS Stealer)

  In the last week of April 2023, it was reported on twitter , that through a telegram channel a new malware was being offered as “Atomic MacOS Stealer”. Many samples of this malware were found on the internet. Figure 1 – Atomic MacOS Stealer Most of these samples were masquerading as an installer of various applications like Tor browser, Photoshop CC, Notion, FL studio. Figure 2 – Amos DMGfiles masquerading as different applications These are delivered as a DMGfile(Disk Image) which is the common format for software distribution & installation packages on macOS. We identified the Tor browser DMG file for the analysis. When we execute the DMG file it gets mounted and we can see the resulting window advises the user to execute the application by right clicking. Figure 3 – Tor Browser These fake applications are created by using Appify , which is used to create applications just by having the executable alone. The icons can be customised. That’s why these applications are in dif...
Read more

CVE-2023-21716: A new Office Exploit

Image
 In Feb-2023, Microsoft (MS) patched a vulnerability in Microsoft Word which, if successfully exploited, could allow an attacker to execute remote code without authentication on victims’ machines. This vulnerability has been assigned CVE-2023–21716 and has a CVSS score of 9.8, making it a critical issue. This vulnerability impacted MS word and the Outlook Preview Pane as well. Microsoft along with the patch released a work around for the vulnerability but did not release details about the vulnerability. While we were analysing to identify what was patched, on 06-March, the researcher who reported the bug released a PoC on Twitter . In this blog, we will be taking a look at some internals of CVE-2023–21716. So far there is no evidence to suggest exploitation of this vulnerability in the wild. Rich Text Format (RTF) is a document file format published by Microsoft. It uses control words to define various sections and properties of the document. CVE-2023–21716 exists in the way MS Wo...
Read more

MuddyWater Back with DarkBit

  Recently, we came across a tweet about DarkBit ransomware. An Iranian APT group, named MuddyWater, is reportedly behind the DarkBit ransomware. In this blog we will explore the ransomware’s initial access method, the use of Cobalt Strike and the final ransomware payload. Initial Access Method The initial lure was delivered as an ISO file. Figure 1 – ISOFile The payload included a shortcut file (with a .doc extension) and a zip file. Figure 2 – Contents Inside ISO File The shortcut was using PrintBrm.exe to unpack the HR-Update.zip and run it as shown below. PrintBrm.exe is a windows inbuilt command line tool . Figure 3 – Shortcut File cmd.exe /c xcopy .\HR-Update.zip %TEMP% /h /y && PrintBrm.exe -r -f %TEMP%\HR-Update.zip -d %TEMP%\unzip & %TEMP%\unzip\HR-Update.exe Figure 4 – HR-Update.exe Running HR-Update.exe was a Cobalt Strike beacon. Cobalt Strike, a penetration testing tool, can also be used by attackers for gaining a foothold in the system. The final ran...
Read more