What’s a PUP?

What’s a PUP? a reader asks…

I use the anti-malware program you recommend, and when I scan my Windows PC it shows me things called PUPs. I usually select them and quarantine or delete them, but I’m curious. What are they, and should I always get rid of them?

First off, thanks for taking my advice and using Malwarebytes Anti-Malware Premium, which provides full-time protection against malware and Potentially Unwanted Programs (PUPs). PUPs may be completely innocuous, but almost always are not a program you intended to install or use. So how did you get them?

PUPs are often installed as ‘ride-along’ programs when you install something else, like Java. When you install Java, a screen appears offering to install a ‘free’ browser add-on. This is a classic example of a PUP, and you should uncheck the checkboxes before proceeding with the installation of Java. In Java’s defense, you aren’t paying them anything for the Java program, so you can’t really blame them for trying to make some money by ‘selling you’. It would be so much easier if Java offered both a paid and free version of their program, but then I suppose most people would choose free over paid.

Anytime you get something on the internet for free, you should be very careful every step of the way. Read all screens and opt out of any ride-along offers. But before you proceed, you need to consider whether you really need the free program at all – almost always you get what you pay for and if you pay nothing, you should expect to have to pay in some way other than money. Most often it results in a loss of your privacy and security. Sometimes all you have to give up is an email address, but more often you get something you didn’t ask for that can negatively affect your digital life. So I recommend you avoid almost anything you can get for free on the internet.

For users of Microsoft Windows computers, you might want to add Adobe Reader which is free, but decline the optional PUP offer. These offers change from time to time, but the current one (McAfee Security Scan Plus utility) is a complete waste – it’s just a marketing ploy by McAfee to get you to buy their computer security product. If you followed my advice on computer security protection in this article then you have (in my opinion) a much better product than what McAfee offers.

You may also be interested in an alternative web browser, such as Google Chrome or Mozilla Firefox. Currently, neither currently have a ride-along offer, but you should carefully watch throughout the download and installation – there’s no guarantee they’ll not add something anytime. That’s the nature of ‘free’ – anything can be added at any time without any fanfare.

“If something is ‘free’, you are not buying the product – you are the product”

Advertisement

There is some (but not all) truth to this saying. Yes some businesses (like ourselves) don’t have a fee for some or all services, and their primary motivation is to build a following in the hopes that when that following is large enough, advertising or another way to make money will be possible. But for much of the online world, ‘free’ generally means that you are giving something other than money as compensation for whatever you get. That can be as simple as an email address (for legitimate email newsletters like ours), that and more of your personal information to be sold to online advertisers, marketers or spammers, or by laying open your computer, tablet or smartphone and your personal information, data and files. The point is that you need to be wary about anything that’s ‘free’.

Not all free downloads are as nice as Java and Adobe – they can easily hide their ride-along programs that get installed without your knowledge or permission, piggy-backing on the permission you gave to install the free program you wanted. This is a primary way that most PUPs get installed, which makes having a strong anti-malware program and security suite critical for any Microsoft Windows-powered PC, and worth considering for Macs and Android-powered devices.

Yes, even Apple Macs aren’t immune, more and more of these types malware, adware and spyware programs are appearing on Macs. As Apple computers have grown in popularity, they’ve become a bigger target for hackers. The success of the PC-to-Mac campaign Apple ran has borne fruit – a lot of Macs are now being used by ordinary consumers who may not be savvy about how they use their computers. So adding protection becomes something more important than it used to be. Unfortunately, I’ve not found a single Mac protection program that provides full protection at good value (and actually, the same is true about Windows). So the same kind of safe computing guidelines every computer user should follow make for the best protection (I have lists here and here). But truthfully, most consumers aren’t going to follow these stringently, so having something to scan and remove threats becomes worthwhile. Here are some options for your Mac (I’m providing these just for some choices, I can’t recommend any product currently):

1. Sophos Antivirus for Mac (free, available here) – you must have Mac OS X Snow Leopard (version 10.6.x) or later. This free program gives decent all-around protection for your own Mac, as well as protecting anyone with a Windows PC to which you might send files. The biggest shortfall is that the program can conflict with the installation of other programs on your Mac. And uninstalling it is more complicated than just trashing the application in your Finder window – you have to run the uninstall program.
2. BitDefender Virus Scanner (free, on the Mac App Store) is good at finding threats hidden inside of email, but misses some other threats.
3. Bitdefender Antivirus for Mac ($60 US, available here) does a much better job than the free one, and has a full-time protection option (but you take a hit on system performance) and inexplicably lacks scheduled system scans. Even if you find it cheaper (I’ve seen it for $40 US) it’s still a lot of money.

Of course, no automated protection program is going to protect you from your own actions, so I really hope you read and follow my Digital Life Security Checklist which includes practicing safe computing (an expanded list of these practices is here). And by all means, if your anti-malware program discovers a PUP, you should remove it unless you purposely wanted it. In my experience, every PUP has turned out to be ‘unwanted’. Please use the comments below to tell me about any PUPs you’ve run across.