Potentially Unwanted Applications (PUA/PUP)
Threat Landscape & Operational Overview
Potentially Unwanted Applications (PUA), also known as Potentially Unwanted Programs (PUP), comprise software that exhibits questionable, misleading, or aggressive behaviors. Common PUA categories include fake system optimizers, bogus driver updaters, registry cleaners, and bundled search toolbars. These applications employ scareware tactics—falsely claiming the system is crippled by thousands of critical errors—to coerce users into purchasing fraudulent licenses, while consuming system resources and destabilizing operational stability.
🛡️ Enterprise Incident Response & Hardening Guidance
Dealing with an active security incident or looking to harden enterprise defenses against this threat class? Read our dedicated operational engineering guide:
→ Open Master Guide: Adware & Unwanted Software Protection for BusinessesPrimary MITRE ATT&CK Tactics & Techniques
Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:
| ID | Technique | Tactic | Observed Operational Behavior |
|---|---|---|---|
T1036 |
Masquerading | Defense Evasion | Poses as legitimate system performance utilities or antivirus scanners. |
T1547.001 |
Registry Run Keys | Persistence | Runs continuous background nag screens on user logon. |
T1059 |
Command and Scripting Interpreter | Execution | Executes scripts to alter system registry settings and desktop shortcuts. |
Actively Weaponized Exploits & Vulnerabilities (2 CVEs)
Adversaries deploying potentially unwanted applications (pua/pup) frequently weaponize the following software vulnerabilities for initial ingress, privilege escalation, or lateral movement:
Microsoft Office Discretionary Memory Corruption Vulnerability (MS15-033)
Attributed Payloads: driverpack
Microsoft Office / WordPad Remote Code Execution via Malicious OLE Moniker
Attributed Payloads: driverpack
SOC Incident Containment Checklist
Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:
- Uninstall the unwanted software through standard administrative application management tools.
- Remove lingering scheduled tasks and startup entries associated with the application publisher.
- Verify that default browser shortcuts and settings have not been modified.
- Educate users regarding social engineering scare tactics and fake cleaner utilities.
- Enforce application control policies (e.g. AppLocker, Windows Defender Application Control) on corporate endpoints.
- Do not input payment card details into applications displaying unsolicited system warning popups.
- Do not allow standard domain users to possess local administrative installation privileges.
Prominent Malware Families in this Category
Top documented threats ranked by historical prevalence and behavioral signatures:
installmonster
InstallMonster (documented across enterprise threat intelligence as Adware.InstallMonster, PUA:Win32/InstallMonster, and Trojan.InstallMo...
dlguide
DownloadGuide (detected across commercial threat intelligence as PUA:Win32/DownloadGuide, Adware:Win32/DownloadGuide, and Win32/DownloadG...
filetour
FileTour (cataloged across threat telemetry as Trojan:Win32/Filetour, Adware.FileTour, and PUA:Win32/Filetour) is a dual-function softwar...
prepscram
SoftwareBundler:Win32/Prepscram (cataloged across security vendor telemetry as Trojan.Prepscram, Win32/Prepscram, or Bundler:Win32/Prepsc...
vittalia
Vittalia (documented across endpoint telemetry as Adware.Vittalia, PUP.Optional.Vittalia, and PUA:Win32/Vittalia) is a persistent adware ...
installcore
PUA:Win32/InstallCore (widely cataloged across endpoint telemetry as ADW_INSTALLCORE, PUP.Optional.InstallCore, or PUA.Win32.InstallCore)...
icloader
ICLoader (identified across vendor detection engines as PUA:Win32/ICLoader, Trojan:Win32/ICLoader, and PUP.Optional.InstallCore) is an ag...
soft32dl
Soft32 Downloader (classified across threat intelligence feeds as PUA:Win32/Soft32Downloader, Adware:Win32/Soft32, and PUP.Optional.Soft3...
Complete Directory (35 Families)
Alphabetical index of all tracked malware families cataloged under potentially unwanted applications (pua/pup):
- 4shared
- appset
- cloudguard
- cloudwrapper
- deceptpcclean
- dlguide
- dnscleaner
- domaiq
- downloadadmin
- downloadshield
- driverpack
- driverupdate
- filetour
- gamemodding
- gt32supportgeeks
- icloader
- installcore
- installmonster
- iobit
- onesystemcare
- optimizer
- outbrowse
- pccleaner
- playtech
- prepscram
- presenoker
- pupstudio
- runbooster
- soft32dl
- softonic
- systweak
- tweakbitdu
- uniblue
- vittalia
- ytddownloader
🛡️ Verified Antivirus Support & Customer Assistance
Experiencing issues with unexpected malware infections, persistent adware popups, or security software licensing? Access our verified resolution guides and official customer support helplines:
- TotalAV Customer Service & Official Helpline Directory — Direct phone contact, toll-free hours, and live escalation paths.
- Total AdBlock Support & Pop-up Removal Guide — Resolve aggressive browser redirects, filter bypasses, and extension activation.
- TotalAV Billing Inquiry & Invoice Verification — Address unexpected recurring charges, dispute duplicate transactions, and manage auto-renewal.
- TotalAV Refund Help Desk & 30-Day Guarantee — Step-by-step money-back claims, PayPal dispute routing, and bank charge reversals.
- TotalAV Cancellation Troubleshooting (When Cancellation Fails) — Bypass account lockouts and force subscription termination cleanly.
- TotalAV Account Recovery & Login Issue Resolver — Password reset links, 2FA recovery, and compromised dashboard mitigation.