Adware and Potentially Unwanted Programs Guide: Risks, Detection and Removal

Adware and potentially unwanted programs (PUPs) are routinely dismissed as nuisances, yet they install without clear consent, collect browsing data, weaken browser security and can hand an attacker a foothold. Security vendors deliberately classify them separately from malware, which means many organisations leave PUP detection in audit mode or switched off. This guide explains how vendors define adware, PUPs and potentially unwanted applications (PUAs), how bundlers, browser hijackers and malicious extensions work, why they matter as an initial access and data collection risk, and how to detect, remove and prevent them with specific Microsoft Defender, Edge and Chrome policies. It is written for endpoint engineers, SOC analysts and IT administrators, and takes a defensive view throughout.

Key takeaways

• PUA is a policy category, not a harmless one. Microsoft's criteria cover advertising, bundling, marketing (activity monitoring), evasion, cryptomining and torrent software; none is classed as malware, so blocking them is a choice you must make.
• Turn PUA protection to block. Microsoft Defender Antivirus exposes PUA protection as Disabled, Audit or Block; the default depends on platform and onboarding, so set it explicitly and verify with Get-MpPreference.
• The browser is the main battleground. Ad injectors, search hijackers and malicious extensions live in the browser, so extension allowlisting through ExtensionSettings is often the single most effective control.
• Removal is more than uninstall. Adware leaves scheduled tasks, browser policies, proxy settings and, in the Superfish case, trusted root certificates that survive uninstallation.
• Treat repeated PUA detections as a signal. They show where users can install software freely and where malvertising or bundled downloads reach the estate, which is the same path real malware takes.

Definitions: adware, PUP, PUA and grayware

Vendors use different names for broadly the same territory: software that is not clearly malicious but behaves in ways users and administrators did not agree to. "PUP" is common in consumer products, Microsoft uses "PUA", and some vendors use "grayware" or "riskware". The labels matter because they map to separate detection settings.

• Where the line with malware sits: once software steals credentials, opens remote access or downloads arbitrary payloads, it is malware, whatever its origin. Many adware families have crossed that line over time. See the Malware Guide for how analysts classify by behaviour rather than label.
• Why vendors separate them: PUPs are often distributed by registered companies with licence agreements, so vendors apply criteria (consent, disclosure, removal) rather than intent. Google's policy, for example, expects transparent installation, simple removal, clear behaviour, disclosed data collection and authorised bundling.

How adware and PUPs arrive

For the delivery side in more depth see the Malvertising and SEO Poisoning Guide and the Drive-by Downloads Guide.

Why PUPs are a security problem

• Data collection: marketing software and many extensions record browsing history, search terms and page content. On a corporate device that can include internal URLs, SaaS tenant names, ticket contents and customer data visible in the browser.
• Weakened TLS: CERT/CC note VU#529496 describes how Superfish VisualDiscovery, bundled on Lenovo consumer systems in 2015, used Komodia's Redirector SDK to inject ads into HTTPS traffic by installing a root CA certificate whose private key was hard-coded and publicly disclosed. An attacker could spoof HTTPS sites on affected machines without certificate warnings, and uninstalling the application did not remove the root certificate.
• Session and token theft: an extension with host permissions on all sites can read cookies and page data. In the Cyberhaven Chrome extension breach, a phished OAuth consent gave attackers rights to publish an update; the malicious version harvested Facebook access tokens and cookies for about 30 hours before removal. Any extension that can update itself is a supply chain dependency.
• Initial access path: PUP installs show that users can run unvetted installers from the internet. The same path delivers loaders and infostealers, and infostealer logs are a major source of the credentials used against cloud and SaaS accounts. See the Infostealer Threat Guide.
• Evasion and persistence: evasion software is a PUA category precisely because it behaves differently when security products are present. Adware commonly persists through scheduled tasks, services, Run keys and browser policy entries.
• Operational cost: slow devices, helpdesk tickets and cryptomining power use are real costs, but they are the least important reason to act.

Where identity fits

The highest-impact data a browser extension or ad injector can reach is not browsing history but session cookies, OAuth tokens and saved passwords for SaaS and cloud consoles. A stolen session cookie bypasses MFA until it expires. Administrators and developers are the priority: their browsers hold sessions for identity providers, cloud consoles and code repositories, and some extensions store their own API keys. Apply the strictest extension policy to privileged users, keep admin work in a separate browser profile or hardened browser, and revoke sessions and tokens after any confirmed malicious extension, not only the extension itself. See the Browser Extension Security Guide and the AI Browser Extensions Security Guide.

Detection

Microsoft Defender PUA protection

• Group Policy: Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus > Configure detection for potentially unwanted applications, set to Enabled with Block or Audit Mode (in the Windows 10 version 1809 administrative templates and later).
• PowerShell: Set-MpPreference -PUAProtection Enabled (block), AuditMode (detect and log) or Disabled; Get-MpPreference returns PUAProtection as 0 (off), 1 (block) or 2 (audit). Intune, Configuration Manager and Defender for Endpoint security settings management can also set it.
• Defaults: Microsoft documents that defaults vary. Devices onboarded to Defender for Endpoint are in audit mode in most scenarios and in block mode on recent platforms with security intelligence 1.329.495.0 or later; Configuration Manager enables PUA protection by default. Never assume: report the actual value per device.
• Events: PUA detections are recorded in the Windows event log under event ID 1160, which can feed SIEM alerts and email notifications.
• Edge: Microsoft Defender SmartScreen in Chromium-based Edge can block PUA downloads and associated URLs. It is off by default from Edge 80.0.361.50; enable it centrally with the SmartScreenPuaEnabled policy rather than relying on users to find Settings > Privacy, search, and services > Security > Block potentially unwanted apps.

Other signals

Removal

1. Scope: query EDR and inventory for the same publisher, file hash, extension ID or scheduled task across the estate. PUPs rarely arrive on one device only.
2. Quarantine with the security tool first: let Defender or the EDR remove detected components so the action is logged; use the vendor uninstaller only where the security tool does not detect it.
3. Clean the browser: remove extensions centrally (Edge supports installation_mode removed, which uninstalls a previously installed extension; in Chrome, set the extension ID to blocked in ExtensionSettings), reset search provider and start pages through policy, revoke notification permissions, and remove any browser policy keys the adware wrote.
4. Remove persistence: scheduled tasks, services, Run and RunOnce keys, startup folder items and proxy or PAC settings.
5. Check trust stores: remove any root certificate the software added. CERT/CC's Superfish note is the reference case: uninstalling the program left the certificate trusted.
6. Rotate exposed credentials: where an extension had broad host permissions or showed data exfiltration, revoke browser sessions, OAuth tokens and saved passwords for the user, starting with identity provider and cloud admin sessions.
7. Decide on reimage: reimage when evidence shows the software downloaded further payloads, disabled security tools or touched credentials; a clean uninstall is acceptable for simple adware with no such behaviour.
8. Close the entry path: record how it arrived (bundle, ad, extension store) and change the control that allowed it.

Enterprise prevention controls

• Standard user rights: users without local admin rights cannot install most bundled software system-wide, although per-user installers and extensions still work. See the Windows Endpoint Hardening Guide.
• Application allowlisting: App Control for Business (WDAC) or AppLocker in audit and then enforce mode stops unapproved installers running from user-writable paths. See the Application Allowlisting Guide.
• Approved software portal: give users a self-service catalogue of vetted installers so they have no reason to search the web for downloads.
• Extension allowlisting: in both Chrome and Edge, the ExtensionSettings policy accepts a "*" default scope and per-extension IDs. Set {"*":{"installation_mode":"blocked"}} and allow approved IDs individually; add blocked_install_message with how to request an exception. In Chrome the policy lives under Administrative Templates > Google > Google Chrome > Extensions > Extension management settings; in Edge under HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionSettings.
• Permission and host controls: use blocked_permissions to stop extensions that request specific API permissions, and runtime_blocked_hosts to keep all extensions away from identity provider, admin and finance sites. In Edge, minimum_version_required disables outdated versions and allowed_types limits what types can be installed.
• Update pinning: Chrome's override_update_url lets you serve extension updates from a controlled location, so a hijacked store update does not reach the estate before review. This trades speed of fixes for control; use it for high-risk, high-permission extensions.
• Browser hardening: manage search provider, home page, notification permissions and SmartScreen or Safe Browsing through policy. See the Browser Security Hardening Guide and the Enterprise Browser and Browser Security Guide.
• Network filtering: DNS and URL filtering for known adware, ad-injection and fake download domains.
• Clean images: deploy a corporate image rather than the manufacturer's consumer build, and monitor the trusted root store against a baseline.

Choosing an approach

Allowlisting beats blocklisting for extensions because new malicious or hijacked extensions appear faster than lists update. Blocklisting is a reasonable first step where the business cannot yet absorb an approval process.

Rolling out PUA and extension controls

1. Inventory (weeks 1 to 2): export installed extensions and software across managed browsers and endpoints; set PUA protection to audit everywhere and collect event ID 1160 detections.
2. Analyse (weeks 2 to 4): rank extensions by install count and permissions; identify business-critical ones and any with all-sites access. Review PUA audit hits for legitimate tools that need exclusions.
3. Pilot (weeks 4 to 6): enable PUA block and an extension allowlist for IT and security staff, then one business unit. Publish the request process and expected turnaround.
4. Enforce in rings: extend to the wider estate in rings, with privileged users and developers covered by the strictest policy early.
5. Validate: on sample devices, check chrome://policy or edge://policy shows ExtensionSettings with status OK, and Get-MpPreference shows PUAProtection 1.
6. Roll back: if a business-critical tool breaks, add a narrow exclusion or allow the single extension ID rather than reverting to audit for everyone; Set-MpPreference -PUAProtection AuditMode or removing the default block scope is the full rollback.

Metrics

• PUA block coverage: % of managed Windows devices with PUAProtection set to block (target: above 98%).
• Extension policy coverage: % of managed browsers with an ExtensionSettings default scope applied.
• Unapproved extensions: count of installed extensions not on the allowlist, trending to zero after enforcement.
• Detection rate: PUA detections per 1,000 devices per month, and the share blocked rather than audited.
• Time to remove: median hours from a malicious extension being identified to removal across the estate.
• Repeat infections: devices with more than one PUA detection in 90 days, which points at a user or entry path to fix.

Framework mapping

Common failure patterns

• Leaving PUA protection in audit: detections pile up in the event log and nobody reviews them. Set block after a short audit period and alert on event ID 1160.
• Trusting store listings: treating an extension as safe because it is in the Chrome Web Store or Edge Add-ons. Legitimate extensions can be sold or hijacked; the Cyberhaven case shows a reputable security vendor's extension being updated with malicious code through the official store.
• Blocklist only: blocking known bad extension IDs while allowing everything else, so every new adware extension is allowed until someone notices.
• Uninstall without cleanup: removing the program but leaving root certificates, proxy settings, scheduled tasks or browser policy keys, as the Superfish advisory warned.
• Ignoring unmanaged browsers: policies apply to the managed browser while users run a second browser or profile with no policy. Inventory all installed browsers and either manage or remove them.
• Not rotating credentials: removing a malicious extension but leaving the sessions and tokens it could read valid.

Practitioner checklist

• Set Microsoft Defender PUA protection to block on all managed Windows devices and report the actual PUAProtection value per device.
• Enable SmartScreenPuaEnabled in Edge and equivalent safe browsing protection in other managed browsers.
• Forward event ID 1160 and EDR PUA detections to the SIEM with an alert for repeat devices.
• Apply an ExtensionSettings default of blocked with a per-ID allowlist and a clear exception request message.
• Block high-risk extension permissions and keep extensions away from identity provider, admin and finance sites with runtime_blocked_hosts.
• Remove local admin rights and enforce application allowlisting for user-writable paths.
• Provide an approved software portal so users do not download installers from search results.
• Baseline and monitor the trusted root certificate store and proxy settings on endpoints.
• Include session, token and password revocation in the removal playbook for malicious extensions.
• Inventory every installed browser and profile, and manage or remove unmanaged ones.

Standards and references

• Microsoft Learn: Detect and block potentially unwanted applications with Microsoft Defender Antivirus
• Microsoft Learn: How Microsoft identifies malware and potentially unwanted applications
• Microsoft Learn: Detailed guide to the ExtensionSettings policy for Microsoft Edge
• Google Chrome Enterprise Help: Manage extensions using the ExtensionSettings policy
• Google: Unwanted Software Policy
• NIST: SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops
• CERT/CC: Vulnerability Note VU#529496 (Komodia Redirector SSL Digestor, Superfish)
• MITRE ATT&CK: Software Extensions: Browser Extensions

Related NHI Mgmt Group resources: Malware Guide · Browser Extension Security Guide · Application Allowlisting Guide · Malvertising and SEO Poisoning Guide · Infostealer Threat Guide