How do I detect PUP/PUA as infected?

Description:

PUP stands for Potentially Unwanted Program

PUA stands for Potentially Unwanted Application

Software that isn't malicious by definition but could be, it is often:

• Installed without clear user consent

• Bundled with other software

• Performs unwanted behavior (e.g., showing ads, tracking activity, slowing performance)

Common Examples:

• Toolbars or browser hijackers (e.g., search engine changers)

• Adware (injects ads or pop-ups)

• System optimizers or registry cleaners (that fake "problems" to upsell)

• Fake antivirus or driver updaters

• Software that installs background processes without notice

How do I mark these detections as infected?

By default, PUP/PUA are labeled in their own category. MetaDefender Core separates unwanted detections into three categories: Suspicious, Infected, and PUP/PUA.

To place PUP/PUA into the infected category, please check the box below on the engine [not available for all engines].

Example:

Use case:

If you have a threshold built into the workflow to only mark a file as “Infected” if x or more engines find a malware signature, PUP/PUA will now be included in this detection threshold.