An Unwanted Program Running On A Computer Is Called A

That mysterious process eating 40% of your CPU. The browser toolbar you never installed. The popup claiming your drivers are outdated — right after you installed a free PDF converter.

You didn't ask for any of it. But it's there, running in the background, slowing things down, maybe watching what you type.

So what do you actually call it?

What Is an Unwanted Program

The short answer: malware. But that's like saying "vehicle" when someone asks what just hit their car. Technically true. Useless in practice.

Security researchers break unwanted software into categories based on what it does* and how it got there*. The distinctions matter because they determine how you remove it — and whether your antivirus will even flag it.

Malware (the umbrella term)

Short for malicious software. That said, any code designed to harm, exploit, or compromise a system without informed consent. In real terms, viruses, worms, ransomware, trojans, rootkits — all malware. But not all unwanted programs are malware in the strict sense.

PUPs — Potentially Unwanted Programs

This is the category most people actually deal with. The term was coined by McAfee years ago to describe software that isn't overtly malicious but behaves in ways users didn't agree to.

A PUP might:

• Change your default search engine
• Install a browser extension you didn't ask for
• Show ads in places ads don't belong
• Bundle itself with legitimate installers
• Collect "anonymous usage data" that isn't so anonymous

The key word is potentially*. Antivirus vendors hesitate to nuke PUPs automatically because false positives generate support tickets. Some users want* that PDF toolbar. Some want the coupon printer. So they flag them, maybe quarantine them, often leave the decision to you.

Adware

Software whose primary purpose is serving advertisements. Sometimes it's upfront — a free game that shows banner ads between levels. Which means that's a fair trade. You know the deal.

But adware crosses the line when:

• It injects ads into websites that don't have them
• It redirects searches through affiliate links
• It runs hidden background processes fetching ad payloads
• It persists after you uninstall the "host" application

At that point it's not a business model. It's an infection.

Spyware

Software that monitors user activity and sends data elsewhere. Keyloggers. But screen scrapers. Clipboard hijackers. Form grabbers that steal credentials before encryption.

Some spyware is commercial — "employee monitoring tools," "parental control apps," "anti-theft software.Plus, " The line between legitimate and criminal is often just who installed it and why*. The code can be identical.

Browser Hijackers

A specialized PUP that takes over browser settings. Here's the thing — homepage. Also, new tab page. Default search engine. Sometimes the proxy configuration. They're stubborn because they often use browser policies, scheduled tasks, or modified shortcuts to reinstate themselves after you "fix" things.

Scareware / Rogue Security Software

Fake antivirus. Fake system optimizers. Fake driver updaters. That said, they run a "scan," find hundreds of "critical errors," and demand payment to fix them. Which means the errors don't exist. The software does nothing — or installs more PUPs.

Cryptojackers

Scripts or binaries that mine cryptocurrency on your hardware. Installed ones persist via services, scheduled tasks, or WMI event subscriptions. You pay the electricity bill. Browser-based ones die when you close the tab. They keep the coins.

Why It Matters

"I'll just ignore it. Computer still boots."

That works until it doesn't.

Performance Death by a Thousand Cuts

One PUP uses 2% CPU. Here's the thing — three browser extensions use 5% each. Think about it: a cryptojacker spikes to 80% when you're idle. A spyware process wakes every 30 seconds to upload logs. Your SSD wears faster from constant telemetry writes. On top of that, your laptop fan never stops. Battery life halves.

You don't notice the day it happens. You notice six months later when the machine feels "old."

Privacy Isn't Abstract

That "anonymous usage data" PUPs collect? Screen resolution. Hardware IDs. Installed software list. That said, it builds a fingerprint. Timezone. And plugin list. Day to day, network names. So browser version. Combined, it's uniquely you — no name required.

Data brokers pay for this. Advertisers pay more. Bad actors pay most.

The Gateway Problem

PUPs lower defenses. They disable Windows Defender via group policy. They add certificate authorities to the trusted root store. And they open firewall ports. They install root certificates that let attackers intercept HTTPS.

A "harmless" toolbar today becomes the entry point for ransomware tomorrow.

Legal and Compliance Risk

If you manage computers for a business — even a small one — PUPs on employee machines can violate GDPR, CCPA, HIPAA, PCI-DSS. Because of that, "I didn't install it" doesn't hold up in an audit. You're responsible for what runs on your network.

Want to learn more? We recommend what two major rivers flowed through central china and identify the components contained in each of the following lipids for further reading.

How They Get In

Nobody wakes up thinking "I'll install some spyware today." The delivery mechanisms are designed to bypass consent without triggering suspicion.

Software Bundling

The classic. The installer offers "Express (Recommended)" and "Custom." Express installs the converter plus* a search toolbar, a registry cleaner, and a browser extension. You download a legitimate tool — say, a video converter. Custom might* let you uncheck them — if the checkboxes aren't grayed out, hidden below the fold, or worded to confuse ("Uncheck to not install the free bonus!").

Major download portals (CNET, Softonic, SourceForge at various times) wrapped open-source installers with their own bundlers. The developers never saw a dime. Users got infected.

Fake Update Prompts

You visit a compromised site. Here's the thing — a popup mimics a Flash Player update. Plus, or a browser update. Or a "missing codec." The button says "Install Update." The file is a downloader that fetches the real payload.

These work because they exploit trust in familiar brands — and urgency. Consider this: "Your browser is out of date! Security risk!

Malvertising

Legitimate ad networks serve malicious ads. Which means you visit a clean site — news, weather, reference. An ad slot loads a script that fingerprints your browser, checks for vulnerabilities, and either exploits silently or redirects to a scareware page.

No click required. Just loading the page.

SEO Poisoning

Attackers create pages targeting popular software searches — "VLC download," "Chrome installer," "TeamViewer free." They rank via link farms, expired domains, or hacked sites. The download button serves a wrapped installer or a completely different payload.

Social Engineering

"Your computer has a virus! Call this number.In real terms, " The "tech support" scammer convinces you to install a remote access tool. They "fix" things — installing PUPs, disabling protections, creating admin accounts for later.

Supply Chain Compromise

Rare but devastating. Plus, a legitimate software vendor's build server is hacked. In real terms, cCleaner (2017), SolarWinds (2020), 3CX (2023) — real examples. The signed, verified update delivers malware. Your "trusted" software becomes the vector.

Common Mistakes / What Most People Get Wrong

"My Antivirus Would Catch It"

Antivirus relies on signatures, heuristics, and behavior monitoring. PUPs often evade

Antivirus relies on signatures, heuristics, and behavior monitoring. PUPs often evade detection by masquerading as legitimate components, employing code obfuscation, and leveraging “living‑off‑the‑land” binaries that already exist on the host. Which means because they are installed with the user’s consent — however coerced — they rarely exhibit the outright malicious behavior that triggers a traditional alert. Instead, they blend into everyday processes, use legitimate installer frameworks, and sometimes even carry a digitally signed binary that passes the cryptographic checks performed by security tools.

A common shortfall is the reliance on signature‑based scanners. Since many PUPs are crafted anew for each campaign, their binaries do not match known patterns, and heuristic engines may struggle to differentiate them from benign utilities that share similar code‑reuse techniques. So naturally, a clean‑looking installation can slip past the first line of defense, only to surface later as an unwanted toolbar, a persistent background service, or a cryptocurrency miner that silently consumes resources.

Another frequent misstep involves ignoring the persistence mechanisms that PUPs establish. Worth adding: by adding themselves to startup folders, scheduled tasks, or registry run keys, they survive reboots and continue operating without further user interaction. Traditional endpoint protection that focuses solely on active processes may miss these dormant footholds, allowing the program to re‑emerge after a cleaning attempt.

User behavior also plays a critical role. Click‑through fatigue leads individuals to accept license agreements without scrutiny, while “Express Install” options present a one‑click path to completion. The lack of granular control during installation removes the opportunity to decline bundled components, effectively surrendering the decision to the installer’s design.

To mitigate these risks, organizations and individuals should adopt a layered approach:

• Application whitelisting – Permit only approved executables to run, blocking unknown or unsigned binaries from executing automatically.
• Least‑privilege principles – Run daily applications with restricted rights, preventing PUPs from modifying system locations or registry keys that require elevated access.
• Behavior‑based monitoring – Deploy endpoint detection and response (EDR) solutions that flag anomalous modifications such as unexpected startup entries, network connections to little‑known domains, or sudden spikes in CPU usage.
• Patch management – Keep browsers, plugins, and operating system components up to date, reducing the attack surface that malvertising and drive‑by exploits rely upon.
• Secure installation habits – Choose “Custom” installers, review each offered component, and decline any optional software that is not essential. When in doubt, abort the installation and seek an alternative source.
• Network filtering – Block outbound traffic to known malicious domains and enforce DNS‑based reputation services, limiting the ability of PUPs to communicate with command‑and‑control servers.

By combining technical controls with informed user practices, the likelihood of inadvertently inviting unwanted programs onto a device drops dramatically. Awareness of the delivery tactics, recognition of the subtle signs of persistence, and a proactive security posture together form a reliable defense against the ever‑present threat of bundled and disguised PUPs.

To keep it short, the notion that “I didn’t install it” offers no protection in a compliance audit. Worth adding: the responsibility rests on every user and administrator to understand how these programs infiltrate systems, to implement safeguards that restrict unauthorized execution, and to maintain vigilant monitoring. Only through disciplined habits and layered defenses can the risk posed by PUPs be effectively contained.