We are publishing these guidelines in order to allow our customers and partners to determine if a software should be classified as PUP (Possibly Unwanted Program). G DATA analysts strongly adhere to these guidelines whenever they issue a PUP verdict to software we analyze at G DATA.
However, this is not limited to single instances of the software itself but also encloses
the behavior of the company behind the software. Usage of a software boils down to a consensual contract between two parties, the user and the software developer/vendor/distributor, subsequentially called distributor in this document.
All features in a software cost time and money for development, testing and maintenance.
Therefore it is highly unlikely that commercial software includes unnecessary features.
Therefore all features encountered have to be assumed added for specific purposes.
That said it is possible for mistakes to happen, however mistakes are expected to be fixed especially if they are to the disadvantage of the user. Repeated "mistakes" that disadvantage users are highly unrealistic.
If a software violates one or several of the following rules, a classification by G DATA as “potentially unwanted” is very likely. Customers who still want to continue using such software can always choose to do so by disabling the detection of “potentially unwanted programs” in G DATAs Antivirus software suites.
Hereby defined as "wrongful or criminal deception intended to result in financial or personal gain." Fraud is always intentional, any kind of fraud will result in a PUP classification or worse.
Examples of fraudulent software behavior:
Hereby defined as "giving the wrong idea or impression”. Misleading a user is not necessarily happening intentional, it can be the result of a bad choice of words, for example due to bad translation. However, if we find misleading information to be intentional we will classify software as potentially unwanted.
Intention may be difficult to prove, but some examples of where information about misleading users can be found are
- software/hardware environment
Purposes of a software can be divided in 2 categories: purpose for user benefit and purpose for distributor benefit.
For software to be viable it has to have user benefit or else no one is willing to use it. On the other hand the software must give the distributor some benefit or development of the software was a waste of time and money. In most cases software is intended to generate some kind of revenue.
For a fair contract the benefits for both benefits have to be balanced.
If the balance however tilts too heavily in direction of the distributor then there is a higher chance that this software is potentially unwanted.
Offers the software makes during/after installation, runtime or uninstall are also counted as advertisement.
Advertising can be divided into 2 categories:
Advertising promoting the software/service
A) Affiliate Marketing usually advertises the software
a. It is the distributors responsibility for keeping affiliates in line, violations against these guidelines from affiliates will also result in a “potentially unwanted” verdict for the software developer and distributor
b. Affiliates cannot be used as an excuse for unwanted installations
c. Affiliates must not violate any of the ad rules laid out in the section for advertising done by the software/services below
B) Self-advertising in other software from the same vendor
Advertising done by the software/service
Environmental awareness can be used legitimately to provide the correct language and files for the operating system.
However it is often used by potentially unwanted software as a means to determine which offensive behavior can be done without being detected. This is equal to using a defeat device as in the Volkswagen Diesel scandal. When detecting that the software runs In a test environment, the software behaves differently than on potential customers PCs.
1. Examples of detected environments:
2. Examples of differing actions
There are very few legitimate use cases for silent installation features of common installers like Innosetup. The most common legitimate case is the deployment by a network administrator. However, in this case the AUP and EULA of the software in question need to explicitly label the software as intended for business use.
Mostly silent installation features are used so affiliates can install without proper user consent.
The EULA (End User License Agreement) must not contain anything surprising or anything violating the law in the country the software wants to be used in. All surprising or unreasonable items are illegitimate. Examples for such items are:
Everything that additionally benefits the distributing party must be explicitly declared during the installation process outside the EULA, for examples see above paragraph.
a. This means everything that any additional data gathering that is not necessary for the application to function must be opt-in (the user has to actively set it to active) and it must be explained in the installation dialogue in a way that everybody can understand it and the resulting consequences
b. Examples of data collection that should be explained properly if used:
The nature of the software must be made clear during installation. This means it must be explicitly made clear if it is a full or trial version and which features and functionality are given and which restrictions are in place.
Trial versions are not entitled to any kind of compensation from the user except for contact information, they must not monetize in any way until user decides to upgrade to the full version. If an application wants to monetize without a trial period don’t call it a “trial” period. Call it Freemium.
Autostart entries must be justified and necessary for the application to function. Examples of possible autostart entry locations are:
Examples of legitimate autostart entries are:
Example of non-legitimate autostart entries:
During runtime a software must work as promised to reach the users expectations and the user benefit. Any functionality that does not work towards these goals must be justified.
Examples of justified distributor benefit:
Uninstallation must be easy to find and execute.
Website and/or web shop represent the company and the software.
- Examples of illegitimate website/web shop practices:
The history and reputation of a distributor and its software can tell about the distributors stance in the present as well as how the software may behave.
Depending on the history a distributor has a different level of credibility. A vendor will get low credibility by:
Vendors are able to get high credibility within the industry when they