Start your 3-day free trial
Sign up to experience all premium features at no cost.
*Available only to new users. Each user is limited to one trial.
What Is Adware, and How Do You Get Rid of It?
Marcus Reid
October 5, 2026· 9 min read
Adware is software associated with unwanted advertising behavior, such as inserting ads into pages or pushing ads beyond the experience you knowingly accepted. An application funded by clearly disclosed advertising is not automatically malicious. Microsoft distinguishes malware from potentially unwanted applications (PUA), including software that inserts advertisements or bundles other software. PUA is not classified as malware in its criteria, although it can create unwanted effects.［1］
Before removing anything, identify where the advertisement appears. A website notification, browser extension, installed application, and malicious advertisement on an otherwise legitimate site are different paths. Cleaning the wrong layer may change your homepage while leaving the actual source active. Do not install a “cleaner” offered by the suspicious advertisement itself.
Key Takeaways
- Ads alone do not establish an adware infection; consent, control, and actual behavior matter.
- Notifications can continue after you close a website without proving that malware is installed.
- Find the source, remove the unwanted component or permission, then verify the result.
- A browser reset is not the same operation as uninstalling an application or recovering an account.
When do ads become an adware problem?
Normal advertising is part of a disclosed service experience. Unwanted behavior may include inserting ads into unrelated pages, changing browser settings without meaningful agreement, or making it difficult to decline or remove a component. Microsoft's criteria emphasize user choice, control, clear installation, and uninstall behavior.［1］ The distinction is about what the software does, not how annoying a single advertisement feels.
PUA is a classification that can vary between security products. A detection tells you what that tool decided about the item under its criteria. It is useful evidence, but it does not mean every PUA has the capabilities of a password stealer. Conversely, avoiding the malware label does not make an unwanted installation harmless or appropriate to keep.
A Trojan can disguise a download that delivers adware. Spyware focuses on information collection, a rootkit on hiding activity, and a computer worm on self-copying propagation. Do not infer those additional functions simply because ads appeared.
Is it adware, a notification, or malvertising?
Use the location and timing of the symptom to choose your first check. A notification permission can let a site send messages when its tab is closed. An extension can change pages you visit. An installed app can produce windows outside the browser. The visible appearance may be similar while the recovery task differs.
| Behavior | First place to investigate | What the observation does not prove |
|---|---|---|
| Alerts name a website after its tab closes | Browser notification permissions | That a malicious application is installed |
| Ads are inserted across unrelated pages | Extensions and recent installations | Which component is responsible without checking |
| Windows appear outside the browser | Installed applications and startup behavior | That resetting one browser will remove the source |
| A suspicious ad appears on one site | The page and its advertisement | That your device is infected |
| Homepage or search changes unexpectedly | Extensions, apps, and browser settings | That passwords were stolen |
Malvertising is the use of advertising to deliver malicious content or lead people into an attack. It can appear through advertising systems without an adware installation on your computer. Do not click the ad to test whether it is dangerous. Close it and investigate independently if you interacted with a download or granted access.
An unfamiliar browser notification can be a permission problem rather than malware. Revoking that site's permission addresses the notification channel. If you also installed software from the same page, that installation still needs its own investigation; stopping the visible alert does not establish that every effect is gone.
Which adware symptoms help locate the source?
Record the browser profile, the site or app showing the message, and whether it happens with the browser closed. A screenshot or the displayed sender can help a trusted support person understand the context. Avoid including private messages or account details when you share evidence.
Compare the start of the problem with recent downloads, extensions, and permission prompts. Correlation helps narrow a check but does not prove causation. A browser update and an unwanted extension may have happened on the same day; do not remove security updates just because the dates match.
A security finding with a component name and file path is more actionable than a generic advertisement saying your computer is unsafe. Preserve the finding and its cleanup result. If a managed extension or company policy controls a setting, ask the administrator instead of treating every enforced setting as a hijack.
Use the guide to checking browser extension safety for the extension-specific decision. Permissions and a recognizable publisher are inputs to that decision, not guarantees that an extension is appropriate for every task.
What is a safe adware removal sequence?
The following sequence is for a personal device you manage. On a workplace computer, contact the administrator before uninstalling managed applications or resetting a profile. If a message demands payment, asks for a phone call, or offers to repair the device remotely, stop interacting with it and open trusted support separately.
- Identify the channel without clicking the ad. Note where it appears, which profile is active, and whether a sender or application is named. Close the suspicious page. Do not approve a download, call its support number, or grant remote access just to investigate.
- Review permissions and extensions. Revoke unwanted site notification permission when that is the source. Review recent extensions and remove those you did not authorize or no longer need. Check every affected browser profile; changes in one profile do not necessarily affect another.
- Remove unwanted applications. Use the operating system's normal uninstall mechanism for the relevant software. Google recommends checking and removing unwanted programs before resetting Chrome settings.［3］ If ownership is unclear or removal fails, seek trusted assistance rather than deleting arbitrary system files.
- Update protection and scan. Use the installed security application and follow its findings. Microsoft explains how PUA protection can block potentially unwanted apps and downloads on supported configurations.［2］ A protection setting is preventive; turning it on does not by itself prove that an existing unwanted component was removed.
- Reset browser settings if the problem remains. Follow your browser's official reset instructions after addressing unwanted programs. Save necessary information and understand the effect on settings, extensions, and permissions before proceeding. Google describes Chrome reset as part of this cleanup path.［3］ It is not a full operating-system cleanup.
- Verify and recover affected accounts when relevant. Reopen normal pages without the suspicious component and check whether the same symptom returns. If you entered credentials into a deceptive page or a security finding indicates collection, recover those accounts from a trusted device. Do not reset every password merely because a legitimate ad was displayed.
If the same detection returns after removal, or an unknown program keeps reinstalling the component, stop repeating superficial browser changes. Provide the saved details to a qualified support person. A symptom disappearing is useful, but the stronger question is whether the identified source was actually removed or its permission revoked.
How do you prevent a repeat installation?
Download applications from the real publisher and read installation choices rather than approving every bundled option. A large download button may be an advertisement instead of the file you intended to obtain. Navigate to the publisher yourself when a page offers an urgent update or browser repair.
Review extensions by purpose and permissions. Remove ones you do not use, but preserve tools required by an administrator until you clarify their ownership. For notifications, grant permission only to sites you want to hear from. Refusing a prompt is often the appropriate response when you do not need the feature.
Keep the browser, operating system, and security protection updated. Microsoft provides PUA protection controls, but availability and management depend on the device and configuration.［2］ Use your installed tool's report to verify outcomes rather than treating the existence of a setting as an assurance about past activity.
The digital privacy guide helps organize permission and account checks. Once the unwanted component has been handled, the explanation of VPN protection against hackers separates network protection from browser or application cleanup. A VPN cannot uninstall an extension, revoke a site notification permission, or certify that a download was safe.
Summary
Begin with the channel delivering the unwanted advertisement, not with an assumption that all ads are malware. Check permissions, extensions, and applications in that order as appropriate, use trusted security tools, and reset browser settings only as part of a targeted cleanup. Verify the source and treat account exposure as a separate question.
FAQ
Is every free app with ads adware?
No. Clearly disclosed advertising can be part of a legitimate service. The concern is unwanted behavior, missing control, deceptive installation, or advertising injected outside the experience you agreed to. Judge actual behavior rather than price alone.
Is PUA the same as malware?
Not in Microsoft's classification. Potentially unwanted applications can have unwanted effects without being classified as malware. A PUA detection still deserves review, but it does not automatically establish password theft or remote control.
Why do notifications appear after I close a website?
A site may have notification permission in your browser. Check the sender and revoke unwanted permission through browser settings. Continued notifications alone do not prove an installed infection; investigate any related downloads separately.
Does a Chrome reset remove all adware?
No. It changes browser settings and can help after unwanted software is addressed, but it is not the same as uninstalling every application. Another app or browser profile may retain the source of the problem.
Is a suspicious ad on a trusted site proof of infection?
No. Malicious advertising can arrive through advertising systems without an adware installation on your device. Avoid interacting with it, and investigate separately if you downloaded a file, entered credentials, or granted access.
Should I download the cleaner recommended by a pop-up?
No. Open your existing security tool or navigate to a trusted vendor independently. A pop-up claiming infection is not a reliable diagnosis, and its proposed cleaner may introduce another unwanted installation or scam.
Can a VPN remove unwanted browser advertisements?
A VPN is not an adware cleanup tool. It does not uninstall apps or extensions or remove site notification permission. Identify and address the source directly rather than assuming a different network route repairs browser state.
Disclaimer: This guide explains general security decisions; it is not an individual diagnosis. For a managed device, follow your organization’s incident-response instructions.
Sources
- How Microsoft identifies malware and potentially unwanted applications — https://learn.microsoft.com/en-us/defender-xdr/criteria
- Protect your PC from unwanted software — https://support.microsoft.com/en-us/windows/security/threat-malware-protection/protect-your-pc-from-unwanted-software
- Remove unwanted ads, pop-ups & malware — https://support.google.com/chrome/answer/2765944?hl=en
Sources checked 5 October 2026
