What is adware? Your complete guide to protection and security

Every day ads are a normal part of using the internet. You’ll likely encounter them every time you open your browser. However, if you’re constantly seeing pop-ups and intrusive ads, you might have an adware infection.

This guide explains what adware is, how it works, and how to remove it. We also offer practical steps to prevent it from infecting your devices in the future.

What is adware?

Adware, or advertising-supported software, is software designed to deliver ads to a user. While it can have legitimate purposes, like advertising useful services or helping developers earn revenue, it can also be used for malicious purposes, such as making changes to your browser or harvesting data without your permission.

Key characteristics of adware

• Displays ads: As the name suggests, adware’s main purpose is to display ads, which often take the form of intrusive pop-ups.
• Changes browser settings: Some adware can change web browser settings or install unwanted toolbars, bookmarks, and extensions.
• Often operates without consent: While some adware is legitimate and asks for consent before installing, most adware apps infect machines without approval or make the ‘opt out’ option small and difficult to see.

Types of adware

There are two main types of adware: legitimate adware and malicious adware. Both can fall under the category of potentially unwanted programs (PUPs) or applications (PUAs), since they’re often installed without users fully realizing it. The main difference between the two types is intent. Legitimate adware focuses on showing ads to generate revenue, while malicious adware is designed to track, manipulate, or harm users for profit.

Legitimate adware

Legitimate adware installs alongside other programs when you accept installation terms, often without you noticing. It’s usually bundled with free apps to help developers earn revenue by promoting related products or sponsored services.

Although this kind of adware isn’t built to steal data or damage your system, it can still be annoying. It may slow performance, clutter your device with ads, or interrupt normal use.

Malicious adware

Malicious adware is more aggressive. It installs without your consent, often hidden in software downloads or fake updates, and can alter browser settings, track your activity, or distribute other malware.

Unlike legitimate adware, malicious versions are specifically designed to deceive or exploit users, posing a greater risk to your privacy and device security.

History of adware

The earliest examples of adware appeared in the 1990s, and many of these early programs weren’t seen as malicious. Developers often bundled them with freeware or shareware to promote their own products or those of partner vendors.

At the time, adware rarely caused problems. Over the years, however, many forms became more intrusive. Some ads grew larger and more persistent, often appearing as pop-ups or banners, while bad actors began hiding adware inside unrelated downloads to trick users into installing it.

As adware’s capabilities expanded, some versions started changing browser settings, adjusting home pages, and harvesting data. In certain cases, adware even exposed systems to other malware infections.

Who do adware authors target?

For the most part, adware authors target individual users, rather than businesses. They can target users on all major devices, from computers and laptops to phones and tablets, and impact all major web browsers, from Safari to Chrome.

How does adware work?

Once installed on a device, adware typically activates when you open a web browser. When you search, click a link, or visit a site, pop-ups or new tabs may open, redirecting you to pages you had no intention of visiting. These ads or redirects are often designed to trigger an immediate response, using tactics that range from enticing offers to alarming security warnings.

Some forms are relatively harmless, promoting a company’s own products or services. Others can lead to malicious websites that expose you to phishing attacks or additional malware infections.

While adware mainly targets the user, it also distorts the online advertising ecosystem. By generating fake engagement or misleading clicks, it can make ad campaigns look more successful than they are. In the process, legitimate advertisers lose money on traffic that never translates into real customers.

How adware infects devices

There are two primary ways in which adware infects devices: it’s either bundled alongside free software or installed onto systems in a drive-by download. Here’s a closer look at both of these methods.

Bundling with free software

There are plenty of programs that are completely free to download and use, but developers want to make money from them. Many of them use adware to do so, attaching either legitimate adware apps or PUAs/PUPs to their files. The adware vendor pays the developer to bundle their adware with the program, and the user starts seeing ads for products or services they may or may not have any interest in.

Drive-by downloads

Drive-by downloads occur when users unintentionally install unwanted and often malicious programs, including adware, on their devices just by visiting a website. They don’t have to click or accept anything for the download to occur, so they often have no idea it’s even happening.

Common symptoms and signs of adware infection

Adware is often easy to spot. Here are some of the most common signs of an infection:

Increased pop-ups and ads

Adware often manifests in the form of pop-ups, sometimes in excessive amounts and without warning. These pop-ups can get in the way when you’re simply trying to browse the web or enjoy online activities. On mobile platforms, adware can result in unwanted push notifications on a regular basis.

Slower browsing experience

Adware often causes performance problems, which are linked to the numerous ads and pop-ups appearing whenever you try to use your device or browse the web. All those ads consume resources, so your device will run more slowly, websites will take longer to load, and you might notice your device getting noisy or overheating.

Browser changes

Many forms of adware change your browser settings without your consent. So, the next time you open up your web browser, your home page might be different, or new tabs might redirect you to sites you didn’t want to visit. You may also notice new toolbars or extensions added to your web browser.

What can malicious adware do?

While some adware is mostly just annoying, showing unwanted pop-up ads or redirecting you to promotional pages, malicious versions can pose real risks to your privacy, security, and device performance. Here are some of the most common ways harmful adware can affect you.

Track activity

Some forms of adware can monitor your online activities to deliver more targeted ads to your device, including malicious ones that you'll be more likely to click. In some cases, your activity data may be shared with other advertisers or third parties without your consent.

Steal data

More intrusive variants may collect technical information, such as your IP address or general location, and in some cases, other details about your system or online behavior. This data can then be shared or sold, raising privacy concerns.

Increase exposure to malware

Though generally not its primary intent, adware can sometimes expose you to additional security risks. Poorly coded or deceptive adware may lead to system vulnerabilities or redirect you to malicious sites. This can make your device more vulnerable to other malware infections.

Cause performance issues

Adware, like any other piece of software, uses system resources like your CPU and RAM. That can lead to negative impacts on performance, like stutters and slowdowns when you’re trying to run applications or carry out tasks. The effects are most notable on older or weaker devices but can be apparent on modern systems.

Adware vs. spyware

Adware and spyware have several similarities. Both can install without your consent and run in the background without your knowledge. The main difference lies in their intent. Adware focuses on showing ads and collecting data to generate revenue, while spyware is designed to monitor your activity and steal personal information for malicious purposes.

When adware becomes so invasive that it secretly tracks users, gathers sensitive data, or manipulates system settings, it effectively crosses into spyware territory.

How to detect adware on your device

Detecting adware is the first step towards removing it. Once you know the warning signs and the right tools to use, you should be able to quickly and easily spot an infection.

Tools for adware detection

The most effective tool for detecting adware, especially the malicious kind, is a reputable antivirus program. These apps scan your system files against databases of known malicious code and blacklisted software, isolating anything suspicious. If the antivirus detects malicious adware, it usually allows you to safely remove it. However, even the best antivirus software can occasionally miss new or emerging threats, so it’s important to stay cautious and keep your security tools up to date.

Quick self-check methods

You may be able to detect adware by looking out for the main warning signs, like slow performance or unexpected browser changes.

How to remove adware (step-by-step)

If you suspect your device has been infected by adware, here are some actions you can take.

Automated adware removal (recommended)

The safest way to remove adware is by using reputable security software such as an antivirus or your device’s built-in malware removal tools. These applications are designed to detect and eliminate known threats, including adware that hides deep within your system files or browser settings.

Steps to remove adware safely:

1. Open your security program: Make sure it’s updated to the latest version so it can recognize the newest threats.
2. Run a full system scan: A quick scan might miss deeply embedded adware, so it’s best to check your entire device with a full scan.
3. Follow the cleanup instructions: If anything suspicious is found, use your software’s recommended option to quarantine or remove the threat.

After removal, it’s a good idea to restart your device and check that your browser settings are back to normal.

Manual removal

You can try removing adware manually, but we don’t advise it. The process can involve locating and deleting hidden files, extensions, or registry entries that may be critical to your device’s stability. Making the wrong change could cause software errors or even prevent your system from starting properly.

If you’re not experienced with advanced troubleshooting, it’s safer to rely on trusted security software to handle the removal automatically. If your antivirus tool can’t fully eliminate the adware, consider getting help from a qualified IT technician or your device manufacturer’s support team.

Reset your browser settings

As stated earlier, adware sometimes comes in the form of browser add-ons or extensions. Adware may also change your browser’s settings, like switching your home page. Fortunately, it’s quite easy to remove problematic extensions or reset your browser settings to undo any changes. Just follow the steps below for your browser on a desktop device.

Google Chrome

1. Open Google Chrome, click the three dots in the top-right of the browser window to open the menu, then select Settings.
2. Select Reset settings, then Restore settings to their original defaults.
3. Click the Reset settings button to confirm.

Safari

1. Open Safari, click the Safari menu in the top-left corner, and then select Settings.
2. Go to Extensions and look for any suspicious items you don’t remember installing. Click the Uninstall button beside each one to remove it. Note that no Safari Extensions are required for it to function properly.
3. Go to General and check that the homepage is set to the URL you want to visit when you open the browser.

Mozilla Firefox

1. Open Firefox and click the three horizontal lines (menu) in the top-right corner of the window. Choose Help, then select More Troubleshooting Information.
2. Click Refresh Firefox.
3. Click Refresh Firefox again in the pop-up window that appears.

How to prevent adware infections

There are several ways you can minimize your risks of encountering adware. This involves browsing more safely, being careful about what you download, and keeping your systems updated.

Safe browsing practices

• Don’t click on pop-ups: As a general rule, don’t click on any unexpected pop-ups that appear while browsing the internet. Not all of them are dangerous, but some can redirect you to unsafe sites, putting you at risk of adware or other malware infections.
• Avoid suspicious links: If you receive a strange link via email or instant message or see one posted in a forum or comment section, it’s usually best to avoid clicking it. Links can be disguised to look legitimate, but they may trigger unwanted downloads.
• Stick to safe, reputable websites: Only visit sites you know or trust. Stay away from sites that seem suspicious or have links to piracy or other illicit activities.
• Use a VPN: A VPN encrypts your internet traffic, which helps protect your privacy, especially when you’re connected to unsecured or public Wi-Fi. While a VPN won’t directly prevent adware infections, it can make it harder for your information to be intercepted or misused online. In addition, ExpressVPN’s advanced protection features include an ad blocker and Threat Manager, which prevent your device from communicating with a blocklist of known ads, trackers, and malicious domains.

Importance of HTTPS

HTTPS encrypts the data exchanged between your browser and the website you are visiting, preventing attackers from intercepting or tampering with it. This encryption is especially important when you enter personal details, such as passwords or payment information, because it keeps them from being exposed to anyone monitoring your connection.

While HTTPS does not guarantee that a site is safe, since many malicious sites can also use it, it helps ensure the data you share and receive is not altered in transit. Without it, attackers could inject malicious content or redirect you to compromised downloads that spread adware or other malware.

Avoiding risky downloads

Adware is often concealed alongside other files or software you might willingly download to your device. To reduce your risks of encountering adware, only download files from trusted, reputable sources. Avoid downloading anything from suspicious sites, especially those offering pirated software or media.

Understanding freeware and shareware risks

Some applications are offered free of charge, either without restrictions (freeware) or with limited functionality (shareware). These types of programs are among the most likely to come bundled with adware. The adware can be either legitimate and disclosed during installation or malicious, hidden within the program’s files to install itself without your knowledge.

When you download freeware or shareware programs, remember that adware may be part of the package. To avoid it, only download from reputable sites and read each step of the installation process carefully before clicking the “Next” or “Continue” button, as you may see options to opt out of installing extra apps, like adware.

Regular software updates

Keeping your devices up-to-date is a smart cybersecurity step in general and will help you avoid adware and other malicious software. This is because many updates bring security improvements or fixes for vulnerabilities in your operating system.

Keeping your device secure

Another good security tip is to keep your devices secure. Use strong, unique passwords for all your accounts and enable extra security layers, such as two-factor authentication. To make this easier, consider using a password manager like ExpressVPN Keys to securely store and generate complex passwords.