Adware: A new approach
Here at the Microsoft Malware Protection Center (MMPC) we understand advertising is part of the modern computing experience. However, we want to give our customers choice and control regarding what happens with their computers. To that end we have recently undergone some changes to both the criteria we use to classify a program as adware and how we remediate it when we find it. This blog will help explain the new criteria and how it affects some programs.
Our updated objective criteria also explains how advertising software can provide users with choice and control. Programs that do not follow these rules will be detected as adware and immediately removed from the user’s machine:
Programs that promote a product or service outside of their own program can interfere with your computing experience. You should have clear choice and control when installing programs that open advertisements.
The advertisements that are opened by these programs must:
- Include an obvious way to close the ad.
- Include the name of the program that created the ad.
The program that creates these advertisements must:
- Provide a standard uninstall method for the program using the same name as shown in the ads it produces.
It is important that both developers and our customers understand this criteria. I will look at each of the points individually. But first, let’s look at which programs can qualify as adware.
What can be classified as adware
We only consider classifying a program as adware if it runs on the user’s machine and produces notifications promoting goods or services in programs other than itself. If the program shows advertisements within its own borders it will not be assessed any further.
Many programs use advertising as a form of payment for the program and that is also an acceptable practice. We are more concerned with the advertising that interferes with our customer’s Windows experience without giving them choice and control over it. To that end, programs that produce notifications promoting goods and services in programs other than themselves must adhere to the following rules:
A method to close the ad
As part of the advertisement there must be a method to close the ad. This must be a clear and obvious method. Suggested methods are an ‘X’ or the word ‘close’ in the corner of the ad.
Figure 1: Our new objective criteria states that the ads must have a visible close button
If you are going to have a group of ads, it is acceptable to have a single close button as long as the ads are clearly grouped together. If the ads are not grouped each ad will need its own close button. Some of the better groupings we have seen are lines around all of the ads or a different colour background for the ads.
Figure 2: A single close button is acceptable for ads that are clearly grouped
In the case of pop-up advertisements, a working close button on the window is acceptable.
Figure 3: Pop-up ads must have a working window close button
The name of the program that is creating the ad
It is important for the user to know that these ads are being shown by a specific program and would not be there if it was not for this program. To tell the user that your program is making the ads, you need to make it clearly known in the advertisement. For example, some of the clearer ways that we see this done are phrases like “Ads by …”, “… ads”, “Powered by …”, “This ad served …”, or “This ad is from …”.
Figure 4: Our new objective criteria states that the ads must clearly mention which program is producing the ads
These methods all meet our updated objective criteria by clearly informing users which program is showing the ads. Using abbreviations or company logos alone are not considered clear enough. Also, only using “Ads not by this site” does not meet our criteria, because the user does not know which program created the ad.
A way to uninstall the program that is making the ads
The final part of giving a user choice and control is giving them a way to uninstall the program that is making the ads. For example, candidate programs that produce independent promotion notifications or promotion notifications in Internet Explorer must have an uninstall entry in the Windows control panel. It is very important that the name of the program in the uninstall entry exactly matches the name shown in the advertisement.
Figure 5: There must be an uninstall entry for the program producing the ads and the name in the entry must match that on the ads
We know that for some browsers extensions are only removable through the browser’s own controls. This is considered a standard uninstall method and meets our objective criteria as long as the name still matches the name in the ad.
What happens to detected adware
Currently, when our security products detect a program as adware they alert the user and offer them a recommended action. If they don’t respond, the security product will let the program run until the user makes a decision.
With our updated objective criteria, this is going to change. Now, when one of our products detects adware it will immediately stop the program and the user will be notified. The user then then has the ability to restore the program if they wish.
When is this going to happen?
Changes to our objective criteria for classifying adware will come into effect on July 1, 2014. This gives developers three months to comply with the new rules.
We have already started reassessing our current adware detections against this new criteria. If your program is still being detected as adware but meets the new criteria you can let us know through the Developer Contact form.
We are very excited by all of these changes. We believe that it will make it easy for software developers to utilize advertising while at the same time empowering users to control their experience.