What is Rogue Software?
Rogue software refers to unwanted applications that violate user privacy, disrupt system operations, or engage in deceptive practices. Unlike traditional viruses that aim to destroy data, rogue software typically seeks to:
- Display Ads: Show unwanted advertisements, pop-ups, or redirect browsers
- Collect Data: Steal browsing history, personal information, or system data
- Install Bundled Software: Install additional unwanted programs without user consent
- Resist Removal: Use self-protection mechanisms to prevent uninstallation
- Consume Resources: Occupy excessive CPU, memory, or network bandwidth
Rogue Software Detection Rules
| Behavior | Score | Description |
|---|---|---|
| Silent ad popups | +4 | Displaying advertisements without user interaction |
| Full-screen promotion | +4 | Opening full-screen advertisement windows |
| Background downloads | +6 | Downloading third-party software without user confirmation |
| Data uploading | +5 | Uploading local files or browsing history to remote servers |
| Process mutual protection | +20 | Multiple processes monitoring and restarting each other |
| Self-restart after termination | +15 | Automatic restart after being terminated by user |
| High resource consumption | +2 | Persistent high CPU/memory usage |
| Unable to close normally | +5 | Ignoring close requests or minimizing instead of closing |
Detection Features
Behavioral Analysis
Monitors process behavior patterns over time. Tracks resource usage, network connections, window creation, and file operations to identify suspicious activity.
Signature-Based Classification
Signed processes are classified as rogue software candidates rather than viruses. This prevents false positives for legitimate but unwanted software.
UI Classification
Processes scoring 60+ points are displayed in the dedicated "Rogue Software" tab in the Qt GUI for user review and action.
Time-Decay Scoring
Risk scores automatically decay over time (1 point per minute by default). This prevents permanent labeling of once-suspicious processes.
Detailed Reporting
Logs suspect process information including name, PID, path, signer, and parent process for AI forensics and user review.
User Notification
Signed but suspicious processes trigger notifications only, allowing users to decide the appropriate action.
Virus vs Rogue Software
🦠 Virus/Malware
- Usually unsigned
- Directly destructive
- Handled by virus analyzer
- Automatic termination at 70+ points
- File deletion after termination
📢 Rogue Software
- Usually signed (commercial software)
- Privacy-invasive, annoying
- Handled by rogue software analyzer
- Displayed in rogue software tab at 60+ points
- User decides action
False Positive Protection
Trusted Path Filtering
To prevent false positives, signed processes located in trusted directories are automatically skipped from rogue software alerts:
- Windows Directory: C:\Windows\*
- Program Files: C:\Program Files\*
- Program Files (x86): C:\Program Files (x86)\*
✅ VMware Tools and other legitimate system software correctly identified and skipped
Response Actions
Monitor Only
Process is tracked but no action is taken. Suitable for borderline cases where behavior needs further observation.
Add to List
Process is added to the rogue software tab for user review. User can decide to keep or remove the software.
Send Notification
User is notified about the suspicious process through popup alerts and log entries.
User-Initiated Removal
User can initiate removal through the GUI. The software guides the user through the uninstallation process.