PUP.Qiyi is a potentially unwanted program (PUP) typically associated with the iQIYI video platform ecosystem, though the detection often extends to bundled software components, browser extensions, or aggressive installer packages that arrive alongside legitimate Chinese media applications. While not inherently malicious in the traditional virus sense, PUP.Qiyi exhibits behaviors that most users find intrusive: unauthorized browser modifications, excessive data collection, installation of additional unwanted software, and persistent advertising modules that survive standard uninstall procedures. Security vendors flag these components because they're frequently installed without clear consent through deceptive bundling tactics, and their removal proves surprisingly stubborn for average users.
The Qiyi designation covers a spectrum of behaviors—from relatively benign adware that merely clutters your browsing experience with video platform promotions to more aggressive variants that establish deep system hooks for persistent advertising delivery. Computer Repair Roswell encounters these infections regularly among customers who downloaded what they thought was a simple video player or codec pack, only to find their browsers hijacked and their system performance degraded by background processes they never authorized.
Threat Profile
| Attribute | Details |
|---|---|
| Family | Potentially Unwanted Program (PUP) / Adware |
| Aliases | PUP:Win32/Qiyi, Adware.Qiyi, PUA:MSIL/Qiyi, BrowserModifier:Win32/Qiyi |
| Platform | Windows 7 through 11 (32-bit and 64-bit); occasional macOS variants |
| First Documented | Variants circulating since approximately 2015, with continued evolution |
| Distribution Method | Software bundling, fake codec installers, torrent packages, freeware wrappers |
| Persistence Mechanisms | Registry Run keys, scheduled tasks, browser extension policies, service installations |
| Primary Capabilities | Browser hijacking, advertisement injection, homepage/search redirection, tracking cookie deployment, background video player installation |
| Typical Payload Locations | %PROGRAMFILES%\Qiyi\, %PROGRAMFILES(X86)%\PPStream\, %LOCALAPPDATA%\[random GUID]\, browser extension directories |
| Network Behavior | Frequent connections to Chinese CDN servers, ad-serving domains (*.iqiyi.com variants), analytics endpoints, software update servers |
| Data Collection | Browsing history, search queries, installed software inventory, geographic location, device identifiers |
| Removal Difficulty | Moderate to High (resistant to simple uninstall, leaves residual components, may reinstall from hidden scheduled tasks) |
| Risk Level | Medium (privacy invasion, system slowdown, gateway for additional PUPs; not typically data-destroying) |
How It Spreads
The overwhelming majority of PUP.Qiyi infections trace back to software bundling—the practice of packaging unwanted programs with legitimate installers. Users searching for free video players, codec packs to play unusual file formats, or pirated software through torrent sites frequently encounter Qiyi-bundled installers. These packages use deliberately confusing installation wizards where the unwanted components appear pre-checked in "custom" installation screens that most users skip past, clicking "Next" rapidly to reach their intended software. The Qiyi components then install silently in the background.
Another common vector involves fake browser updates or codec requirement notifications. You're watching a video online when a pop-up claims you need to "update your video player" or "install codec XYZ to continue." Clicking these prompts downloads an installer that may include a working codec but bundles the Qiyi adware alongside it. Less frequently, we see Qiyi components arriving as secondary payloads from other PUPs—an initial infection downloads and installs additional unwanted programs, creating a cascade of bundled software.
Key distribution channels include:
- Freeware download sites that wrap legitimate software in custom installers containing Qiyi components (sites like Softonic, Download.com clones, torrent bundles)
- Fake codec alerts on streaming sites, particularly those hosting pirated content or adult material
- Search engine advertising for popular free software, where paid ads lead to bundled installers rather than official downloads
- Email attachments disguised as video files (.exe files with video-related icons) claiming to be shared content
- Malicious browser extensions that advertise video downloading capabilities but install Qiyi advertising modules
- Pay-per-install networks where software developers are paid to bundle third-party offers, with Qiyi being one of the monetization partners
What It Does On Your Machine
Once installed, PUP.Qiyi establishes multiple persistence mechanisms to survive basic removal attempts. The primary payload typically consists of a background service or scheduled task that monitors for the presence of core Qiyi components and reinstalls them if removed. You'll notice your browser homepage suddenly points to a Qiyi-controlled search engine or video portal, your default search provider changes without your permission, and new browser extensions appear that you never authorized. Every search query now routes through advertising networks that inject sponsored results above legitimate search findings.
The adware component manifests as intrusive pop-up advertisements, in-text ads that transform random words on websites into advertising links, and banner ads injected into pages that ordinarily wouldn't display advertising. These ads frequently promote questionable products: system optimizers that are themselves PUPs, fake antivirus software, browser toolbars, and adult content. The advertisements slow down your browsing considerably because each page must load additional scripts and content from advertising networks before displaying properly. System resources get consumed by background processes—you might notice "Qiyi.exe" or similar processes in Task Manager consuming CPU cycles and network bandwidth even when you're not actively using your computer.
Behind the scenes, PUP.Qiyi collects extensive telemetry about your computer usage. It monitors which websites you visit, what search terms you enter, which software you have installed, and builds a profile for targeted advertising. This information flows back to remote servers, often located outside the United States, raising both privacy and security concerns. While not a credential stealer in the strict sense, the data collection occurs without meaningful consent and the information potentially gets sold to data brokers.
Some Qiyi variants install browser helper objects (BHOs) or extensions that can read and modify data on all websites you visit—a capability that could theoretically be exploited to intercept sensitive information, though such malicious activity isn't the primary function we typically observe. The real damage comes from degraded system performance, compromised privacy, and the risk that the PUP opens the door for genuinely malicious software. Machines infected with one PUP often harbor several, as the advertising networks cross-promote each other's unwanted software.
Manual Removal — Step by Step
Disconnect Network and Document Symptoms
Before making changes, disconnect from the internet (disable Wi-Fi or unplug ethernet) to prevent the PUP from downloading additional components during removal. Take screenshots of unusual browser behavior, note any unfamiliar programs in your taskbar, and write down what symptoms you're experiencing—this helps verify complete removal later.
Boot Into Safe Mode with Networking
Restart your computer and enter Safe Mode (on Windows 10/11: hold Shift while clicking Restart, then navigate to Troubleshoot → Advanced Options → Startup Settings → Restart → press F5 for Safe Mode with Networking). Safe Mode loads only essential drivers, preventing the PUP's services from launching and making removal significantly easier.
Uninstall Qiyi Programs Through Control Panel
Open Control Panel → Programs and Features (or Settings → Apps on Windows 10/11) and look for entries containing "Qiyi," "iQIYI," "PPStream," or similar names. Uninstall each one, being careful to decline any offers presented during the uninstallation process (some PUPs try to install additional software even while being removed). Also remove any unfamiliar programs installed around the same date as Qiyi.
Remove Browser Extensions and Reset Settings
Open each browser you use (Chrome, Firefox, Edge) and navigate to extensions/add-ons. Remove anything Qiyi-related and any other extensions you don't recognize or didn't intentionally install. Then reset your homepage and search engine to your preferred choices. In Chrome, consider using the "Reset settings" option under Settings → Advanced to clear all hijacks at once.
Delete Scheduled Tasks
Open Task Scheduler (search for "Task Scheduler" in the Start menu) and examine the Task Scheduler Library. Look for tasks named with Qiyi, random characters, or that reference executable paths in AppData folders. Right-click suspicious tasks and select Delete. Pay particular attention to tasks that run hourly or at logon—these are the persistence mechanisms that cause reinstallation.
Clean Registry Run Keys
Press Windows+R, type "regedit," and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and the same path under HKEY_LOCAL_MACHINE. Look for entries pointing to Qiyi executables or unfamiliar programs in AppData folders. Right-click and delete suspicious entries. Exercise caution here—only remove entries you're confident relate to the PUP, as legitimate programs also use Run keys.
Manually Delete Remaining Files
Open File Explorer and navigate to C:\Program Files, C:\Program Files (x86), and C:\Users\[YourUsername]\AppData (you may need to enable "Show hidden files" in View options). Look for folders named Qiyi, QiyiHelper, PPStream, or matching the paths shown in the terminal section above. Delete these folders completely. Empty your Recycle Bin afterward.
Run Malwarebytes Anti-Malware
Download Malwarebytes (the free version works fine) from the official malwarebytes.com site and run a full Threat Scan. This catches residual components, related PUPs, and any additional threats that piggybacked on the Qiyi installation. Quarantine everything it finds. Follow up with a Windows Defender full scan for additional coverage.
Change Passwords If Needed
If you entered passwords or accessed financial accounts while the PUP was active, consider changing those passwords now, especially if the PUP had been present for weeks or months. While PUP.Qiyi isn't primarily a credential stealer, the extensive browser access it possesses means data exposure is theoretically possible.
Reboot Normally and Verify Clean System
Restart your computer normally (not in Safe Mode). Verify that your browser homepage is correct, no unwanted pop-ups appear, and no Qiyi processes show in Task Manager. Monitor over the next 24-48 hours—if symptoms return, the PUP likely has a persistence mechanism you missed, and professional removal becomes the practical choice.
Prevention
- Download software only from official sources. Get VLC from videolan.org, not from "vlc-download.com" or similar sites. Avoid third-party download portals like Softonic, CNET Download, and similar aggregators that bundle unwanted software with legitimate programs.
- Always choose Custom/Advanced installation. Never click through installer wizards using Express/Recommended options. Custom installation reveals bundled offers that you can decline. Read each screen carefully and uncheck any pre-selected optional software.
- Keep Windows Defender active and updated. The built-in protection in Windows 10/11 catches many PUPs at download time if you keep it current. Don't disable it to install "free" software—that's exactly when you need protection most.
- Use an ad blocker and script blocker. Extensions like uBlock Origin prevent many of the fake codec alerts and malicious advertising that distribute PUPs. This stops infections before they reach your system.
- Be skeptical of codec requirements. Modern browsers play virtually all video formats without additional codecs. If a website claims you need to download something to watch a video, that's almost certainly a scam—close the tab and find the content elsewhere.
- Enable real-time protection in Malwarebytes. The premium version includes real-time blocking of PUPs before they install. The investment pays for itself the first time it blocks a bundled installer you didn't notice.
- Create a standard user account for daily use. Running as Administrator makes PUP installation easier because the software has full system privileges. A standard user account forces installers to request elevation, giving you an additional checkpoint to catch unwanted software.
- Review installed programs monthly. Make it a habit to check Programs and Features regularly. Unfamiliar entries spotted early are far easier to remove than PUPs that have been establishing persistence mechanisms for months.
Bring It In
Manual removal works for technically comfortable users who catch the infection early, but PUP.Qiyi often proves more stubborn than expected. Variants evolve constantly, developing new persistence mechanisms that generic removal guides can't anticipate. If you've followed these steps and still see symptoms—pop-ups reappearing, browser settings reverting, unfamiliar processes in Task Manager—or if you simply don't feel confident editing the registry and hunting through system folders, Computer Repair Roswell is here to help. We see these infections daily and have the specialized tools and experience to eliminate them completely, typically within the same day you bring your computer in.
Our Roswell shop at 1394 Canton Road handles both Windows and Mac systems, providing transparent flat-rate pricing with no diagnostic fees. We'll explain exactly what we found, how it got there, and what we did to remove it—plus configure your system to prevent reinfection. Call (770) 856-1550 or stop by Monday through Saturday. Most PUP removals are completed same-day, getting you back to a clean, fast-running computer without the advertising barrage and privacy invasion these unwanted programs create.