PUABundler:Win32/CandyOpen is a Microsoft Defender potentially unwanted application/bundler detection. It is commonly tied to installers that add advertising components, browser changes, or unwanted offers. It is not something to allow on a normal PC.
Should you remove CandyOpen?
- Yes, remove or quarantine it.
- Delete the installer that triggered Defender.
- Check browser search, homepage, extensions, and notifications.
- If it keeps returning, look for the source archive or companion updater.
| Detection | PUABundler:Win32/CandyOpen |
| Type | Potentially unwanted bundler/adware-related installer |
| Common source | Freeware bundles, download portals, repacked utilities |
| Best action | Remove, delete source, clean browser changes, run a full scan |
What is PUABundler:Win32/CandyOpen?
CandyOpen is a PUA/bundler-style detection name used by Microsoft Defender. It usually points to a package that may install extra components or advertising-related changes. Users often cannot find “CandyOpen” as a normal app because the detected item may be an installer, extracted file, or bundled component.
How to remove PUABundler:Win32/CandyOpen
- Use Remove or Quarantine in Windows Security.
- Delete the original setup file or ZIP/RAR archive.
- Uninstall recently added apps.
- Remove suspicious browser extensions.
- Reset browser search/homepage if changed.
- Restart and run a full scan.
After uninstalling the suspicious app or deleting the visible threat, use Gridinsoft Anti-Malware to check hidden files, startup entries, scheduled tasks, bundled apps, browser changes, and other persistence points that can restore malware.
Download Anti-MalwareFAQ
Why can’t I find CandyOpen in Apps?
The alert may refer to an installer or component, not a visible installed program.
Is CandyOpen a virus?
It is usually classified as PUA/bundler, but it can still cause unwanted browser and adware behavior.
Can I ignore it?
No. Remove the bundle and clean browser changes.
Sources: Microsoft Answers cases for PUABundler:Win32/CandyOpen and Microsoft Security Intelligence PUA guidance.
