"Potentially Unwanted Program"? That's a polite way of putting it.

> PUP.Optional.Booking

> This is the detection for a family of potentially unwanted programs (PUPs) that show advertisements hailing from the booking.com domain. This PUP predominantly uses scheduled tasks to trigger the advertisements.

Wouldn't mind seeing that looks like. Regardless, "scheduled tasks" definitely sounds like unsolicited EXE execution, which is firmly on the "no thanks" side of shady.

I believe these don't come from the actual company itself, rather from other people abusing their affiliate program (same thing happens with Amazon, for instance, so I guess you can't trust them either).