A protection application detects and removes unwanted applications. The protection application scans a client device for suspected unwanted applications. A security server provides an application rating for detected applications to the client device. The application rating is generated based on application retention data received from client devices indicating whether users of the clients choose to remove or retain the application when given the option. The application retention data may be weighed based on a categorization of the clients providing the application retention data into to clients expected to have different reliability levels. The security server can also provide a definition specifying all known components associated with a suspected unwanted application. Responsive to a selection to remove a suspected unwanted application, the protection application uninstalls all components of the application.