Applies to: Sophos Home for Windows and Mac
What is a PUA detection?
Potentially Unwanted Applications (PUA) are programs that aren't malicious by design but are potentially unsuitable for your device. For example, they may introduce privacy, security, or user experience risks. You can choose to allow PUAs based on your personal preference.
"Potentially unwanted application detected" messages will appear under New Activity or HISTORY in the Sophos Home dashboard:
How to manage PUA detected messages
- Sign in to your Sophos Home dashboard.
- Choose the desired computer and scroll down to the New Activity section (or choose HISTORY to see all current alerts).
- Select one of the following actions:
- Allow - This action allows the detected application to run. The application is then listed under PUA excluded applications on the Sophos Home dashboard.
- Clean - This option deletes the PUA.
- Ignore - This clears out the alert but the detected PUA is neither excluded or deleted. However, the alert triggers again when the application is relaunched.
Note: These actions can also be applied directly to the Sophos Home software installed on your computer.
PUA message keeps reappearing
If you keep seeing the same Potentially Unwanted Application (PUA) detection after clearing it, it’s usually because the file is being reintroduced to your system repeatedly. This can happen when:
- An application on your computer is updating and recreating the file.
- Your system is synchronizing files from another device or the cloud.
- A backup application is restoring the file.
What to do
-
Check synchronization settings
Look for cloud services (like OneDrive, Dropbox, Google Drive) or backup tools that might be restoring the file. Disable syncing for the affected file if needed. -
Review program updates
If the detection is related to a specific program, updates may be re-adding the file. Confirm if the program is trusted and Allow the detection in Sophos Home, or uninstall the program altogether. -
Verify the file’s safety
If you need help making the decision, use our Intelix Portal and/or online tools such as VirusTotal to check if the file is flagged as malicious/safe. You can also contact the vendor if the detection is getting triggered from a program.
Manage PUA detections that were automatically cleaned up
See Disable automatic cleanup on macOS
For other OS versions, as well as general guidelines, please see Setting scan exceptions
DISCLAIMER: The information in these articles is provided for general educational purposes only and is based on information available to Sophos at the time of publication. The materials may contain technical inaccuracies or typographical errors and may be updated, revised, or changed at any time without notice.
To the maximum extent permitted by applicable law, Sophos disclaims and excludes all representations, warranties, and conditions, whether express, implied, or statutory, including without limitation any warranties or conditions of title, non-infringement, satisfactory condition or quality, merchantability, and fitness for a particular purpose, with respect to the content.