Applies to: Sophos Home Premium and Free (Mac)

After performing a Clean operation with Sophos Home on a detected PUA, you receive an alert stating Manual PUA cleanup required.

Cause

This alert appears when Sophos Home detects a PUA that it cannot remove with the normal Clean method, due to the location of the file not being accessible to Sophos Home.  

Solution

1. Find the location of the detected threat. 
   • Click on the Manual detection via the Sophos Home Shield and hover the mouse over the threat's name to see its full path.  Click on the path to open it in finder 
     
     OR
   •  Log in to your Sophos Home Dashboard , locate the affected system and use the HISTORY tab to find the detection and its full path,  copy it, then paste it in Spotlight
     
     (click on the magnifying glass at the top right --> paste the path and hit Enter to open the location in finder).
     
     
2. Once at the location, find the threat, right-click on it Delete/Move to trash
3. Empty the trash
4. Back to Sophos Home Shield or Dashboard, find the detection and choose Ignore
   
   OR
   
   
   
5. Run a Full System scan to ensure no more detections are present. 
   
   Note: additional steps for manual detections removal can be found here. 

Related information

• Manual malware cleanup on a Mac computer
• PUA detected alert shows in the Sophos Home dashboard
• Resolving PUA detected through the installed Sophos Home software