Disable PUA automatic remove.

Two years later and this still isn't resolved. This is a serious PITA, as you don't know what gets recognized as PUA until it is removed.

We just started rolling out Endpoint Protection via Sophos Central and I already had two cases where this breaks running applications. And to put icing on the cake out of the box you don't get a notification, unless you notice the breakage or specifically look for it.

Is disabling Deep Learning a valid workaround?

Two years later and this still isn't resolved. This is a serious PITA, as you don't know what gets recognized as PUA until it is removed.

We just started rolling out Endpoint Protection via Sophos Central and I already had two cases where this breaks running applications. And to put icing on the cake out of the box you don't get a notification, unless you notice the breakage or specifically look for it.

Is disabling Deep Learning a valid workaround?

Hi Marcus Bayer 

Disabling Deep learning is not a good idea.

If you have the case where PUA was detected and was removed, you can allow it as the exception and that same file will not be detected as PUA in future until software update happens and you have allowed the SHA for the exception.

Please refer to this article for what action you can take.

Hello Jasmin, while I understand where this is coming from, please also understand the annoyance that I rather like to review a PUA find than have to repair and whitelist something aftterwards. We are talking about PUA after all, not malware. Why do I have the possibility to disable malware cleanup, but not PUA cleanup?

Hi Marcus Bayer 

I certainly understand your concern, but this is something by design. If you believe a detection was made in error, then please submit to our labs for re-categorization: https://community.sophos.com/kb/en-us/134763

Shweta Care to elaborate on the rationale behind the design decision? Customers are much more willing to accept a situation if they can be enlightened as to why it is the way it is.

Hi everyone, 

I can understand that it might become frustrating for Admins to add an exclusion for an application they use after Sophos detects it. To overcome this, I'd like to suggest a few steps: 

1. If you're suspicious that Sophos might detect the application as PUA, please visit the following link to confirm that: https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas.aspx (For e.g. Utorrent)

2. Once it is confirmed that the application is detected as a PUA, proactively add an exclusion for it before Sophos detects it. Please PM me, Jasmin or Shweta if you need any further assistance with this.

If you're interested, you can subscribe to our Latest Adware and PUA detections RSS Feed: https://www.sophos.com/en-us/rss/threats/latest-adware-and-puas.xml.