Removing spyware/PUAs
1. Using Enterprise Console, version 32. Sophos Anti-Virus for Windows, version 7
3. Sophos Anti-Virus for Windows, version 6
Potentially unwanted applications are not viruses or Trojan horses. Please see the specific analysis for more information about the application concerned. If you want to retain the application, you can authorize it.
The removal of PUAs and spyware is supported only in Sophos Anti-Virus for Windows 2000/XP/2003/Vista. No other version of Sophos Anti-Virus for any platform can detect and remove unwanted applications. They will only remove viruses, worms and other malware.
- If the analysis includes special information on removal, those instructions should be used.
- If the application was installed by third-party software, that software should be removed at the same time.
1. Using Enterprise Console, version 3
To remove a spyware/PUA program:
- In Enterprise Console, right-click the affected computer or group.
- Select 'Clean up detected items'.
- Select the name of the item that you want to clean up. For more information on the item, click 'Details'.
- Click 'OK'
- Run a full system scan on the computer to check that all items have been removed.
If you encounter problems when cleaning up a program, double-click the computer in Enterprise Console and check for any error messages.
If problems persist, go to the affected computer and remove the program.
The report of the item will be removed from the 'Outstanding alerts and errors' section of the computer details pane for the affected computer(s).
Separate instructions describe removing viruses, Trojans and worms over a network using Enterprise Console.
2. Sophos Anti-Virus for Windows, version 7
Note: You must be logged in as an administrator to run clean-up on an application.
To remove an application:
- Check the threat analysis for any special details on removal.
- Close down all programs.
- Go to Start|Programs|Sophos|Sophos Anti-Virus and run the 'Sophos Anti-Virus' program.
- In the 'Available scans' list, select the scan for which you want to enable removal, or use 'Setup a new scan' to scan your local disks. (Do not select a scheduled scan, as you will not be able to run this manually.)
- Click Edit|Configure this Scan
- Select the Cleanup tab and select 'Automatically clean up items that contain virus/spyware'. Click Apply|OK.
- Click 'Save and Start' to save the scan, and run it immediately.
- At the end of the scan, click the link in 'Items passed to Quarantine' to open Quarantine manager.
- Select any items needing removal.
- From the 'Perform action' dropdown, select 'Cleanup'.
- Select 'Yes or 'Yes to all' to clean your computer.
- Any remaining items should be deleted.
- From the 'Perform action' dropdown, select 'Delete'.
- Select 'Yes or 'Yes to all' to delete files.
- Run another scan to ensure that the program has been removed.
- If you were instructed during removal to reboot your computer, now do so.
- Click Edit|Configure this Scan
- Select the Cleanup tab and deselect 'Automatically clean up items that contain virus/spyware'. Click Apply|OK.
The alert on the program will have been cleared from the screen, but a record of it remains in the log.
If you encounter problems when cleaning up an application, click '[details]' and check for any error messages.
3. Sophos Anti-Virus for Windows, version 6
Note: You must be logged in as an administrator to run clean-up on an application.
To remove an application:
- Check the threat analysis for any special details on removal.
- Close down all programs.
- Go to Start|Programs|Sophos Anti-Virus and run the 'Sophos Anti-Virus' program.
- Run a scan by clicking 'Scan my computer', then wait for the scan to complete.
- Select 'Manage quarantine items'.
- Select the Applications tab.
- Select the application that you want to clean up. For more information on the application, click '[details]'.
- Click 'Cleanup'.
- When asked if you are sure, click 'Yes' or 'Yes to All'.
- When clean-up has finished, click 'Close'.
- Run another scan to check that all items have been removed.
- If you were instructed during removal to reboot your computer, now do so.
The alert on the application will have been cleared from the screen, but a record of it remains in the log.
If you encounter problems when cleaning up an application, click '[details]' in the Application tab and check for any error messages.
If problems persist, contact technical support.
