PUA "remnants" persistent in Windows 10 Sophos Home. Conflicting Support Responses.

Hi Aliss,

I am very sorry to hear that your experience with support was not satisfactory.

Remnants are only detected by Premium scans - i.e. "Scan Computer". They are registry keys and files associated with PUAs. They will not be detected with other scan types, as you have pointed out on your message.
They are reported to the dashboard, and in your Sophos Home antivirus program. But they can only be deleted on the AV program at the end of the scan where they have been detected (or manually by accessing those locations on the computer).

At this time, remnants cannot be excluded, so exclusions will not make a difference. As covered in our articles, we do not recommend adding those anyway, but if a customer chooses to do so, they can, at their own discretion (the best way to go about it is reaching out to Sophos Labs instead). 

Having said that, if you do not wish to delete said remnants as you believe they belong to a legitimate program, you can still run your scans normally and delete any other things that may show up.

I have seen the report from Labs stating the file is clean, and I checked the app against virustotal, which also shows it as clean. I will work on getting more information regarding these remnants and get back to you. 

Thank you for your understanding, and again, sorry about any inconveniences.

Please, let me know if you would like me to contact you directly via our ticketing system, so we can continue working there.  

Hi Aliss,

I am very sorry to hear that your experience with support was not satisfactory.

Remnants are only detected by Premium scans - i.e. "Scan Computer". They are registry keys and files associated with PUAs. They will not be detected with other scan types, as you have pointed out on your message.
They are reported to the dashboard, and in your Sophos Home antivirus program. But they can only be deleted on the AV program at the end of the scan where they have been detected (or manually by accessing those locations on the computer).

At this time, remnants cannot be excluded, so exclusions will not make a difference. As covered in our articles, we do not recommend adding those anyway, but if a customer chooses to do so, they can, at their own discretion (the best way to go about it is reaching out to Sophos Labs instead). 

Having said that, if you do not wish to delete said remnants as you believe they belong to a legitimate program, you can still run your scans normally and delete any other things that may show up.

I have seen the report from Labs stating the file is clean, and I checked the app against virustotal, which also shows it as clean. I will work on getting more information regarding these remnants and get back to you. 

Thank you for your understanding, and again, sorry about any inconveniences.

Please, let me know if you would like me to contact you directly via our ticketing system, so we can continue working there.  

Hi Barb,

Thanks for your response. On your advice I have removed the Folder and local executable exceptions/exclusions for CleanMyPC.

The number of scans which were performed in the troubleshooting between Jan and March did indeed have a cluttering effect, which will now diminish to the occasional local scan for cookies etc.

Thanks also for your continued work on this issue. Unless you require further SDUs I would like to leave the ticketing for now.

I did not receive an email upon your reply in this forum or I would have replied sooner. I see a box with notify me ticked below.  I will check daily.

Hi Aliss,

The remnants for CleanMyPC should no longer appear.
Could you please perform another scan ("Scan Computer")  to confirm? 

Thank you!

PS: To receive an email when somebody replies to your posts, you need to do 2 things: 

1 - Click "Notify me when someone replies to this post" 
2 - Click on your username at the top right of the screen --> Settings and make sure "Enable email contact" is checked. 

Hello Barb,

Scan completed, and no remnants. Thank you!

Interested to know; Has Sophos addressed all remnant behaviour in scanning engine or just specifically CleanMyPC?

Not seeing CleanMyPC in the labs.

PS: not receiving emails although:

1 -  Clicked "Notify me when someone replies to this post"

2 - "Enable email contact" has been checked since joining the community

Hi Aliss,

The changes were performed for CleanMyPC.

Emails should come from "Sophos Community - Automated Email" - via a noreply email address, so make sure you don't have any filters for those, or that they are being sent to your Junk Mail. 

Please, let us know if there's anything else we can assist you with. 

Thank you!

Hello Barb,

Perhaps you can direct me to assistance regarding the failure of email notifications for my account.

Hi Aliss,

I've sent you a private message so that we can continue troubleshooting via there.

Thanks!

Hi Barb,

Thanks for taking the time to get my Community Notificatiions Working.

Not to mention clearing out those pesky remnants.

A marvellous introduction to the Sophos Community