# Sophos antivirus complains and quarantines

**URL:** <https://forums.synfig.org/t/sophos-antivirus-complains-and-quarantines/14020>\
**Category:** Support\
**Created:** [May 3, 2023, 1:58pm UTC](https://forums.synfig.org/t/sophos-antivirus-complains-and-quarantines/14020 "2023-05-03T13:58:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SirClickalot](https://forums.synfig.org/user_avatar/forums.synfig.org/sirclickalot/32/7143_2.png) [@SirClickalot](https://forums.synfig.org/u/SirClickalot)\
**Post date:** [May 3, 2023, 1:58pm UTC](https://forums.synfig.org/t/sophos-antivirus-complains-and-quarantines/14020/1 "2023-05-03T13:58:47Z")

</div>

I have just installed Synfig (SynfigStudio-1.4.4-2023.03.30-win64-b8d62.exe) and along the way, my local Sophos antivirus software warned me that it did not trust the following files and so quarantined them…

Potentially unwanted application detected  
These applications are not malicious but has potentially unwanted behaviour, and will be quarantined…

Generic ML PUA: C:\Program Files\Synfig\bin\gspawn-win64-helper.exe  
Generic ML PUA: C:\Program Files\Synfig\bin\gspawn-win64-helper-console.exe  
Generic ML PUA: C:\Program Files\Synfig\bin\gdk-pixbuf-query-loaders.exe  
Generic ML PUA: C:\Program Files\Synfig\bin\gdk-pixbuf-pixdata.exe

As you can see, Sophos identifies these files as belonging to a family of ‘Generic ML PUA’ as described [here](https://support.sophos.com/support/s/article/KB-000036922?language=en_US).

I was wondering about others’ experience like this and I am keen to understand quite what Potentially Unwanted Application action I might be letting myself in for?

Thanks all

---

<div class="post-metadata">

**Author:** ![BobSynfig](https://forums.synfig.org/user_avatar/forums.synfig.org/bobsynfig/32/175_2.png) [@BobSynfig](https://forums.synfig.org/u/BobSynfig)\
**Post date:** [May 3, 2023, 5:26pm UTC](https://forums.synfig.org/t/sophos-antivirus-complains-and-quarantines/14020/2 "2023-05-03T17:26:57Z")

</div>

Hi and welcome here 🙂

> [@SirClickalot](#):
>
> **Potentially** unwanted application detected  
> **These applications are not malicious** but has **potentially** unwanted behaviour, and will be quarantined…

Synfig is free and open-source, it is built and published on open and public platforms (GitHub).  
The quarantined executables are part of MinGW/MSYS (also open-source) that are used to launch sub-processes.  
But creators of malicious apps can use this toolchain and antiviruses sometimes think that if is has been used in a malicious software, then there presence may be **potentially** sign of an infection.

[![](https://i.imgflip.com/7keqrr.jpg) ](https://i.imgflip.com/7keqrr.jpg)

---

<div class="post-metadata">

**Author:** ![mohamed.Adhamc](https://forums.synfig.org/letter_avatar_proxy/v4/letter/m/a88e4f/32.png) [@mohamed.Adhamc](https://forums.synfig.org/u/mohamed.Adhamc)\
**Post date:** [May 3, 2023, 6:14pm UTC](https://forums.synfig.org/t/sophos-antivirus-complains-and-quarantines/14020/3 "2023-05-03T18:14:42Z")

</div>

xD, never have I seen such an informative picture. Well written ;).