<page xmlns="http://projectmallard.org/1.0/" type="topic"
id="clamtk-pua-help">
  <info>
    <link type="guide" xref="index#settings" />
    <credit type="author">
        <name>Dave M</name>
        <email>dave.nerd @ gmail.com</email>
    </credit>
  </info>
  <title>Scanning for Potentially Unwanted Programs</title>

<p>You may wish to set specific preferences for <app>ClamTk</app> usage.  To do so, click the <gui>Settings</gui> button or click <keyseq><key>ctrl-S</key></keyseq>.</p>

<p>Potentially Unwanted Programs - or PUAs - are typically defined as programs that fall into a grey area - that is, the intent behind their use and whoever is using them plays a role in determing whether you want them on your system or not.</p>

<p>For example, tools such as "sniffers", password crackers, and port scanners can all be considered useful from an administrator's perspective, but may also be used by individuals with malicious intent.</p>

<p>When <app>ClamTk</app> reports an item prefaced with "PUA" in the signature, these are things to keep in mind.</p>

<p>Currently, the types of potentially unwanted applications are as follows:</p>
<list>
        <item><p><code>Packed (files using a runtime packer)</code></p></item>
        <item><p><code>Password tools</code></p></item>
        <item><p><code>Net tools (e.g., sniffers)</code></p></item>
        <item><p><code>Peer to Peer (P2P) clients</code></p></item>
        <item><p><code>Internet Relay Chat (IRC) clients</code></p></item>
        <item><p><code>Remote access trojans (RATs)</code></p></item>
        <item><p><code>General system tools (e.g., process killers)</code></p></item>
        <item><p><code>Spy tools (e.g., keyloggers)</code></p></item>
        <item><p><code>Server tools (e.g., DistributedNet)</code></p></item>
        <item><p><code>Script-based (e.g., "problem" scripts written in
Javascript, ActiveX, or similar)</code></p></item>
</list>

        <note style="advanced">
                <p>List of PUA types taken from
https://github.com/vrtadmin/clamav-faq/blob/master/faq/faq-pua.md</p>

        </note>

<p>To enable this feature, select the option as indicated below.</p>

<note style="warning">
        <p>Note that the recommended setting for PUAs is <em>disabled</em>.</p>
</note>

<media type="image" mime="image/png" src="figures/clamtk-pua.png" />

</page>
