Remove Sophos Manually

Hello Karen,

Thank you for opening a support case with Sophos. My name is Praveen and I am assigned to help you with this case.

I understand you have problems with reinstallation of Sophos on a macOS device. From the case description and the error message that you listed, I believe the tamper protection on this host was not removed.

Can you please try the below commands and let me know if that helps?

Disable/revoke Tamper protection passsword

Disable servicemanager: sudo launchctl unload /Library/LaunchDaemons/com.sophos.common.servicemanager.plist
Delete keychain: sudo rm -f /Library/Sophos\ Anti-Virus/SophosSecure.keychain
Reenable servicemanager: sudo launchctl load /Library/LaunchDaemons/com.sophos.common.servicemanager.plist

Once the above steps are complete, lets run the command line removal commands to ensure there are no traces of Sophos software on the machine.

Please run the following commands in Terminal as sudo user

sudo rm -r /Library/Sophos\ Anti-Virus
sudo rm -r /Library/LaunchDaemons/com.sophos.*
sudo rm -r /Library/LaunchAgents/com.sophos.*
sudo rm -r /Library/Preferences/com.sophos.*
sudo rm -r /Library/Logs/Sophos\ Anti-Virus.log
sudo rm -r /Library/Application\ Support/Sophos*
sudo rm -r /Library/Frameworks/SAVI-pyexec.framework
sudo rm -r /Library/Frameworks/SAVI.framework
sudo rm -r /Library/Frameworks/SophosGenericsCommon.framework
sudo rm -r /Library/Frameworks/SophosGenericsCore.framework
sudo rm -r /var/db/receipts/com.sophos.*
sudo rm -r /Library/SophosCBR
sudo rm -r /Library/Logs/Sophos*
sudo rm -r /Applications/Sophos/Sophos\ Endpoint.app
sudo rm -r /Applications/Sophos/Sophos\ Endpoint\ Self\ Help.app
sudo rm -r /Applications/Sophos/Remove\ Sophos\ Endpoint.app
sudo rm -r /Applications/Sophos/Sophos\ Network\ Extension.app
sudo rm -r /Applications/Sophos/Sophos\ Scan.app
sudo rm -r /Applications/Sophos

Followed by the below steps

1. Run the uninstall via GUI
• or use our Sophos Removal Tool found here: https://download.sophos.com/tools/RemoveSophosEndpoint.zip

##At /Library/Caches/ --> there are few files called com.sophos.* --> they should get cleaned as well
##At /Library/Logs all SophosDiagostics.*

Before Reinstallation - Please be reminded of this advisory from Sophos

1. After downloading the Sophos Central installer, extract the .zip to a directory other than the Documents, Desktop, or Downloads folders. It is recommended to use the user home directory (/Users/<username>/).
2. Run the installer .app from this new location.

Please let me know if you have any questions, and I will get back to you within one business day.

United States: Toll Free: 1-833-886-6005
United States: International: 1-508-970-7318

Regards,

Praveen | Technical Support Engineer | Sophos Support

*****Additional line to remove:

Can you try just this command and let us know the output (with a screenshot)?

sudo rm /Library/Sophos Anti-Virus/SophosSecure.keychain