Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 17 replies
  • Answers 1 answer
  • Subscribers 10 subscribers
  • Views 24106 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HELP REMOVING FREE VIRUS SOFTWARE

Catherine Jones

 I installed the free Sophos home anti-virus software on my MacBook 1 month ago. It was fine, but I decided to go with another software. I tried logging in to use the removal tool but the password wouldn't work. I logged into my home account and was able to access the account. I tried deleting from the account but I guess it deleted only the account and not the app. So I still can't get the app off my computer. I also cannot get a new antivirus software because I can't get this one off. There is NO tech support for the free software and so no one I can get help from. I have no tech skills and have no idea where to begin... I am SO BEYOND FRUSTRATED with this stupid system. HELP!!!!



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to Catherine Jones

    So "Remove Sophos Home.app" comes up. After double clicking on that you should get a dialog.  The title is "Remove Sophos Endpoint".

    The text says:
    Welcome to Sophos Home removal application....

    Click Continue.

    This prompts for a password.  Your username is filled in, so after entering the password you can click "Install Helper".

    The dialog then says:
    Stopping services....
    Finally "The removal was successful."
    and you can click Close.

    There really is not much to it.

    Where is it going wrong in the above steps.


    Jak

Children
  • 0 in reply to jak

    What is wrong is that although the icons appear to be gone, once I try to install new (different) software, I can't because it is still detected on my system.

  • 0 in reply to Catherine Jones

    I suppose it's down to how the other application detects Sophos is still there. 

    Typically the other software will have a log file where it logs what is it picking up on.  What is the other software you are trying to install?  

    Regards,

    Jak

  • 0 in reply to jak

    Avast. How do I find a log?

  • 0 in reply to Catherine Jones

    It seems like the Avast installer checks for Kernel Extensions.

    From a Terminal window, if you run:

    kextstat

    I assume you see the 3 Sophos entries in the results.  E.g.

      163    0 0xffffff7f81034000 0x7000     0x7000     com.sophos.nke.swi (9.7.4) AFB9B66E-C67A-32D1-A8A8-654F475EECFC <4 1>

      164    0 0xffffff7f80c20000 0x8000     0x8000     com.sophos.kext.sfm (9.7.4) 47394905-E2D3-3643-804D-D278B1BF74FB <5 4 2 1>

      165    0 0xffffff7f80e27000 0x8000     0x8000     com.sophos.kext.oas (9.7.4) FE151087-F3B0-3F51-BD15-3313B8BCDDAB <5 4 2 1>

    After I uninstall Sophos Home.  Then run the Avast installer I get, I assume the same message as you:

    8540.Screen Shot 2018-04-06 at 23.52.34.png

    If I shutdown the computer and start it back up, then run the same kextstat command following the restart, then the Sophos entries are no longer listed and I get to the next page in the Avast installer:

    1185.Screen Shot 2018-04-07 at 00.02.50.png

    Have you tried restarting the computer after uninstalling Sophos?

    If so, can you run the "kexstat" command in a Terminal window to look for Sophos entries, are they there? 

    Regards,

    Jak

  • 0 in reply to jak

    I assume the above worked in that the computer just needed a restart.

  • 0 in reply to jak

    Hi,

    I've been occupied with other things and have not been able to reply.

    I tried the steps as you describe them. There seems to be no difference between the screen shots before and after the restart. I can't upload them because they are too large. 

     

    Is there a way to remove the kernels?

  • 0 in reply to Catherine Jones

    So having shutdown and started the computer back up; then opening a "Terminal" window and running the command:

    kextstat

    You still see references to Sophos in the output of that command, E.g.:

    163    0 0xffffff7f81034000 0x7000     0x7000     com.sophos.nke.swi (9.7.4) AFB9B66E-C67A-32D1-A8A8-654F475EECFC <4 1>

    164    0 0xffffff7f80c20000 0x8000     0x8000     com.sophos.kext.sfm (9.7.4) 47394905-E2D3-3643-804D-D278B1BF74FB <5 4 2 1>

    165    0 0xffffff7f80e27000 0x8000     0x8000     com.sophos.kext.oas (9.7.4) FE151087-F3B0-3F51-BD15-3313B8BCDDAB <5 4 2 1>

    Is so, I have to assume this is the reason I assume Avast still believes Sophos is installed in their pre-check.

    Regards,

    Jak

  • 0 in reply to jak

    Hi,

    This problem still exists and I don't know how to remove the kernel  data. Can you tell me how to remove it?

    Catherine

  • 0 in reply to Catherine Jones

    Have you confirmed the names of the Sophos extensions presumably still loaded with the command:

    kextstat

     

    For each of those listed you should be able to remove them with the kextunload command as detailed here as the first example:

    https://www.maketecheasier.com/add-remove-kexts-from-macos/

    Regards,

    Jak

  • 0 in reply to jak

    I'm having similar issue. I did look for and find he removal tool from the very start. But Removal tool fails, and gives no other option. The sis what happens:

    jak said:

    The text says:
    Welcome to Sophos Home removal application....

    Click Continue.

    Yep.

    jak said:
    This prompts for a password.  Your username is filled in, so after entering the password you can click "Install Helper".

    Yep.

    jak said:
    The dialog then says:
    Stopping services....
    Finally "The removal was successful."
    and you can click Close.

    Nope. The dialog then says:

    "The Removal failed."

    "The software was not successfully removed." 

    And I can click "Close" and no other option. 

    After trying this three or four times, I tried uninstalling with "Clean My Mac", that fails too because it can not force Sophos Home to quit. I though I have turned off all protection from Sophos Home, I can't find a way to force it to quit either.

    Is there an OFF button I'm missing somewhere?

Unfiltered HTML