This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HELP REMOVING FREE VIRUS SOFTWARE

I installed the free Sophos home anti-virus software on my MacBook 1 month ago. It was fine, but I decided to go with another software. I tried logging in to use the removal tool but the password wouldn't work. I logged into my home account and was able to access the account. I tried deleting from the account but I guess it deleted only the account and not the app. So I still can't get the app off my computer. I also cannot get a new antivirus software because I can't get this one off. There is NO tech support for the free software and so no one I can get help from. I have no tech skills and have no idea where to begin... I am SO BEYOND FRUSTRATED with this stupid system. HELP!!!!

This thread was automatically locked due to age.

Parents

0 jak over 6 years ago

I assume you've seen:
https://community.sophos.com/kb/en-us/122710

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 Catherine Jones over 6 years ago in reply to jak

You assume incorrectly.

I have now tried it but it didn't work. I still can't install new software because this stupid software won't be removed.
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 6 years ago in reply to Catherine Jones

So "Remove Sophos Home.app" comes up. After double clicking on that you should get a dialog. The title is "Remove Sophos Endpoint".

The text says:
Welcome to Sophos Home removal application....

Click Continue.

This prompts for a password. Your username is filled in, so after entering the password you can click "Install Helper".

The dialog then says:
Stopping services....
Finally "The removal was successful."
and you can click Close.

There really is not much to it.

Where is it going wrong in the above steps.

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 Catherine Jones over 6 years ago in reply to jak

What is wrong is that although the icons appear to be gone, once I try to install new (different) software, I can't because it is still detected on my system.
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 6 years ago in reply to Catherine Jones

I suppose it's down to how the other application detects Sophos is still there.

Typically the other software will have a log file where it logs what is it picking up on. What is the other software you are trying to install?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 Catherine Jones over 6 years ago in reply to jak

Avast. How do I find a log?
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 6 years ago in reply to Catherine Jones

It seems like the Avast installer checks for Kernel Extensions.

From a Terminal window, if you run:

kextstat

I assume you see the 3 Sophos entries in the results. E.g.

163    0 0xffffff7f81034000 0x7000     0x7000     com.sophos.nke.swi (9.7.4) AFB9B66E-C67A-32D1-A8A8-654F475EECFC <4 1>

164    0 0xffffff7f80c20000 0x8000     0x8000     com.sophos.kext.sfm (9.7.4) 47394905-E2D3-3643-804D-D278B1BF74FB <5 4 2 1>

165    0 0xffffff7f80e27000 0x8000     0x8000     com.sophos.kext.oas (9.7.4) FE151087-F3B0-3F51-BD15-3313B8BCDDAB <5 4 2 1>

After I uninstall Sophos Home. Then run the Avast installer I get, I assume the same message as you:

8540.Screen Shot 2018-04-06 at 23.52.34.png

If I shutdown the computer and start it back up, then run the same kextstat command following the restart, then the Sophos entries are no longer listed and I get to the next page in the Avast installer:

1185.Screen Shot 2018-04-07 at 00.02.50.png

Have you tried restarting the computer after uninstalling Sophos?

If so, can you run the "kexstat" command in a Terminal window to look for Sophos entries, are they there?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 jak over 6 years ago in reply to Catherine Jones

It seems like the Avast installer checks for Kernel Extensions.

From a Terminal window, if you run:

kextstat

I assume you see the 3 Sophos entries in the results. E.g.

163    0 0xffffff7f81034000 0x7000     0x7000     com.sophos.nke.swi (9.7.4) AFB9B66E-C67A-32D1-A8A8-654F475EECFC <4 1>

164    0 0xffffff7f80c20000 0x8000     0x8000     com.sophos.kext.sfm (9.7.4) 47394905-E2D3-3643-804D-D278B1BF74FB <5 4 2 1>

165    0 0xffffff7f80e27000 0x8000     0x8000     com.sophos.kext.oas (9.7.4) FE151087-F3B0-3F51-BD15-3313B8BCDDAB <5 4 2 1>

After I uninstall Sophos Home. Then run the Avast installer I get, I assume the same message as you:

8540.Screen Shot 2018-04-06 at 23.52.34.png

If I shutdown the computer and start it back up, then run the same kextstat command following the restart, then the Sophos entries are no longer listed and I get to the next page in the Avast installer:

1185.Screen Shot 2018-04-07 at 00.02.50.png

Have you tried restarting the computer after uninstalling Sophos?

If so, can you run the "kexstat" command in a Terminal window to look for Sophos entries, are they there?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 jak over 6 years ago in reply to jak

I assume the above worked in that the computer just needed a restart.
Cancel
Vote Up 0 Vote Down

Cancel
0 Catherine Jones over 6 years ago in reply to jak

Hi,

I've been occupied with other things and have not been able to reply.

I tried the steps as you describe them. There seems to be no difference between the screen shots before and after the restart. I can't upload them because they are too large.

Is there a way to remove the kernels?
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 6 years ago in reply to Catherine Jones

So having shutdown and started the computer back up; then opening a "Terminal" window and running the command:

kextstat

You still see references to Sophos in the output of that command, E.g.:

163    0 0xffffff7f81034000 0x7000     0x7000     com.sophos.nke.swi (9.7.4) AFB9B66E-C67A-32D1-A8A8-654F475EECFC <4 1>

164    0 0xffffff7f80c20000 0x8000     0x8000     com.sophos.kext.sfm (9.7.4) 47394905-E2D3-3643-804D-D278B1BF74FB <5 4 2 1>

165    0 0xffffff7f80e27000 0x8000     0x8000     com.sophos.kext.oas (9.7.4) FE151087-F3B0-3F51-BD15-3313B8BCDDAB <5 4 2 1>

Is so, I have to assume this is the reason I assume Avast still believes Sophos is installed in their pre-check.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 Catherine Jones over 6 years ago in reply to jak

Hi,

This problem still exists and I don't know how to remove the kernel data. Can you tell me how to remove it?

Catherine
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 6 years ago in reply to Catherine Jones

Have you confirmed the names of the Sophos extensions presumably still loaded with the command:

kextstat

For each of those listed you should be able to remove them with the kextunload command as detailed here as the first example:

https://www.maketecheasier.com/add-remove-kexts-from-macos/

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel