How to remove the Sophos keychain file on Mac OS 11.5.2

Question

The discussion from 7 years ago no longer helps. The solution that was posted no longer exists. 
 Any ideas what I can do? I have tried many things. Logged in as root, tried deleting from Keychain Acces, tried deleting in Terminal, tried finding the file in the Finder, looked for the com.apple.security-common.plist to remove the sophos keychain content there (the file doesn't exist). 
 So.... can anyone tell me how the heck to get rid of this thing? 
 It's causing problems with Adobe apps so I really need to delete the thing.

GlennSen · Answer

Hi there,

You may follow the below steps on removing this key chain.

Here are the directions to follow for removing the Sophos keychain remnant (you need to be booted into a root user to do this). Tips for enabling root are here: https://support.apple.com/en-us/HT204012

"To fix this you have to manually edit the file /Library/Preferences/com.apple.security-common.plist, as root, and delete the corresponding hardcoded <dict>...Sophos...</dict> entry in there.

Great care must be taken because you can screw up your system(-keychain) if you leave any errors inside this .plist file. The section that needs to be deleted looks as follows:

...
<dict>
<key>DbName</key>
<string>/Library/Sophos Anti-Virus/Sophos.keychain</string>
<key>GUID</key>
<string>{some UUID string here}</string>
<key>SubserviceType</key>
<integer>6</integer>
</dict>
...

Upon save, there should no longer be any "Sophos" entry in Keychain Access or as the output of security list-keychains."
Remember to turn off the root after you're done.

Let us know if this helps you with your query.

Glenn ArchieSeñas (GlennSen)

Global Community Support Engineer

The New Home of Sophos Support Videos! - Visit Sophos Techvids