Help with Sophos Endpoint Protection

With Tamper Protection (Endpoint Defense component) disabled on a client, the standard uninstaller should work.  Either the UI version of CLI version found under:

C:\Program Files\Sophos\Sophos Endpoint Agent\

Notes:

• Any requests to reboot are driven by the PendingFileRenameOperations registry key being present:  https://technet.microsoft.com/en-us/library/cc960241.aspx.
• Endpoint Defense is implemented by the driver "\windows\system32\drivers\Sophosed.sys"

That said, the files you had left over are part of web intelligence/web control feature. They only exist on Windows 7/2008.  Windows 8.1+ doesn't use a LSP to implement web features.

The LSP is removed from the Winsock Catalog on reboot when configured to do so by the Sophos Web Intelligence Service.

The command:
netsh winsock show catalog > cat.txt

...will show if the Sophos LSP is registered in Winsock.

It is the Sophos Web Intelligence Update Service that starts up and reads a "swiupdateaction" registry DWORD value under: 
HKEY_LOCAL_MACHINE\SOFTWARE\[WOW6432Node]\Sophos\Web Intelligence\.

Note: This value can be a 3 if it's just to disable the web feature and unload the LSP on next start or 8 (I think) if it's a removal.  By default it's not present unless there is work scheduled for the service to perform and boot.

This value tells the Sophos Web Intelligence Update Service, which starts starts early on at boot to either unload the LSP from Winsock, if you are just disabling the Web protection and web Control features or if on uninstall of Sophos Anti-Virus, the service removes the LSP from the Winsock catalog and goes on to remove itself.

Of course, the swi update service still starts after some services that make winsock calls, so there is a chance that the DLL can't be removed until 2 reboots, as on the second reboot the catalog entry doesn't reference the LSP dll and therefore it's not loaded by any process.

You can reset the winsock catalog (netsh winsock reset) to remove references to all LSPs but this would remove all LSPs not that there are typically many on most machines.

Regards,

Jak

Hi Jak and thanks for the reply.

When I try to use uninstall option from the control panel is either ask for restart or it says that .msi installer is not found. Is there Sophos removal tool as some other vendors have? I tried to search myself but I did not find anything.

Below is a screenshot of my winsock entry for Sophos. The PC was restarted more than 10 times and this entry is still there. 

This is the registry location you mention at your reply. Do I need to do anything here, can I safely delete the Sophos record from the registry?

We have to remove this product for 4 servers and I am quite skeptical now how this will go. There should be solution as I see that other people has similar issues either after installation or removal of the software.

Thanks

Mladen 

When you try an uninstall from Programs and Features you mention this message:
".msi installer is not found. "

This could be a misleading error message if it's relating to the Sophos Anti-Virus component.  It could be that the uninstall of SAV is actually failing.

There should be a MSI uninstal log under %temp%.  When I have seen this, it's because the uninstalling user is not a member of the SophosAdministrator local group.  Can you add your account to the local sophosadministrator group and try an uninstall again?  The MSI log will confirm it but this is my hunch.

Regards,

Jak

 

As I am using Local or Domain Administrator accounts I thought that I have all permissions to uninstall the software. I add my account to Sophos Administrators group as per your recommendation. Now the system ask again for restart every time I try to run the uninstaller. I know you mention that this is because some files are pending for renaming. Are these files Sophos files or they can be any files? Is this because I did not do something correctly or because there is some problem with the windows itself. How can I solve this problem?

Thanks

Mladen

The pendingfilerename operations is a system wide setting.  Any application can pend a file for removal or rename at startup.

When the computer starts the Session Manager, the smss.exe process reads the key and either removes or deletes the files refernced.  There is a \Windows\PFRO.log log file but it is only created or appended to if an operation fails.

Entries in the key with a blank line beneath are be to removed.  2 consecutive lines in the key are a rename from one to the other.

It is possible you could be unlucky that it keeps getting populated but it's quite easy to evaluate the values in it to know if you can just rename/delete the key given the entries in it.

Regards,

Jak

The pendingfilerename operations is a system wide setting.  Any application can pend a file for removal or rename at startup.

When the computer starts the Session Manager, the smss.exe process reads the key and either removes or deletes the files refernced.  There is a \Windows\PFRO.log log file but it is only created or appended to if an operation fails.

Entries in the key with a blank line beneath are be to removed.  2 consecutive lines in the key are a rename from one to the other.

It is possible you could be unlucky that it keeps getting populated but it's quite easy to evaluate the values in it to know if you can just rename/delete the key given the entries in it.

Regards,

Jak

I have manage to successfully uninstall Sophos Endpoint agent software following your steps. After the removal process and the PC restart there are some Sophos leftovers but I can delete them easily without affecting my system.

I am planing product removal on my server next weekend. Hopefully it will be a smooth operation.

Thank you Jak for your time and effort.

Regards

Mladen