Boot failure - Sophosed.sys corrupted

Question

The Sophosed.sys file is corrupted causing a Windows 10 system boot failure. This driver file is located in \Windows\System32\Drivers\. Only the command prompt (not Safeboot) can be accessed. I can access an external USB drive and can transfer files. Where can I find a copy of this file? Or is there anyway to uninstall/disable Sophos from a command line?

This thread was automatically locked due to age.

jak · Answer

You might find a copy here: 
 C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\sed64 
 This is the file downloaded by AutoUpate before being installed. 
 I assume if you rename \Windows\System32\Drivers\sophosed.sys, the computer boots fine? 
 Regards, 
 Jak

jak · Answer

Are you able to open the registry, navigate to: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense" and set the "Start" value to 4 and reboot. This should disable the driver in question from starting at startup. From the command line, the following should do the same: REG.EXE ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /d "4" /t REG_DWORD /f 
 
 That said, I would think that being able to rename the file would result in the same outcome. 
 Regards, 
 Jak