Can't install or uninstall

Hi mickeykelly,

The majority of components are installed into /Library/Sophos Anti-Virus. You'll need administrative permission on your Mac to remove them.

In the future I'd recommend running the uninstallation tool - its there for a reason. :smileyhappy:

PLEASE somebody help me!  I have used Sophos Anti-Virus for over a year, with success.  About 2 weeks ago, I upgraded from originally Snow Leopard to Mountain Lion.  I think I may have run Sophos since the upgrade, but am not positive.  Today, all of a sudden, I get a pop-up window, a 'Problem Report for SophosUI Server', saying "SophosUISever cannot be opened because of a problem."  It suggests I check with the developer to make sure SophosUIServer works with this version of OS X.  I first look in Finder & the Sophos app has mysteriously disappered, but the uninstall app was still listed.  I opted to uninstall, but for a while it would not accept my administrative password to do so.  I even tried changing my password, but it still would not accept.  Finally the uninstall app also disappeared from Finder:  but the pop-up Problem Report still pops-up literally every 5 seconds, totatlly bringing all things to a standstill until I click OK or momentarily get rid of it by clicking back on what I am working on, such as this message.  I had Apple Support contact me, & we absolutely securely trashed ALL TRACES of any form of Sophos throughout the entire computer.  They did all they could & had to admit it must be something about the software.  I have since tried to upgrade to Sophos Version 8, & then even the new Version 9 Sophos, to over-ride this pop-up.  It will not let me install either because it says this application is already installed on my computer.  IT IS NOT.  Apple Support & I went back through every last thing.  It simply refuses to admit there has been an uninstall, & this pop-up box is RELENTLESS, & will only not show up when starting up the computer in Safe Mode, which is horribly slow & won't let me stay in full-screen for movies, etc.  EVERYTHING I try to do is CONSTANTLY interrupted by this absolute MYSTERY.  Anyone?!?  PLEASE!!!   Thanks!  T

Hi Mark33,

The SophosUIServer is started on login. Sounds like there is still code trying to start it. You should check your Login Items (System Preferences > Users & Groups > Login Items tab). Remove anything saying Sophos.

Next check your system LaunchAgents directory. Check the directory /Library/LaunchAgents and remove anything containing "sophos". You'll need to be the computer administrator to do it.

Hope that helps.

Thanks so much for responding!  I had already tried the things you suggested, when working with the Apple Support person.  We erased several Sophos files from different locations.  But I double-checked what you said, just to be certain: nothing.  I then decided to look in EVERY Folder & every Folder within every Folder.  FINDINGS:  In Logs, I did find an Anti-Soph Folder & Trashed it.  Also in Logs<DiagnosticReports are multiple SophosUISer...-iMac.crash messages (as you might expect), but Trashing them is futile as more & more just re-appear.  In Logs<DeviceLink there is this: MDCrashReportTool.00.log, which I did not Trash, though I remember the Apple Support person saying sometimes software designers list items as something other than the name of the software, & I believe she said "It might be something labelled..." & I believe she said either MO or MD?  I then found Containers<com.symantec.iAntivirus<Data<AntiVirus, but that led to nothing & seems all Mac related, no?  I didn't erase any of that.  There is also Application Support<CrashReporter<SophosUISer...BOE157.plist, but I keeps re-appearing before being able to securely Trash it.  THAT'S IT.  I shut down, unplugged, waited a few minutes, re-booted, & it is still the same. ANYTHING?  Thanks so,so much for the help, really.

Hi Mark33,

The crash logs are appearing because the system is attempting to start the SophosUIServer and its either not present or been partially removed. The system attempts to restart background software every ~10 seconds or so.

If you didn't find files in /Library/LaunchAgents or as Login Items, its possible that launchd still has a copy in its "memory" - unfortunately Apple does not document where launchd keeps its configuration on disk for later versions of the system (see their man page for confirmation). If launchd still has it, you might get it to clear on reboot, but possibly it will require a bit more work.

You can poke at launchd via the Terminal with the launchctl command. Try this in Terminal:

    launchctl list | grep -i sophos

You might get a blank result (meaning there is no such entry matching "sophos") or you might get something like "com.sophos.uiserver".

You can try to remove an entry from launchd using launchctl using these commands in Terminal:

    launchctl unload /Library/LaunchAgents/com.sophos.uiserver.plist

    launchctl remove com.sophos.uiserver

Chances are good that one of these will fail e.g. spit back an error message of some sort. Might be that both of them will fail, but that would be surprising because your description suggests launchd still has it.

Hope that helps.

Bob...

Well, I tried all that you suggested.

launchctl list | grep -i sophos  DID originally bring the result of "com.sophos.uiserver"

Neither approach to unload or remove via launchctl was successful.

I also tried launchctl remove (also tried unload) /Library/Application Support/CrashReporter/SophosUISer...BOE157.plist (this is where a SophosUIServer .plist actually IS located; & yes, I actually dragged the .plist that is listed via Finder into Terminal, so the whole of the code was listed when attempting to remove/unload).

I contacted Apple Support again, to no avail.

They say it is the software, not the operating system, & that you, as Sophos head designer, can & must find a way of getting your product off my computer.

I know you are trying, & please don't give up.

I've given you all the Sophos related information I can find in my Library.

Operating in Safe Mode is the only way to keep this thing from popping up...but that's a total drag, as the computer is slow, it won't play video in full-screen, etc.

That can't be the answer.

I just can't seem to get this thing out of my computer!

I tried multiple combinations of launchctl commands in an attempt to route this out.

What next, do you think?

Bob...

I think I might be trying to find a SophosUIServer Problem Reporter.app ???

I can't find it anywhere, but in trying to restart my computer, it said this app should first be closed.

I have no idea.

The Path identified in the Problem Details and System Configuration of the pop-up is: /Library/Sophos Anti-Virus/SophosUIServer.app/Contents/MacOS/SophosUIServer

Of course I can't find that.

Remember, the Sophos Anti-Virus option within Finder was no longer there once this pop-up occurred, only the Uninstall, which I did.

I'm at a loss here.

                                    ~Mark33

Hi Mark33,

We don't install anything called "SophosUIServer Problem Reporter.app" - sounds like its just the operating system trying to report something about our software (which is called SophosUIServer.app and typically lives in /Library/Sophos Anti-Virus/).

I'm quite surprised the "launchctl remove" option didn't work, but at least we've identified where the problem is. The path you mentioned in your previous email re: /Library/Application Support/CrashReporter is not related to launchd, unfortuantely. Otherwise it would be as easy as deleting that file.

Desperation recommendation: install the product again and re-run the remove program (it should be able to remove the entries from launchd once they are installed). I would recommend running the version 9 installer & remover, its smarter than the v8 one.

One way you might try to avoid doing that is to create an entry for launchctl to be able to manipulate. You would need to create a file named /Library/LaunchAgents/com.sophos.uiserver.plist then ask launchctl to unload it. The contents of that file should look like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.sophos.uiserver</string>
<key>ProgramArguments</key>
<array>
<string>/Library/Sophos Anti-Virus/SophosUIServer.app/Contents/MacOS/SophosUIServer</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>

This is what launchd thinks already exists, so creating it won't be harmful. Once you've got the file created, try running the "launchctl unload" command. Once that command succeeds, remove the file.

Let me know how it goes.

Bob...

Thanks for hanging in there with me!

I'll give it a go & let you know.

Always a learning curve!

                                               ~Mark33

Bob...

So...I couldn't do the Desperation Move...install 9.0 & uninstall, as it wouldn't let me install the program as "it already exists" (I believe it said)...so I was told to uninstall the current version then try install again.

If only I could!

The code:  As I am new to this, it took me a while to research & find I needed to put quotes around the first line, in order to avoid a -bash: syntax error near unexpected 'newline' message.

However, once I placed the quotes, it dropped down to a line with simply a > symbol displayed (I took this as a good sign).

But after the second command line, I received an -bash: !DOCTYPE: event not found message.

(It seemed you added the text in blue after sending the original message...is this true?)

 At any rate, I Copy & Past'd both & typed both, separate & together, with and without quotes, just to be sure: no go.

It does seem strange to me that the unload & remove didn't work in Terminal, so I tried again.

The launchctl list | grep -i sophos command DID result in a com.sophos.uiserver message (not positive it said .plist as well, however).

I again tried the launchctl remove com.sophos.uiserver command, & it just went to the next line.

It didn't ask me to verify the remove or not (though I think I read that is what the -i is for in the code, to verify a remove command with a y or yes response).

Since it didn't kick back an error message of any kind, I was hoping that was it.

I simply Quit out of Terminal & Re-started.

Didn't do a thing.

I just now tried the same launchctl list | grep -i sophos command in Terminal & was given a launchctl remove error: No such process response.

It DIDN'T, this time, first produce the com.sophos.uiserver message as it had previously done when I tried before.

This was the same as the other times I have tried both unload & remove.

I will Re-start & try again.

So...what do you think?

                                          ~Mark