Sophos Mac Manual Clean Up

Sophos Mac Manual Clean Up Average ratng: 6,6/10 8743 votes
  1. Apple Mac Manual
  2. Sophos Mac Manual Clean Up Mac
  3. Sophos Mac Manual Clean Up Free
  4. Sophos Mac Manual Clean Up Software
Active2 years, 2 months ago

.Automated malware clean up 4. Evolution of Systems Control System Reactive System Autonomous System 5. Zero Trust System 6 Autonomous Security Firewall Wireless Email Web Sophos Encryption Mobile Server Endpoint Central Users Devices Cloud Computing Instances SaaS Applications. Manual attacks with custom or legitimate hack tools.

I was viewing another answer on this website and one of the links lead me to a malicious website. I have Sophos Antivirus installed, and a warning immediately popped up telling me that a threat was detected:

To activate a license: 1. Ensure you have the License Activation Key shown in the License Schedule that Sophos sent you. Sophos Home protects every Mac and PC in your home. Sophos Clean Free Trial. Get the full-featured product Easy to set up and deploy. If Sophos detects that your Mac has a virus-infected file on it, here are instructions on how to use the Quarantine Manager to get rid of the infection. Previously, I’ve endorsed the use of an anti-virus application and specifically recommend Sophos or ClamXav.

Threat: Mal/Badsrc-M
Path and Filename: /Users/USER/Library/Caches/Google/Chrome/Default/Cache/f_000e36
Action Available: The threat cannot be cleaned up. Please click the threat name above for manual cleanup instructions.

On the website, there are no instructions as to how to cleanup the threat. Even though this seems to be only a Windows virus, I still want it removed on my Mac so that it can't infect any other computers. Is it as simple as manually deleting the file listed above, or is there anything else I need to be worried about?

Community♦
SensefulSenseful
12.9k66 gold badges157 silver badges258 bronze badges

3 Answers

Minus the fact that Sophos is just a giant waste of resources and space on your mac. The easiest way to clean it up would be to close chrome and go to that path in terminal and delete the file.

Open terminal and type the following:

That should delete the file forcibly.

Personal Note:

Having to run antivirus on your mac to protect windows machines is like wearing a helmet at your desk cause the guy on the bike outside might get hit by a car..

DigitalchildDigitalchild

It seems that the steps Sophos wants you to take are found on this page:

OBD-II codes and definitions for all 1996 and newer vehicles ABS and SRS/Airbag codes and definitions for most GM, Ford, Chrysler, Toyota, Honda, Nissan, and Hyundai veh. OBD II codes and definitions for all 1996 and newer vehicles ABS codes and definitions for most 1996-2013 GM, Ford, Chrysler, Toyota, Honda, Nissan, and Hyundai vehicles. View & download of more than 53 Mac tools PDF user manuals, service manuals, operating guides. Welding system user manuals, operating guides & specifications. Mac tools code scanner et110anx manual.

  1. Open the Quarantine Manager.
  2. [..]
  3. If there are any threats for which the action available is 'Clean up manually', create a custom scan.
  4. Select the areas where the remaining threats reside and add these to the Scan Items.
  5. In the Options tab, select 'Delete threat' from the drop down menu.
  6. Click Done.
  7. Run the scan.

Tip: When choosing which folder to scan in step 4, I needed to navigate to the hidden Library folder in the Sophos dialog, which I couldn't do. So what I ended up doing was using Finder's Go >Go To Folder.. menu option to first get to the folder, and then I created a shortcut to the cache folder in my Documents folder. Then when it asked me to select a folder to scan, I simply followed that shortcut I created.

SensefulSenseful
12.9k66 gold badges157 silver badges258 bronze badges

You can clear your browsing data like here if you must. It is in Google chrome cache buddy.

And then you find and remove:

  • /Applications - any .app starting Sophos
  • /Library/Application Support/Sophos - entire folder (SAV 9 only)
  • /Library/Caches - all folders with com.sophos in name
  • /Library/Contextual Menu Items/Sophos Anti-Virus.plugin (SAV 8 only)
  • /Library/Extensions - all .kext files with Sophos in name
  • /Library/Frameworks/SAVI.framework & SUMScanKit.framework
  • /Library/LaunchAgents - all .plists with sophos in name
  • /Library/LaunchDaemons - all com.sophos plists
  • /Library/Sophos Anti-Virus - entire folder
  • /Library/usr/bin/sweep N.B. /Library/usr folder is invisible in the Finder.
kenorb
7,6179 gold badges54 silver badges103 bronze badges
iskraiskra

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged anti-virusvirus .

sophosremoval.bat
@ECHOOFF
ECHO
ECHO Sophos Removal v1.0 - Ed Cooper 2014
ECHO Removes Sophos v7 - v10
ECHO
ECHO.
ECHO.
IFNOTEXIST'%~dp0msizap.exe'GOTO MSIZAPNOTFOUND
ECHO Administrative permissions required. Detecting permissions..
ECHO.
net session>NUL2>&1
IF%errorLevel%0 (
ECHO All good, let's go!
GOTO GO
) ELSE (
ECHO Nah, you ain't no admin! Try again with Run as Administrator.
ECHO.
PAUSE
EXIT
)
:GO
ECHO.
ECHO
ECHO Modifying Services
ECHO
net stop'Sophos Agent'>NUL2>&1
net stop'Sophos Anti-Virus'>NUL2>&1
net stop'Sophos Anti-Virus status reporter'>NUL2>&1
net stop'Sophos AutoUpdate Service'>NUL2>&1
net stop'Sophos Message Router'>NUL2>&1
net stop'Sophos Web Intelligence Service'>NUL2>&1
net stop'Sophos Client Firewall'>NUL2>&1
net stop'Sophos Client Firewall Manager'>NUL2>&1
net stop'Sophos Web Control Service'>NUL2>&1
sc config sharedaccess start= disabled >NUL2>&1
sc config browser start= auto >NUL2>&1
sc config remoteregistry start= auto >NUL2>&1
sc config lanmanserver start= auto >NUL2>&1
sc config schedule start= auto >NUL2>&1
sc config msiserver start= auto >NUL2>&1
sc config lanmanworkstation start= auto >NUL2>&1
net stop sharedaccess >NUL2>&1
net start lanmanworkstation >NUL2>&1
net start msiserver >NUL2>&1
net start schedule >NUL2>&1
net start lanmanserver >NUL2>&1
net start remoteregistry >NUL2>&1
net start browser >NUL2>&1
ECHO.
ECHO Done
ECHO.
ECHO
ECHO Performing MSI Uninstall
ECHO
msiexec.exe /x 'c:program filessophosautoupdatecachesavxpsophos anti-virus.msi' /q /norestart >NUL2>&1
msiexec.exe /x 'c:program filessophosautoupdatecachermssophos remote management system.msi' /q /norestart >NUL2>&1
msiexec.exe /x 'c:program filessophosautoupdatecachesausophos autoupdate.msi' /q /norestart >NUL2>&1
msiexec.exe /x 'c:program filessophosautoupdatecachescfsophos client firewall.msi' /q /norestart >NUL2>&1
reg delete HKLMSoftwareSophos /f >NUL2>&1
reg delete HKCUSoftwareSophos /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos Agent' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSavService' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSAVAdminService' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos AutoUpdate Agent' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos AutoUpdate Service' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos Certification Manager' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos EMLib Update Agent' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSEMscheduler' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos Management Service' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos Message Router' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSQLAgent$SOPHOS' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesMSSQL$SOPHOS' /f >NUL2>&1
reg delete 'HKLMSystemCurrentControlSetServicesEventlogSophos' /f >NUL2>&1
reg delete 'HKEY_CLASSES_ROOTISPSheet' /f >NUL2>&1
reg delete 'HKEY_CLASSES_ROOTISPSheet.1' /f >NUL2>&1
reg delete 'HKEY_LOCAL_MACHINESOFTWAREClassesAppID{061CC07B-BA7A-44D1-81FA-D36BE1CE55D9}' /f >NUL2>&1
TASKKILL /F /IM 'Almon.exe'>NUL2>&1
TASKKILL /F /IM 'swc_service.exe'>NUL2>&1
ECHO.
ECHO Done
ECHO.
ECHO
ECHO Performing MSI Cleanup
ECHO
'%~dp0MSIZAP.EXE' tw {15C418EB-7675-42be-B2B3-281952DA014D} >NUL2>&1
'%~dp0MSIZAP.EXE' tw {09C6BF52-6DBA-4A97-9939-B6C24E4738BF} >NUL2>&1
'%~dp0MSIZAP.EXE' tw {9ACB414D-9347-40B6-A453-5EFB2DB59DFA} >NUL2>&1
'%~dp0MSIZAP.EXE' tw {C12953C2-4F15-4A6C-91BC-511B96AE2775} >NUL2>&1
'%~dp0MSIZAP.EXE' tw {FF11005D-CBC8-45D5-A288-25C7BB304121} >NUL2>&1
'%~dp0MSIZAP.EXE' tw {FED1005D-CBC8-45D5-A288-FFC7BB304121} >NUL2>&1
'%~dp0MSIZAP.EXE' tw {12C00299-B8B4-40D3-9663-66ABEA3198AB} >NUL2>&1
ECHO.
ECHO Done
ECHO.
ECHO
ECHO Performing Registry Cleanup
ECHO
reg delete HKLMSoftwareSophos /f >NUL2>&1
reg delete HKCUSoftwareSophos /f >NUL2>&1
reg delete 'HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindowsAppInit_DLLs' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos Agent' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSavService' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSAVAdminService' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos AutoUpdate Agent' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos AutoUpdate Service' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos Certification Manager' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos EMLib Update Agent' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSEMscheduler' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos Management Service' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSophos Message Router' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesSQLAgent$SOPHOS' /f >NUL2>&1
reg delete 'HKLMSYSTEMCurrentControlSetServicesMSSQL$SOPHOS' /f >NUL2>&1
reg delete 'HKLMSystemCurrentControlSetServicesEventlogSophos' /f >NUL2>&1
reg delete 'HKEY_CLASSES_ROOTISPSheet' /f >NUL2>&1
reg delete 'HKEY_CLASSES_ROOTISPSheet.1' /f >NUL2>&1
reg delete 'HKEY_LOCAL_MACHINESOFTWAREClassesAppID{061CC07B-BA7A-44D1-81FA-D36BE1CE55D9}' /f >NUL2>&1
ECHO REGEDIT4 >%TEMP%SOTMP.REG
ECHO. >>%TEMP%SOTMP.REG
ECHO [-HKEY_CLASSES_ROOTInstallerProducts25FB6C90ABD679A499936B2CE47483FB] >>%TEMP%SOTMP.REG
ECHO [-HKEY_CLASSES_ROOTInstallerProductsBE814C515767eb242B3B829125AD10D4] >>%TEMP%SOTMP.REG
ECHO [-HKEY_CLASSES_ROOTInstallerProducts2C35921C51F4C6A419CB15B169EA7257] >>%TEMP%SOTMP.REG
ECHO [-HKEY_CLASSES_ROOTInstallerProductsD50011FF8CBC5D542A88527CBB031412] >>%TEMP%SOTMP.REG
ECHO [-HKEY_CLASSES_ROOTInstallerFeatures25FB6C90ABD679A499936B2CE47483FB] >>%TEMP%SOTMP.REG
ECHO [-HKEY_CLASSES_ROOTInstallerFeaturesBE814C515767eb242B3B829125AD10D4] >>%TEMP%SOTMP.REG
ECHO [-HKEY_CLASSES_ROOTInstallerFeatures2C35921C51F4C6A419CB15B169EA7257] >>%TEMP%SOTMP.REG
ECHO [-HKEY_CLASSES_ROOTInstallerFeaturesD50011FF8CBC5D542A88527CBB031412] >>%TEMP%SOTMP.REG
ECHO [-HKEY_CLASSES_ROOTInstallerUpgradeCodesE932B7952303A1943A2218777329E5A8] >>%TEMP%SOTMP.REG
ECHO [-HKEY_CLASSES_ROOTInstallerUpgradeCodes0D6888B32A8929940ACA98A3DEBB94B4] >>%TEMP%SOTMP.REG
ECHO [-HKEY_CLASSES_ROOTInstallerUpgradeCodesA2ECF5789F971654CBB5476964870E94] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREClassesInstallerFeatures25FB6C90ABD679A499936B2CE47483FB] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREClassesInstallerFeaturesBE814C515767eb242B3B829125AD10D4] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREClassesInstallerFeatures2C35921C51F4C6A419CB15B169EA7257] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREClassesInstallerFeaturesD50011FF8CBC5D542A88527CBB031412] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREClassesInstallerProducts25FB6C90ABD679A499936B2CE47483FB] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREClassesInstallerProductsBE814C515767eb242B3B829125AD10D4] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREClassesInstallerProducts2C35921C51F4C6A419CB15B169EA7257] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREClassesInstallerProductsD50011FF8CBC5D542A88527CBB031412] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREClassesInstallerUpgradeCodesE932B7952303A1943A2218777329E5A8] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREClassesInstallerUpgradeCodes0D6888B32A8929940ACA98A3DEBB94B4] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREClassesInstallerUpgradeCodesA2ECF5789F971654CBB5476964870E94] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUpgradeCodesE932B7952303A194 3A2218777329E5A8] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUpgradeCodes0D6888B32A892994 0ACA98A3DEBB94B4] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUpgradeCodesA2ECF5789F971654 CBB5476964870E94] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Products25FB6C90ABD679A499936B2CE47483FB] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ProductsBE814C515767eb242B3B829125AD10D4] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Products2C35921C51F4C6A419CB15B169EA7257] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ProductsD50011FF8CBC5D542A88527CBB031412] >>%TEMP%SOTMP.REG
ECHO [-HKEY_CURRENT_USERSoftwareSophos] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESoftwareSophos] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall{09C6BF52-6DBA-4A97-9939-B6C24E4738BF}] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall{15C418EB-7675-42be-B2B3-281952DA014D}] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall{C12953C2-4F15-4A6C-91BC-511B96AE2775}] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall{FF11005D-CBC8-45D5-A288-25C7BB304121}] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_SAVADMINSERVICE] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_SAVONACCESS_CONTROL] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_SAVONACCESS_FILTER] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_SAVSERVICE] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_SOPHOS_AGENT] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_SOPHOS_AUTOUPDATE_AGENT] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_SOPHOS_AUTOUPDATE_SERVICE] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_SOPHOS_MESSAGE_ROUTER] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEventlogApplicationSophosAntiVirus] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEventlogSystemSAVOnAccess Control] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEventlogSystemSAVOnAccess Filter] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesSAVAdminService] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesSAVOnAccess Control] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesSAVOnAccess Filter] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesSAVService] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesSophos Agent] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesSophos AutoUpdate Agent] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesSophos AutoUpdate Service] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesSophos Message Router] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_SAVADMINSERVICE] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_SAVONACCESS_CONTROL] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_SAVONACCESS_FILTER] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_SOPHOS_AGENT] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_SAVSERVICE] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_SOPHOS_AUTOUPDATE_AGENT] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_SOPHOS_AUTOUPDATE_SERVICE] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_SOPHOS_MESSAGE_ROUTER] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventlogApplicationSophosAntiVirus] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventlogSystemSAVOnAccess Control] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventlogSystemSAVOnAccess Filter] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSAVAdminService] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSAVOnAccess Control] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSAVOnAccess Filter] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSAVService] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSophos Agent] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSophos AutoUpdate Agent] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSophos AutoUpdate Service] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSophos Message Router] >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-Viruspublic.pem'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusBackgroundScanClient.exe'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusWSCClient.exe'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusDataControlManagement.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusDetectionFeedback.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusComponentManager.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusConfiguration.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusDriveProcessor.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusEEConsumer.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusICAdapter.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusSAVControl.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusSIPSManagement.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusSWIManagement.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusSavProgress.exe'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusScanManagement.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusSystemInformation.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusTamperProtectionControl.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusTamperProtectionManagement.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusTamperProtectionPlugin.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusThreatDetection.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusVirusDetection.dll'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosAutoUpdateCache'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosAutoUpdate'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosAutoUpdateConfig'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosAutoUpdatedata'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosAutoUpdate'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosAutoUpdateLogs'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosAutoUpdatezh_cn'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosAutoUpdatezh_tw'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosAutoUpdateDefaultConfig'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosAutoUpdateen'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosAutoUpdatefr'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosAutoUpdatede'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosAutoUpdateit'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosAutoUpdateja'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosAutoUpdatees'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:WindowsInstaller{15C418EB-7675-42be-B2B3-281952DA014D}'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3Agent'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3AgentAdapterStorage'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3AgentAdapterStorageALC'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3AgentLogs'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3EMLib'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3EMLibLogs'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3Router'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3RouterEnvelopes'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3AgentAdapterStorageNAC'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3RouterNetworkReport'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3RouterLogs'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3AgentAdapterStorageSAV'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3AgentAdapterStorageSCF'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosRemote Management System3AgentAdapterStorageSDDM'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:WindowsInstaller{FED1005D-CBC8-45D5-A288-FFC7BB304121}'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataMicrosoftWindowsStart MenuProgramsSophosSophos Endpoint Security and Control'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataMicrosoftWindowsStart MenuProgramsSophos'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-Virus'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosSophos Anti-VirusConfig'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:WindowsInstaller{9ACB414D-9347-40B6-A453-5EFB2DB59DFA}'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosSophos Anti-VirusINFECTED'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosSophos Anti-VirusTemp'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosSophos Anti-VirusCache'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosSophos Data Controllogs'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosSophos Data Control'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosSophos Device Controllogs'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosSophos Device Control'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosSophos Tamper Protectionlogs'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:ProgramDataSophosSophos Tamper Protection'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusWeb Control'=- >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerFolders] >>%TEMP%SOTMP.REG
ECHO'C:Program FilesSophosSophos Anti-VirusWeb Intelligence'=- >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesSophos Web Control Service] >>%TEMP%SOTMP.REG
ECHO [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesswi_update] >>%TEMP%SOTMP.REG
ECHO [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] >>%TEMP%SOTMP.REG
ECHO'Sophos AutoUpdate Monitor'=- >>%TEMP%SOTMP.REG
SC create SopReg binpath= 'cmd /K START /WAIT REGEDIT /S %TEMP%SOTMP.REG' type= own type= interact >NUL2>&1 >NUL
scstart'SopReg'>NUL2>&1 >NUL
sc delete 'SopReg'>NUL2>&1 >NUL
ECHO.
ECHO Done
ECHO.
ECHO
ECHO Deleting Sophos Services
ECHO
sc delete SAVService >NUL2>&1
sc delete SAVAdminService >NUL2>&1
sc delete 'Sophos Agent'>NUL2>&1
sc delete 'Sophos AutoUpdate Agent'>NUL2>&1
sc delete 'Sophos AutoUpdate Service'>NUL2>&1
sc delete 'Sophos Message Router'>NUL2>&1
sc delete 'swi_service'>NUL2>&1
sc delete 'Sophos Client Firewall'>NUL2>&1
sc delete 'Sophos Client Firewall Manager'>NUL2>&1
sc delete 'Sophos Web Control Service'>NUL2>&1
ECHO.
ECHO Done
ECHO.
ECHO
ECHO Unregistering DLLs
ECHO
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusbackgroundscanning.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Viruscomponentmanager.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusconfiguration.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusdesktopmessaging.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusdriveprocessor.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Viruseeconsumer.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusfilterprocessors.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusfsdecomposer.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusicadapter.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusicmanagement.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusicprocessors.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Viruslegacyconsumers.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Viruslocalisation.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Viruslogging.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Viruspersistance.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-VirusSAVI0.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-VirusSAVMSCM.DLL'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virussavshellext.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusscaneditexports.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusscaneditfacade.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusscanmanagement.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virussecurity.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virussophtaineradapter.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virussysteminformation.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusthreatdetection.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusthreatmanagement.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virustranslators.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosSophos Anti-Virusvirusdetection.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosAutoUpdatecidsync.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosAutoUpdateconfig.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosAutoUpdateinetconn.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosAutoUpdateInstlMgr.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosAutoUpdateispsheet.dll'>NUL2>&1
regsvr32 /u /s '%PROGRAMFILES%SophosAutoUpdatelogger.dll'>NUL2>&1
ECHO.
ECHO Done
ECHO.
ECHO
ECHO Removing the Sophos Installation Files
ECHO
RD /s /Q %TEMP%>NUL2>&1
MD%TEMP%>NUL2>&1
RD /s /Q %WINDIR%TEMP >NUL2>&1
MD%WINDIR%Temp >NUL2>&1
RD /S /Q '%PROGRAMFILES%SOPHOSAutoUpdate'>NUL2>&1
RD /S /Q '%PROGRAMFILES%SOPHOSSophos Anti-Virus'>NUL2>&1
RD /S /Q '%PROGRAMFILES%SOPHOSRemote Management System'>NUL2>&1
RD /S /Q '%PROGRAMFILES%SOPHOS'>NUL2>&1
RD /S /Q 'C:SAVXPSA'>NUL2>&1
RD /s /Q '%ALLUSERSPROFILE%Start MenuProgramsSophos'>NUL2>&1
RD /S /Q '%ALLUSERSPROFILE%Application DataSophos'>NUL2>&1
RD /S /Q '%USERPROFILE%Application DataSophos'>NUL2>&1
DEL /Q '%ALLUSERSPROFILE%Start MenuProgramsStartupAutoUpdate Monitor.lnk'>NUL2>&1
RD /S /Q '%WINDIR%Installer{09C6BF52-6DBA-4A97-9939-B6C24E4738BF}'>NUL2>&1
RD /S /Q '%WINDIR%Installer{15C418EB-7675-42be-B2B3-281952DA014D}'>NUL2>&1
RD /S /Q '%WINDIR%Installer{C12953C2-4F15-4A6C-91BC-511B96AE2775}'>NUL2>&1
RD /S /Q '%WINDIR%Installer{FF11005D-CBC8-45D5-A288-25C7BB304121}'>NUL2>&1
RD /S /Q '%WINDIR%Installer{387EF71D-9F19-4059-B6E5-B29E521AF040}'>NUL2>&1
DEL /Q '%WINDIR%System32Driverssavonaccesscontrol. sys'>NUL2>&1
DEL /Q '%WINDIR%System32Driverssavonaccessfilter.s ys'>NUL2>&1
IFEXIST'C:Program FilesSophos'rmdir'C:Program FilesSophos' /s /q >NUL2>&1
IFEXIST'C:Program Files (x86)Sophos'rmdir'C:Program Files (x86)Sophos' /s /q >NUL2>&1
ECHO.
ECHO Done
ECHO.
ECHO
ECHO Deleting Sophos Accounts and Sophos Groups
ECHO
Net user SophosSAU%COMPUTERNAME%0 /DELETE >NUL2>&1
Net user SophosSAU%COMPUTERNAME%1 /DELETE >NUL2>&1
Net user SophosSAU%COMPUTERNAME%2 /DELETE >NUL2>&1
Net user SophosSAU%COMPUTERNAME%3 /DELETE >NUL2>&1
Net localgroup SophosAdministrator /DELETE >NUL2>&1
Net localgroup SophosOnAccess /DELETE >NUL2>&1
Net localgroup SophosPowerUser /DELETE >NUL2>&1
Net localgroup SophosUser /DELETE >NUL2>&1
ECHO.
ECHO Done
ECHO.
GOTO DONE
:MSIZAPNOTFOUND
ECHO msizap.exe not found, please copy it to this script's directory and run the script again
PAUSE
EXIT
:DONE
ECHO.
ECHO
ECHO All done!
ECHO
ECHO.
EXIT

commented Aug 19, 2015

Apple Mac Manual

Very helpful batch file . Successfully helped me to uninstall Sophos . Well Done!! Thanks for sharing.

commented Aug 11, 2016

Sophos Mac Manual Clean Up Mac

This requires MSIZAP.exe, a utility to remove installers. Microsoft doesn't support this anymore, so you will need to download msicuu2.exe -Windows installer clean up - link: http://www.majorgeeks.com/files/details/windows_installer_cleanup_utility.html It installs to C:Program Files (x86)Windows Installer Clean Up so run this batch file from that directory, or add that to your PATH.

commented Sep 15, 2016

do you have mac version?

commented Dec 28, 2016•
edited

THANK YOU SO MUCH
i did all now is not showing in my computer
but in the cloud my computer and all my activities are there
that's mean it is not removed

commented Apr 27, 2017

Worked great for me. One thing I noticed that it did not kill the ALMon process. Other than that, all good. @WINNERI I don't think you would be able to script that kind of thing. Removal from Sophos Cloud AKA Sophos Central would still be manual process. If all the Sophos processes are gone, then it won't be able to report back to Sophos.

commented Aug 16, 2017

Apple mac manual

I updated this to include newer GUID's & service deletion:
https://gist.github.com/ion-storm/11ff973495002f228b0f7949f3c52e13

commented Aug 24, 2017

Not seeing the difference between your updated bat file and the original (as far as having additional Service Deletions).

This is what my latest Sophos Services Look like:

commented Aug 24, 2017

You may also want to change your MISZAP.exe references to msicuu2.exe since MISZAP is no longer supported.

commented Aug 24, 2017

In looking at the bat file again, it looks like it is for versions v7-v10.

I am at v11.5.6 - a lot of differences. This bat needs a complete rewrite for 11 ..unless someone has already done it.. maybe you ion-storm?

commented Oct 7, 2017

This worked for me, thank you very much.

Also stubobis1 's info was very helpful as well.

Sophos Mac Manual Clean Up

commented Oct 27, 2017

Dear @Coopeh, dear @ion-storm, I hope that you are well.
I'm like @krhoads65, stuck with 11.5.9 version and totally disappointed.
Can anyone help us on this version as previous script does not work any longer.
it is a full nightmare, as sometimes it removes false positive files.
thanks to all the community.

commented Nov 30, 2017

Can you please tell me how to enable/disable sophos web Control. i have only access to administrative command prompt

commented Sep 18, 2018

Sophos Mac Manual Clean Up Free

Great script! Worked for me, I was not able to uninstall following the right way. I was getting an error message: MSI terminated unexpectedlly

Sophos Mac Manual Clean Up Software

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment