Remove Sophos from macOS Recovery Mode - execution instructions

sophos-removal-instructions.md

Remove Sophos from macOS (No Tamper Password)

Step 1 — Test if tamper protection is blocking normal removal

Open Terminal and run:

sudo rm -rf "/Library/Sophos Anti-Virus"

• If it succeeds → run the rest of the commands in Option A below
• If you get Operation not permitted → skip to Option B (Recovery Mode)

---

Option A — Remove from normal macOS (if tamper protection is off)

Run each line in Terminal:

sudo rm -rf "/Library/Sophos Anti-Virus"
sudo rm -rf "/Library/Sophos Encryption"
sudo rm -rf "/Library/SophosCBR"
sudo rm -rf "/Library/Application Support/Sophos"
sudo rm -rf "/Library/Application Support/Sophos Encryption"
sudo rm -rf "/Applications/Sophos"
sudo rm -rf "/Applications/Sophos Device Encryption.app"
sudo rm -rf /Library/LaunchDaemons/com.sophos.*
sudo rm -rf /Library/LaunchAgents/com.sophos.*

Then reboot.

---

Option B — Remove from macOS Recovery Mode (bypasses tamper protection)

Boot into Recovery Mode

• Apple Silicon: Shut down → hold Power button → click Options > Continue
• Intel: Restart → hold Cmd+R

Open Terminal

Menu bar → Utilities > Terminal

Run the script (already saved to your Desktop)

bash "/Volumes/Macintosh HD/Users/cpruitt/Desktop/remove-sophos-recovery.sh"

If you get "Volume not found", run ls /Volumes to see the correct name and substitute it.

The script will print OK/FAILED for each item. When done:

reboot

---

After rebooting — verify Sophos is gone

ls /Library/Sophos* 2>/dev/null && echo "Still present" || echo "Removed"
ls /Applications/Sophos* 2>/dev/null && echo "Still present" || echo "Removed"

Both should print Removed.