Remove Sophos from macOS Recovery Mode

remove-sophos-recovery.sh

#!/bin/bash
# Run this from Terminal in macOS Recovery Mode.
# Recovery Mode: hold Cmd+R (Intel) or Power button (Apple Silicon) at boot,
# then open Utilities > Terminal.

set -e

VOLUME="/Volumes/Macintosh HD"

# If your main volume has a different name, update the line above.
# To list available volumes: ls /Volumes

echo "Removing Sophos from: $VOLUME"
echo "This will delete all Sophos files. Press Ctrl+C within 5 seconds to cancel."
sleep 5

rm -rf "$VOLUME/Library/Sophos Anti-Virus"
rm -rf "$VOLUME/Library/Sophos Encryption"
rm -rf "$VOLUME/Library/SophosCBR"
rm -rf "$VOLUME/Library/Application Support/Sophos"
rm -rf "$VOLUME/Library/Application Support/Sophos Encryption"
rm -rf "$VOLUME/Applications/Sophos"
rm -rf "$VOLUME/Library/Application Support/com.sophos"*
rm -rf "$VOLUME/Library/Caches/com.sophos"*

# Remove launch daemons and agents
for f in "$VOLUME"/Library/LaunchDaemons/com.sophos.*; do
    [ -e "$f" ] && rm -rf "$f"
done
for f in "$VOLUME"/Library/LaunchAgents/com.sophos.*; do
    [ -e "$f" ] && rm -rf "$f"
done

# Remove kernel/system extensions
for f in "$VOLUME"/Library/SystemExtensions/*/com.sophos.*; do
    [ -e "$f" ] && rm -rf "$f"
done

echo ""
echo "Done. Reboot normally: type 'reboot' and press Enter."