How to force uninstall an unwanted (left over) Sophos system extension?

[Mork]

I have a problem where a program I wrote is not accessing its end port. I believe the problem may be a former installation of Sophos where an extension is still in place. I ran the antivirus uninstaller program that reported it stopped all services, but this "com.sophos.endpoint.scanextension.systemextension" is still running in /Library/SystemExtensions/51AC3210-2B6F-4C40-B44A-39DA33A0FE53.

Logged in as root, I'm unable to "rm -R -f" this directory.

So, my question is...how do I get rid of this extension?

It does not show up in Preferences under Extensions.

As you can see below, it's definitely still running and probably causing problems for me.

Trying to force quit this process does not work...

Thanks very much in advance.

Mac OS 11.1

 

[chrfr]

I have a problem where a program I wrote is not accessing its end port. I believe the problem may be a former installation of Sophos where an extension is still in place. I ran the antivirus uninstaller program that reported it stopped all services, but this "com.sophos.endpoint.scanextension.systemextension" is still running in /Library/SystemExtensions/51AC3210-2B6F-4C40-B44A-39DA33A0FE53.

Logged in as root, I'm unable to "rm -R -f" this directory.

So, my question is...how do I get rid of this extension?

It does not show up in Preferences under Extensions.

As you can see below, it's definitely still running and probably causing problems for me.

Trying to force quit this process does not work...
View attachment 1716311

Thanks very much in advance.

Mac OS 11.1

I did a Google search for "uninstall com.sophos.endpoint.scanextension.systemextension" and found this page: https://community.sophos.com/interc...-reads/124391/how-to-remove-system-extensions

 

[Mork]

Thanks. I had actually done the same search, but just not with the big "G".

I was able to uninstall that extension, but the problem remains.

Next ....

Thanks again!

 

[Asbow]

I have this problem. I'm just not comfortable disabling SIP.

 

[Mork]

Probably a good idea. I ended up hosing my machine and had to rebuild from scratch...

 

[bogdanw]

There is another way to disable third party extensions: kmutil trigger-panic-medic from Terminal in Recovery. Works with SIP enabled.

trigger-panic-medic Delete and disable loading of third party kexts in order to safely boot into a target volume. (can only be triggered in Recovery mode) eg usage: `kmutil trigger-panic-medic --volume-root /Volumes/<VolumeName>`

Example

kmutil trigger-panic-medic --volume-root "/Volumes/Macintosh HD"

or

kmutil trigger-panic-medic --volume-root /Volumes/Macintosh\ HD

Another thread about Sophos https://forums.macrumors.com/threads/removing-com-sophos-endpoint-scanextension.2337752/

 

[KALLT]

There is another way to disable third party extensions: kmutil trigger-panic-medic from Terminal in Recovery. Works with SIP enabled.


Example

kmutil trigger-panic-medic --volume-root "/Volumes/Macintosh HD"

or

kmutil trigger-panic-medic --volume-root /Volumes/Macintosh\ HD

Another thread about Sophos https://forums.macrumors.com/threads/removing-com-sophos-endpoint-scanextension.2337752/

Are you sure that this resolves this issue? At issue is a system extension, not a kernel extension.

A system extension like the one mentioned by the OP should be deactivated and deleted automatically when the app bundle that contains the system extension is deleted, albeit after a reboot. If this does not happen, then the issue may be outside of the developer’s control. The only other way seems to be systemextensionsctl uninstall <teamId> <bundleId>, which (still) requires SIP to be turned off (which is not something a user should do).

 

[bogdanw]

Are you sure that this resolves this issue? At issue is a system extension, not a kernel extension.

A system extension like the one mentioned by the OP should be deactivated and deleted automatically when the app bundle that contains the system extension is deleted, albeit after a reboot. If this does not happen, then the issue may be outside of the developer’s control. The only other way seems to be systemextensionsctl uninstall <teamId> <bundleId>, which (still) requires SIP to be turned off (which is not something a user should do).

Actually, there is a simpler way from Recovery: delete the extensions & rebuild the cache.

This is from a Monterey virtual machine that didn’t have other extensions besides Sophos in /Library/SystemExtensions, so I deleted the whole folder.