Read Only Keychain element (from Sophos)

MacMan988

macrumors 6502a
Original poster
Jul 7, 2012
721
63
Hi, I have Sophos Antivirus installed and I just removed it (I removed it using the provided uninstaller). But still theres a Keychain called Sophos in the Keychain Access. How do I remove it?


 

Weaselboy

Moderator
Staff member
Jan 23, 2005
30,306
10,040
California
You need to delete that entire keychain. Go up to the top left and right click where it says Sophos then select delete keychain.
 

MacMan988

macrumors 6502a
Original poster
Jul 7, 2012
721
63
You need to delete that entire keychain. Go up to the top left and right click where it says Sophos then select delete keychain.
The item called "Primary Server" is has disappeared now! If I right click on the "Sophos" item from the Keychains pane at the top left, it brings up a menu that has "New keychain..." and "Add keychain" in it. Delete option is not there. left click doesn't do anything.


 

Weaselboy

Moderator
Staff member
Jan 23, 2005
30,306
10,040
California
The item called "Primary Server" is has disappeared now! If I right click on the "Sophos" item from the Keychains pane at the top left, it brings up a menu that has "New keychain..." and "Add keychain" in it. Delete option is not there. left click doesn't do anything.
Hmmm... okay let's try this.

Quit Keychain first.

Open Finder then click the Go menu then Go to Folder... then one by one paste in the path(s) below and hit enter. Look in each of those Folders for the Sophos entry and delete it. You may need to logout then log back in to make it go away from Keychain after the delete.

Code:
~/Library/Keychains
/System/Library/Keychains
/Library/Keychains
 

MacMan988

macrumors 6502a
Original poster
Jul 7, 2012
721
63
Hmmm... okay let's try this.

Quit Keychain first.

Open Finder then click the Go menu then Go to Folder... then one by one paste in the path(s) below and hit enter. Look in each of those Folders for the Sophos entry and delete it. You may need to logout then log back in to make it go away from Keychain after the delete.

Code:
~/Library/Keychains
/System/Library/Keychains
/Library/Keychains
It is supposed to have Sophos in its name right? I'm not seeing any keychains containing "Sophos" in the file name in any of those folders.

I opened the keychain list from the Edit menu of the Keychain Access and it lists down the path as :

Macintosh HD > Library > Sophos Anti-Virus > Sophos.keychain

But I don't see a "Sophos Anti-Virus" folder in Macintosh HD > Library directory.

And it seems I can remove those entries from the Keychain List window. Will it be a proper removal if I remove it from there?
 

Weaselboy

Moderator
Staff member
Jan 23, 2005
30,306
10,040
California
It is supposed to have Sophos in its name right? I'm not seeing any keychains containing "Sophos" in the file name in any of those folders.

I opened the keychain list from the Edit menu of the Keychain Access and it lists down the path as :

Macintosh HD > Library > Sophos Anti-Virus > Sophos.keychain

But I don't see a "Sophos Anti-Virus" folder in Macintosh HD > Library directory.

And it seems I can remove those entries from the Keychain List window. Will it be a proper removal if I remove it from there?
If there is nothing in that Sophos folder it sounds like the Keychain app entry is just a phantom entry left over from the uninstall routine you ran and it would be safe to delete.
 

MacMan988

macrumors 6502a
Original poster
Jul 7, 2012
721
63
If there is nothing in that Sophos folder it sounds like the Keychain app entry is just a phantom entry left over from the uninstall routine you ran and it would be safe to delete.
I removed it from the Keychain List and dismissed that dialog box. But the Sophos keychain remains in the top left pane. When I re-open the Keychain List, it appears again :(
 

Weaselboy

Moderator
Staff member
Jan 23, 2005
30,306
10,040
California
I removed it from the Keychain List and dismissed that dialog box. But the Sophos keychain remains in the top left pane. When I re-open the Keychain List, it appears again :(
Sneaky bastard huh!

Let's try just searching in Finder for "sophos" like in my example. Click the little plus next to the save button and add system files are included like I have.

 

MacMan988

macrumors 6502a
Original poster
Jul 7, 2012
721
63
Sneaky bastard huh!

Let's try just searching in Finder for "sophos" like in my example. Click the little plus next to the save button and add system files are included like I have.

Image
I tried that too. Nothing comes up apart from a bunch of html files.
 

stradify

macrumors member
Jul 4, 2015
85
27
USA
I didn't have any success with sophos' fix for the stuck keychain remnant.
I did find a working solution though here: https://apple.stackexchange.com/que...eychain-access-after-uninstalling-the-program

Here are the directions to follow for removing the sophos keychain remnant (you need to be booted into a root user to do this). Directions for enabling root are here: https://support.apple.com/en-us/HT204012

"To fix this you have to manually edit the file /Library/Preferences/com.apple.security-common.plist, as root, and delete the corresponding hardcoded <dict>...Sophos...</dict> entry in there.

Great care must be taken because you can totally screw up your system(-keychain) if you leave any errors inside this .plist file. The section that needs to be deleted looks as follows:

...
<dict>
<key>DbName</key>
<string>/Library/Sophos Anti-Virus/Sophos.keychain</string>
<key>GUID</key>
<string>{some UUID string here}</string>
<key>SubserviceType</key>
<integer>6</integer>
</dict>
...

Upon save, there should no longer be any "Sophos" entry in Keychain Access or as output of security list-keychains."

I used this fix on both my computers and it works like a charm. Remember to disable root after you're done.
 
  • Like
Reactions: MJB007

MJB007

macrumors newbie
Oct 16, 2018
1
0
I didn't have any success with sophos' fix for the stuck keychain remnant.
I did find a working solution though here: https://apple.stackexchange.com/que...eychain-access-after-uninstalling-the-program

Here are the directions to follow for removing the sophos keychain remnant (you need to be booted into a root user to do this). Directions for enabling root are here: https://support.apple.com/en-us/HT204012

"To fix this you have to manually edit the file /Library/Preferences/com.apple.security-common.plist, as root, and delete the corresponding hardcoded <dict>...Sophos...</dict> entry in there.

Great care must be taken because you can totally screw up your system(-keychain) if you leave any errors inside this .plist file. The section that needs to be deleted looks as follows:

...
<dict>
<key>DbName</key>
<string>/Library/Sophos Anti-Virus/Sophos.keychain</string>
<key>GUID</key>
<string>{some UUID string here}</string>
<key>SubserviceType</key>
<integer>6</integer>
</dict>
...

Upon save, there should no longer be any "Sophos" entry in Keychain Access or as output of security list-keychains."

I used this fix on both my computers and it works like a charm. Remember to disable root after you're done.
[doublepost=1539686237][/doublepost]Thank you so much.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.