Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Read Only Keychain element (from Sophos)
- Thread starter MacMan988
- Start date
- Sort by reaction score
You need to delete that entire keychain. Go up to the top left and right click where it says Sophos then select delete keychain.
The item called "Primary Server" is has disappeared now! If I right click on the "Sophos" item from the Keychains pane at the top left, it brings up a menu that has "New keychain..." and "Add keychain" in it. Delete option is not there. left click doesn't do anything.
Hmmm... okay let's try this.
Quit Keychain first.
Open Finder then click the Go menu then Go to Folder... then one by one paste in the path(s) below and hit enter. Look in each of those Folders for the Sophos entry and delete it. You may need to logout then log back in to make it go away from Keychain after the delete.
Code:
~/Library/Keychains
/System/Library/Keychains
/Library/Keychains
It is supposed to have Sophos in its name right? I'm not seeing any keychains containing "Sophos" in the file name in any of those folders.
I opened the keychain list from the Edit menu of the Keychain Access and it lists down the path as :
Macintosh HD > Library > Sophos Anti-Virus > Sophos.keychain
But I don't see a "Sophos Anti-Virus" folder in Macintosh HD > Library directory.
And it seems I can remove those entries from the Keychain List window. Will it be a proper removal if I remove it from there?
If there is nothing in that Sophos folder it sounds like the Keychain app entry is just a phantom entry left over from the uninstall routine you ran and it would be safe to delete.
I removed it from the Keychain List and dismissed that dialog box. But the Sophos keychain remains in the top left pane. When I re-open the Keychain List, it appears again
I removed it from the Keychain List and dismissed that dialog box. But the Sophos keychain remains in the top left pane. When I re-open the Keychain List, it appears again
Sneaky bastard huh!
Let's try just searching in Finder for "sophos" like in my example. Click the little plus next to the save button and add system files are included like I have.
Hmm... I don't get it. So if you open Finder then Go and Go to folder and paste in the below you don't see the Sophos folder there at all?
Code:
/Library(Placing this here in case someone else comes along looking for the answer)
You have to run Keychain Access as root in order to delete read-only items. In Terminal:
sudo "/Applications/Utilities/Keychain Access.app/Contents/MacOS/Keychain Access"
Make sure you include the quotes.
Sophos posted a video explanation here:
http://openforum.sophos.com/t5/Mac-...Sophos-keychain-after-uninstalling/td-p/15027
You have to run Keychain Access as root in order to delete read-only items. In Terminal:
sudo "/Applications/Utilities/Keychain Access.app/Contents/MacOS/Keychain Access"
Make sure you include the quotes.
Sophos posted a video explanation here:
http://openforum.sophos.com/t5/Mac-...Sophos-keychain-after-uninstalling/td-p/15027
I didn't have any success with sophos' fix for the stuck keychain remnant.
I did find a working solution though here: https://apple.stackexchange.com/que...eychain-access-after-uninstalling-the-program
Here are the directions to follow for removing the sophos keychain remnant (you need to be booted into a root user to do this). Directions for enabling root are here: https://support.apple.com/en-us/HT204012
"To fix this you have to manually edit the file /Library/Preferences/com.apple.security-common.plist, as root, and delete the corresponding hardcoded <dict>...Sophos...</dict> entry in there.
Great care must be taken because you can totally screw up your system(-keychain) if you leave any errors inside this .plist file. The section that needs to be deleted looks as follows:
...
<dict>
<key>DbName</key>
<string>/Library/Sophos Anti-Virus/Sophos.keychain</string>
<key>GUID</key>
<string>{some UUID string here}</string>
<key>SubserviceType</key>
<integer>6</integer>
</dict>
...
Upon save, there should no longer be any "Sophos" entry in Keychain Access or as output of security list-keychains."
I used this fix on both my computers and it works like a charm. Remember to disable root after you're done.
I did find a working solution though here: https://apple.stackexchange.com/que...eychain-access-after-uninstalling-the-program
Here are the directions to follow for removing the sophos keychain remnant (you need to be booted into a root user to do this). Directions for enabling root are here: https://support.apple.com/en-us/HT204012
"To fix this you have to manually edit the file /Library/Preferences/com.apple.security-common.plist, as root, and delete the corresponding hardcoded <dict>...Sophos...</dict> entry in there.
Great care must be taken because you can totally screw up your system(-keychain) if you leave any errors inside this .plist file. The section that needs to be deleted looks as follows:
...
<dict>
<key>DbName</key>
<string>/Library/Sophos Anti-Virus/Sophos.keychain</string>
<key>GUID</key>
<string>{some UUID string here}</string>
<key>SubserviceType</key>
<integer>6</integer>
</dict>
...
Upon save, there should no longer be any "Sophos" entry in Keychain Access or as output of security list-keychains."
I used this fix on both my computers and it works like a charm. Remember to disable root after you're done.