remove sophos kext files

[brothman01]

I uninstalled Sophos with the uninstaller it comes with, but there are still kext files in my library folder. (/Library, not ~/Library). I have tried many different ways to delete them but nothing has worked. If you are somehow a genius and know how to delete the files please let me know.

1. Cannot cmd-delete them, the command is disabled and nothing happens.

2. Cannot manually drag the files to the trash because I get an error that says 'file cannot be modified or deleted because it is required by macOS'.

3. I cannot run sudo chmod or sudo chown on the files because then I get the error "Operation not Permitted.'.

4. cmd-i on the file (look down at permissions) shows read only for system, wheel and everyone. I can unlock the permissions by clicking the lock icon but if I try to change the permissions I get the error message, "The operation can’t be completed because you don’t have the necessary permission." (Please refer to #3 for why I cannot change the permissions manually)

5.
$ sudo kextunload /Library/StagedExtensions/Library/Extensions/SophosFileMonitor.kext
Password:
(kernel) Kext com.sophos.kext.sfm not found for unload request.
Failed to unload com.sophos.kext.sfm - (libkern/kext) not found.
$

I am stumped. Does anyone have any ideas on how to remove this file?

 

[DeltaMac]

You could try simply enabling the root user, then log in to that root user. You may be able to trash the file then.
be sure to log out of the root account, then disable root user. (Most users should not leave the root account enabled - it's a security risk in some situations)

Or, because of the location of that kext - you might need to disable SIP before you can do anything with that file.
(The System Integrity Protection (SIP) is likely the reason that the Sophos uninstaller didn't remove it.)

 

[Weaselboy]

Or, because of the location of that kext - you might need to disable SIP before you can do anything with that file.

That is exactly it. Starting with High Sierra third party app kexts are SIP protected.

https://developer.apple.com/library...ml#//apple_ref/doc/uid/DTS40017658-CH1-TNTAG4