Author Topic: Uninstalled an antivirus program, still detected by installer.  (Read 3275 times)

0 Members and 1 Guest are viewing this topic.

Offline fcon

  • Newbie
  • *
  • Posts: 4
Uninstalled an antivirus program, still detected by installer.
« on: January 18, 2017, 09:44:51 AM »
I asked Avast about this problem, but since they don't provide support to free users I have to post this here.
So, here's what I originally said:
"I had Sophos Home for Mac up until I heard about your antivirus and saw what it was like, then instantly dumped and uninstalled Sophos, then I tried to install Avast Mac Security until I was met with an error saying that Avast was incompatible with Sophos and since I had it, Avast couldn't be installed, even though there are no traces at all that it even existed on my Mac. Please help."

By the way, I used the bundled uninstaller, I didn't just drag it to the trash.

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31341
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: Uninstalled an antivirus program, still detected by installer.
« Reply #1 on: January 18, 2017, 09:56:32 AM »
Yes there are things of Sophos left or avast would not detect them.

Give this a try > https://community.sophos.com/kb/hu-hu/121206

https://forum.avast.com/index.php?topic=189886.msg1333555#msg1333555
« Last Edit: January 18, 2017, 10:03:04 AM by Eddy »

Offline fcon

  • Newbie
  • *
  • Posts: 4
Re: Uninstalled an antivirus program, still detected by installer.
« Reply #2 on: January 18, 2017, 04:48:54 PM »
Nothing in the folder the forum post you linked talked about. Also the article from Sophos didn't really help as I already used the uninstaller.

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31341
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: Uninstalled an antivirus program, still detected by installer.
« Reply #3 on: January 18, 2017, 05:05:43 PM »
Did you run a search for files with Sophos in their name ?
Perhaps even search for files containing the word Sophos in them will show something.

Anything in the avast setup file about it ? (perhaps a filename or location)

Offline fcon

  • Newbie
  • *
  • Posts: 4
Re: Uninstalled an antivirus program, still detected by installer.
« Reply #4 on: January 19, 2017, 10:00:10 AM »
I did search for files with the word "Sophos" in them, still nothing.
Tried opening the installer with TextEdit, still nothing.

So I wonder why Avast detects it?

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31341
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: Uninstalled an antivirus program, still detected by installer.
« Reply #5 on: January 19, 2017, 10:07:04 AM »
I remember there is a thread on this webboard where someone from avast told what was detected, but I'm not sure if it was about Sophos or another av.
See if you can find it I would say.

In the mean time I will try to get a hold of someone from avast and ask him/her to have a look.

Offline tumic

  • Moderator
  • Advanced Poster
  • *
  • Posts: 724
Re: Uninstalled an antivirus program, still detected by installer.
« Reply #6 on: January 19, 2017, 11:58:04 AM »
Avast detects loaded kernel extensions (KEXTs) of the other antiviruses. If a Sophos
kernel extension is still loaded, Sophos was not correctly uninstalled. If you run the kextstat
command, you should see a sophos KEXT loaded amongst other KEXTs.

Offline fcon

  • Newbie
  • *
  • Posts: 4
Re: Uninstalled an antivirus program, still detected by installer.
« Reply #7 on: January 19, 2017, 04:59:23 PM »
Found some Sophos kexts, how do I get rid of them? I'm a newbie to this sort of thing.

Offline tumic

  • Moderator
  • Advanced Poster
  • *
  • Posts: 724
Re: Uninstalled an antivirus program, still detected by installer.
« Reply #8 on: January 23, 2017, 04:48:31 PM »
I would try a reboot first. If the KEXTs will be still present, than Sophos did left more mess than expected
and searching for the loading mechanism of the KEXTs is necessary. Most probably there will be some
launchd plists left in the system together with the KEXTs self.

You can also try asking Sophos technical support how to clean your Mac if their product is not capable
doing it by itself ;-)