It works for: Sophos Central Endpoint, Sophos Home, Sophos Anti-Virus 9.x/10.x, Sophos Intercept X, and Sophos Firewall client (RED). It does NOT remove Sophos XG Firewall OS or Sophos Email Gateway.
Even with the right SophosZap download, you may encounter errors:
| Error | Meaning | Solution |
|-------|---------|----------|
| “Access Denied” | Not run as admin | Right-click > Run as Administrator. |
| “Zap cannot remove while tamper protection is on” | Modern Sophos Intercept X prevents termination | Boot into Safe Mode. Tamper protection is disabled there. |
| “Driver still loaded after reboot” | Residual driver | Run fltmc unload SAVOnAccess from an admin command prompt, then re-run SophosZap. |
| “Missing MSCOREE.DLL” | .NET Framework issue | Install .NET 4.8 or later, then retry. | sophoszap download
Reach for SophosZap only in specific scenarios:
Warning: SophosZap removes all Sophos products present — including endpoint protection, encryption, and server protection. It cannot reverse its own action without a full reinstall. It works for: Sophos Central Endpoint, Sophos Home,
If Windows won’t boot normally due to a Sophos driver:
Sophos Zap is a lightweight, free tool from Sophos designed to remove persistent malware, browser hijackers, and unwanted programs that standard antivirus scans sometimes miss. It’s intended as a focused cleanup utility, not a full antivirus replacement — use it when you suspect stubborn adware, browser redirects, or leftover components after infection. Warning: SophosZap removes all Sophos products present —
Avoid third-party download sites. Sophos does not host SophosZap on generic file repositories. Unofficial copies could be outdated, tampered, or bundled with malware.