No, but because it kills antivirus software, many endpoint detection systems (EDRs) flag it as “aggressive.” Always download from Sophos directly.

✅ Recommended for:

❌ Not for:

Rating: 4/5 – For its specific purpose (free on-demand malware removal), it works very well. The only drawbacks are the lack of offline install and slow definition downloads.

Tip: If you need an offline-capable portable scanner, consider Kaspersky Virus Removal Tool or Emsisoft Emergency Kit instead.

The SophosZap tool is a command-line cleanup utility used as a "last resort" to uninstall Sophos Endpoint products and revert a Windows device to a clean state. You can download the tool from the official Sophos Support Downloads page or via a Direct Download Link provided in official documentation. Key Usage Guidelines

Last Resort Only: Use this tool only if standard uninstallation methods have failed, as it uses heuristics that carry additional risks.

Prerequisites: You must have administrative privileges and disable Tamper Protection on the device before running the tool.

Compatibility: Supports Windows 7 and later, including ARM64 devices from version 1.2.3.0 onwards. Step-by-Step Uninstallation Process

The process typically requires two runs of the command and multiple reboots to ensure complete removal.

Preparation: Backup important data and disable Tamper Protection via the Sophos Central Admin console or local settings. First Run: Open an Administrative Command Prompt.

Navigate to the folder containing the executable (e.g., cd C:\SophosZap). Run the command: SophosZap --confirm.

Reboot: After the tool displays "Reboot and re-execute," restart your device. Second Run: Open the Administrative Command Prompt again. Re-run the same command: SophosZap --confirm.

Final Reboot: Once the tool indicates completion, perform a final restart before attempting to reinstall any software. Supported Products for Removal

SophosZap is designed to remove a wide range of components, including: Sophos Central Endpoint/Server Sophos Home HitmanPro Alert (HMPA) and Sophos Clean Sophos Anti-Virus (Standalone) Sophos Update Cache and Message Relay

SophosZap is a "last-resort" command-line utility used to completely remove Sophos Endpoint products when standard uninstallation methods fail. Download and Technical Details

Direct Download: You can download the tool directly from Sophos.

Official FAQ: Detailed documentation and troubleshooting steps are available at Sophos Support.

Compatibility: Supports Windows 7 and later, including ARM64 devices (version 1.2.3.0+).

Current Version: Ensure you are using version 1.9.158.0 or later. Core Functionality

SophosZap uses heuristics to identify and remove all Sophos components to revert a device to a clean state. It can remove: Sophos Central Endpoint, Server, and Home HitmanPro / HitmanPro Alert (HMPA) Update Cache and SEC managed endpoints How to Use SophosZap

Running this tool requires administrative privileges and typically involves two passes with a system reboot in between. Preparation:

Disable Tamper Protection: This must be turned off via the Sophos Central dashboard or the local agent before running the tool. Backup Data: Confirm all appropriate backups are complete. Execution: Open a Command Prompt as an Administrator.

Navigate to the folder where SophosZap.exe is located (e.g., cd C:\Users\\Downloads). Run the command: SophosZap.exe --confirm. Completion:

Once the first run is complete, you will see a message to "Reboot and re-execute".

After restarting, run the same command again: SophosZap.exe --confirm.

A final restart is recommended before attempting any new installations.

Even with the right SophosZap download, you may encounter errors:

| Error | Meaning | Solution | |-------|---------|----------| | “Access Denied” | Not run as admin | Right-click > Run as Administrator. | | “Zap cannot remove while tamper protection is on” | Modern Sophos Intercept X prevents termination | Boot into Safe Mode. Tamper protection is disabled there. | | “Driver still loaded after reboot” | Residual driver | Run fltmc unload SAVOnAccess from an admin command prompt, then re-run SophosZap. | | “Missing MSCOREE.DLL” | .NET Framework issue | Install .NET 4.8 or later, then retry. |

This is the most critical section. Because SophosZap is a powerful administrative tool, Sophos does not host it on a public, easy-to-find download page. This prevents attackers from using it maliciously (e.g., disabling AV on a victim’s machine).

Official Sources Only (Do not trust third-party sites):

Avoid these red flags:

Verified File Hash (as of latest version):
Before running, right-click the file > Properties > Digital Signatures. Ensure it is signed by “Sophos Limited.” On PowerShell, run Get-FileHash SophosZap.exe – compare with Sophos’s published SHA256.

It’s a free, standalone, on-demand virus and malware scanner from Sophos. Unlike full antivirus software, it doesn’t run in the background. Instead, you download and run it when you suspect an infection or want a second opinion.