Every day a new "SophosUpdate" folder/package will appear on my desktop (see screenshot).

When I highlight it my trash can turns into an eject button. When I drag them to the eject button nothing happens. Also nothing happens when I right click one of them and select "eject".

The only thing that got rid of them once was starting up in safe mode but they keep coming back after that.

Does anyone know what I can do? I'm stuck.

enter image description here

  • What version/edition of Sophos are you using? – Miles Erickson Mar 27 '12 at 3:27
  • It says Version 7.3.9 – Greg_the_Ant Mar 27 '12 at 13:38

When I highlight it my trash can turns into an eject button.

This is a huge clue, because it indicates that this is a mounted volume (presumably a mounted image of the update package) and not an actual folder in ~/Desktop.

If you enter mount or diskutil list at a terminal prompt, does anything called SophosUpdate show up? If you see one or more of these listed, you should be able to unmount it with sudo diskutil unmount force /dev/diskN where N is the disk number. Alternately, sudo diskutil unmount force "/Volumes/Volume Name" has the same effect.

  • Interesting idea, I just tried mount, and diskutil list but neither shows anything mentioning SophosUpdate. – Greg_the_Ant Mar 27 '12 at 11:44

you have to do it through Terminal

# sudo rm -rf ~/Desktop/SophosUpdate

it should ask you for your password and return nothing, to verify that it completed without any errors try this command

# echo $?

if you get 0 that means everything went ok, if any other number then something was wrong. at that point I suggest you to try Disk Utility to "Verify Disk" and/or "Verify Disk Permissions"

  • Running that rm command doesn't do anything. I do get 0 when I run the echo command. – Greg_the_Ant Mar 22 '12 at 12:10
  • make sure you do it with sudo in front and as I said if that still fails do step #2 and then try again step #1 – alexus Mar 22 '12 at 21:24
  • 1
    If the trash icon is changing into an eject/unmount button when these are highlighted, they are not actually folders located on the Desktop and they cannot be removed with rm. – Miles Erickson Mar 27 '12 at 3:25

Looks like your Sophos antivirus cannot perform automatic update. Try running it manually or just disable auto updates. Reinstalling it could also help. Also, have you tried permission check from disk utility?

  • Any idea how I would disable autoupdate? – Greg_the_Ant Mar 22 '12 at 11:51
  • Should be in Sophos Anti-Virus > Preferences, then Auto Update; uncheck ` “Check for updates on connection to network or Internet”` – Dmitry Alexeyev Mar 24 '12 at 10:37
  • I don't seem to have Sohpos Anti-Virus in my System Preferences – Greg_the_Ant Mar 26 '12 at 14:36
  • Do you have the application installed? – Dmitry Alexeyev Mar 26 '12 at 18:10
  • Any recommendation to disable antivirus definition updates has potentially huge implications in terms of security, and in a litigious country like the USA one could even get sued for any negative consequences resulting from such a recommendation. Security is not meant to be taken lightly. – Miles Erickson Mar 27 '12 at 3:45

I ended up uninstalling sophos and installed the free personal edition instead of the one I had (corporate?).

It's been working fine since then.

I guess it still doesn't answer the more general question of how to remove a strange mounted item on your desktop with that red bar through it. Any ideas on that?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .