Unlike a typical GUI uninstaller, ZAP is a command-line tool.
Search for cmd , right-click, and select Run as Administrator .
A system restart is almost always required to finish removing locked registry keys and drivers. ⚠️ Important Warnings
Once the first phase finishes, the output will say "Reboot and re-execute." Restart your computer.
| Error Code | Message | Solution | | :--- | :--- | :--- | | | Access Denied | You are not running as administrator, or Tamper Protection is still active. Reboot into Safe Mode and try again. | | 0x80070020 | File in use | A Sophos process is stubborn. Use Task Manager to kill any Sophos*.exe processes, or run ZAP in Safe Mode. | | 0x00000002 | System not found | The Sophos installation is partially missing. Run -clean flag twice in a row. | | ZAP hangs at 45% | Driver removal stuck | Manually delete C:\Windows\System32\drivers\savonaccess.sys or sophos*.sys after booting into Safe Mode, then re-run ZAP. |
Yes. ZAP supports silent switches. Example: SophosCleanupTool.exe -clean -quiet or -silent . This suppresses all prompts, making it suitable for SCCM or RMM tools. The exit code 0 indicates success, any other code indicates failure.
