I do not remember ever having Sophos AV, but I am seeing this:



Log Name: System
Source: Microsoft-Windows-Wininit
Date: 17/06/2020 07:42:08
Event ID: 11
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: %computername%
Description:
Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications.
Event Xml:



11
0
3
0
0
0x4000000000000000

24454


System
%computername%



1
C:\PROGRA~2\Sophos\SOPHOS~2\SOPHOS~2.DLL

---