Sorry to hear of your problem. Your suspicion and possible explanation may be very hard to prove. Surely, vendors have adequate safeguards in place to prevent such a possibility especially on a SERVER. Consider the possibility that someone else (deemed to be you or using your compromised password) accessed the computer and manually uninstalled Sophos. That is a more likely explanation.


Suggest that you send Sophos an email asking whether it is THEORETICALLY possible to remove thier AV tool using a properly crafted script or batch file without having any user inaction needed.

It shouldn't be that easy, if possible at all. I could see where your school wouldn't believe that as a possible explanation. That would be a big problem flaw if such actions are possible and a very valuable hacker tool indeed. And Sophos, potentially, should be very interested to learn of such a vulnerability possibility.