How do you prevent a process from automatically restarting? (specifically, sophos antivirus) I am required by my VPN software to have Sophos anti-virus installed and running.  However, when I'm NOT on VPN, I don't want it running at all - I want it dead.

However, killing the tasks is ineffective:

ps -ax | grep -i soph
40972 ??         0:07.34 /Library/Sophos Anti-Virus/SophosAutoUpdate.app/Contents/MacOS/SophosAutoUpdate -d
41069 ??        28:08.48 /Library/Sophos Anti-Virus/InterCheck.app/Contents/MacOS/InterCheck -d
41078 ??         0:02.42 /Library/Sophos Anti-Virus/SophosAntiVirus.app/Contents/MacOS/SophosAntiVirus -d
$ sudo kill 40972 41069 41078 41084
$ ps -ax | grep -i soph
44344 ??         0:00.03 /Library/Sophos Anti-Virus/SophosAutoUpdate.app/Contents/MacOS/SophosAutoUpdate -d
44345 ??         0:00.02 /Library/Sophos Anti-Virus/SophosAntiVirus.app/Contents/MacOS/SophosAntiVirus -d
44347 ??         0:03.03 /Library/Sophos Anti-Virus/InterCheck.app/Contents/MacOS/InterCheck -d


It just automatically restarts.  What do I need to do to prevent that?
This means that there is another monitor process which relaunches it.  

You can check out who is the parent process: select the process in activity monitor and use the Info button, or via terminal with ps -ax -O ppid if I recall correctly.


It might be another process by Sophos but with a stealth name, or maybe even your VPN software. In that case you can just kill'em all.
The other possibility is that the process is being kept alive by the launch daemon launchd. In this case you will find an entry (a plist XML file) for your antivirus in either ~/Library/LaunchAgents, /Library/LaunchAgents (likely) or /System/Library/LaunchAgents (I dearly hope not).  


If the second is the case, you can either:


Edit the file, and change the KeepAlive parameter, either removing or changing it (you can do nifty things, see the docs for more).
Just ask launchd to do the stopping for you. Unfortunately you can't just tell to launchtl stop since the process would just respawn. You'll have to use  sudo launchctl unload /path/to/the/plist file