Virus that will try to Remove Sophos?

The Remove Sophos app running by itself seems extremely suspicious; the Sophos Anti-Virus app running is not so suspicious, especially if you have a scheduled scan.

You may want to check:

System Prefences -> Sharing

and see if you're sharing anything you shouldn't be.  Remember that Remote Login is password based by default.

Beyond this, you may want to familiarize yourself with Activity Monitor.  Set it to All Processes, Hierarchically -- you'll probably have around 80 listed.  You can sort by user to see which processes are running as root, and which are running as you.  The hierarchical view is useful as it shows you how the various processes were launched, and at what user level.

Beyond this, you may want to run console.app  System Log Queries is useful to check for things that aren't running as expected, and /Library/Logs/Sophos Anti-Virus.log will show you when it last updated -- if this was at 4 AM, you've got your answer as to what was happening (an upgrade).

You may also want to check /Library/Logs/appfirewall.log, as it will show you what network activity is being allowed, and from where.

Look around at the other logs too, as everything's there for a reason :)  If you don't understand what something means, a quick google search should help, if it's an important log item.

The Remove Sophos app running by itself seems extremely suspicious; the Sophos Anti-Virus app running is not so suspicious, especially if you have a scheduled scan.

You may want to check:

System Prefences -> Sharing

and see if you're sharing anything you shouldn't be.  Remember that Remote Login is password based by default.

Beyond this, you may want to familiarize yourself with Activity Monitor.  Set it to All Processes, Hierarchically -- you'll probably have around 80 listed.  You can sort by user to see which processes are running as root, and which are running as you.  The hierarchical view is useful as it shows you how the various processes were launched, and at what user level.

Beyond this, you may want to run console.app  System Log Queries is useful to check for things that aren't running as expected, and /Library/Logs/Sophos Anti-Virus.log will show you when it last updated -- if this was at 4 AM, you've got your answer as to what was happening (an upgrade).

You may also want to check /Library/Logs/appfirewall.log, as it will show you what network activity is being allowed, and from where.

Look around at the other logs too, as everything's there for a reason :)  If you don't understand what something means, a quick google search should help, if it's an important log item.