Endpoint Protection

Dear all,
I've problem when install SEP. The result always rollback.
Before write in this forum I try many trick, from Microsoft and Symantec and any solution in this forum but never success.

Here the last line in SEP_INST.log
-------------------------------------------------------

Property(S): ProductToBeRegistered = 1
Property(S): MsiFilterRebootMode_RebootAtEndModeBefore = 1
MSI (s) (FC:D8) [14:34:36:113]: Note: 1: 1708
MSI (s) (FC:D8) [14:34:36:113]: Product: Symantec Endpoint Protection -- Installation operation failed.

MSI (s) (FC:D8) [14:34:36:145]: Cleaning up uninstalled install packages, if any exist
MSI (s) (FC:D8) [14:34:36:145]: MainEngineThread is returning 1603
MSI (s) (FC:68) [14:34:36:145]: Destroying RemoteAPI object.
MSI (s) (FC:58) [14:34:36:145]: Custom Action Manager thread ending.
=== Logging stopped: 11/4/2009  14:34:36 ===
MSI (c) (E8:7C) [14:34:36:145]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (E8:7C) [14:34:36:145]: MainEngineThread is returning 1603
=== Verbose logging stopped: 11/4/2009  14:34:36 ===

Thank you for any help.

PS : SEP_INST.log size 3.588 kb so I compressed that file.
        Thanks again

Hi,

PLease post the sep_inst.log as an attachment to your priginal post. You can edit it, from left hand top corner and at the bottom you will find the attachment section.

Aniket

In the log search for Return value  3 and paste 5-6 lines before and after that

Error codes are here
https://www-secure.symantec.com/connect/forums/symantec-endpoint-protection-install-error-codes

if u want to make logs of your installation then
http://service1.symantec.com/SUPPORT/ent-security.nsf/ppfdocs/1999060918102448

do this let me see

installation complete logs file in %temp% or %temp%

 

from the attached log,

serviceIsRunning: OpenService FAILED with error 1060
LoadEvtMgrDll: ccEvtMgr is not running
serviceIsRunning: OpenService FAILED with error 1060
SendReload: ccEvtMgr is not running
loadEventManagerDLLs: FAILED to send reload event
loadEventManagerDLLs: exiting
restoreSPState: Changing service configuration to SERVICE_DEMAND START for SPBBCSvc
modifyServiceConfiguration: OpenService() FAILED with error 1060
restoreSPState: Unable to modify configuration for SPBBCSvc
restoreSPState: Value of szSPState "0"
restoreSPState: SPState is NOT set to 1. NOT Calling startSP
restoreSPState: exiting
MSI (s) (FC:D8) [14:34:35:504]: Executing op: ActionStart(Name=checkMSXMLVersion.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
MSI (s) (FC:D8) [14:34:35:504]: Executing op: ActionStart(Name=RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
MSI (s) (FC:D8) [14:34:35:504]: Executing op: CustomActionRollback(Action=RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,ActionType=1345,Source=BinaryData,Target=cleanupFolder,)
MSI (s) (FC:80) [14:34:35:519]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI6E.tmp, Entrypoint: cleanupFolder
InstSymProtect::cleanupFolder() -> called
DeleteFolderIfNoFileExists: Driver file is not present.
DeleteFolder: FAILED to delete directory C:\Program Files\Common Files\Symantec Shared\SPBBC
DeleteFolderIfNoFileExists: SHDeleteFolder FAILED
InstSymProtect::cleanupFolder() -> DeleteFolderIfNoFileExists FAILED
MSI (s) (FC:D8) [14:34:35:707]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (FC:D8) [14:34:35:707]: Error in rollback skipped. Return: 5
cleanupFolder:  exiting
MSI (s) (FC:D8) [14:34:35:754]: No System Restore sequence number for this installation.
MSI (s) (FC:D8) [14:34:35:754]: Unlocking Server
MSI (s) (FC:D8) [14:34:35:754]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 14:34:35: INSTALL. Return value 3.


tampre protection service is causing teh rollback and also instanceof lusetup.


Delete the folder manually "C:\Program Files\Common Files\Symantec Shared\SPBBC
" and try installing again.

I would suggest to delete the folders of Symantec and registry entries for the same.

Cheers
Pete

your symantec currenlty installed is not working properly
first check you are login with admin rights
then
try to remove live and symanec from add & remove
then stop and all symantec services ...services.msc
stop all extra startup ,,,,msconfig
and stop symantec ccap..ccset ccevt process via taskkill /IM ccap* /F

then
cut these folders to other path
C:\Documents and Settings\currentloginuser\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Program Files\Common Files\Symantec Shared
C:\Program Files\Symantec
C:\Program Files\Symantec AntiVirus


remove symantec from these registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer

then try to install

Uninstall liveupdate

Delete following folders

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate

C:\Program Files\Symantec

C:\Program Files\Symantec antivirus

Install LiveUpdate using LUSETUP.EXE located in the SEP installation files, in the following folder:

...\SEP\LUSETUP.EXE

Install SEP once again

 

Dear All...
Thanks for all answer, suggest, and responds.
If I try all respond above and not solving the problem what else can I do?
My last action is formating the harddisk... :(

H,

Pls use latest version of MSI installer & use cleanwipe to remove the left over of SEP from the computer.

After that try to reinstall SEP again this will help you.

Try to repair Windows.

If non of the above suggestions are helping you try to cleanup your PC with Windows Installer CleanUp Utility  and try to install once again..

Is there any other instance of RETURN VALUE 3 in the logs

Common Symantec Endpoint Protection Client Installation Issues 

@Prachand one more instant is present you can check it in the log file which is attached as SEP_INST.zip. 

Found the following in logs:

LUCA: UnInstallLiveUpdate enter.
LUCA: C:\DOCUME~1\**********.*******\LOCALS~1\Temp\FVADHOQE\LiveUpdate\lucheck.exe
LUCA: UnInstallLiveUpdate exit.


restoreSPState: Changing service configuration to SERVICE_DEMAND START for SPBBCSvc
modifyServiceConfiguration: OpenService() FAILED with error 1060
restoreSPState: Unable to modify configuration for SPBBCSvc



I think the previous instance if liveupdate could be causing this issue. Uninstall liveupdate. Go ot device manager->view->show hidden devices-> non-plug & play devices-> uninstall SPBBC, SRTSP if you see those drivers there.

Make sure that you delete all symantec related folders before attempting the next installation.

Aniket

To All :
"I'll try yours. I'll be broadcast any theory can help me to solved this problem."
Because it can help me with my job :)

Try to login with local Administrator account and then try to  installation again

I had the same issue with a number of machines. I resolved it by doing the below.

1. Check if Event Log is Started and set as automatic  in services.msc. If this service is stopped, then,
2. Download eventlog.dll file and copy it in C:\WINDOWS\system32
3. Start the Event Log and install SEP11

Regards,
Guru
Symantec Certified Specialist

Installl any third-party AV to check if infected by virus. I usually encountered the rollback when the PC is infected by Sality. It infects executbable files including your installer. Try to ZIP first your other AV installer with password protected and unzip it to the affected PC. Try to install it and restart your PC. After restart, try to install your SEP.

There are 2 return value 3, I would always go with the first one, thats the first point of failure, anything after that does not have any impact, coz it already rolled back.

From the logs

:\DOCUME~1\**********.*******\LOCALS~1\Temp\FVADHOQE\LiveUpdate\lucheck.exe
LUCA: InstallLiveUpdate : CreateProcessAndWait( LUCHECK.EXE ) returned 2089878865
MSI (s) (FC:D8) [14:34:28:514]: User policy value 'DisableRollback' is 0
MSI (s) (FC:D8) [14:34:28:514]: Machine policy value 'DisableRollback' is 0
Action ended 14:34:28: InstallFinalize. Return value 3.

Installation of Symantec Endpoint Protection Client rolls back with error LUCHECK.EXE returned 206
http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/d0eba8eac1258b9388257643007e0f0c?OpenDocument

Installation rollback for Symantec Endpoint Protection Client , LuCheck.exe returning value 206

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/d0eba8eac1258b9388257643007e0f0c?OpenDocument

Hope the rollback problem is solved.  I did nothing specific, just tried installing the setup file time and again, and was successful.