Endpoint Protection

Previously the SEP 11 is installed in my computer, after several days the SEP has been corrupted I tried to uninstall then reinstall the SEP client then suddenly the installation is interrupted during "copying files" I tried to use the SEP clean wipe, no nav and manually deleted the entry of Symantec Endpoint Protection from the registry but it wont help.

I tried to install SAV10 fortunately it successfully installed then updated virus defintion then performed full scan just to check if the virus is exist after full scan we found out there is no virus.

then I tried to upgrade from SAV10 to SEP11 but the installation is interrupted

anyone could help me on this.

did you check sep_inst.log file for the installation issue.

check for the file ( start --> run --> %temp%, check for return value 3)

go to start run
%temp%
find SEP_INST.log
look for return value 3
look for 10 lines above and below that for the reason why it failed.
it would be good if you can paste the log here.

You can directly uninstall SAV10 & reinstall SEP11. as you have confirmed that there is no virus. This could have saved time.

Remove SAV 10 & install SEP 11 using unmanaged installer.


Regards...
Ramji Iyyer

Run a scan in Safe-Mode with Networking.

I tried all the steps posted here but still wont help, I will post the logs later so you can scrutinize it

=== Verbose logging started: 8/17/2009  16:19:38  Build type: SHIP UNICODE 3.01.4001.5512  Calling process: C:\WINDOWS\system32\MSIEXEC.EXE ===
MSI (c) (40:24) [16:19:38:562]: Resetting cached policy values
MSI (c) (40:24) [16:19:38:562]: Machine policy value 'Debug' is 0
MSI (c) (40:24) [16:19:38:562]: ******* RunEngine:
           ******* Product: C:\Documents and Settings\Administrator\Desktop\SEP install new EDPC-REGION-5S\Symantec AntiVirus.msi
           ******* Action:
           ******* CommandLine: **********
MSI (c) (40:24) [16:19:38:796]: Machine policy value 'DisableUserInstalls' is 0
MSI (c) (40:24) [16:19:39:546]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\Documents and Settings\Administrator\Desktop\SEP install new EDPC-REGION-5S\Symantec AntiVirus.msi' against software restriction policy
MSI (c) (40:24) [16:19:39:546]: Note: 1: 2262 2: DigitalSignature 3: -2147287038
MSI (c) (40:24) [16:19:39:546]: SOFTWARE RESTRICTION POLICY: C:\Documents and Settings\Administrator\Desktop\SEP install new EDPC-REGION-5S\Symantec AntiVirus.msi is not digitally signed
MSI (c) (40:24) [16:19:39:562]: SOFTWARE RESTRICTION POLICY: C:\Documents and Settings\Administrator\Desktop\SEP install new EDPC-REGION-5S\Symantec AntiVirus.msi is permitted to run at the 'unrestricted' authorization level.
MSI (c) (40:24) [16:19:39:812]: Cloaking enabled.
MSI (c) (40:24) [16:19:39:812]: Attempting to enable all disabled priveleges before calling Install on Server
MSI (c) (40:24) [16:19:39:968]: End dialog not enabled
MSI (c) (40:24) [16:19:39:968]: Original package ==> C:\Documents and Settings\Administrator\Desktop\SEP install new EDPC-REGION-5S\Symantec AntiVirus.msi
MSI (c) (40:24) [16:19:39:968]: Package we're running from ==> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\13e7b.msi
MSI (c) (40:24) [16:19:40:250]: APPCOMPAT: looking for appcompat database entry with ProductCode '{C1B0BDC8-0624-4036-90D1-F7DF0EE8C96D}'.
MSI (c) (40:24) [16:19:40:250]: APPCOMPAT: no matching ProductCode found in database.
MSI (c) (40:24) [16:19:40:453]: MSCOREE not loaded loading copy from system32
MSI (c) (40:24) [16:19:40:765]: Machine policy value 'TransformsSecure' is 0
MSI (c) (40:24) [16:19:40:765]: User policy value 'TransformsAtSource' is 0
MSI (c) (40:24) [16:19:40:859]: Machine policy value 'DisablePatch' is 0
MSI (c) (40:24) [16:19:40:859]: Machine policy value 'AllowLockdownPatch' is 0
MSI (c) (40:24) [16:19:40:859]: Machine policy value 'DisableLUAPatching' is 0
MSI (c) (40:24) [16:19:40:859]: Machine policy value 'DisableFlyWeightPatching' is 0
MSI (c) (40:24) [16:19:40:859]: APPCOMPAT: looking for appcompat database entry with ProductCode '{C1B0BDC8-0624-4036-90D1-F7DF0EE8C96D}'.
MSI (c) (40:24) [16:19:40:875]: APPCOMPAT: no matching ProductCode found in database.
MSI (c) (40:24) [16:19:40:875]: Transforms are not secure.
MSI (c) (40:24) [16:19:40:875]: Command Line: SETUPEXEDIR=C:\Documents and Settings\Administrator\Desktop\SEP install new EDPC-REGION-5S CURRENTDIRECTORY=C:\Documents and Settings\Administrator\Desktop\SEP install new EDPC-REGION-5S CLIENTUILEVEL=0 CLIENTPROCESSID=1344
MSI (c) (40:24) [16:19:40:875]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{B904DC4E-092A-44C3-9609-3D4A0DADE2EE}'.
MSI (c) (40:24) [16:19:40:875]: Product Code passed to Engine.Initialize:           ''
MSI (c) (40:24) [16:19:40:875]: Product Code from property table before transforms: '{C1B0BDC8-0624-4036-90D1-F7DF0EE8C96D}'
MSI (c) (40:24) [16:19:40:875]: Product Code from property table after transforms:  '{C1B0BDC8-0624-4036-90D1-F7DF0EE8C96D}'
MSI (c) (40:24) [16:19:40:875]: Product not registered: beginning first-time install
MSI (c) (40:24) [16:19:40:875]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
MSI (c) (40:24) [16:19:40:875]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (c) (40:24) [16:19:40:875]: User policy value 'SearchOrder' is 'nmu'
MSI (c) (40:24) [16:19:40:875]: Adding new sources is allowed.
MSI (c) (40:24) [16:19:40:875]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
MSI (c) (40:24) [16:19:40:875]: Package name extracted from package path: 'Symantec AntiVirus.msi'
MSI (c) (40:24) [16:19:40:875]: Package to be registered: 'Symantec AntiVirus.msi'
MSI (c) (40:24) [16:19:40:875]: Note: 1: 2729
MSI (c) (40:24) [16:19:40:937]: Note: 1: 2729
MSI (c) (40:24) [16:19:40:937]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (c) (40:24) [16:19:40:937]: Machine policy value 'DisableMsi' is 0
MSI (c) (40:24) [16:19:40:937]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (c) (40:24) [16:19:40:937]: User policy value 'AlwaysInstallElevated' is 0
MSI (c) (40:24) [16:19:40:937]: Product installation will be elevated because user is admin and product is being installed per-machine.
MSI (c) (40:24) [16:19:40:937]: Running product '{C1B0BDC8-0624-4036-90D1-F7DF0EE8C96D}' with elevated privileges: Product is assigned.
MSI (c) (40:24) [16:19:40:937]: PROPERTY CHANGE: Adding SETUPEXEDIR property. Its value is 'C:\Documents and Settings\Administrator\Desktop\SEP install new EDPC-REGION-5S'.
MSI (c) (40:24) [16:19:40:937]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'C:\Documents and Settings\Administrator\Desktop\SEP install new EDPC-REGION-5S'.
MSI (c) (40:24) [16:19:40:937]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '0'.
MSI (c) (40:24) [16:19:40:937]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '1344'.
MSI (c) (40:24) [16:19:40:937]: TRANSFORMS property is now:
MSI (c) (40:24) [16:19:40:937]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '301'.
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\Application Data
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\Favorites
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\NetHood
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\My Documents
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\PrintHood
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\Recent
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\SendTo
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\Templates
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Application Data
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\Local Settings\Application Data
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\My Documents\My Pictures
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Start Menu\Programs\Startup
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Start Menu\Programs
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Start Menu
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Desktop
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\Start Menu\Programs\Administrative Tools
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\Start Menu\Programs
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\Start Menu
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\Administrator\Desktop
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\Documents and Settings\All Users\Templates
MSI (c) (40:24) [16:19:40:937]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
MSI (c) (40:24) [16:19:40:937]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
MSI (c) (40:24) [16:19:40:953]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
MSI (c) (40:24) [16:19:40:953]: PROPERTY CHANGE: Adding USERNAME property. Its value is ' '.
MSI (c) (40:24) [16:19:40:953]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is ' '.
MSI (c) (40:24) [16:19:40:953]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\13e7b.msi'.
MSI (c) (40:24) [16:19:40:953]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\Documents and Settings\Administrator\Desktop\SEP install new EDPC-REGION-5S\Symantec AntiVirus.msi'.
MSI (c) (40:24) [16:19:40:953]: PROPERTY CHANGE: Adding SourceDir property. Its value is 'C:\Documents and Settings\Administrator\Desktop\SEP install new EDPC-REGION-5S\'.
MSI (c) (40:24) [16:19:40:953]: PROPERTY CHANGE: Adding SOURCEDIR property. Its value is 'C:\Documents and Settings\Administrator\Desktop\SEP install new EDPC-REGION-5S\'.
MSI (c) (40:B0) [16:19:43:406]: PROPERTY CHANGE: Adding VersionHandler property. Its value is '3.01'.
=== Logging started: 8/17/2009  16:19:43 ===
MSI (c) (40:24) [16:19:43:546]: Note: 1: 2205 2:  3: PatchPackage
MSI (c) (40:24) [16:19:43:546]: Machine policy value 'DisableRollback' is 0
MSI (c) (40:24) [16:19:43:546]: User policy value 'DisableRollback' is 0
MSI (c) (40:24) [16:19:43:546]: PROPERTY CHANGE: Adding UILevel property. Its value is '5'.
MSI (c) (40:24) [16:19:43:546]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
MSI (c) (40:24) [16:19:43:546]: Doing action: INSTALL
Action 16:19:43: INSTALL.
Action start 16:19:43: INSTALL.
MSI (c) (40:24) [16:19:43:687]: UI Sequence table 'InstallUISequence' is present and populated.
MSI (c) (40:24) [16:19:43:687]: Running UISequence
MSI (c) (40:24) [16:19:43:687]: PROPERTY CHANGE: Adding EXECUTEACTION property. Its value is 'INSTALL'.
MSI (c) (40:24) [16:19:43:734]: Doing action: CommonAppDataFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2
Action 16:19:43: CommonAppDataFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2.
Action start 16:19:43: CommonAppDataFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2.

Action 16:24:31: . WindowsInstaller-KB893803-x86.exe
ADMINMOVEFILES: Deleting File: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\Cache\WindowsInstaller-KB893803-x86.exe
ADMINMOVEFILES: Removed folder: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\Cache\
ADMINMOVEFILES: Folder: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\CmcPolicies\
ADMINMOVEFILES: Pattern: *.*
Action 16:24:31: . SyLink.xml
ADMINMOVEFILES: Deleting File: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\CmcPolicies\SyLink.xml
ADMINMOVEFILES: Removed folder: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\CmcPolicies\
ADMINMOVEFILES: Folder: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\CmcSettings\
ADMINMOVEFILES: Pattern: *.*
ADMINMOVEFILES: Removed folder: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\CmcSettings\
ADMINMOVEFILES: Folder: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\LiveUpdate\
ADMINMOVEFILES: Pattern: *.*
Action 16:24:31: . LuCheck.exe
ADMINMOVEFILES: Deleting File: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\LiveUpdate\LuCheck.exe
Action 16:24:31: . LUSETUP.EXE
ADMINMOVEFILES: Deleting File: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\LiveUpdate\LUSETUP.EXE
ADMINMOVEFILES: Removed folder: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\LiveUpdate\
ADMINMOVEFILES: Folder: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\VirDefs\
ADMINMOVEFILES: Pattern: *.*
Action 16:24:31: . VDefHub.zip
ADMINMOVEFILES: Deleting File: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\VirDefs\VDefHub.zip
ADMINMOVEFILES: Removed folder: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\VirDefs\
ADMINMOVEFILES: Folder: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\IPSDefs\
ADMINMOVEFILES: Pattern: *.*
ADMINMOVEFILES: Removed folder: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GSTGRKLB\IPSDefs\
WriteCcSettingsTables: SetOneTimeUpdateCookie_RB.93C43188_D2F5_461E_B42B_C3A2A318345C
MSI (s) (AC:C8) [16:24:31:671]: Executing op: ActionStart(Name=SetOneTimeUpdateCookie_RB.93C43188_D2F5_461E_B42B_C3A2A318345C,,)
MSI (s) (AC:C8) [16:24:31:671]: Executing op: CustomActionRollback(Action=SetOneTimeUpdateCookie_RB.93C43188_D2F5_461E_B42B_C3A2A318345C,ActionType=1281,Source=BinaryData,Target=SetOneTimeUpdateCookie_RB,)
MSI (s) (AC:AC) [16:24:31:703]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSIAD.tmp, Entrypoint: SetOneTimeUpdateCookie_RB
WriteCcSettingsTables: DisableCancelButton.93C43188_D2F5_461E_B42B_C3A2A318345C
MSI (s) (AC:C8) [16:24:31:750]: Executing op: ActionStart(Name=DisableCancelButton.93C43188_D2F5_461E_B42B_C3A2A318345C,,)
WriteCcSettingsTables: stopSP.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1
MSI (s) (AC:C8) [16:24:31:750]: Executing op: ActionStart(Name=stopSP.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
WriteCcSettingsTables: restoreSPState.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1
MSI (s) (AC:C8) [16:24:31:750]: Executing op: ActionStart(Name=restoreSPState.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
MSI (s) (AC:C8) [16:24:31:750]: Executing op: CustomActionRollback(Action=restoreSPState.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,ActionType=3329,Source=BinaryData,Target=restoreSPState,CustomActionData=0)
MSI (s) (AC:F8) [16:24:31:765]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSIAE.tmp, Entrypoint: restoreSPState
restoreSPState: called
restoreSPState: calling loadEventManagerDLLs
loadEventManagerDLLs: called
serviceIsRunning: OpenService FAILED with error 1060
LoadEvtMgrDll: ccEvtMgr is not running
serviceIsRunning: OpenService FAILED with error 1060
SendReload: ccEvtMgr is not running
loadEventManagerDLLs: FAILED to send reload event
loadEventManagerDLLs: exiting
restoreSPState: Changing service configuration to SERVICE_DEMAND START for SPBBCSvc
modifyServiceConfiguration: OpenService() FAILED with error 1060
restoreSPState: Unable to modify configuration for SPBBCSvc
restoreSPState: Value of szSPState "0"
restoreSPState: SPState is NOT set to 1. NOT Calling startSP
restoreSPState: exiting
WriteCcSettingsTables: checkMSXMLVersion.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1
MSI (s) (AC:C8) [16:24:31:796]: Executing op: ActionStart(Name=checkMSXMLVersion.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
WriteCcSettingsTables: RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1
MSI (s) (AC:C8) [16:24:31:796]: Executing op: ActionStart(Name=RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
MSI (s) (AC:C8) [16:24:31:796]: Executing op: CustomActionRollback(Action=RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,ActionType=1345,Source=BinaryData,Target=cleanupFolder,)
MSI (s) (AC:14) [16:24:31:812]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSIAF.tmp, Entrypoint: cleanupFolder
InstSymProtect::cleanupFolder() -> called
DeleteFolderIfNoFileExists: Driver file is not present.
DeleteFolder: FAILED to delete directory C:\Program Files\Common Files\Symantec Shared\SPBBC
DeleteFolderIfNoFileExists: SHDeleteFolder FAILED
InstSymProtect::cleanupFolder() -> DeleteFolderIfNoFileExists FAILED
cleanupFolder:  exiting
MSI (s) (AC:C8) [16:24:32:171]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (AC:C8) [16:24:32:171]: Error in rollback skipped. Return: 5
MSI (s) (AC:C8) [16:24:32:187]: No System Restore sequence number for this installation.
MSI (s) (AC:C8) [16:24:32:187]: Unlocking Server
MSI (s) (AC:C8) [16:24:32:187]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 16:24:32: INSTALL. Return value 3.

how to attach the logs?

its becuase of the folder existing there on the system , this is related to tamper protection. Hence if you have cleanwipe tool tool run it, ensure all folders related to SAV are deleted and reboot and try installing the SAV/SEP again.

FAILED to delete directory C:\Program Files\Common Files\Symantec Shared\SPBBC

I already tried to use the sepcleanwipe but it wont help

Try using Microsoft Installer Cleanup utility first.  It should be Google-able then downlod directly from Microsoft.  Try Cleanwipe after.  With problem pcs, I would always followup cleanwipe with the Microsoft installer cleanup just to be on the safe side.  If nothing is there, it only take 30 seconds to run.

Good Luck. -Toast

most of the removal tool didn't work in my case too... I hope theres an easy way to get rid of this problem...