Endpoint Protection

I was having lots of problems with corrupt virus definitions. Finally we were advised to just uninstall Symantec Antivirus Corporate Edition from our server and reinstall. Now when we attempt to reinstall, we get the following error: "the wizard was interrupted before symantec antivirus could be completely installed." A few important things about our environment: this is the same server that the symantec console resides on. Also we are using the install that is located under CLT-INST. Finally Symantec Mail Security for exchange is also installed on this same server. We've had some suggest to manually remove symantec antivirus - however we went trhrough this 30 step manual removal on symantec's website and that didn't work. We are desparate to get symantec antivirus re-installed on this server. Please help..

Do you want to install SAV 9.0 Server version.

Backup the pki folder before removing  if you want to install sav server.


Use nonav or cleanwipe to completely remove symantec products from server.

then delete following folders

C:\Documents and Settings\All Users\Application Data\          "Symantec"

C:\Program Files\Common Files\   "Symantec Shared"

C:\Program Files\  "Symantec"

then install sav from cd.  not from client-int folder.

if the server is infected then use NSS.exe to remove the threat before installing symantec. 

What is the no of clients you are having?

The best option will be to upgrade the symantec Antivirus server to 10.1.8 and later upgrade all the clients.

Title: 'Error: "The wizard was interrupted before Symantec AntiVirus Corporate Edition could be completely installed" when installing Symantec AntiVirus Corporate Edition'
Document ID: 2002092715192848
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2002092715192848?Open&seg=ent

Hi Starfish,

I have to agree with Ajju: upgrade to a version of SAV that is still supported and (more importantly) is capable of remediating today's threats.  The removal powers of SAV 9 were good in their day, but the bad guys have had several years to learn how to create viruses and worms that older AV technologies cannot handle.  SAV 10.1 offers much better remediation, and it includes added features like PKI.  (SAV 9 did not have PKI).

The latest version of SAV is 10.1 MR 9.

You may wish to check what version of SMSMSE is also on this server.  SMSMSE 5 has just reached End of Life.  I recommend migrating to SMSMSE 6.0.9 if you have not already done so.  License files that were valid for the earlier version are still completely valid, and the latest release of the product has all the known enhancement and improvements.  Highly recommended!

If you do need to contact Symantec Technical Support, I recommend generating a debug .msi install log.  See How to create a detailed installation log file for the Microsoft Installer for details!  With taht in hand, Support can usually spot the root of the trouble straight away.

One disclaimer: the latest releases of SAV 10.1 and SMSMSE 6 cannot function on very old hardware or OS's like Windows NT. 

Thanks and best regards,

Mick

You might have some left out, most of the times it will be AMS, alert management system
Use Microsoft clean up utility.
support.micrsoft.com/kb/290301
install it.
look for AMS , if you find one remove it , now install AV should work fine

Generally speaking, most customers I've come across still using 9 have a very good reason...they have Windows NT 4.0 deployed in their environment and cannot move to 10.x (or higher) because we no longer install to NT on the newer versions.

If this is the case for you Starfish, I implore you to remove these NT machines from the network until you can upgrade their OSes to a version that is currently supported by Microsoft.

There are viruses currently in the wild (such as IRCbot and Spybot) that actively try to exploit vulnerabilities in Windows NT that Microsoft has refused to patch (because the OS isn't supported)...so if you've got NT, it's not *if* you get these infections, it's a question of *when* you will get them.

@Chris: We still have to use 9.x on couple thousand machines due to the clearcase compatibility issue which was supposedly fixed with 10.x but never worked well for us. For the other 40K odd machines we have 10.x. So sometimes you have to use the older version 'cause it's working better than the new one, seen it with some other vendors too. We are migrating on to SEP right now and other than the new issues, that problem seems to be resolved.


@Starfish: Can you upload the msi log file for a look, in case if you have to use 9.x ?