Endpoint Protection

I am having problems reinstalling the Endpoint Protection application on one of the workstations on our network. SEP had been installed and working previously, but seems to have malfunctioned about a week ago. In an attempt to fix the issue, I uninstalled it, and now I am unable to successfully complete a reinstallation. The installer gets to the  "Configuring services" section and then rolls back.

I have tried following the manual removal instructions for Windows XP, manually deleting C:\Program Files\Symantec , All Users\Application Data\Symantec & Common Files\Symantec . I have tried generating a new installation package on the server and installing it locally using the setup.exe file.  I had tried removing the Symantec Auto-Upgrade service manually following the directions in the KB. I have been rebooting the system before every new installation attempt.

The workstation is running Windows XP Service Pack 3, and is fully patched.

I have attached the installer log.

Any help would be greatly appreciated!

I went through the logs did not get anything from it.
At time we have seen that when there is a infection then also the install fails,

Please run the NSS

ftp://ftp.symantec.com/misc/tools/nss/NortonSecurityScan.exe

Are there any errors in the event viwer for SEP?

Every time I run the installation, I get this error in the event log:

Event Type:    Information
Event Source:    MsiInstaller
Event Category:    None
Event ID:    11708
Date:        10/13/2009
Time:        12:27:16 PM
User:        (Removed to protect the guilty)
Computer:    INCANUS
Description:
Product: Symantec Endpoint Protection -- Installation operation failed.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7b 33 42 41 42 34 39 31   {3BAB491
0008: 34 2d 39 43 43 31 2d 34   4-9CC1-4
0010: 43 43 32 2d 41 33 44 41   CC2-A3DA
0018: 2d 35 36 45 46 36 32 44   -56EF62D
0020: 46 44 33 37 33 7d         FD373} 



I also get this error:

Event Type:    Error
Event Source:    Automatic LiveUpdate Scheduler
Event Category:    (1)
Event ID:    101
Date:        10/13/2009
Time:        2:27:10 PM
User:        NT AUTHORITY\SYSTEM
Computer:    INCANUS
Description:
The description for Event ID ( 101 ) in Source ( Automatic LiveUpdate Scheduler ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: error, Failed unregistering service..


I have tried running the installation and selecting not to run LiveUpdate as part of the installation and still get that error.

I am running the security scan now, although I have already tried running a couple of different Malware scans with no positive results.

Title: 'Installation for Symantec Endpoint Protection (SEP) rolls back with an Event ID 101 in the Application logs in the Event Viewer'
Document ID: 2009011310570948
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2009011310570948?Open&seg=ent

Well, the "good" news is that I am no longer getting that event showing up, but am now getting this one instead:

Event Type:    Error
Event Source:    Service Control Manager
Event Category:    None
Event ID:    7009
Date:        10/13/2009
Time:        3:47:43 PM
User:        N/A
Computer:    INCANUS
Description:
Timeout (30000 milliseconds) waiting for the Symantec Settings Manager service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Take the backup of the registry

a. In Registry Editor, locate, and then right-click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control

b. Point to New, and then click DWORD Value. In the right pane of Registry Editor, notice that New Value #1 (the name of a new registry entry) is selected for editing.

c. Type ServicesPipeTimeout to replace New Value #1, and then press ENTER.

d. Right-click the ServicesPipeTimeout registry entry that you created in step c, and then click Modify. The Edit DWORD Value dialog box appears.

e. In the Value data text box, type TimeoutPeriod, and then click OK

f. Restart the computer. You must restart the computer for Service Control Manager to apply this change.

HI rekabbelac I just want to ask if the resolution that they provided work to resolve the issue? I having the same problem encountered right now.

I have not been able to try the latest set of step yet. The system is a laptop that needed to be taken out of the office for a meeting. I ended up just putting AVG on it temporarily until I can work on it further when it is available again.