Endpoint Protection

 View Only
Back to discussions
Expand all | Collapse all

SEP 11 reinstall keeps rolling back

  • 1.  SEP 11 reinstall keeps rolling back

    Posted Dec 14, 2011 11:11 AM

    Hi all,

    Have a machine that had a pretty bad virus on it, SEP couldn't pick it up in the end I had to use some other removal tools, anyway after doing this and cleaning the system I noticed SEP wouldn't re-enable or update, so I decided to reinstall it, now every time Ive tried to install it it rolls back and says it was interrupted before it could be completely uninstalled.

     

    I've searched around and tried a few things:

    • removing everything manually
    • creating install logs ( points to : error failed to register current syknapps dll for lu code :1013)
    • tried installing LU on its own first (that went fine)
    • used an old copy of clean wipe I had from about 8 months ago
    • deleted all local files in program files and ProgramData
    • cleared the registry with ccleaner for any lose ends

    nothing will work, I get the same error and cant get anywhere, can anyone help me out?

     

    cheers



  • 2.  RE: SEP 11 reinstall keeps rolling back

    Trusted Advisor
    Posted Dec 14, 2011 11:27 AM

    Hello,

    What version of SEP are you trying to install??

    What OS is installed on the machine in Question??

     

    In your case, when Symantec is not Detecting a Threat is often recommended to Run the Symantec Support Tool, which would detect all the Suspicious file on the Machine and Assisting you to Submit the same to the Symantec Security Response Team. 

    Check this: https://www-secure.symantec.com/connect/articles/using-symantec-support-tool-how-do-we-collect-suspicious-files-and-submit-same-symantec-sec

    and 

    Scanning a file with a competitor's antivirus program detects a virus, but scanning with Symantec AntiVirus or Symantec Endpoint Protection does not

    http://www.symantec.com/docs/TECH98929

     

    Could you try Installing the Latest version of SEP on the same machine. The Latest version of SEP is 11.0.7101.

     

    I would recommend you to also Run the Symantec Power Eraser in this Case.
     
    Hope that helps!!


  • 3.  RE: SEP 11 reinstall keeps rolling back

    Posted Dec 14, 2011 04:35 PM

    Hello ADprin,

    It would be best if you can post a copy of the SEP installation log so we can review it.

    1. Login to the affected machine
    2. Try to install SEP
    3. After it fails, click Start
    4. Click Run
    5. Type in: %temp%
    6. Click OK
    7. Find the file SEP_INST.LOG
    8. Attach it to this thread.

    Regards,

    James



  • 4.  RE: SEP 11 reinstall keeps rolling back

    Posted Dec 14, 2011 07:47 PM

    Hi ADprin,

    You may have missed some entries in the registry or some fragments of the virus that's still running. Either try and scan it using Symantec Endpoint Recovery Tool or if you're sure of the malware, check it in the Symantec Threat List: http://www.symantec.com/security_response/threatexplorer/azlisting.jsp. for manual removal instructions.

    And if there are absolutely no more traces of a virus, go run CleanWipe or check the manual removal of SEP. It probably got corrupted and now needs to be removed before a new installation.



  • 5.  RE: SEP 11 reinstall keeps rolling back

    Posted Dec 14, 2011 08:50 PM

    Hi

     

    Kindly check this Article

     

     

    http://www.symantec.com/business/support/index?page=content&id=TECH104575

     

     

    Thanks Ashish Sharma



  • 6.  RE: SEP 11 reinstall keeps rolling back

    Posted Dec 15, 2011 12:24 AM

    Hi.

    SEP 11 reinstall keeps rolling back

    when installing aney antivirus if it roolback virus in that machine

    we should clean the virus in that machine before installing the antivirus for that

    we can use tools like  NNS,stinger,combofix..etc

    Run these tools and full scan in that machine and after completing scane restart the machine and 

    then install the antivirus and update with latest version and given the full scane one againe your system will get clean.



  • 7.  RE: SEP 11 reinstall keeps rolling back

    Posted Dec 15, 2011 05:47 AM

    Hi all, as I said the virus is now cleaned I had to use a kaspersky tool as well as Combofix.

    the versionof SEP is : 11.0.6300.803-32bit ( dont want to try the latest yet as I havent even tested it on anything)

    machine is windows 7 32bit

     

    log as follows (why cant we attach .txt files:( )

    was getting error failed to register current syknapps dll for lu code :1013 in my log before, after clean wipe it seems to keep saying it needs a reboot, (have checked the registry for pending file rename, thats clear before the install starts but present after)

     

    === Verbose logging started: 15/12/2011  09:52:34  Build type: SHIP UNICODE 5.00.7601.00  Calling process: C:\Windows\system32\MSIEXEC.EXE ===
    MSI (c) (EC:D4) [09:52:34:235]: Resetting cached policy values
    MSI (c) (EC:D4) [09:52:34:235]: Machine policy value 'Debug' is 7
    MSI (c) (EC:D4) [09:52:34:235]: ******* RunEngine:
               ******* Product: \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\Symantec AntiVirus.msi
               ******* Action:
               ******* CommandLine:  REBOOT=ReallySuppress  IDCENABLE=0  SETUPEXEDIR="\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit"
    MSI (c) (EC:D4) [09:52:34:250]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (EC:D4) [09:52:34:250]: Grabbed execution mutex.
    MSI (c) (EC:D4) [09:52:34:328]: Cloaking enabled.
    MSI (c) (EC:D4) [09:52:34:328]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (EC:D4) [09:52:34:344]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (F0:90) [09:52:34:359]: Running installation inside multi-package transaction \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\Symantec AntiVirus.msi
    MSI (s) (F0:90) [09:52:34:359]: Grabbed execution mutex.
    MSI (s) (F0:C4) [09:52:34:359]: Resetting cached policy values
    MSI (s) (F0:C4) [09:52:34:359]: Machine policy value 'Debug' is 7
    MSI (s) (F0:C4) [09:52:34:359]: ******* RunEngine:
               ******* Product: \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\Symantec AntiVirus.msi
               ******* Action:
               ******* CommandLine:  REBOOT=ReallySuppress  IDCENABLE=0  SETUPEXEDIR="\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit"  CURRENTDIRECTORY="\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit" CLIENTUILEVEL=3  CLIENTPROCESSID=3564
    MSI (s) (F0:C4) [09:52:34:810]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (F0:C4) [09:52:35:246]: Machine policy value 'DisableUserInstalls' is 0
    MSI (s) (F0:C4) [09:52:35:277]: Incrementing counter to disable shutdown. Counter after increment: 1
    MSI (s) (F0:C4) [09:52:36:460]: SRSetRestorePoint skipped for this transaction.
    MSI (s) (F0:C4) [09:52:36:460]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: 0
    MSI (s) (F0:C4) [09:52:36:491]: File will have security applied from OpCode.
    MSI (s) (F0:C4) [09:52:53:793]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (s) (F0:C4) [09:52:53:793]: SOFTWARE RESTRICTION POLICY: Verifying package --> '\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\Symantec AntiVirus.msi' against software restriction policy
    MSI (s) (F0:C4) [09:52:53:793]: Note: 1: 2262 2: DigitalSignature 3: -2147287038
    MSI (s) (F0:C4) [09:52:53:793]: SOFTWARE RESTRICTION POLICY: \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\Symantec AntiVirus.msi is not digitally signed
    MSI (s) (F0:C4) [09:52:53:793]: SOFTWARE RESTRICTION POLICY: \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\Symantec AntiVirus.msi is permitted to run at the 'unrestricted' authorization level.
    MSI (s) (F0:C4) [09:52:53:793]: End dialog not enabled
    MSI (s) (F0:C4) [09:52:53:793]: Original package ==> \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\Symantec AntiVirus.msi
    MSI (s) (F0:C4) [09:52:53:793]: Package we're running from ==> C:\Windows\Installer\3e70cc0.msi
    MSI (s) (F0:C4) [09:52:53:839]: APPCOMPAT: Compatibility mode property overrides found.
    MSI (s) (F0:C4) [09:52:53:839]: APPCOMPAT: looking for appcompat database entry with ProductCode '{AAE221D5-C3DD-4FE2-A063-C1368FE730A5}'.
    MSI (s) (F0:C4) [09:52:53:839]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (F0:C4) [09:52:53:839]: MSCOREE not loaded loading copy from system32
    MSI (s) (F0:C4) [09:52:53:855]: Machine policy value 'TransformsSecure' is 0
    MSI (s) (F0:C4) [09:52:53:855]: User policy value 'TransformsAtSource' is 0
    MSI (s) (F0:C4) [09:52:53:855]: Machine policy value 'DisablePatch' is 0
    MSI (s) (F0:C4) [09:52:53:855]: Machine policy value 'AllowLockdownPatch' is 0
    MSI (s) (F0:C4) [09:52:53:855]: Machine policy value 'DisableLUAPatching' is 0
    MSI (s) (F0:C4) [09:52:53:855]: Machine policy value 'DisableFlyWeightPatching' is 0
    MSI (s) (F0:C4) [09:52:53:855]: APPCOMPAT: looking for appcompat database entry with ProductCode '{AAE221D5-C3DD-4FE2-A063-C1368FE730A5}'.
    MSI (s) (F0:C4) [09:52:53:855]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (F0:C4) [09:52:53:855]: Transforms are not secure.
    MSI (s) (F0:C4) [09:52:53:855]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\Users\ADMINI~1.WKS\AppData\Local\Temp\SEP_INST.LOG'.
    MSI (s) (F0:C4) [09:52:53:855]: Command Line: REBOOT=ReallySuppress IDCENABLE=0 SETUPEXEDIR=\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit CURRENTDIRECTORY=\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit CLIENTUILEVEL=3 CLIENTPROCESSID=3564
    MSI (s) (F0:C4) [09:52:53:855]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{1CBED30E-7DD9-44A4-B799-AB104B6D21F6}'.
    MSI (s) (F0:C4) [09:52:53:855]: Product Code passed to Engine.Initialize:           ''
    MSI (s) (F0:C4) [09:52:53:855]: Product Code from property table before transforms: '{AAE221D5-C3DD-4FE2-A063-C1368FE730A5}'
    MSI (s) (F0:C4) [09:52:53:855]: Product Code from property table after transforms:  '{AAE221D5-C3DD-4FE2-A063-C1368FE730A5}'
    MSI (s) (F0:C4) [09:52:53:855]: Product not registered: beginning first-time install
    MSI (s) (F0:C4) [09:52:53:855]: Product {AAE221D5-C3DD-4FE2-A063-C1368FE730A5} is not managed.
    MSI (s) (F0:C4) [09:52:53:855]: MSI_LUA: Credential prompt not required, user is an admin
    MSI (s) (F0:C4) [09:52:53:855]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
    MSI (s) (F0:C4) [09:52:53:855]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (s) (F0:C4) [09:52:53:870]: User policy value 'SearchOrder' is 'nmu'
    MSI (s) (F0:C4) [09:52:53:870]: Adding new sources is allowed.
    MSI (s) (F0:C4) [09:52:53:870]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
    MSI (s) (F0:C4) [09:52:53:870]: Package name extracted from package path: 'Symantec AntiVirus.msi'
    MSI (s) (F0:C4) [09:52:53:870]: Package to be registered: 'Symantec AntiVirus.msi'
    MSI (s) (F0:C4) [09:52:53:870]: PROPERTY CHANGE: Adding IsAdminPackage property. Its value is '1'.
    MSI (s) (F0:C4) [09:52:53:870]: Machine policy value 'DisableMsi' is 0
    MSI (s) (F0:C4) [09:52:53:870]: Machine policy value 'AlwaysInstallElevated' is 0
    MSI (s) (F0:C4) [09:52:53:870]: User policy value 'AlwaysInstallElevated' is 0
    MSI (s) (F0:C4) [09:52:53:870]: Product installation will be elevated because user is admin and product is being installed per-machine.
    MSI (s) (F0:C4) [09:52:53:870]: Running product '{AAE221D5-C3DD-4FE2-A063-C1368FE730A5}' with elevated privileges: Product is assigned.
    MSI (s) (F0:C4) [09:52:53:870]: PROPERTY CHANGE: Adding REBOOT property. Its value is 'ReallySuppress'.
    MSI (s) (F0:C4) [09:52:53:870]: PROPERTY CHANGE: Modifying IDCENABLE property. Its current value is '1'. Its new value: '0'.
    MSI (s) (F0:C4) [09:52:53:870]: PROPERTY CHANGE: Adding SETUPEXEDIR property. Its value is '\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit'.
    MSI (s) (F0:C4) [09:52:53:870]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is '\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit'.
    MSI (s) (F0:C4) [09:52:53:870]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'.
    MSI (s) (F0:C4) [09:52:53:870]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '3564'.
    MSI (s) (F0:C4) [09:52:53:870]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0
    MSI (s) (F0:C4) [09:52:53:870]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality.
    MSI (s) (F0:C4) [09:52:53:870]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
    MSI (s) (F0:C4) [09:52:53:870]: TRANSFORMS property is now:
    MSI (s) (F0:C4) [09:52:53:870]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '301'.
    MSI (s) (F0:C4) [09:52:53:870]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\AppData\Roaming
    MSI (s) (F0:C4) [09:52:53:886]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\Favorites
    MSI (s) (F0:C4) [09:52:53:886]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    MSI (s) (F0:C4) [09:52:53:886]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\Documents
    MSI (s) (F0:C4) [09:52:53:886]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    MSI (s) (F0:C4) [09:52:53:886]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\AppData\Roaming\Microsoft\Windows\Recent
    MSI (s) (F0:C4) [09:52:53:886]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\AppData\Roaming\Microsoft\Windows\SendTo
    MSI (s) (F0:C4) [09:52:53:886]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\AppData\Roaming\Microsoft\Windows\Templates
    MSI (s) (F0:C4) [09:52:53:886]: SHELL32::SHGetFolderPath returned: C:\ProgramData
    MSI (s) (F0:C4) [09:52:53:886]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\AppData\Local
    MSI (s) (F0:C4) [09:52:53:902]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\Pictures
    MSI (s) (F0:C4) [09:52:53:902]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (s) (F0:C4) [09:52:53:902]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (s) (F0:C4) [09:52:53:902]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    MSI (s) (F0:C4) [09:52:53:902]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
    MSI (s) (F0:C4) [09:52:53:902]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
    MSI (s) (F0:C4) [09:52:53:902]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (s) (F0:C4) [09:52:53:917]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (s) (F0:C4) [09:52:53:917]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    MSI (s) (F0:C4) [09:52:53:917]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\AppData\Roaming\Microsoft\Windows\Start Menu
    MSI (s) (F0:C4) [09:52:53:917]: SHELL32::SHGetFolderPath returned: C:\Users\Administrator.wkstn-becksw\Desktop
    MSI (s) (F0:C4) [09:52:53:917]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
    MSI (s) (F0:C4) [09:52:53:917]: SHELL32::SHGetFolderPath returned: C:\Windows\Fonts
    MSI (s) (F0:C4) [09:52:53:917]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
    MSI (s) (F0:C4) [09:52:53:933]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
    MSI (s) (F0:C4) [09:52:53:933]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
    MSI (s) (F0:C4) [09:52:53:933]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
    MSI (s) (F0:C4) [09:52:53:933]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (s) (F0:C4) [09:52:53:933]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'user'.
    MSI (s) (F0:C4) [09:52:53:933]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (s) (F0:C4) [09:52:53:933]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'Microsoft'.
    MSI (s) (F0:C4) [09:52:53:933]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\Windows\Installer\3e70cc0.msi'.
    MSI (s) (F0:C4) [09:52:53:933]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is '\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\Symantec AntiVirus.msi'.
    MSI (s) (F0:C4) [09:52:53:933]: Machine policy value 'MsiDisableEmbeddedUI' is 0
    MSI (s) (F0:C4) [09:52:53:933]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install
    MSI (s) (F0:C4) [09:52:53:933]: Note: 1: 2205 2:  3: PatchPackage
    MSI (s) (F0:C4) [09:52:53:933]: Machine policy value 'DisableRollback' is 0
    MSI (s) (F0:C4) [09:52:53:933]: User policy value 'DisableRollback' is 0
    MSI (s) (F0:C4) [09:52:53:933]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
    === Logging started: 15/12/2011  09:52:53 ===
    MSI (s) (F0:C4) [09:52:53:933]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
    MSI (s) (F0:C4) [09:52:53:933]: Doing action: INSTALL
    Action start 09:52:53: INSTALL.
    MSI (s) (F0:C4) [09:52:53:933]: Running ExecuteSequence
    MSI (s) (F0:C4) [09:52:53:933]: Doing action: CommonAppDataFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2
    MSI (s) (F0:C4) [09:52:53:933]: PROPERTY CHANGE: Adding CommonAppDataFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 property. Its value is 'C:\ProgramData\'.
    Action start 09:52:53: CommonAppDataFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2.
    MSI (s) (F0:C4) [09:52:53:933]: Doing action: System16Folder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2
    Action ended 09:52:53: CommonAppDataFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2. Return value 1.
    MSI (s) (F0:C4) [09:52:53:933]: PROPERTY CHANGE: Adding System16Folder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 property. Its value is 'C:\Windows\system\'.
    Action start 09:52:53: System16Folder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2.
    MSI (s) (F0:C4) [09:52:53:933]: Doing action: SystemFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2
    Action ended 09:52:53: System16Folder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2. Return value 1.
    MSI (s) (F0:C4) [09:52:53:933]: PROPERTY CHANGE: Adding SystemFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 property. Its value is 'C:\Windows\system32\'.
    Action start 09:52:53: SystemFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2.
    MSI (s) (F0:C4) [09:52:53:933]: Doing action: ProgramFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2
    Action ended 09:52:53: SystemFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2. Return value 1.
    MSI (s) (F0:C4) [09:52:53:933]: PROPERTY CHANGE: Adding ProgramFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 property. Its value is 'C:\Program Files\'.
    Action start 09:52:53: ProgramFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2.
    MSI (s) (F0:C4) [09:52:53:933]: Doing action: CommonFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2
    Action ended 09:52:53: ProgramFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2. Return value 1.
    MSI (s) (F0:C4) [09:52:53:948]: PROPERTY CHANGE: Adding CommonFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 property. Its value is 'C:\Program Files\Common Files\'.
    Action start 09:52:53: CommonFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2.
    MSI (s) (F0:C4) [09:52:53:948]: Doing action: CommonFilesFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1
    Action ended 09:52:53: CommonFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2. Return value 1.
    MSI (s) (F0:C4) [09:52:53:948]: PROPERTY CHANGE: Adding CommonFilesFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1 property. Its value is 'C:\Program Files\Common Files\'.
    Action start 09:52:53: CommonFilesFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1.
    MSI (s) (F0:C4) [09:52:53:948]: Doing action: ProgramFilesFolder.93C43188_D2F5_461E_B42B_C3A2A318345C
    Action ended 09:52:53: CommonFilesFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1. Return value 1.
    MSI (s) (F0:C4) [09:52:53:948]: PROPERTY CHANGE: Adding ProgramFilesFolder.93C43188_D2F5_461E_B42B_C3A2A318345C property. Its value is 'C:\Program Files\'.
    Action start 09:52:53: ProgramFilesFolder.93C43188_D2F5_461E_B42B_C3A2A318345C.
    MSI (s) (F0:C4) [09:52:53:948]: Doing action: CommonFilesFolder.AE34FE77_F4D6_42C5_A0D4_A58BE72B0219
    Action ended 09:52:53: ProgramFilesFolder.93C43188_D2F5_461E_B42B_C3A2A318345C. Return value 1.
    MSI (s) (F0:C4) [09:52:53:948]: PROPERTY CHANGE: Adding CommonFilesFolder.AE34FE77_F4D6_42C5_A0D4_A58BE72B0219 property. Its value is 'C:\Program Files\Common Files\'.
    Action start 09:52:53: CommonFilesFolder.AE34FE77_F4D6_42C5_A0D4_A58BE72B0219.
    MSI (s) (F0:C4) [09:52:53:948]: Doing action: CommonFilesFolder.611D9A69_39FC_4998_998E_1ECADF28A979
    Action ended 09:52:53: CommonFilesFolder.AE34FE77_F4D6_42C5_A0D4_A58BE72B0219. Return value 1.
    MSI (s) (F0:C4) [09:52:53:948]: PROPERTY CHANGE: Adding CommonFilesFolder.611D9A69_39FC_4998_998E_1ECADF28A979 property. Its value is 'C:\Program Files\Common Files\'.
    Action start 09:52:53: CommonFilesFolder.611D9A69_39FC_4998_998E_1ECADF28A979.
    MSI (s) (F0:C4) [09:52:53:948]: Doing action: WindowsFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: CommonFilesFolder.611D9A69_39FC_4998_998E_1ECADF28A979. Return value 1.
    MSI (s) (F0:C4) [09:52:53:948]: PROPERTY CHANGE: Adding WindowsFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\'.
    Action start 09:52:53: WindowsFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:948]: Doing action: SystemFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: WindowsFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:948]: PROPERTY CHANGE: Adding SystemFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\system32\'.
    Action start 09:52:53: SystemFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:948]: Doing action: WindowsFolder.74FD3CE6_2A8D_0E9C_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: SystemFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:948]: PROPERTY CHANGE: Adding WindowsFolder.74FD3CE6_2A8D_0E9C_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\'.
    Action start 09:52:53: WindowsFolder.74FD3CE6_2A8D_0E9C_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:948]: Doing action: SystemFolder.74FD3CE6_2A8D_0E9C_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: WindowsFolder.74FD3CE6_2A8D_0E9C_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:948]: PROPERTY CHANGE: Adding SystemFolder.74FD3CE6_2A8D_0E9C_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\system32\'.
    Action start 09:52:53: SystemFolder.74FD3CE6_2A8D_0E9C_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:948]: Doing action: WindowsFolder.68B7C6D9_1DF2_54C1_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: SystemFolder.74FD3CE6_2A8D_0E9C_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:948]: PROPERTY CHANGE: Adding WindowsFolder.68B7C6D9_1DF2_54C1_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\'.
    Action start 09:52:53: WindowsFolder.68B7C6D9_1DF2_54C1_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:964]: Doing action: SystemFolder.68B7C6D9_1DF2_54C1_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: WindowsFolder.68B7C6D9_1DF2_54C1_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:964]: PROPERTY CHANGE: Adding SystemFolder.68B7C6D9_1DF2_54C1_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\system32\'.
    Action start 09:52:53: SystemFolder.68B7C6D9_1DF2_54C1_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:964]: Doing action: WindowsFolder.9BAE13A2_E7AF_D6C3_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: SystemFolder.68B7C6D9_1DF2_54C1_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:964]: PROPERTY CHANGE: Adding WindowsFolder.9BAE13A2_E7AF_D6C3_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\'.
    Action start 09:52:53: WindowsFolder.9BAE13A2_E7AF_D6C3_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:964]: Doing action: SystemFolder.9BAE13A2_E7AF_D6C3_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: WindowsFolder.9BAE13A2_E7AF_D6C3_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:964]: PROPERTY CHANGE: Adding SystemFolder.9BAE13A2_E7AF_D6C3_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\system32\'.
    Action start 09:52:53: SystemFolder.9BAE13A2_E7AF_D6C3_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:964]: Doing action: WindowsFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: SystemFolder.9BAE13A2_E7AF_D6C3_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:964]: PROPERTY CHANGE: Adding WindowsFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\'.
    Action start 09:52:53: WindowsFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:964]: Doing action: SystemFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: WindowsFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:964]: PROPERTY CHANGE: Adding SystemFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\system32\'.
    Action start 09:52:53: SystemFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:964]: Doing action: WindowsFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: SystemFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:964]: PROPERTY CHANGE: Adding WindowsFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\'.
    Action start 09:52:53: WindowsFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:964]: Doing action: SystemFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: WindowsFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:964]: PROPERTY CHANGE: Adding SystemFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\system32\'.
    Action start 09:52:53: SystemFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:964]: Doing action: CommonFilesFolder.58B3CBD8_773E_456F_B761_5F9C67C2E7B1
    Action ended 09:52:53: SystemFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:964]: PROPERTY CHANGE: Adding CommonFilesFolder.58B3CBD8_773E_456F_B761_5F9C67C2E7B1 property. Its value is 'C:\Program Files\Common Files\'.
    Action start 09:52:53: CommonFilesFolder.58B3CBD8_773E_456F_B761_5F9C67C2E7B1.
    MSI (s) (F0:C4) [09:52:53:964]: Doing action: CommonFilesFolder.BF6FF7BD_CEB9_4E46_A42A_F2D66B1408DE
    Action ended 09:52:53: CommonFilesFolder.58B3CBD8_773E_456F_B761_5F9C67C2E7B1. Return value 1.
    MSI (s) (F0:C4) [09:52:53:964]: PROPERTY CHANGE: Adding CommonFilesFolder.BF6FF7BD_CEB9_4E46_A42A_F2D66B1408DE property. Its value is 'C:\Program Files\Common Files\'.
    Action start 09:52:53: CommonFilesFolder.BF6FF7BD_CEB9_4E46_A42A_F2D66B1408DE.
    MSI (s) (F0:C4) [09:52:53:964]: Doing action: CommonFilesFolder.36948328_55DA_46B6_83BE_D004EF7F2582
    Action ended 09:52:53: CommonFilesFolder.BF6FF7BD_CEB9_4E46_A42A_F2D66B1408DE. Return value 1.
    MSI (s) (F0:C4) [09:52:53:979]: PROPERTY CHANGE: Adding CommonFilesFolder.36948328_55DA_46B6_83BE_D004EF7F2582 property. Its value is 'C:\Program Files\Common Files\'.
    Action start 09:52:53: CommonFilesFolder.36948328_55DA_46B6_83BE_D004EF7F2582.
    MSI (s) (F0:C4) [09:52:53:979]: Doing action: CommonFilesFolder.538DD692_7153_4092_B920_08C862D08386
    Action ended 09:52:53: CommonFilesFolder.36948328_55DA_46B6_83BE_D004EF7F2582. Return value 1.
    MSI (s) (F0:C4) [09:52:53:979]: PROPERTY CHANGE: Adding CommonFilesFolder.538DD692_7153_4092_B920_08C862D08386 property. Its value is 'C:\Program Files\Common Files\'.
    Action start 09:52:53: CommonFilesFolder.538DD692_7153_4092_B920_08C862D08386.
    MSI (s) (F0:C4) [09:52:53:979]: Doing action: CommonAppDataFolder.538DD692_7153_4092_B920_08C862D08386
    Action ended 09:52:53: CommonFilesFolder.538DD692_7153_4092_B920_08C862D08386. Return value 1.
    MSI (s) (F0:C4) [09:52:53:979]: PROPERTY CHANGE: Adding CommonAppDataFolder.538DD692_7153_4092_B920_08C862D08386 property. Its value is 'C:\ProgramData\'.
    Action start 09:52:53: CommonAppDataFolder.538DD692_7153_4092_B920_08C862D08386.
    MSI (s) (F0:C4) [09:52:53:979]: Doing action: WindowsFolder.66332652_9C28_58B1_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: CommonAppDataFolder.538DD692_7153_4092_B920_08C862D08386. Return value 1.
    MSI (s) (F0:C4) [09:52:53:979]: PROPERTY CHANGE: Adding WindowsFolder.66332652_9C28_58B1_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\'.
    Action start 09:52:53: WindowsFolder.66332652_9C28_58B1_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:979]: Doing action: SystemFolder.66332652_9C28_58B1_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: WindowsFolder.66332652_9C28_58B1_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:979]: PROPERTY CHANGE: Adding SystemFolder.66332652_9C28_58B1_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\system32\'.
    Action start 09:52:53: SystemFolder.66332652_9C28_58B1_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:979]: Doing action: WindowsFolder.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: SystemFolder.66332652_9C28_58B1_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:979]: PROPERTY CHANGE: Adding WindowsFolder.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\'.
    Action start 09:52:53: WindowsFolder.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:979]: Doing action: SystemFolder.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E
    Action ended 09:52:53: WindowsFolder.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:979]: PROPERTY CHANGE: Adding SystemFolder.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E property. Its value is 'C:\Windows\system32\'.
    Action start 09:52:53: SystemFolder.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E.
    MSI (s) (F0:C4) [09:52:53:979]: Doing action: ProgramFilesFolder.DD672C28_4216_4DEF_980E_970B569C3C55
    Action ended 09:52:53: SystemFolder.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E. Return value 1.
    MSI (s) (F0:C4) [09:52:53:979]: PROPERTY CHANGE: Adding ProgramFilesFolder.DD672C28_4216_4DEF_980E_970B569C3C55 property. Its value is 'C:\Program Files\'.
    Action start 09:52:53: ProgramFilesFolder.DD672C28_4216_4DEF_980E_970B569C3C55.
    MSI (s) (F0:C4) [09:52:53:979]: Doing action: CommonAppDataFolder.DD672C28_4216_4DEF_980E_970B569C3C55
    Action ended 09:52:53: ProgramFilesFolder.DD672C28_4216_4DEF_980E_970B569C3C55. Return value 1.
    MSI (s) (F0:C4) [09:52:53:979]: PROPERTY CHANGE: Adding CommonAppDataFolder.DD672C28_4216_4DEF_980E_970B569C3C55 property. Its value is 'C:\ProgramData\'.
    Action start 09:52:53: CommonAppDataFolder.DD672C28_4216_4DEF_980E_970B569C3C55.
    MSI (s) (F0:C4) [09:52:53:979]: Doing action: SystemFolder.DD672C28_4216_4DEF_980E_970B569C3C55
    Action ended 09:52:53: CommonAppDataFolder.DD672C28_4216_4DEF_980E_970B569C3C55. Return value 1.
    MSI (s) (F0:C4) [09:52:53:979]: PROPERTY CHANGE: Adding SystemFolder.DD672C28_4216_4DEF_980E_970B569C3C55 property. Its value is 'C:\Windows\system32\'.
    Action start 09:52:53: SystemFolder.DD672C28_4216_4DEF_980E_970B569C3C55.
    MSI (s) (F0:C4) [09:52:53:995]: Doing action: CommonFilesFolder.DD672C28_4216_4DEF_980E_970B569C3C55
    Action ended 09:52:53: SystemFolder.DD672C28_4216_4DEF_980E_970B569C3C55. Return value 1.
    MSI (s) (F0:C4) [09:52:53:995]: PROPERTY CHANGE: Adding CommonFilesFolder.DD672C28_4216_4DEF_980E_970B569C3C55 property. Its value is 'C:\Program Files\Common Files\'.
    Action start 09:52:53: CommonFilesFolder.DD672C28_4216_4DEF_980E_970B569C3C55.
    MSI (s) (F0:C4) [09:52:53:995]: Doing action: SystemFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01
    Action ended 09:52:53: CommonFilesFolder.DD672C28_4216_4DEF_980E_970B569C3C55. Return value 1.
    MSI (s) (F0:C4) [09:52:53:995]: PROPERTY CHANGE: Adding SystemFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01 property. Its value is 'C:\Windows\system32\'.
    Action start 09:52:53: SystemFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01.
    MSI (s) (F0:C4) [09:52:53:995]: Doing action: CommonFilesFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01
    Action ended 09:52:53: SystemFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01. Return value 1.
    MSI (s) (F0:C4) [09:52:53:995]: PROPERTY CHANGE: Adding CommonFilesFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01 property. Its value is 'C:\Program Files\Common Files\'.
    Action start 09:52:53: CommonFilesFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01.
    MSI (s) (F0:C4) [09:52:53:995]: Doing action: CommonAppDataFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01
    Action ended 09:52:53: CommonFilesFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01. Return value 1.
    MSI (s) (F0:C4) [09:52:53:995]: PROPERTY CHANGE: Adding CommonAppDataFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01 property. Its value is 'C:\ProgramData\'.
    Action start 09:52:53: CommonAppDataFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01.
    MSI (s) (F0:C4) [09:52:53:995]: Doing action: ProgramFilesFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01
    Action ended 09:52:53: CommonAppDataFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01. Return value 1.
    MSI (s) (F0:C4) [09:52:53:995]: PROPERTY CHANGE: Adding ProgramFilesFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01 property. Its value is 'C:\Program Files\'.
    Action start 09:52:53: ProgramFilesFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01.
    MSI (s) (F0:C4) [09:52:53:995]: Doing action: System16Folder.6500F9C2_37EA_4F25_A4DE_6211026D9C01
    Action ended 09:52:53: ProgramFilesFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01. Return value 1.
    MSI (s) (F0:C4) [09:52:53:995]: PROPERTY CHANGE: Adding System16Folder.6500F9C2_37EA_4F25_A4DE_6211026D9C01 property. Its value is 'C:\Windows\system\'.
    Action start 09:52:53: System16Folder.6500F9C2_37EA_4F25_A4DE_6211026D9C01.
    MSI (s) (F0:C4) [09:52:53:995]: Doing action: CommonFilesFolder.14DD7176_DF3C_4FFC_B723_66069FF29729
    Action ended 09:52:53: System16Folder.6500F9C2_37EA_4F25_A4DE_6211026D9C01. Return value 1.
    MSI (s) (F0:C4) [09:52:53:995]: PROPERTY CHANGE: Adding CommonFilesFolder.14DD7176_DF3C_4FFC_B723_66069FF29729 property. Its value is 'C:\Program Files\Common Files\'.
    Action start 09:52:53: CommonFilesFolder.14DD7176_DF3C_4FFC_B723_66069FF29729.
    MSI (s) (F0:C4) [09:52:53:995]: Doing action: LocateSourceDir.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5
    Action ended 09:52:53: CommonFilesFolder.14DD7176_DF3C_4FFC_B723_66069FF29729. Return value 1.
    MSI (s) (F0:90) [09:52:54:011]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI514E.tmp, Entrypoint: LocateSourceDir
    MSI (s) (F0:78) [09:52:54:011]: Generating random cookie.
    MSI (s) (F0:78) [09:52:54:011]: Created Custom Action Server with PID 2308 (0x904).
    MSI (s) (F0:9C) [09:52:54:057]: Running as a service.
    MSI (s) (F0:9C) [09:52:54:057]: Hello, I'm your 32bit Impersonated custom action server.
    Action start 09:52:53: LocateSourceDir.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5.
    AgentMainCA: SourceDir=
    MSI (s) (F0!C0) [09:52:54:057]: PROPERTY CHANGE: Adding SourceDir property. Its value is '\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\'.
    AgentMainCA: OriginalDatabase=\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\Symantec AntiVirus.msi
    MSI (s) (F0:C4) [09:52:54:073]: Doing action: SetInstallStateFailed.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5
    Action ended 09:52:54: LocateSourceDir.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5. Return value 1.
    MSI (s) (F0:84) [09:52:54:073]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI519D.tmp, Entrypoint: SetInstallStateFailed
    Action start 09:52:54: SetInstallStateFailed.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5.
    MSI (s) (F0:C4) [09:52:54:104]: Doing action: CheckAndFixccSettings.D3A883B9_8F94_4E7D_96B6_852388CE5647
    Action ended 09:52:54: SetInstallStateFailed.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5. Return value 1.
    MSI (s) (F0:D4) [09:52:54:119]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI51BE.tmp, Entrypoint: _CheckAndFixccSettings@4
    Action start 09:52:54: CheckAndFixccSettings.D3A883B9_8F94_4E7D_96B6_852388CE5647.
    MSIASSERT - CheckAndFixccSettings: ccSetDLL is -1:
    MSIASSERT - CheckAndFixccSettings: ccSetMgrEXE is -1:
    MSI (s) (F0:C4) [09:52:54:151]: Doing action: AppSearch
    Action ended 09:52:54: CheckAndFixccSettings.D3A883B9_8F94_4E7D_96B6_852388CE5647. Return value 1.
    Action start 09:52:54: AppSearch.
    MSI (s) (F0:C4) [09:52:54:151]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2
    MSI (s) (F0:C4) [09:52:54:151]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2
    MSI (s) (F0:C4) [09:52:54:151]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2
    MSI (s) (F0:C4) [09:52:54:151]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Intel\LANDesk\Virusprotect6\CurrentVersion 3: 2
    MSI (s) (F0:C4) [09:52:54:151]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC 3: 2
    MSI (s) (F0:C4) [09:52:54:151]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Sygate Technologies, Inc.\Sygate Personal Firewall 3: 2
    MSI (s) (F0:C4) [09:52:54:151]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC 3: 2
    MSI (s) (F0:C4) [09:52:54:166]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC 3: 2
    MSI (s) (F0:C4) [09:52:54:166]: PROPERTY CHANGE: Adding SDIDATFOUND.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5 property. Its value is '\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\sdi.dat'.
    MSI (s) (F0:C4) [09:52:54:182]: PROPERTY CHANGE: Adding SERDEFDATFOUND.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5 property. Its value is '\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\serdef.dat'.
    MSI (s) (F0:C4) [09:52:54:182]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC 3: 2
    MSI (s) (F0:C4) [09:52:54:182]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Sygate Technologies, Inc.\Sygate Personal Firewall 3: 2
    MSI (s) (F0:C4) [09:52:54:197]: PROPERTY CHANGE: Adding SPMXMLFOUND.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5 property. Its value is '\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\SyLink.xml'.
    MSI (s) (F0:C4) [09:52:54:197]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Sygate Technologies, Inc.\Sygate Personal Firewall\SYLINK\SyLink 3: 2
    MSI (s) (F0:C4) [09:52:54:213]: PROPERTY CHANGE: Adding SYMRASMAN_REGPATH1 property. Its value is 'C:\Windows\System32\rastls.dll'.
    MSI (s) (F0:C4) [09:52:54:213]: PROPERTY CHANGE: Adding SYMRASMAN_REGPATH2 property. Its value is 'C:\Windows\System32\rastls.dll'.
    MSI (s) (F0:C4) [09:52:54:213]: PROPERTY CHANGE: Adding RASMAN_PATH property. Its value is 'C:\Windows\system32\rastls.dll'.
    MSI (s) (F0:C4) [09:52:54:213]: PROPERTY CHANGE: Adding SNACNP_HWPROVIDER_REGVALUE property. Its value is 'SnacNp,RDPNP,LanmanWorkstation,webclient,TdmNetworkProvider'.
    MSI (s) (F0:C4) [09:52:54:213]: PROPERTY CHANGE: Adding SNACNP_PROVIDER_REGVALUE property. Its value is 'SnacNp,RDPNP,LanmanWorkstation,webclient,TdmNetworkProvider'.
    MSI (s) (F0:C4) [09:52:54:213]: PROPERTY CHANGE: Adding SYMRASMAN_REGPATH3 property. Its value is 'C:\Windows\System32\rastls.dll'.
    MSI (s) (F0:C4) [09:52:54:213]: PROPERTY CHANGE: Adding SYMRASMAN_REGPATH4 property. Its value is 'C:\Windows\System32\rastls.dll'.
    MSI (s) (F0:C4) [09:52:54:213]: PROPERTY CHANGE: Adding SYMRASMAN_REGPATH5 property. Its value is 'C:\Windows\System32\rastls.dll'.
    MSI (s) (F0:C4) [09:52:54:213]: PROPERTY CHANGE: Adding SYMRASMAN_REGPATH6 property. Its value is 'C:\Windows\System32\rastls.dll'.
    MSI (s) (F0:C4) [09:52:54:213]: PROPERTY CHANGE: Adding SYMRASMAN_REGPATH7 property. Its value is 'C:\Windows\System32\rastls.dll'.
    MSI (s) (F0:C4) [09:52:54:213]: PROPERTY CHANGE: Adding SYMRASMAN_REGPATH8 property. Its value is 'C:\Windows\System32\rastls.dll'.
    MSI (s) (F0:C4) [09:52:54:213]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WZCSVC 3: 2
    MSI (s) (F0:C4) [09:52:54:213]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV 3: 2
    MSI (s) (F0:C4) [09:52:54:213]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\INTEL\LANDesk\VirusProtect6\CurrentVersion 3: 2
    MSI (s) (F0:C4) [09:52:54:228]: PROPERTY CHANGE: Adding DEFENDERFOUND.93C43188_D2F5_461E_B42B_C3A2A318345C property. Its value is 'Microsoft Windows Defender'.
    MSI (s) (F0:C4) [09:52:54:228]: PROPERTY CHANGE: Adding DEFENDERFOUND64.93C43188_D2F5_461E_B42B_C3A2A318345C property. Its value is 'Microsoft Windows Defender'.
    MSI (s) (F0:C4) [09:52:54:228]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\EXCHNG32.EXE 3: 2
    MSI (s) (F0:C4) [09:52:54:228]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Intel\LANDesk\Virusprotect6\CurrentVersion\Storages\MicrosoftExchangeClient 3: 2
    MSI (s) (F0:C4) [09:52:54:228]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Intel\LANDesk\Virusprotect6\CurrentVersion 3: 2
    MSI (s) (F0:C4) [09:52:54:228]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\notes.exe 3: 2
    MSI (s) (F0:C4) [09:52:54:228]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Intel\LANDesk\Virusprotect6\CurrentVersion\Storages\LotusNotes 3: 2
    MSI (s) (F0:C4) [09:52:54:228]: PROPERTY CHANGE: Adding OUTLOOKFOUND property. Its value is 'C:\Program Files\Microsoft Office\Office14\'.
    MSI (s) (F0:C4) [09:52:54:228]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Symantec\InstalledApps 3: 2
    MSI (s) (F0:C4) [09:52:54:228]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\TSE 3: 2
    MSI (s) (F0:C4) [09:52:54:228]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC 3: 2
    MSI (s) (F0:C4) [09:52:54:228]: PROPERTY CHANGE: Adding EXPLORERCHECK property. Its value is 'C:\Windows\explorer.exe'.
    MSI (s) (F0:C4) [09:52:54:244]: PROPERTY CHANGE: Adding IE6FOUND property. Its value is 'C:\Windows\system32\shdocvw.dll'.
    MSI (s) (F0:C4) [09:52:54:244]: PROPERTY CHANGE: Adding NAMECREATION83 property. Its value is '#0'.
    MSI (s) (F0:C4) [09:52:54:244]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7} 3: 2
    MSI (s) (F0:C4) [09:52:54:244]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Norton AntiVirus Corporate Edition 3: 2
    MSI (s) (F0:C4) [09:52:54:244]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2
    MSI (s) (F0:C4) [09:52:54:244]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2
    MSI (s) (F0:C4) [09:52:54:259]: PROPERTY CHANGE: Adding SETAIDFOUND property. Its value is '\\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\SetAid.ini'.
    MSI (s) (F0:C4) [09:52:54:275]: PROPERTY CHANGE: Adding SHDOCVW property. Its value is 'C:\Windows\system32\shdocvw.dll'.
    MSI (s) (F0:C4) [09:52:54:275]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV 3: 2
    MSI (s) (F0:C4) [09:52:54:275]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\WholeSecurity Inc.\Confidence Online(tm) Server 3: 2
    MSI (s) (F0:C4) [09:52:54:275]: Skipping action: checkInstallBlocksIE.87654321_4321_4321_4321_210987654321 (condition is false)
    MSI (s) (F0:C4) [09:52:54:275]: Doing action: ChkExistCCInstalledAppsCcWebWnd.58B3CBD8_773E_456F_B761_5F9C67C2E7B1
    Action ended 09:52:54: AppSearch. Return value 1.
    MSI (s) (F0:B4) [09:52:54:275]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI526A.tmp, Entrypoint: _CheckExistingCCInstalledAppsCcWebWnd@4
    Action start 09:52:54: ChkExistCCInstalledAppsCcWebWnd.58B3CBD8_773E_456F_B761_5F9C67C2E7B1.
    MSIRESULT !!FAILED!! - CheckExistingCCInstalledApps: Unable to open key. Return:2:
    MSI (s) (F0:C4) [09:52:54:291]: Doing action: CheckServicesInstalled.C609CF46_1171_49F3_A937_F9F402B507DF
    Action ended 09:52:54: ChkExistCCInstalledAppsCcWebWnd.58B3CBD8_773E_456F_B761_5F9C67C2E7B1. Return value 1.
    MSI (s) (F0:AC) [09:52:54:291]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI527B.tmp, Entrypoint: _CheckServicesInstalled@4
    Action start 09:52:54: CheckServicesInstalled.C609CF46_1171_49F3_A937_F9F402B507DF.
    MSI (s) (F0!08) [09:52:54:306]: PROPERTY CHANGE: Adding SERVICESALREADYINSTALLED property. Its value is '0'.
    MSI (s) (F0:C4) [09:52:54:306]: Doing action: GetExistingCCInstalledApps.538DD692_7153_4092_B920_08C862D08386
    Action ended 09:52:54: CheckServicesInstalled.C609CF46_1171_49F3_A937_F9F402B507DF. Return value 1.
    MSI (s) (F0:D0) [09:52:54:306]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI528B.tmp, Entrypoint: _GetExistingCCInstalledApps@4
    Action start 09:52:54: GetExistingCCInstalledApps.538DD692_7153_4092_B920_08C862D08386.
    MSIRESULT !!FAILED!! - CheckExistingCCInstalledApps: Unable to open key. Return:2:
    MSI (s) (F0:C4) [09:52:54:322]: Doing action: MSIValidateTrial
    Action ended 09:52:54: GetExistingCCInstalledApps.538DD692_7153_4092_B920_08C862D08386. Return value 1.
    MSI (s) (F0:B8) [09:52:54:322]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI529C.tmp, Entrypoint: MSIValidateTrial
    Action start 09:52:54: MSIValidateTrial.
    MSI (s) (F0:C4) [09:52:54:353]: Skipping action: iNoClientTypeDefined.6500F9C2_37EA_4F25_A4DE_6211026D9C01 (condition is false)
    MSI (s) (F0:C4) [09:52:54:353]: Skipping action: preLaunchCond.87654321_4321_4321_4321_210987654321 (condition is false)
    MSI (s) (F0:C4) [09:52:54:353]: Doing action: IsRebootRequiredOSAutoUpdate.B754A361_3344_430B_92FF_8F9A227A6B90
    Action ended 09:52:54: MSIValidateTrial. Return value 1.
    MSI (s) (F0:A8) [09:52:54:353]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI52BC.tmp, Entrypoint: IsRebootRequiredOSAutoUpdate
    MSI (s) (F0!34) [09:52:54:368]: PROPERTY CHANGE: Adding REBOOTREQUIREDOSAUTOUPDATE property. Its value is '1'.
    Action start 09:52:54: IsRebootRequiredOSAutoUpdate.B754A361_3344_430B_92FF_8F9A227A6B90.
    MSI (s) (F0:C4) [09:52:54:368]: Skipping action: iNoClientTypeDefined.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 (condition is false)
    MSI (s) (F0:C4) [09:52:54:368]: Doing action: LaunchConditions
    Action ended 09:52:54: IsRebootRequiredOSAutoUpdate.B754A361_3344_430B_92FF_8F9A227A6B90. Return value 1.
    Action start 09:52:54: LaunchConditions.
    MSI (s) (F0:C4) [09:52:54:368]: Product: Symantec Endpoint Protection -- Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.

    Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
    Action ended 09:52:54: LaunchConditions. Return value 3.
    Action ended 09:52:54: INSTALL. Return value 3.
    Property(S): DiskPrompt = [1]
    Property(S): UpgradeCode = {24BF7A02-B60A-494B-843A-793BBC77DED4}
    Property(S): VersionNT = 601
    Property(S): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\
    Property(S): AppDataFolder = C:\Users\Administrator.wkstn-becksw\AppData\Roaming\
    Property(S): CommonAppDataFolder = C:\ProgramData\
    Property(S): CommonFilesFolder = C:\Program Files\Common Files\
    Property(S): SystemFolder = C:\Windows\system32\
    Property(S): DesktopFolder = C:\Users\Public\Desktop\
    Property(S): FavoritesFolder = C:\Users\Administrator.wkstn-becksw\Favorites\
    Property(S): FontsFolder = C:\Windows\Fonts\
    Property(S): LocalAppDataFolder = C:\Users\Administrator.wkstn-becksw\AppData\Local\
    Property(S): MyPicturesFolder = C:\Users\Administrator.wkstn-becksw\Pictures\
    Property(S): PersonalFolder = C:\Users\Administrator.wkstn-becksw\Documents\
    Property(S): ProgramFilesFolder = C:\Program Files\
    Property(S): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
    Property(S): TempFolder = C:\Users\ADMINI~1.WKS\AppData\Local\Temp\
    Property(S): SendToFolder = C:\Users\Administrator.wkstn-becksw\AppData\Roaming\Microsoft\Windows\SendTo\
    Property(S): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\
    Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
    Property(S): System16Folder = C:\Windows\system\
    Property(S): SourceDir = \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\
    Property(S): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\
    Property(S): WindowsFolder = C:\Windows\
    Property(S): IS_COMPLUS_PROGRESSTEXT_COST = Costing COM+ application: [1]
    Property(S): IS_COMPLUS_PROGRESSTEXT_INSTALL = Installing COM+ application: [1]
    Property(S): IS_COMPLUS_PROGRESSTEXT_UNINSTALL = Uninstalling COM+ application: [1]
    Property(S): CommonFilesFolder.14DD7176_DF3C_4FFC_B723_66069FF29729 = C:\Program Files\Common Files\
    Property(S): SystemFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01 = C:\Windows\system32\
    Property(S): CommonFilesFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01 = C:\Program Files\Common Files\
    Property(S): CommonAppDataFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01 = C:\ProgramData\
    Property(S): ProgramFilesFolder.6500F9C2_37EA_4F25_A4DE_6211026D9C01 = C:\Program Files\
    Property(S): System16Folder.6500F9C2_37EA_4F25_A4DE_6211026D9C01 = C:\Windows\system\
    Property(S): APPS_TEST = 1
    Property(S): SYMNETBUILDNUM.6500F9C2_37EA_4F25_A4DE_6211026D9C01 = 7.2.5.9
    Property(S): ProgramFilesFolder.DD672C28_4216_4DEF_980E_970B569C3C55 = C:\Program Files\
    Property(S): CommonAppDataFolder.DD672C28_4216_4DEF_980E_970B569C3C55 = C:\ProgramData\
    Property(S): SystemFolder.DD672C28_4216_4DEF_980E_970B569C3C55 = C:\Windows\system32\
    Property(S): CommonFilesFolder.DD672C28_4216_4DEF_980E_970B569C3C55 = C:\Program Files\Common Files\
    Property(S): Date = 15/12/2011
    Property(S): WindowsFolder.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E = C:\Windows\
    Property(S): SystemFolder.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E = C:\Windows\system32\
    Property(S): ALLUSERS = 1
    Property(S): WindowsFolder.66332652_9C28_58B1_FF1F_C8B3B9A1E18E = C:\Windows\
    Property(S): SystemFolder.66332652_9C28_58B1_FF1F_C8B3B9A1E18E = C:\Windows\system32\
    Property(S): SDIDATFOUND.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5 = \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\sdi.dat
    Property(S): SERDEFDATFOUND.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5 = \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\serdef.dat
    Property(S): SPMXMLFOUND.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5 = \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\SyLink.xml
    Property(S): CACHEINSTALL = 1
    Property(S): CMC_PRODUCT_BUILD = #0
    Property(S): CMC_PRODUCT_VERSION = 0.0
    Property(S): DELAYED_REBOOT_NEEDED = 0
    Property(S): HaveUninstallPassword = 1
    Property(S): MIGRATESETTINGS = 1
    Property(S): REBOOT = ReallySuppress
    Property(S): ProductVersion = 11.0.6300.803
    Property(S): ProductCode = {AAE221D5-C3DD-4FE2-A063-C1368FE730A5}
    Property(S): CommonFilesFolder.538DD692_7153_4092_B920_08C862D08386 = C:\Program Files\Common Files\
    Property(S): CommonAppDataFolder.538DD692_7153_4092_B920_08C862D08386 = C:\ProgramData\
    Property(S): CCVER = 106.5.3.6
    Property(S): CCAPPINSTALLING.18376EA1_A7B1_41ED_A75C_CD6FAB0434AA = 1
    Property(S): CommonFilesFolder.36948328_55DA_46B6_83BE_D004EF7F2582 = C:\Program Files\Common Files\
    Property(S): CommonFilesFolder.BF6FF7BD_CEB9_4E46_A42A_F2D66B1408DE = C:\Program Files\Common Files\
    Property(S): CommonFilesFolder.58B3CBD8_773E_456F_B761_5F9C67C2E7B1 = C:\Program Files\Common Files\
    Property(S): WindowsFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E = C:\Windows\
    Property(S): SystemFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E = C:\Windows\system32\
    Property(S): WindowsFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E = C:\Windows\
    Property(S): SystemFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E = C:\Windows\system32\
    Property(S): LUCONFIGURED = 1
    Property(S): WindowsFolder.9BAE13A2_E7AF_D6C3_FF1F_C8B3B9A1E18E = C:\Windows\
    Property(S): SystemFolder.9BAE13A2_E7AF_D6C3_FF1F_C8B3B9A1E18E = C:\Windows\system32\
    Property(S): WindowsFolder.68B7C6D9_1DF2_54C1_FF1F_C8B3B9A1E18E = C:\Windows\
    Property(S): SystemFolder.68B7C6D9_1DF2_54C1_FF1F_C8B3B9A1E18E = C:\Windows\system32\
    Property(S): WindowsFolder.74FD3CE6_2A8D_0E9C_FF1F_C8B3B9A1E18E = C:\Windows\
    Property(S): SystemFolder.74FD3CE6_2A8D_0E9C_FF1F_C8B3B9A1E18E = C:\Windows\system32\
    Property(S): WindowsFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E = C:\Windows\
    Property(S): SystemFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E = C:\Windows\system32\
    Property(S): SYMRASMAN_REGPATH1 = C:\Windows\System32\rastls.dll
    Property(S): SYMRASMAN_REGPATH2 = C:\Windows\System32\rastls.dll
    Property(S): RASMAN_PATH = C:\Windows\system32\rastls.dll
    Property(S): SNACNP_HWPROVIDER_REGVALUE = SnacNp,RDPNP,LanmanWorkstation,webclient,TdmNetworkProvider
    Property(S): SNACNP_PROVIDER_REGVALUE = SnacNp,RDPNP,LanmanWorkstation,webclient,TdmNetworkProvider
    Property(S): SYMRASMAN_REGPATH3 = C:\Windows\System32\rastls.dll
    Property(S): SYMRASMAN_REGPATH4 = C:\Windows\System32\rastls.dll
    Property(S): SYMRASMAN_REGPATH5 = C:\Windows\System32\rastls.dll
    Property(S): SYMRASMAN_REGPATH6 = C:\Windows\System32\rastls.dll
    Property(S): SYMRASMAN_REGPATH7 = C:\Windows\System32\rastls.dll
    Property(S): SYMRASMAN_REGPATH8 = C:\Windows\System32\rastls.dll
    Property(S): WindowsVolume = C:\
    Property(S): CommonFilesFolder.611D9A69_39FC_4998_998E_1ECADF28A979 = C:\Program Files\Common Files\
    Property(S): MinimumVersion = 1.2.7
    Property(S): IDCENABLE = 0
    Property(S): IDCDATASERVER = exftpp.symantec.com
    Property(S): IDCDATALOC = /incoming
    Property(S): IDCDEPLOYMENT = Local
    Property(S): IDCEXTRAINFO = 0
    Property(S): HIGHCONTRAST = 0
    Property(S): SYMFORCEFAIL = 0
    Property(S): HITYPE.CE633825_BB8F_4C40_8B94_769CF5D8253E = 0
    Property(S): LOCATIONSENSOR.CE633825_BB8F_4C40_8B94_769CF5D8253E = 0
    Property(S): REVERSEDNS.CE633825_BB8F_4C40_8B94_769CF5D8253E = 0
    Property(S): CommonFilesFolder.AE34FE77_F4D6_42C5_A0D4_A58BE72B0219 = C:\Program Files\Common Files\
    Property(S): ProgramFilesFolder.93C43188_D2F5_461E_B42B_C3A2A318345C = C:\Program Files\
    Property(S): DEFENDERFOUND.93C43188_D2F5_461E_B42B_C3A2A318345C = Microsoft Windows Defender
    Property(S): DEFENDERFOUND64.93C43188_D2F5_461E_B42B_C3A2A318345C = Microsoft Windows Defender
    Property(S): OUTLOOKFOUND = C:\Program Files\Microsoft Office\Office14\
    Property(S): EMAILTOOLSADDED = 0
    Property(S): EMAILTOOLSREMOVED = 0
    Property(S): BB_NO_LU = 1
    Property(S): CC_NO_LU = 1
    Property(S): DONT_REGISTER_WITH_LIVEUPDATE = 1
    Property(S): EARLY_PROTECTION = 0
    Property(S): FILE_PROTECTION = 0
    Property(S): MSI_SECURITY_STATE = 2
    Property(S): PROCESS_PROTECTION = 1
    Property(S): PROTECT_CC_VER_TRUST = 1
    Property(S): REG_PROTECTION = 0
    Property(S): SAV_INSTALL = 1
    Property(S): SYKNAPPS_PRODUCT_ID = SAV
    Property(S): SYMPROTECTDISABLED = 0
    Property(S): WSCAVALERT = 1
    Property(S): WSCAVUPTODATE = 30
    Property(S): WSCCONTROL = 0
    Property(S): CommonFilesFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1 = C:\Program Files\Common Files\
    Property(S): SP_ENABLE = 1
    Property(S): LUMONIKER.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1 = {A771BA64-95B4-4651-ADD0-7D24258AB4BD}
    Property(S): BB_DRIVER.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1 = -1
    Property(S): PROCESS_STARTUP_PRIORITY_MGR = 0
    Property(S): CommonAppDataFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 = C:\ProgramData\
    Property(S): System16Folder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 = C:\Windows\system\
    Property(S): SystemFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 = C:\Windows\system32\
    Property(S): ProgramFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 = C:\Program Files\
    Property(S): CommonFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 = C:\Program Files\Common Files\
    Property(S): SRTSPBUILDNUM.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 = 10.3.6.5
    Property(S): LANG = LANG1033
    Property(S): EXPLORERCHECK = C:\Windows\explorer.exe
    Property(S): IE6FOUND = C:\Windows\system32\shdocvw.dll
    Property(S): NAMECREATION83 = #0
    Property(S): SETAIDFOUND = \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\SetAid.ini
    Property(S): SHDOCVW = C:\Windows\system32\shdocvw.dll
    Property(S): DISABLEDEFENDER = 1
    Property(S): ENABLEAUTOPROTECT = 1
    Property(S): ISCHECKFORPRODUCTUPDATES = 0
    Property(S): RUNLIVEUPDATE = 1
    Property(S): Managed_Client_Type = Unmanaged
    Property(S): NewProperty1 = 0
    Property(S): UnmanTxt = 0
    Property(S): ManTxt = 0
    Property(S): _BrowseProperty = 0
    Property(S): WindowsDefenderText = 0
    Property(S): AgreeToLicense = No
    Property(S): _IsMaintenance = Change
    Property(S): RestartManagerOption = CloseRestart
    Property(S): IDCHeaderText = 0
    Property(S): SetupType = Typical
    Property(S): _IsSetupTypeMin = Typical
    Property(S): Display_IsBitmapDlg = 1
    Property(S): SAVRebootPromptText = You must restart your system for the configuration changes made to [2] to take effect. Click Yes to restart now or No if you plan to restart later.
    Property(S): INSTALLLEVEL = 100
    Property(S): ADDSTARTMENUICON = 1
    Property(S): APPTYPE = 105
    Property(S): ARPCONTACT = Technical Support
    Property(S): ARPHELPLINK = http://www.symantec.com/enterprise/support
    Property(S): ARPPRODUCTICON = ARPPRODUCTICON.exe
    Property(S): ARPURLINFOABOUT = http://www.symantec.com
    Property(S): ARPURLUPDATEINFO = http://www.symantec.com
    Property(S): COPYSYLINK = 1
    Property(S): DWUSLINK = CEBCB0D89E3BD7AFEEAC57E849EB978F098B978FDEEB30AFCE6C877FEECBE07FEEFB803FF9AC
    Property(S): DefaultUIFont = Tahoma8
    Property(S): DialogCaption = InstallShield for Windows Installer
    Property(S): DisplayNameCustom = Custom
    Property(S): DisplayNameMinimal = Minimal
    Property(S): DisplayNameTypical = Typical
    Property(S): ErrorDialog = SetupError
    Property(S): IDSCLIENTTYPE = Enterprise
    Property(S): IS_PROGMSG_XML_COSTING = Costing XML files...
    Property(S): IS_PROGMSG_XML_CREATE_FILE = Creating XML file %s...
    Property(S): IS_PROGMSG_XML_FILES = Performing XML file changes...
    Property(S): IS_PROGMSG_XML_REMOVE_FILE = Removing XML file %s...
    Property(S): IS_PROGMSG_XML_ROLLBACK_FILES = Rolling back XML file changes...
    Property(S): IS_PROGMSG_XML_UPDATE_FILE = Updating XML file %s...
    Property(S): InstallChoice = AR
    Property(S): LICENSEDOVERUNLICENSED = 0
    Property(S): MSIENFORCEUPGRADECOMPONENTRULES = 1
    Property(S): MSIFILTERREBOOTMODE_ALREADYSETPROPS = NAVCORP8X;NAVSERVER8X;SYMTDISYS_INSTALLED
    Property(S): MSIFILTERREBOOTMODE_FILENAMEEXCLUSIONS = msxml3.dll
    Property(S): MSIRESTARTMANAGERCONTROL = Disable
    Property(S): Manufacturer = Symantec Corporation
    Property(S): MsiHiddenProperties = SERVERGROUPPASS;CONSOLEPASSWORD;MSIServerPKIStandAlone.65CE4DDA_36B1_4B17_8E59_E63AE84B286A
    Property(S): MsiLogging = iwearmopvx
    Property(S): NonAdminManagedClientBlurb = 0
    Property(S): PROGMSG_IIS_CREATEAPPPOOL = Creating application pool %s
    Property(S): PROGMSG_IIS_CREATEAPPPOOLS = Creating application Pools...
    Property(S): PROGMSG_IIS_CREATEWEBSERVICEEXTENSION = Creating web service extension
    Property(S): PROGMSG_IIS_CREATEWEBSERVICEEXTENSIONS = Creating web service extensions...
    Property(S): PROGMSG_IIS_REMOVEAPPPOOL = Removing application pool
    Property(S): PROGMSG_IIS_REMOVEAPPPOOLS = Removing application pools...
    Property(S): PROGMSG_IIS_REMOVEWEBSERVICEEXTENSION = Removing web service extension
    Property(S): PROGMSG_IIS_REMOVEWEBSERVICEEXTENSIONS = Removing web service extensions...
    Property(S): PROGMSG_IIS_ROLLBACKAPPPOOLS = Rolling back application pools...
    Property(S): PROGMSG_IIS_ROLLBACKWEBSERVICEEXTENSIONS = Rolling back web service extensions...
    Property(S): ProductLanguage = 1033
    Property(S): ProductName = Symantec Endpoint Protection
    Property(S): ProductType = SAV
    Property(S): ProgressType0 = install
    Property(S): ProgressType1 = Installing
    Property(S): ProgressType2 = installed
    Property(S): ProgressType3 = installs
    Property(S): RebootYesNo = Yes
    Property(S): ReinstallModeText = omus
    Property(S): SAV10UNINSTALLFIXRUN = 0
    Property(S): SESSIONID = 0
    Property(S): SHOWLAUNCHPROGRAM = 0
    Property(S): SNDUNINSTALLREBOOTOVERRIDE = 1
    Property(S): SRTSPCLIENTTYPE = Enterprise
    Property(S): SYMNETCLIENTTYPE = Enterprise
    Property(S): SecureCustomProperties = SHDOCVW;NAVCORP8X;NAV2003FOUND;NAV2003FOUNDB;NAV2004FOUND;NAV2008FOUND;NSW2006FOUND;NORTON360FOUND;NAVSERVER8X;SAV9FOUND;MAJORVERSION;MINORVERSION;OSVER_PLATFORMID;NEWERFOUND;OLDERFOUND;SNACFOUND;NEWERSNACFOUND;SCSFOUND;RUNLIVEUPDATE;SCFFOUND;KEPLERPLUSFOUND;SSCOLDFOUND;COPYTARGETFOLDER;SERVERNAME;SAV10FOUND;VIRUSDEFFOLDER;SAV10UNINSTALLFIXRUN;DISABLEDEFENDER;SESSIONID;LEGACYSPAAGENT_NM;LEGACYSPAAGENT_M;LEGACYSPAPERSONAL_NM;LEGACYSPAPERSONAL_M;MSIFILTERREBOOTMODE_FILENAMEEXCLUSIONS;MSIFILTERREBOOTMODE_ALREADYSETPROPS;SCS3FOUND;SCS2FOUND;NIS2003FOUND;NIS2004FOUND;HAMLETPLUSFOUND;AMSFOUND;LEGACYSEA_M;LEGACYSEA_NM;CLIENTTYPEREG;LEGACYCOHFOUND;LEGACYNCOFOUND;PREHAMLETFOUND;WSCONFONLINE;IE6FOUND;INSTALLCACHETEMPDIR;MIGRATIONFOLDER;IPSDEFFOLDER;POLICYTEMPFOLDER;SNACNP_HWPROVIDER_REGVALUE;SNACNP_PROVIDER_REGVALUE;SYMRASMAN_REGPATH1;SYMRASMAN_REGPATH2;SYMRASMAN_REGPATH3;SYMRASMAN_REGPATH4;SYMRASMAN_REGPATH5;SYMRASMAN_REGPATH6;SYMRASMAN_REGPATH7;SYMRASMAN_REGPATH8;SYMRASMAN_REGPATH9;WZCSVC_INSTALLED;SYMTEMPDIRBASE;SETUPEXEDIR;LIVEUPDATE.FF07F38E_78C2_412E_B858_64488E808644;LUTEMPFOLDER.FF07F38E_78C2_412E_B858_64488E808644;CLEANUPTEMPDIRS.B754A361_3344_430B_92FF_8F9A227A6B90;CREATETEMPDIRS_RB.B754A361_3344_430B_92FF_8F9A227A6B90;LEGACYNCO2FOUND;SAVCLIENT8XFOUND;SAVCORP7XFOUND;LUCONFIGURED;LEGACYSEA_NM1;LEGACYSEA_NM2;LEGACYSPA_NM2;LEGACYCOHCLIENTFOUND;SCFFOUND_M;ORGINAL_REBOOT_PROP;REENABLEWINFIREWALL.AFD7E729_F6AF_4E0F_912C_CF8E6A1326EF;NSW2007_2008FOUND;INSTALLDIR;CLOCKWORKS_SAV_MR6_FOUND;CLOCKWORKS_SCS_MR6_FOUND;TRIALWAREFOUND;EXPLORERCHECK;DELAYED_REBOOT_NEEDED;HAMLETSTMFOUND;PREMR1SEPFOUND;PRECZFOUND;PREMR2SEPFOUND;PREMR3SEPFOUND;NORTON2009FOUND;NORTON360V2FOUND;DUALINSTALLFOUND
    Property(S): SyLinkAlwaysConnect = 0
    Property(S): UNLICENSEDOVERLICENSED = 0
    Property(S): VALIDFEATURESELECTIONS = 0
    Property(S): VALIDTRIAL = 0
    Property(S): ValidInstallDir = 1
    Property(S): ISReleaseFlags = RELEASE,NotLIC,ENGLISH
    Property(S): Privileged = 1
    Property(S): REBOOTREQUIREDOSAUTOUPDATE = 1
    Property(S): SERVICESALREADYINSTALLED = 0
    Property(S): ACTION = INSTALL
    Property(S): UILevel = 2
    Property(S): OriginalDatabase = \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit\Symantec AntiVirus.msi
    Property(S): DATABASE = C:\Windows\Installer\3e70cc0.msi
    Property(S): COMPANYNAME = Microsoft
    Property(S): USERNAME = user
    Property(S): MsiRunningElevated = 1
    Property(S): RedirectedDllSupport = 2
    Property(S): MsiWin32AssemblySupport = 6.1.7601.17514
    Property(S): MsiNetAssemblySupport = 4.0.30319.1
    Property(S): Time = 09:52:54
    Property(S): TTCSupport = 1
    Property(S): ColorBits = 32
    Property(S): TextInternalLeading = 3
    Property(S): TextHeight = 16
    Property(S): BorderSide = 1
    Property(S): BorderTop = 1
    Property(S): CaptionHeight = 22
    Property(S): ScreenY = 768
    Property(S): ScreenX = 1024
    Property(S): SystemLanguageID = 2057
    Property(S): ComputerName = WKSTN-BECKSW
    Property(S): UserLanguageID = 2057
    Property(S): UserSID = S-1-5-21-3360271683-497848670-407986485-500
    Property(S): LogonUser = Administrator
    Property(S): MsiTrueAdminUser = 1
    Property(S): AdminUser = 1
    Property(S): VirtualMemory = 5792
    Property(S): PhysicalMemory = 3510
    Property(S): Intel = 6
    Property(S): ShellAdvtSupport = 1
    Property(S): OLEAdvtSupport = 1
    Property(S): GPTSupport = 1
    Property(S): RecentFolder = C:\Users\Administrator.wkstn-becksw\AppData\Roaming\Microsoft\Windows\Recent\
    Property(S): PrintHoodFolder = C:\Users\Administrator.wkstn-becksw\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\
    Property(S): NetHoodFolder = C:\Users\Administrator.wkstn-becksw\AppData\Roaming\Microsoft\Windows\Network Shortcuts\
    Property(S): RemoteAdminTS = 1
    Property(S): MsiNTProductType = 1
    Property(S): ServicePackLevelMinor = 0
    Property(S): ServicePackLevel = 1
    Property(S): WindowsBuild = 7601
    Property(S): VersionMsi = 5.00
    Property(S): MsiSystemRebootPending = 1
    Property(S): VersionDatabase = 301
    Property(S): CLIENTPROCESSID = 3564
    Property(S): CLIENTUILEVEL = 3
    Property(S): CURRENTDIRECTORY = \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit
    Property(S): SETUPEXEDIR = \\stella\deployment$\SEP Full Client\11.0.6300.803_32-bit
    Property(S): IsAdminPackage = 1
    Property(S): PackagecodeChanging = 1
    Property(S): ProductState = -1
    Property(S): PackageCode = {1CBED30E-7DD9-44A4-B799-AB104B6D21F6}
    Property(S): MsiLogFileLocation = C:\Users\ADMINI~1.WKS\AppData\Local\Temp\SEP_INST.LOG
    MSI (s) (F0:C4) [09:52:54:477]: Note: 1: 1708
    MSI (s) (F0:C4) [09:52:54:477]: Product: Symantec Endpoint Protection -- Installation operation failed.

    MSI (s) (F0:C4) [09:52:54:477]: Windows Installer installed the product. Product Name: Symantec Endpoint Protection. Product Version: 11.0.6300.803. Product Language: 1033. Manufacturer: Symantec Corporation. Installation success or error status: 1603.

    MSI (s) (F0:C4) [09:52:54:493]: Deferring clean up of packages/files, if any exist
    MSI (s) (F0:C4) [09:52:54:493]: MainEngineThread is returning 1603
    MSI (s) (F0:90) [09:52:54:493]: No System Restore sequence number for this installation.
    === Logging stopped: 15/12/2011  09:52:54 ===
    MSI (s) (F0:90) [09:52:54:493]: User policy value 'DisableRollback' is 0
    MSI (s) (F0:90) [09:52:54:493]: Machine policy value 'DisableRollback' is 0
    MSI (s) (F0:90) [09:52:54:493]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (F0:90) [09:52:54:493]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
    MSI (s) (F0:90) [09:52:54:493]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
    MSI (s) (F0:90) [09:52:54:493]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2
    MSI (s) (F0:90) [09:52:54:493]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2
    MSI (s) (F0:90) [09:52:54:493]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (s) (F0:90) [09:52:54:493]: Restoring environment variables
    MSI (s) (F0:90) [09:52:54:493]: Destroying RemoteAPI object.
    MSI (s) (F0:78) [09:52:54:493]: Custom Action Manager thread ending.
    MSI (c) (EC:D4) [09:52:54:493]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (EC:D4) [09:52:54:493]: MainEngineThread is returning 1603
    === Verbose logging stopped: 15/12/2011  09:52:54 ===



  • 8.  RE: SEP 11 reinstall keeps rolling back

    Trusted Advisor
    Posted Dec 15, 2011 09:42 AM

    Hello,

    Upon Checking the Log, here is waht we see:

     

    MSI (s) (F0:A8) [09:52:54:353]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI52BC.tmp, Entrypoint: IsRebootRequiredOSAutoUpdate
    MSI (s) (F0!34) [09:52:54:368]: PROPERTY CHANGE: Adding REBOOTREQUIREDOSAUTOUPDATE property. Its value is '1'.
    Action start 09:52:54: IsRebootRequiredOSAutoUpdate.B754A361_3344_430B_92FF_8F9A227A6B90.
    MSI (s) (F0:C4) [09:52:54:368]: Skipping action: iNoClientTypeDefined.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 (condition is false)
    MSI (s) (F0:C4) [09:52:54:368]: Doing action: LaunchConditions
    Action ended 09:52:54: IsRebootRequiredOSAutoUpdate.B754A361_3344_430B_92FF_8F9A227A6B90. Return value 1.
    Action start 09:52:54: LaunchConditions.
    MSI (s) (F0:C4) [09:52:54:368]: Product: Symantec Endpoint Protection -- Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.

    Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
    Action ended 09:52:54: LaunchConditions. Return value 3.
    Action ended 09:52:54: INSTALL. Return value 3.

     

    Question and Suggestions:

    1) Did you ever have Norton Product on this Machine??

    2) Are you running the SEP Installation from a Shared Drive??

    If yes, please have the Package on the local machine HDD and then Run the setup.exe as Administrator (by right click on setup.exe)

    Also, check this Article: http://www.symantec.com/docs/TECH95608

     
    Hope that helps!!


  • 9.  RE: SEP 11 reinstall keeps rolling back

    Posted Dec 15, 2011 10:04 AM

    its never had Norton on it no, just that exact version of SEP, ill try moving it locally and see if it works, its on a network share yes! will let you know how i go on, FYI already done the session manager bit as I mentioned above, been aware of the pending filename change bug for a long time, and in this case, the entry only appears after the install fails, removing it and retrying does not work!



  • 10.  RE: SEP 11 reinstall keeps rolling back

    Posted Dec 15, 2011 10:18 AM

    did  you remove the reboot key in the registry as well?



  • 11.  RE: SEP 11 reinstall keeps rolling back

    Posted Dec 15, 2011 07:09 PM

    Hello ADprin,

    Have you tried rebooting?

    Regards,

    James