Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

SEP 11 "Service framework..."

Created: 24 Sep 2009 • Updated: 21 May 2010 | 9 comments

"...has encountered an error..." On install. 

So, I went on site yesterday to resolve an outlook attachment problem. User couldn't open, save, download, etc any attachments from email. After looking at the obvious, and some not so obvious settings, I couldn't find any issues. So, knowing that Symantec likes to take control of the PC, I pulled up the endpoint client, and saw things all over in Red.  I uninstalled the client, and lo and behold, Outlook returns to normal functioning. I then proceeded to reinstall the Endpoint client, and received the error that the "Symantec Service Framework has encountered an error and needs to shutdown" blah blah blah. (PLEASE NOTE: THIS SOFTWARE WAS INSTALLED ON THIS COMPUTER BEFORE AND FUNCTIONING). I performed the following actions, in no particular order, and some multiple times, to attempt to reinstall the software: Reboot, reinstall. Install from the SEP setup file directly. Install the LiveUpdate alone first. Used CleanWipe to remove all traces of Symantec. Used the SEP Support Tool (which complained that port 445 was not open, so I disabled the Firewall, and also that Simple File Sharing was on, so I disabled that, even tho this is an unmanaged solution).  Checked to make sure we had removed the Acer management junk (all that was left was the eAcoustic, which won't uninstall, also see BOLD note above).

None of these steps produced anything different than multiple popups of the Framework erroring followed by the Window that Symantec had not installed properly and had been interrupted, with one exception where the"been interrupted and not installed properly" window came up without the Framework showing it had failed first. So, anyone have any ideas why this Acer, out of the 7 of this model we have on site, won't let me reinstall the SEP 11?  Thanks in advance. 


Comments 9 CommentsJump to latest comment

John_Prince's picture

Greetings,

What version of SEP are you installing? 11.0.1xxx, 11.0.2xxx, etc.

If you check the application Eventviewer, do you see any errors around the time you installed? If so, what is the Event ID?

If you want to email me the install log I can take a look at it:
-Click Start > Run
-Type:%temp%
-Look for SEP_INST.LOG

Remote Product Specialist, Business Critical Services, Symantec

Rafeeq's picture

you need to post the install log fine
go to start
run
type %temp%
look for SEP_INST.log file
look for return value 3, post 30 lines above and below of that value here,
 

cpatterson's picture

 Well, the Sep_Inst log file is 9 1/2 Mb, so I appreciate the offer John, but I'll not dump all that on you unless you really insist :)  Here's the info requested by Rafeeq, hopefully it will help. 

Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll 
Module: ImagePath=C:\WINDOWS\system32\ole32.dll 
Module: ImagePath=C:\WINDOWS\System32\MSACM32.dll 
Module: ImagePath=C:\WINDOWS\system32\VERSION.dll 
Module: ImagePath=C:\WINDOWS\system32\msvcrt.dll 
Module: ImagePath=C:\WINDOWS\system32\ADVAPI32.dll 
Module: ImagePath=C:\WINDOWS\system32\RPCRT4.dll 
Module: ImagePath=C:\WINDOWS\system32\GDI32.dll 
Module: ImagePath=C:\WINDOWS\system32\SHLWAPI.dll 
Module: ImagePath=C:\WINDOWS\system32\Secur32.dll 
Module: ImagePath=C:\WINDOWS\system32\kernel32.dll 
Module: ImagePath=C:\WINDOWS\system32\ntdll.dll 
Module: ImagePath=C:\WINDOWS\system32\SHELL32.dll 
Module: ImagePath=C:\WINDOWS\system32\USER32.dll 
CollectProcessInfo:  Dumping info for Pid=4028 ImagePath=f:\sep\setup.exe
 Dumping module information for the process
Module: ImagePath=C:\WINDOWS\system32\UxTheme.dll 
Module: ImagePath=C:\WINDOWS\system32\ShimEng.dll 
Module: ImagePath=C:\WINDOWS\system32\LPK.DLL 
Module: ImagePath=C:\WINDOWS\AppPatch\AcGenral.DLL 
Module: ImagePath=C:\WINDOWS\system32\USP10.dll 
Module: ImagePath=C:\WINDOWS\system32\msctfime.ime 
Module: ImagePath=C:\WINDOWS\system32\IMM32.DLL 
Module: ImagePath=C:\WINDOWS\system32\USERENV.dll 
Module: ImagePath=C:\WINDOWS\system32\WINMM.dll 
Module: ImagePath=C:\WINDOWS\system32\OLEAUT32.dll 
Module: ImagePath=C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\COMCTL32.dll 
Module: ImagePath=C:\WINDOWS\system32\ole32.dll 
Module: ImagePath=C:\WINDOWS\system32\Apphelp.dll 
Module: ImagePath=C:\WINDOWS\system32\MSACM32.dll 
Module: ImagePath=C:\WINDOWS\system32\VERSION.dll 
Module: ImagePath=C:\WINDOWS\system32\msvcrt.dll 
Module: ImagePath=C:\WINDOWS\system32\ADVAPI32.dll 
Module: ImagePath=C:\WINDOWS\system32\RPCRT4.dll 
Module: ImagePath=C:\WINDOWS\system32\GDI32.dll 
Module: ImagePath=C:\WINDOWS\system32\SHLWAPI.dll 
Module: ImagePath=C:\WINDOWS\system32\Secur32.dll 
Module: ImagePath=C:\WINDOWS\system32\kernel32.dll 
Module: ImagePath=C:\WINDOWS\system32\ntdll.dll 
Module: ImagePath=C:\WINDOWS\system32\SHELL32.dll 
Module: ImagePath=C:\WINDOWS\system32\USER32.dll 
Action ended 16:41:32: InstallFinalize. Return value 3.
MSI (s) (F8:9C) [16:41:32:937]: User policy value 'DisableRollback' is 0
MSI (s) (F8:9C) [16:41:32:953]: Machine policy value 'DisableRollback' is 0
MSI (s) (F8:9C) [16:41:33:000]: Executing op: Header(Signature=1397708873,Version=301,Timestamp=993494235,LangId=1033,Platform=0,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
MSI (s) (F8:9C) [16:41:33:000]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (F8:9C) [16:41:33:000]: Executing op: DialogInfo(Type=1,Argument=Symantec Endpoint Protection)
MSI (s) (F8:9C) [16:41:33:000]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
Action 16:41:33: Rollback. Rolling back action:
Rollback: CcSetMgrStart.D3A883B9_8F94_4E7D_96B6_852388CE5647
MSI (s) (F8:9C) [16:41:33:000]: Executing op: ActionStart(Name=CcSetMgrStart.D3A883B9_8F94_4E7D_96B6_852388CE5647,,)
MSI (s) (F8:9C) [16:41:33:000]: Executing op: ProductInfo(ProductKey={FB8A4E30-9915-4814-ADF9-42E00D9FDC3D},ProductName=Symantec Endpoint Protection,PackageName=Symantec AntiVirus.msi,Language=1033,Version=184550376,Assignment=1,ObsoleteArg=0,ProductIcon=ARPPRODUCTICON.exe,PackageMediaPath=\sep\,PackageCode={025688C1-EB04-4BD7-86FB-FF0AC9888A73},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0)
Rollback: CcSetMgrStart_Rol.D3A883B9_8F94_4E7D_96B6_852388CE5647
MSI (s) (F8:9C) [16:41:33:000]: Executing op: ActionStart(Name=CcSetMgrStart_Rol.D3A883B9_8F94_4E7D_96B6_852388CE5647,,)
MSI (s) (F8:9C) [16:41:33:000]: Executing op: CustomActionRollback(Action=CcSetMgrStart_Rol.D3A883B9_8F94_4E7D_96B6_852388CE5647,ActionType=3329,Source=BinaryData,Target=_CcSetMgrShutdown@4,)
MSI (s) (F8:28) [16:41:33:000]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI93.tmp, Entrypoint: _CcSetMgrShutdown@4
2009-09-23-16-41-33-156 : cc::StopServiceAndDepAtAnyCost(393) :  There are no dependent active services for ccSetMgr
2009-09-23-16-41-33-625 : cc::CServiceControl::WaitForService(86) : Allocated 334 bytes
2009-09-23-16-41-33-625 : cc::CServiceControl::WaitForService(118) : Waiting for Symantec Settings Manager service to stop.
2009-09-23-16-41-33-625 : cc::CServiceControl::WaitForService(129) : Service status is set to 3
2009-09-23-16-41-33-625 : cc::CServiceControl::WaitForService(152) : Sleeping for 1000 milliseconds.
2009-09-23-16-41-34-625 : cc::CServiceControl::WaitForService(182) : Service status before exit 2
MSIASSERT - 2009-09-23-16-41-34-625 : cc::CServiceControl::WaitForService(188) :  Service status is incorrect. Returning false: 
2009-09-23-16-41-34-640 : In Stop(), WaitForService() failed while stopping ccSetMgr.
2009-09-23-16-41-34-640 : In Stop(), ControlService() failed to stop ccSetMgr and returned error 1052.
2009-09-23-16-41-34-640 : In Stop(), ControlService() failed to stop ccSetMgr and returned error 1052.
2009-09-23-16-41-34-640 : In Stop(), ControlService() failed to stop ccSetMgr and returned error 1052.
2009-09-23-16-41-34-640 : In Stop(), ControlService() failed to stop ccSetMgr and returned error 1052.
2009-09-23-16-41-34-640 : cc::StopService(211) :  Unable to stop the service ccSetMgr
2009-09-23-16-41-34-671 : ccLib::CRegistry::Open(101) : RegOpenKeyEx() != ERROR_SUCCESS, Software\Symantec\Common Client\Install, 0x00000002

2009-09-23-16-41-34-671 : cc::StopThisServiceAtAnyCost(274) : Unable to open regKey. Error=2
2009-09-23-16-41-34-687 : cc::GetPidForService(976) : Returning pid=600 for service=ccSetMgr
2009-09-23-16-41-34-687 : CPrivilege::GrantThread() : GetLastError() == ERROR_NO_TOKEN

2009-09-23-16-41-34-703 : cc::NukeProcess(839) :  Done. The process you wanted NUKED is now NUKED
2009-09-23-16-41-34-703 : cc::NukeService(222) : Nuked service 'ccSetMgr'
2009-09-23-16-41-34-703 : cc::StopThisServiceAtAnyCost(279) : service ccSetMgr has been successfully nuked with image ccSetPlg.dll
2009-09-23-16-41-34-703 : cc::StopThisServiceAtAnyCost(279) : Now attempting to shutdown service incase it came back up
2009-09-23-16-41-34-703 : cc::StopService(187) :  The service ccSetMgr is already not running. Nothing to stop. service State=1
2009-09-23-16-41-34-703 : cc::StopThisServiceAtAnyCost(279) : service ccSetMgr has been successfully shutdown with image ccSetPlg.dll
2009-09-23-16-41-34-703 : cc::StopServiceAndDepAtAnyCost(470) : Able to stop service ccSetMgr successfully
MSIRESULT PASS - CcSetMgrShutdown:  Able to successfully stop ccSetMgr: 
MSIASSERT - 2009-09-23-16-41-34-703 : CMutex::Open() : OpenMutex() == NULL, Global\ccSetMgr_Single_Instance_Lock, 0x00000002
CcSetMgrShutdown: 
Rollback: Configuring SymEvent
MSI (s) (F8:9C) [16:41:34:703]: Executing op: ActionStart(Name=SevInstUninstallWorkAround.93C43188_D2F5_461E_B42B_C3A2A318345C,Description=Configuring SymEvent,)
Rollback: Installing Firewall drivers
MSI (s) (F8:9C) [16:41:34:703]: Executing op: ActionStart(Name=MsiInstallWps.AFD7E729_F6AF_4E0F_912C_CF8E6A1326EF,Description=Installing Firewall drivers,)
Rollback: MsiInstallWps_RB.AFD7E729_F6AF_4E0F_912C_CF8E6A1326EF
MSI (s) (F8:9C) [16:41:34:703]: Executing op: ActionStart(Name=MsiInstallWps_RB.AFD7E729_F6AF_4E0F_912C_CF8E6A1326EF,,)
MSI (s) (F8:9C) [16:41:34:703]: Executing op: CustomActionRollback(Action=MsiInstallWps_RB.AFD7E729_F6AF_4E0F_912C_CF8E6A1326EF,ActionType=3329,Source=BinaryData,Target=MsiUninstallWps,CustomActionData=C:\Program Files\Symantec\Symantec Endpoint Protection\)
MSI (s) (F8:60) [16:41:34:718]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI94.tmp, Entrypoint: MsiUninstallWps
FWMainCA: Wps successfully uninstalled.
Rollback: Installing Device Protection driver
MSI (s) (F8:9C) [16:41:34:765]: Executing op: ActionStart(Name=InstallSysPlant.CE633825_BB8F_4C40_8B94_769CF5D8253E,Description=Installing Device Protection driver,)
Rollback: InstallSysPlant_RB.CE633825_BB8F_4C40_8B94_769CF5D8253E
MSI (s) (F8:9C) [16:41:34:765]: Executing op: ActionStart(Name=InstallSysPlant_RB.CE633825_BB8F_4C40_8B94_769CF5D8253E,,)
MSI (s) (F8:9C) [16:41:34:765]: Executing op: CustomActionRollback(Action=InstallSysPlant_RB.CE633825_BB8F_4C40_8B94_769CF5D8253E,ActionType=3329,Source=BinaryData,Target=UninstallSysPlant,)
MSI (s) (F8:00) [16:41:34:765]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI95.tmp, Entrypoint: UninstallSysPlant
SPAMAINCA: DeleteDriverService DeleteService worked for service SysPlant.
Rollback: Installing NAC driver
MSI (s) (F8:9C) [16:41:34:796]: Executing op: ActionStart(Name=WGXInstallHelper.D8CB2A9F_8EC6_4EF2_B650_B6951138D94F,Description=Installing NAC driver,)
Rollback: StartEventLogService.03FE01CF_295E_4354_A292_7DC4A810E0DA
MSI (s) (F8:9C) [16:41:34:796]: Executing op: ActionStart(Name=StartEventLogService.03FE01CF_295E_4354_A292_7DC4A810E0DA,,)
Rollback: StartEventLogService_Rol.03FE01CF_295E_4354_A292_7DC4A810E0DA
MSI (s) (F8:9C) [16:41:34:796]: Executing op: ActionStart(Name=StartEventLogService_Rol.03FE01CF_295E_4354_A292_7DC4A810E0DA,,)
MSI (s) (F8:9C) [16:41:34:796]: Executing op: CustomActionRollback(Action=StartEventLogService_Rol.03FE01CF_295E_4354_A292_7DC4A810E0DA,ActionType=1281,Source=BinaryData,Target=_StartEventLogService_Rol@4,)
MSI (s) (F8:08) [16:41:34:796]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI96.tmp, Entrypoint: _StartEventLogService_Rol@4
MSIRESULT PASS - MsiHelper::CMsiDefRegArchive::Init: Start Initialization: 
MSIRESULT PASS - MsiHelper::CMsiDefRegArchive::Init: Getting custom action data: 
MSIRESULT PASS - MsiHelper::CMsiDefRegArchive::Init: szFileName == '': 
StartEventLogService_Rol: Skipping custom action
Rollback: WriteCcServiceRegistry.D9F570F7_4F5A_41B0_9D99_89851EE85080
MSI (s) (F8:9C) [16:41:35:234]: Executing op: ActionStart(Name=WriteCcServiceRegistry.D9F570F7_4F5A_41B0_9D99_89851EE85080,,)
Rollback: WriteCcServiceRegistryRol.D9F570F7_4F5A_41B0_9D99_89851EE85080
MSI (s) (F8:9C) [16:41:35:234]: Executing op: ActionStart(Name=WriteCcServiceRegistryRol.D9F570F7_4F5A_41B0_9D99_89851EE85080,,)
MSI (s) (F8:9C) [16:41:35:234]: Executing op: CustomActionRollback(Action=WriteCcServiceRegistryRol.D9F570F7_4F5A_41B0_9D99_89851EE85080,ActionType=3329,Source=BinaryData,Target=_DeleteCcServiceEntries@4,CustomActionData=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\CCI49.tmp)
MSI (s) (F8:EC) [16:41:35:250]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI97.tmp, Entrypoint: _DeleteCcServiceEntries@4

Let me know about that file John, and thanks for looking. 

cpatterson's picture

 Oh, yeah, sorry John, I believe the version I'm trying to load is 11.0.1000.1112. 

And this is what the event log sees happening...

Faulting application ccSvcHst.exe, version 106.3.6.2, faulting module unknown, version 0.0.0.0, fault address 0x7c9f19b7.

No real errors other than that, and a message stating the install failed. 




Vikram Kumar-SAV to SEP's picture

 Run Cleanwipe on this machine then try to install SEP
and install 11.0.5002.xxx version of SEP

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.

cpatterson's picture

" I performed the following actions, in no particular order, and some multiple times, to attempt to reinstall the software.....Used CleanWipe to remove all traces of Symantec."

If I could get it installed at all, I'd be happy to try to install the update as well. 
Thanks for the response. 

cpatterson's picture

I see you're online, did you want me to send this file to you even at 9 Mb? (obviously can be compressed/zipped), or is the data above good enough? Let me know please, and thanks. 

Vikram Kumar-SAV to SEP's picture

I don't want you to update the software after installing i wanted you to directly install MR5 rather than trying out with MR1 (11.0.1000.xx )
You can download MR5 from https://fileconnect.symantec.com download the CD1 and try installing that.
At the same time you can upload your logs at http://www.2shared.com/ and post the link so that we can download and review the log

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.