Endpoint Protection

I am having an issue installing SEP 11.0.6005.562 on the passive node of an Exchange 2003 Cluster. The servers in the cluster were using SAV 10.1.5000.5. I installed SEP on Server A while it was passive with no issues. I failed the cluster over to active Server A and pushed out the install from the SEP console to Server B. The install shows that it was successful in the console. When I remote into Server B I see the icon in the systray for SEP. But when I go to Add/Remove programs I still see SAV. I tried to uninstall it but it gave me an error. Server A does not have SAV in Add/Remove programs. I was under the assumption that SEP would remove SAV during the install process. Can some one please get me some tips on what I am doing wrong here?

Also, I have SMSME 6.5 running too.

Sounds like a corrupt SAV install of some kind.

Your best bet is to call support and get Cleanwipe.

Cleanwipe will fully remove all existing SAV/SEP installations, which will allow to install a fresh version of SEP.

The problem is though you want to be careful running Cleanwipe on a server. It requires 2 reboots I believe. But if you can fail it over then you should not have to worry about down time.

Cleanwipe is the quickest and easiest way to solve this problem. You can do a manual removal of SAV but it can be painful editing so much in the registry.

Personally, I would go with cleanwipe. It has always solved issues for me with SAV/SEP installs/uninstalls.

Yeah, I was thinking of running Cleanwipe. I think i already have a copy some where. Will Cleanwipe wipe out the Symantec Mail Security for Microsoft Exchange?

To be honest, I don't know.

When you first run it, it should give a list of what will be wiped.

Start it on a test machine just to see what that list says. It may even say in the readme as well.

I do not believe it will remove Symantec Mail Security, BUT two things:

If you have to use CleanWipe, make sure it is not an older version of CleanWipe than the version of SEP you will be removing.  CleanWipe v5 for  SEP RU5 and what not.

Secondly, I would caution against using CleanWipe on a server unless absolutely necessary.  CleanWipe is very agressive, as it needs to be, but nonetheless, I have had it mess with NIC drivers.  Granted when I had the issue, it was on workstations that had NTP installed.  If you do not have NTP installed, I don't know if CleanWipe would be as big a threat.

Yes, Cleanwipe will remove SMSE as well as the following -

Well, if Cleanwip will remove SMSME along with SAV then what is another option?

manual uninstall of SAV

here are the manual uninstall documents -

Manual uninstallation documents for Symantec Client Security products

http://www.symantec.com/business/support/index?page=content&id=TECH99631

Do I need to uninstall SEP first?

Shouldn't need to

Hi Mykul,

I have seen several cases where SAV was still listed among the products in Add/Remove programs, but was in fact gone from the computer.  It was just that an entry was left behind in the registry which creates the listing for Add/Remove programs.

Have a quick look at how the server is operating and at the directory structure.  Is SEP running correctly, detecting eicar test files, and communicating with its SEPM?  Is SMSMSE also functioning correctly?  Are SAV files actually present in the directory structure? 

If everything is functioning correctly with the current products, then the SAV entry in Add/Remove programs may be a pursued as a cosmetic issue alone.  The security of those mail servers is the real crucial thing: I recommend checking that before anything else.

Thanks and best regards,

Mick 

Mick,

SEP does seem to be running correctly. It is communicating with the SEP server and downloading new virus definition files. I compared Server B directory structure under Programs Files with Server A and everything is the same with the exception of a folder named SAVRT on Server B.

How do I tell if it is detecting eicar test files?

you need to check the logs.. that would tel u 

Are you talking about the logs in the client application or some where esle?

Here's the instruction:

What to do when you suspect that a Symantec AntiVirus product is not detecting viruses