Unable to uninstall SEP
Hi....
Am unable to uninstall SEP from a client machine...An error stating "Live Update is still running"....We have also run clean wipe to uninstall it....After clicking on the prompts....there is no progress...It only stops with the Windows Installer Dialog box....Please help out with a soln....
Regards,
Monica
Filed under: Endpoint Protection (AntiVirus), Security
Pls check in task manger any
Pls check in task manger any process is running related to liveupate(luall.exe,callbackproxy.exe ,lucom.exe) ,if anything present kill that process and try to uninstall..
Hi Aravind... We are unable
Hi Aravind...
We are unable to stop those processes...Its giving access denied error......I tried removing it by running the setup file (which will give repair..remove and modify options).....After the half way...its hanging......But in services.msc....no services related to SEP are running....Is there any other tool to remove SEP other than cleanwipe....
Once you restart your pc and
Once you restart your pc and try to uninstall
You can check below doc also
How to manually uninstall Symantec Endpoint Protection client from Windows 2000, XP and 2003, 32-bit Editions
The user which you are using
The user which you are using for uninstalling is an admin user ,I am correct?
One more thig why you are uninstalling SEP from that pc?
Yes the user is an admin
Yes the user is an admin user.The reason for uninstalling is,that client is not communicating with the SEPM...we have tried all possible trouble shooting....still no go...Thats y we opted for the last option of reinstalling it.......
hI
seems like autoprotect is protecting liveupdate.
open cmd prompt
type taskkill /f /im "luall.exe"
or
disable tamper protection
Enabling, disabling, and configuring Tamper Protection in Endpoint Protection on unmanaged Clients
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007101809460948?Open&seg=ent
once you kill LU you will be able to uninstall
Rafeeq
Manually uninstall SEP
The running services mentioned by you are interdependent therefore its possible that you might get a access denied error eeven if you are logged in as an Administrator. You can manually remove the SEP installatio although the process is lengthy it ensures a complete removal of the Symantec endpoint.
http://service1.symantec.com/SUPPORT/ent-security....
Thanks & Regards
Sandip C Sali
Reboot your machine and then
Reboot your machine and then kill the Lu* processes if still its not working install Unlocker and kill these processes using it.
then delete the folder \program files\symantec\liveupdate then try installing SEP again.
Celebrating 2 years as a community member....
We have tried this also
We have tried this also Vikram.....We run the process explorer and killed all the processes related to LU...and manually deleted the files and folders...also we have deleted the registry entries....In Services.msc no SEP services are running...but still we are not able to reinstall...please help out with a soln....
Ok..for the first part of
Ok..for the first part of your issue is resolved now its the second part right ( un-install complete but unable to re-install0
Delete
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Program Files\Symantec
C:\Program Files\Symantec Endpoint Protection or
C:\Program Files\Symantec Antivirus,
C:\Program Files\Common Files\Symantec Shared.
Clear out start - run - %temp%
reboot the computer once
Then run the install again.
If Sucess then good if not then go to
%temp%\SEP_INST.log
Look for 1st Return Value 3
And paste 10 line above this value over here we'll go from there..
Celebrating 2 years as a community member....
Hi Vikram, Am not clear on
Hi Vikram,
Am not clear on how to perform the last two step....pasting 10 line above this value....can u plss explain...
SEP installation creates a
SEP installation creates a install log which is located in start - run - %temp% ( temp folder for the user profile)
SEP_INST.log
it will be a huge log file. Open it notepad ( by default it will open in notepad)
in the log search for Return value 3
(Return value 3 is generated when install fails it shows the reason why install failed)
then copy 10-15 line above this return value 3 and paste it on this forum so that we can determine what is causing the install failure and can recommend you further steps to perform.
Celebrating 2 years as a community member....
Do u infer anything from the
Do u infer anything from the Logs......?
Open the file
Open the file %temp%\SEP_INST.log
Search for the value Return Value 3
You may get multiple times this same error
Look at the first time value paste 10 lines above it
Hi...... Am pasting the logs
Hi......
Am pasting the logs here.......
MSIASSERT - 2009-11-09-11-59-49-437 : cc::StopServiceAndDepAtAnyCost(366) : Unable to openService ccSetMgr. Error=1060:
MSI (s) (D8:CC) [11:59:49:437]: Executing op: ActionStart(Name=InstallLiveUpdate_RB.FF07F38E_78C2_412E_B858_64488E808644,,)
MSIASSERT - StopCcSetMgrOnOverOrBrokenInstall: Unable to stop ccSetMgr:
MSI (s) (D8:CC) [11:59:49:437]: Executing op: CustomActionSchedule(Action=InstallLiveUpdate_RB.FF07F38E_78C2_412E_B858_64488E808644,ActionType=3329,Source=BinaryData,Target=UnInstallLiveUpdate,CustomActionData=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QARXINZL\LiveUpdate\lucheck.exe)
MSI (s) (D8:CC) [11:59:49:453]: Executing op: ActionStart(Name=InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644,,)
MSI (s) (D8:CC) [11:59:49:453]: Executing op: CustomActionSchedule(Action=InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644,ActionType=3073,Source=BinaryData,Target=InstallLiveUpdate,CustomActionData=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QARXINZL\LiveUpdate\lucheck.exe)
MSI (s) (D8:5C) [11:59:49:468]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7B.tmp, Entrypoint: InstallLiveUpdate
LUCA: InstallLiveUpdate enter.
LUCA: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QARXINZL\LiveUpdate\lucheck.exe
LUCA: InstallLiveUpdate : CreateProcessAndWait( LUCHECK.EXE ) returned 1
MSI (s) (D8:CC) [12:00:04:640]: User policy value 'DisableRollback' is 0
MSI (s) (D8:CC) [12:00:04:640]: Machine policy value 'DisableRollback' is 0
Regards,
Monica
First install lusetup and try
First install lusetup and try to install sep afterwards..
Ya....that also has been
Ya....that also has been tried.....Even then no result......
have you deleted the folders
have you deleted the folders suggested earlier and cleared the %temp% before the install ?
Celebrating 2 years as a community member....
Yes.....I have deleted all
Yes.....I have deleted all the folders that have been suggested....also cleared the temp files.....
Check these permissions also
Troubleshooting Symantec AntiVirus Corporate Edition and Symantec Endpoint Protection installations: Checking rights and permissions
While you are trying to
While you are trying to install liveupdate whether it is getting installed?
Yes it is getting
Yes it is getting installed...but after that there is no progress.....
Is it roll backing the same
Is it roll backing the same place with same errors?
After installing live
After installing live update.....while running the av setup..in the task manager the LU* processes are running.....but after that it is not proceeding any further....the system hangs....
While running lu if you try
While running lu if you try to install sep the possibility of rolling back is high..
Try to install after killing all process of lu..
Try to use Cleanwipe.
Try to use Cleanwipe.
Jomar Gonzales
Well the logs gives a very
Well the logs gives a very generic error that install failed due to liveupdate...I would recommend you download MalwareBytes update it and run a full on this system first..
As you had some problems with this system so you had removed SEP....
If the computer comes out clean..
then try installing SEP if still doesn't install try running lucheck.exe from Cd1\SEP folder and post the
luresult.txt
Also try running Cleanwipe once..
Celebrating 2 years as a community member....
Hi all.....The issue has been
Hi all.....The issue has been resolved after formatting and reloading SEP......
Well...Thats the easiest way
Well...Thats the easiest way of resolving things when you need the issue to be resolved immediately..
Celebrating 2 years as a community member....
Would you like to reply?
Login or Register to post your comment.