Unable to uninstall SEP

Monica Alexander's picture

Hi....

Am unable to uninstall SEP from a client machine...An error stating "Live Update is still running"....We have also run clean wipe to uninstall it....After clicking on the prompts....there is no progress...It only stops with the Windows Installer Dialog box....Please help out with a soln....

Regards,
Monica

AravindKM's picture

Pls check in task manger any

Pls check in task manger any process is running related to liveupate(luall.exe,callbackproxy.exe ,lucom.exe) ,if anything present kill that process and try to uninstall.. 

Monica Alexander's picture

Hi Aravind... We are unable

Hi Aravind...

We are unable to stop those processes...Its giving access denied error......I tried removing it by running the setup file (which will give repair..remove and modify options).....After the half way...its hanging......But in services.msc....no services related to SEP are running....Is there any other tool to remove SEP other than cleanwipe....

AravindKM's picture

Once you restart your pc and

Once you restart your pc and try to uninstall 

AravindKM's picture

The user which you are using

The user which you are using for uninstalling is an admin user ,I am correct?
One more thig why you are uninstalling SEP from that pc? 

Monica Alexander's picture

Yes the user is an admin

Yes the user is an admin user.The reason for uninstalling is,that client is not communicating with the SEPM...we have tried all possible trouble shooting....still no go...Thats y we opted for the last option of reinstalling it.......

Rafeeq's picture

hI

seems like autoprotect is protecting liveupdate.
open cmd prompt
type taskkill /f /im "luall.exe"
or
disable tamper protection

Enabling, disabling, and configuring Tamper Protection in Endpoint Protection on unmanaged Clients
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007101809460948?Open&seg=ent

once you kill LU you will be able to uninstall

Rafeeq

sandip_sali's picture

Manually uninstall SEP

The running services mentioned by you are interdependent therefore its possible that you might get a access denied error eeven if you are logged in as an Administrator. You can manually remove the SEP installatio although the process is lengthy it ensures a complete removal of the Symantec endpoint.

http://service1.symantec.com/SUPPORT/ent-security....

Thanks & Regards

Sandip C Sali

Vikram Kumar-SAV to SEP's picture

 Reboot your machine and then

 Reboot your machine and then kill the Lu* processes if still its not working install Unlocker  and kill these processes using it.
then delete the folder \program files\symantec\liveupdate then try installing SEP again.

Celebrating 2 years as a community member....

Monica Alexander's picture

We have tried this also

We have tried this also Vikram.....We run the process explorer and killed all the processes related to LU...and manually deleted the files and folders...also we have deleted the registry entries....In Services.msc no SEP services are running...but still we are not able to reinstall...please help out with a soln....

Vikram Kumar-SAV to SEP's picture

 Ok..for the first part of

 Ok..for the first part of your issue is resolved now its the second part right ( un-install complete but unable to re-install0
Delete
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Program Files\Symantec
C:\Program Files\Symantec Endpoint Protection or
C:\Program Files\Symantec Antivirus,

C:\Program Files\Common Files\Symantec Shared.

Clear out start - run - %temp%

reboot the computer once

Then run the install again.
If Sucess then good if not then go to
%temp%\SEP_INST.log

Look for 1st Return Value 3
And paste 10 line above this value over here we'll go from there..




Celebrating 2 years as a community member....

Monica Alexander's picture

Hi Vikram, Am not clear on

Hi Vikram,

Am not clear on how to perform the last two step....pasting 10 line above this value....can u plss explain...

Vikram Kumar-SAV to SEP's picture

 SEP installation creates a

 SEP installation creates a install log which is located in start - run - %temp%  ( temp folder for the user profile)
SEP_INST.log

it will be a huge log file. Open it notepad ( by default it will open in notepad)
in the log search for Return value 3  
(Return value 3 is generated when install fails it shows the reason why install failed)

then copy 10-15 line above this return value 3 and paste it on this forum so that we can determine what is causing the install failure and can recommend you further steps to perform.

Celebrating 2 years as a community member....

Monica Alexander's picture

Do u infer anything from the

Do u infer anything from the Logs......?

AravindKM's picture

Open the file

Open the file %temp%\SEP_INST.log
Search for the value  Return Value 3
You may get multiple times this same error
Look at the first time value paste 10 lines above it

Monica Alexander's picture

Hi...... Am pasting the logs

Hi......

Am pasting the logs here.......

MSIASSERT - 2009-11-09-11-59-49-437 : cc::StopServiceAndDepAtAnyCost(366) : Unable to openService ccSetMgr. Error=1060:
MSI (s) (D8:CC) [11:59:49:437]: Executing op: ActionStart(Name=InstallLiveUpdate_RB.FF07F38E_78C2_412E_B858_64488E808644,,)
MSIASSERT - StopCcSetMgrOnOverOrBrokenInstall: Unable to stop ccSetMgr:
MSI (s) (D8:CC) [11:59:49:437]: Executing op: CustomActionSchedule(Action=InstallLiveUpdate_RB.FF07F38E_78C2_412E_B858_64488E808644,ActionType=3329,Source=BinaryData,Target=UnInstallLiveUpdate,CustomActionData=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QARXINZL\LiveUpdate\lucheck.exe)
MSI (s) (D8:CC) [11:59:49:453]: Executing op: ActionStart(Name=InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644,,)
MSI (s) (D8:CC) [11:59:49:453]: Executing op: CustomActionSchedule(Action=InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644,ActionType=3073,Source=BinaryData,Target=InstallLiveUpdate,CustomActionData=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QARXINZL\LiveUpdate\lucheck.exe)
MSI (s) (D8:5C) [11:59:49:468]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7B.tmp, Entrypoint: InstallLiveUpdate
LUCA: InstallLiveUpdate enter.
LUCA: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QARXINZL\LiveUpdate\lucheck.exe
LUCA: InstallLiveUpdate : CreateProcessAndWait( LUCHECK.EXE ) returned 1
MSI (s) (D8:CC) [12:00:04:640]: User policy value 'DisableRollback' is 0
MSI (s) (D8:CC) [12:00:04:640]: Machine policy value 'DisableRollback' is 0

Regards,
Monica

 

AravindKM's picture

First install lusetup and try

First install lusetup and try to install sep afterwards.. 

Monica Alexander's picture

Ya....that also has been

Ya....that also has been tried.....Even then no result......

Vikram Kumar-SAV to SEP's picture

 have you deleted the folders

 have you deleted the folders suggested earlier and cleared the %temp% before the install ?

Celebrating 2 years as a community member....

Monica Alexander's picture

Yes.....I have deleted all

Yes.....I have deleted all the folders that have been suggested....also cleared the temp files.....

AravindKM's picture

While you are trying to

While you are trying to install liveupdate whether it is getting installed? 

Monica Alexander's picture

Yes it is getting

Yes it is getting installed...but after that there is no progress.....

AravindKM's picture

Is it roll backing the same

Is it roll backing the same place with same errors? 

Monica Alexander's picture

After installing live

After installing live update.....while running the av setup..in the task manager the LU* processes are running.....but after that it is not proceeding any further....the system hangs....

AravindKM's picture

While running lu if you try

While running lu if you try to install sep the possibility of rolling  back is high..
Try to install after killing all process of lu.. 

jomargonzales's picture

Try to use Cleanwipe.

Try to use Cleanwipe.

Jomar Gonzales

Vikram Kumar-SAV to SEP's picture

 Well the logs gives a very

 Well the logs gives a very generic error that install failed due to liveupdate...I would recommend you download MalwareBytes update it and run a full on this system first..
As you had some problems with this system so you had removed SEP....

If the computer comes out clean..
then try installing SEP if still doesn't install try running lucheck.exe from Cd1\SEP folder and post the
luresult.txt

Also try running Cleanwipe once..

Celebrating 2 years as a community member....

Monica Alexander's picture

Hi all.....The issue has been

Hi all.....The issue has been resolved after formatting and reloading SEP......

Vikram Kumar-SAV to SEP's picture

Well...Thats the easiest  way

Well...Thats the easiest  way of resolving things when you need the issue to be resolved immediately..

Celebrating 2 years as a community member....