Endpoint Protection

I cannot install SEP 11.0.5 on Windows XP- it always says that I have a previous version of Norton products.  I was (and am again) running symantec anti-virus 9.0.1.1000.  I tried the following ways to uninstall it:

1) Windows Add/ Remove Programs

2) Norton Removal Tool which I downloaded today from here:
http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039
They didn't have anything for Symantec 9, but I chose the  version for Norton products 2004, since that is the date.

3) Manually uninstalling Symantec AntiVirus Corporate Edition 9.x client from Windows NT/2000/XP/2003 from
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2004040815592148
The only items that I found valid was the step 21 removing the VirusProtect6 key.  I found several of them and deleted them.  All other instruction were not valid as the keys or processes did not exist.

Despite all this, and restarting the computer numerous times, the SEP installer still says that a says that a previous version of Norton needs to be unistalled/ or is in the process of being uninstalled and won't proceed

I've tried to remove/upgrade SAV 9 for the last few years.  I have repeatedly searched the forums and symantec website, and used whatever tools or protocols are recommended.  I always waste a couple of hours before re-installing SAV 9 in frustration.

If someone can point me to a removal tool or instructions for removal that work, I would appreciate it.  I would prefer a tool, as screwing around with regedit makes me nervous.  I'm not a computer professional.  I am just trying to follow the guidelines that my company has provided- they want SEP 11.0.5 installed on personal computers of people who do work at home.


Thanks,
Louise

Try running cleanwipe then reinstalling

 Call Symantec Support or open a web case a request for a Cleanwipe utility or NoNav utility.

How do I open a webcase?  I found something called customer care, but it was mostly about problems with orders.  Searching for web case turned up a bunch of forum topics, but I didn't see any links. 

I don't know how comfortable you are using the windows command line, but this is the guide I have used in the past and found it great:

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2004072213295048 

Also if you are interested in obtaining cleanwipe please visit here https://mysupport.symantec.com/ to open a webcase. Be advised that you need a valid support contract.

Cheers
Grant

This is an unusual report, as SEP 11 should install cleanly over SAV 9.  There should not be any need to uninstall SAV 9 at all.

If the error message specifically mentions "Norton" as opposed to "Symantec," then there is a detection of a consumer product like NIS or NSW.  These must be removed before SEP can be installed.  Was any similar product ever in place on that computer-?

Is there are specific error message that appears in the msi log or Windows Application Event log?  Looking at the debug log generated by msiinstaller will probably be the key to determining what in fact is being detected.

I very strongly recommend moving away from SAV 9 as soon as possible.  It was not designed to completely remediate the threats that have since evolved.

Thanks and best regards,

Mick

Try this.

get regmon from here
http://technet.microsoft.com/en-us/sysinternals/bb896652.aspx
put a filter for msiexec.exe

run the install of symantec endpoint
when it error " nortan is already install pops up"
check the registry key, Its getting the product codes from registry and think its still there
if you open the sep_inst.log file under temp folder
you wil find the product codes.

I'm not sure what the MSI log is, but if I look at the windows application log  I see 3 items relating to the uninstall of SAV and the install of SEP.
3)


1)

Event Type: Information
Event Source: MsiInstaller
Event Category: None
Event ID: 11724
Date: 1/9/2010
Time: 12:53:01 PM
Description:
Product: Symantec AntiVirus -- Removal completed successfully.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7b 38 34 38 41 43 37 39 {848AC79
0008: 34 2d 38 42 38 31 2d 34 4-8B81-4
0010: 34 30 41 2d 38 31 41 45 40A-81AE
0018: 2d 36 34 37 34 33 33 37 -6474337
0020: 44 42 35 32 37 7d DB527}

2)

Event Type: Information
Event Source: MsiInstaller
Event Category: None
Event ID: 1005
Date: 1/9/2010
Time: 12:53:01 PM
Description:
The Windows Installer initiated a system restart to complete or continue the configuration of 'Symantec AntiVirus'.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7b 38 34 38 41 43 37 39 {848AC79
0008: 34 2d 38 42 38 31 2d 34 4-8B81-4
0010: 34 30 41 2d 38 31 41 45 40A-81AE
0018: 2d 36 34 37 34 33 33 37 -6474337
0020: 44 42 35 32 37 7d DB527}


3)

Event Type: Error
Event Source: MsiInstaller
Event Category: None
Event ID: 10005
Date: 1/9/2010
Time: 1:03:12 PM
Description:
Product: <no name> -- blah

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7b 41 39 32 42 41 44 30 {A92BAD0
0008: 41 2d 34 33 45 41 2d 34 A-43EA-4
0010: 32 32 31 2d 38 35 45 46 221-85EF
0018: 2d 46 38 46 38 42 33 31 -F8F8B31
0020: 35 36 30 33 30 7d 56030}


On this machine, I only have had sav.  I may have a hard-drive (as a slave drive) which _may_ have had another norton product, but I did not have any problems when I installed SAV.  Now this harddrive just has some pictures and documents.

Is there another place to look for log information?  I read what windows said about msi.log and it wasn't very clear.  I guess you have to enable it, which I don't think I've ever done.  I'm looking in a folder that opens when I type %temp% at the command line, according to some instructions I found on the web, but there are several files from when I was working on this.  Many are named SymNRT, which I guess is the Norton Removal tool I tried.  Then there are several MSI# files which each say "blah" then "Logging stopped".  Then I have SAV_INST from when I re-installed SAV because I couldn't get anything to work.

As for moving away from SAV... I'm trying.  But my company refuses to request the cleanwipe or NoNav utilities recommended by the posters above.  The computer support person at my company told me my only option was to wipe my computer and re-install XP.  He refused to even look at this thread and I don't have any of the service contract information to request this on my own.

Thanks,
Louise
 

There is a replacement product called process monitor.  It looks complicated, so I am not going to try this right now.  I generally like to schedule a few hours when I do stuff like this, so I don't have to leave the system in a broken state.

Thanks,
Louise 

 On your system go to start - run -%temp%\SEP_INST.log
Open this log then search for return value 3

Once you find the first return value 3..copy and paste atleast 10-15 line above return value 3 and post it on this thread.

There is no file with that name.  
 

go to
c:\windows\temp folder and check for the file 

yes, I checked in that folder.  There is no file with that name.  I found the install log from when I re-installed SAV9, but nothing for SEP. 

If you are sure that you don't have any other Symantec or Norton products on the PC.. you can very well do a quick cealnup on the registry... check in the following locations..

* HKLM\Software\Symantec ( Delete if present, also check for norton)

* HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall

Here, you can check for names like symantec and norton, also you can find long numbered keys.. please do go through them, select one and check the 'Install Source' and 'Install Path' values...

And also, please check under documents and settings\All users\application data for any symantec or norton folders..

Let us know what happened..

Cheers,
Visu.

So, I tried everything again, including (most of) the suggestions here.

After uninstall of SAV using add/remove programs, the install program for SEP goes through the welcome screen, 'install in the following location', 'now ready to install', and the license agreement screen before terminating.

The exact error message was "An uninstall of Norton Antivirus needs to be completed.  Please restart to complete the uninstall, then relaunch the SEP installer".

No install log was recreated during this process, and the msi log that is created just says 'blah' as reported upthread.  The windows add/remove programs screen is opened during this process but there are not any norton or symantec products listed.

I tried using the processmonitor recommended upthread during this procedure, but it immediately ran out of memory and then terminated about 30 seconds after putting the filter for msiexec.exe.  I tried this twice, and had the same result both times.  The original poster recommended another product that has been replaced by the processmonitor.  Maybe that original program was more stable or maybe there is some special way that processmonitor needs to be configured that I missed.

After restart, you get the same error upon installing SEP.  If you then start looking at the registry and documents and settings\All users\application data you do find all sorts of things relating to symantec SAV.  This is similar to when I did the manual uninstall- I did find and delete a bunch of stuff in the registry (though nothing in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, where I looked through every key for norton or symantec).  But removing these items don't seem to help.

Restarted again, and still no joy on the install.

So, I tried cleanwipe, which I managed to get my hands on.  This gave one message about uninstalling liveupdater.  After a few restarts, I was able to install SEP.   So, that solution works, though, as I mentioned upthread, it is not easy for an end user to get this product.  My company's policy is not to provide any tech support for personal machines, even though this software was installed on their recommendation and under their license.  Combined with symantec's policy of not making cleanwipe available unless you have a service contract, this makes a very difficult situation for people in my position.  If someone hadn't done me a favor, I'd still be stuck.  

Lastly, I noticed that the program Secunia PSI which I have running on my machine, reported that I still had an insecure version of live updater installed, though SAV was removed from the list.  When I rescanned, it was removed, so I think that part of the program was the problem, and was not uninstalled through the normal uninstall of SAV or through  any of the registry key cleanup.  I didn't see anything relating to live update in any of my searches through the registry- and for the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall I went through every key looking for symantec or norton.  


Thanks for everyone's help.


Louise

We appreciate you coming back and telling us that it worked and you finally got SEP installed. I just wanted to explain a little bit about your most recent post. Specifically this part:

"So, I tried cleanwipe, which I managed to get my hands on.  This gave one message about uninstalling liveupdater.  After a few restarts, I was able to install SEP.   So, that solution works, though, as I mentioned upthread, it is not easy for an end user to get this product.  My company's policy is not to provide any tech support for personal machines, even though this software was installed on their recommendation and under their license.  Combined with symantec's policy of not making cleanwipe available unless you have a service contract, this makes a very difficult situation for people in my position.  If someone hadn't done me a favor, I'd still be stuck."

I just want to make sure that you know you are the exception and not the rule. Usually uninstalling Norton from add/remove programs is completely correct. Only in extreme cases do we suggest that users run cleanwipe to get rid of one of our products (and only under the supervision of Symantec Tech Support). The other thing I want to make sure you know is we don't distribute cleanwipe publicy because there are many issues that can happen if the correct procedures are not followed. Things like SNAC or Liveupdate being uninstalled are common. We want tech support on the phone with the customer to correct any of these issues if they happen. Also we want to know details about the users environment as well as details on why the uninstall did not happen correctly with add/remove programs. These gives us better information so we can continue to improve the product in the future.

I am glad you got your issue solved though, and I hope you can have confidence that this issue does not happen on every install of SEP over Norton.

Grant-