Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 9 replies
  • Subscribers 1 subscriber
  • Views 8653 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Uninstall Issue

disco_samurai

Good Morning

At my workplace we use Sophos Endpoint Security and Control v9.5 and I'm having an issue on one of the machines its installed on I wonder if anyone can suggest anything to assist me?

The PC in question had Sophos installed (via a network share) but upon first install when it does its initial update (the 3 stage update) the update window would close once it got to 'Installing Package 1 of..

Now I assumed that I had mistyped the admin password/ID so I went to uninstall it.  However when I try and uninstall Sophos it asks for a 'Sophos Anti-Virus.msi' file.  I browsed to this file on the network server but the uninstaller would not accept this MSI (I've seen a few threads on Google with this issue with no successful resolutions).

I have tried reinstalling Sophos again (same thing happened) and I've tried absolutely everything to remove Sophos, I've manually cleared the registry, manually deleted the files, logged onto safemode to try and remove it I even reinstalled the Windows Installer (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=5a58b56f-60b6-4412-95b9-54d056d6f9f4&displaylang=en_) as it was suggested as a way to get round this issue on the net.  Nothing seems to work.

Any suggestions?

Cheers

Neal

:8433


This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    Is the failing package:

    RMS, SAV, SCF, SAU?

    Using the most recently created/modified AutoUpdate (SAU) trace log file (\ProgramData\Sophos\AutoUpdate\Logs\ALUpdate<timestamp>log), if you search from the bottom up for:

    "ALUpdate started:"

    This will signify the start of the last update and you can see from the time stamps where it skipped forward the same number of minutes as the updating interval.

    The next lines of interest are really the lines that start:

    ALUpdate(Action.Skipped)

    or

    ALUpdate(Action.Execute)

    These are in the UpdateNow method (so all the checking of the CID is complete).

    So if you see:

    ALUpdate(Action.Skipped): RMSNT
    ALUpdate(Action.Skipped): SAVXP
    ALUpdate(Action.Skipped): Sophos Client Firewall
    ALUpdate(Action.Skipped): Sophos AutoUpdate

    You can see that nothing took place as presumably all the packages were up to date.  If the SAV package was updated you would see something like:

    "SetupAction::Execute: Creating thread to install product SAVXP"

    and it would then continue loging the install.

    Once the package that is being updated is discovered the msi and custom actions logs in:

    \windows\temp

    should help.

    I typically use Notepad++ (http://notepad-plus-plus.org/) for looking at this sort of log as you can search with "Find all in current document" and it gives you a list of result lines.  So searching for:

    "ALUpdate(Action.Execute): SAVXP"

    and hitting  "Find all in current document" would show you all the times that the SAV package was updated.

    Thanks,

    Jak

    :9043
Reply
  • 0

    Hi,

    Is the failing package:

    RMS, SAV, SCF, SAU?

    Using the most recently created/modified AutoUpdate (SAU) trace log file (\ProgramData\Sophos\AutoUpdate\Logs\ALUpdate<timestamp>log), if you search from the bottom up for:

    "ALUpdate started:"

    This will signify the start of the last update and you can see from the time stamps where it skipped forward the same number of minutes as the updating interval.

    The next lines of interest are really the lines that start:

    ALUpdate(Action.Skipped)

    or

    ALUpdate(Action.Execute)

    These are in the UpdateNow method (so all the checking of the CID is complete).

    So if you see:

    ALUpdate(Action.Skipped): RMSNT
    ALUpdate(Action.Skipped): SAVXP
    ALUpdate(Action.Skipped): Sophos Client Firewall
    ALUpdate(Action.Skipped): Sophos AutoUpdate

    You can see that nothing took place as presumably all the packages were up to date.  If the SAV package was updated you would see something like:

    "SetupAction::Execute: Creating thread to install product SAVXP"

    and it would then continue loging the install.

    Once the package that is being updated is discovered the msi and custom actions logs in:

    \windows\temp

    should help.

    I typically use Notepad++ (http://notepad-plus-plus.org/) for looking at this sort of log as you can search with "Find all in current document" and it gives you a list of result lines.  So searching for:

    "ALUpdate(Action.Execute): SAVXP"

    and hitting  "Find all in current document" would show you all the times that the SAV package was updated.

    Thanks,

    Jak

    :9043
Children
No Data