I have a PC that was having some issues. I first tried to do a system restore but it would not let me because of Intercept X. There is no easy way, that I found, to turn off Sophos for something like this. SO, I did an uninstall of Sophos. That then allowed me to do a system restore in Windows 10. After the reboot it brought part of Sophos back. I was not able to uninstall or install because of Tamper Protection. I found in the community how to get around that issue. That worked up to a point. It said it uninstall Sophos. Now I can get part way through the reinstall of the program and it will fail. I have tried a few different things with no luck. Any suggestions would be greatly appreciated.
If you have turned off tamper protection, please try out the uninstall script here: https://sophos.com/kb/122126
If that does not work, you can check out any HitmanPro.alert uninstall logs from %localappdata%\Temp or C:\Windows Temp, see if there are any error codes that come up (usually at the end of the log). See if you also find error codes such as error 1920, etc.
Hope the above information helps you.
The Central installer is trying to remove the Sophos AutoUpdate component and failing:
2019-08-14T20:45:43.8097498Z INFO : Uninstallation of Sophos AutoUpdate failed with error code: 16032019-08-14T20:45:43.8097498Z INFO : Ended uninstalling Sophos AutoUpdate2019-08-14T20:45:43.8097498Z ERROR : UninstallCommand::onRun MSI error exit code 16032019-08-14T20:45:43.8097498Z INFO : Command 'Uninstall' completed with failure with reboot code '0' and error message 'Could not uninstall existing Sophos software'.
The log for this MSI uninstall of SAU shows the failure to be:
MSI (s) (0C:34) [16:45:43:387]: Product: Sophos AutoUpdate XG -- Error 1309. Error reading from file: C:\WINDOWS\Installer\program files\Sophos\AutoUpdate\ALsvc.exe. System error 3. Verify that the file exists and that you can access it.
MSI (s) (0C:34) [16:45:43:419]: Note: 1: 2265 2: 3: -2147287035 MSI (s) (0C:34) [16:45:43:419]: User policy value 'DisableRollback' is 0MSI (s) (0C:34) [16:45:43:419]: Machine policy value 'DisableRollback' is 0Action ended 16:45:43: InstallFinalize. Return value 3.
C:\WINDOWS\Installer\program files\Sophos\AutoUpdate\ALsvc.exe seems an odd path and it's not suprising it's getting error 3, which is ERROR_PATH_NOT_FOUND.
This is the cached msi file being used for the uninstall:
You can try right clicking on that to uninstall SAU and I think removing SAU manually should be the focus before re-running the Central Installer.
I think I might be tempted to take a copy of alsvc.exe from C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe (I assume it's still there?) and maybe create the path referenced, just so it finds it in that location when you run the uninstall. Maybe run Process Monitor to confirm that is the path that is being checked for during the uninstall.Hopefully that helps.Jak
Fell like I am going down hill in a hand basket (LOL).
Went to C:\Windows\Installer and tried to run the 76719.msi. It failed.
Went to C:\Program Files (x86)\Sophos and nothing in the Sophos folder.
Went to C:\Program Files\Sophos and there are files there. But, no Auto Update.
Also tried the previous persons suggestion with running the batch file. Nope, that did not help. Failed to uninstall.
Thanks for your update. You can try copying the C:\Program Files (x86)\Sophos folder and its contents from a working machine to this problem machine, and try uninstalling again.
If that does not work, please raise a support case, and also include SDU logs. Support should be able to help remove Sophos via removal script.