Cant Install Intercept X because another Antivirus is installed.

Hi Peter Kekich,

Most likely, there’s still some remnant of Trend Micro on those machines' registry keys. Unless you can wipe clean the registry keys for the old AV, you’ll only get the same error when you perform the installation. You may try asking the Trend Micro support team if they have some registry clean-up tool to clean on the system before running the installation. 

I understand that you'd like to see what parts of TM were detected during the sophos installation. I'd prefer to see that in the sophos install logs, too. Probably because of some compliance stuff they cannot provide you that information here.

In case of TM WFBS you could search manually by following the article from TM https://success.trendmicro.com/solution/1117997-uninstalling-worry-free-business-security-services-wfbs-svc-agents#collapseThree

Or get the TM "Security Agent Uninstall Tool" from TM support, if a support contract or ex-contract exists.

I ran the Security Agent uninstall tool and verified all registry entries have been removed based on a KB article from Trend Micro. Still no luck.

If you look in: "C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp\crt\data.zip" at ProductCatalog.xml it hints at what is being looked for.

I suggest running Process Monitor as well to highlight the key being found.

Maye:

0A07E717-BB5D-4B99-840B-6C5DED52B277
or
Wofie

under:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
or
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Uninstall

But the Registry events in a PML should confirm what is being found.

That said, if you copy the "crt" folder to the desktop for example from the cache location above, in an admin prompt you can run:

.\AVRemoveW.exe -d -t

%temp%\avremove.log will highlight what is being found.

The path to the ProductCatalog.xml was brilliant. Once I was able to look in that location I was able to see that this was the culprit: 0A07E717-BB5D-4B99-840B-6C5DED52B277 within the registries. By removing it, I was able to install Intercept X with no problem. Thanks for the help.

Sophos User930 is good :-)