Can't Uninstall Sophos Endpoint 9.5

Hi,

Typically you get this sort of error removing Sophos AV if the cache of AutoUpdate is removed before you try and remove Sophos in the managed install scenario.  For a managed install AutoUpdate installs Sophos Anti-Virus and therefore the source of the install is:

"C:\ProgramData\Sophos\AutoUpdate\cache\savxp\" on a Vista+ machine (adjust for other platforms), this source location is stored in the InstallSource value for the product in the registry, I.e.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9ACB414D-9347-40B6-A453-5EFB2DB59DFA}\InstallSource

on 64-bit adjust again as required.

The DisplayName key will show "Sophos Anti-Virus" so you know you've found the right key.

So typically you should be able to copy the cache directory from a machine running the same version to this machine and just browse when prompted or move it to the location that is in the registry key InstallSource.

Another option might be to use the copy of the msi file that is stored in the "\windows\installer\" directory.  The filenames are a bit cryptic but if you look at the "Subject" properties (suggest adding this column in the Explorer view), you should be able to spot the MSI file of SAV.  Once you find that you could right click on it and choose uninstall.  

I would opt for the first method first though and then try the installer directory technique.

Jak

Thanks for the help. Unfortunately, doing a full search for the file it's requesting on the local file system "Sophos Anti-Virus.msi" brings up only two results, and right clicking on those and selecting Uninstall errors out with "only valid for products that are installed".

Checking the registry location you suggested didn't exist, but I did find what I think could be the problem. I think the entry in the Add/remove programs is for version 7.6, which would make sense because we did recently upgrade to 9.5. I still have the old Interchck folder on my Enterprise server, and that contained the file "sophos anti-virus.msi" in lower case, which is what the Uninstaller was asking for.

Unfortunately, it still errored out as my original post. But I have confirmed that the Product Version for the entry that is in my Add/Remove programs is 7.6.20, which makes sense why the MSI file for 9.5 isn't working as an uninstaller.

Also, in my Program Files / Sophos / Sophos Antivirus folder, I have files in there with a version number of 9.5 - probably leftover from my previous failed attempts to install 9.5. But again, using the right-click-to-uninstall method on a 9.5 MSI file errors out with "the product is not installed".

So basically I'm thinking I need to get rid of every trace of every version of Sophos on this server in order to truly start over. Any thoughts?

I have seen similar issues on some machines. We've used msicuu2.exe to remove the Installer information for the Sophos products.

Christian

Did you find the MSI file of Sophos AV in the directory:

\windows\installer\

It will not be called "Sophos Anti-Virus.msi", for that reason you need to add on the column heading "Subject" to help you find it.

What happens if you right click on that file and select uninstall?

Jak

Yes, sorry I wasn't accurate before. Right clicking the appropriate Sophos msi file in windows/installer (after showing Subject and finding it that way) returns "The action is only valid for products that are currently installed".

I'm trying the msicuu2.exe route now, will let you know.

After using msicuu2.exe, I the old 7.x entry in Add/remove programs was gone, and I uninstalled the other Sophos entries as well (Remote Management and Auto Update).

Now, unfortuantely, the Sophos services are still installed and running, and C:\Program Files\Sophos still has a ton of in use files on it, telling me that SOphos actually did not properly uninstall. So aggravating! Any ideas?

If that approach doesn't work I would suggest a manual removal.

I've put some detail in this post:

/search?q= 7387

about things to remove.

If you stop all the services you should be able to start hacking out files.  The other option is to call support and see if they have any scripts to remove SAV.

Regards

Jak

We have had this issue and its not that you're missing any files, its just that Sophos is running.

Go in an run task manager.  Go and kill your SAVSerice and SAVAdminService.  After killing them (it may take a few trys) uninstall the product.  This will take care of it.

There are no Sophos related services running, and nothing running in the taskbar. When I try to delete the Sophos folder, the first thing it yells at me is for SavShellExt.dll, which makes me think that I truly need a dedicated uninstaller app or script. I'm going to start following the manual uninstall method posted above before contacting Support.

On another note, is there any method for making this **bleep** Sophos forum remember my login and password?!? I've had to type it in something like 5 times today, basically every time I visit.

Oh @*!# - sorry, I should have mentioned that msicuu2 does not uninstall a product. It just deletes the Installer information so the next time an install is attempted the path for a "first install" is taken. So after using it one either has to scrape the remains but the idea is that you then can successfully install the product again (and in case you want to get rid of it that the uninstall will work also).

Christian   

Thanks JAK perfect solution....