Another anti-virus product is installed, but no Sophos Anti-Virus Competitor List.txt produced

There will likely be some left over reg key we need to find.

The two logs we need to check:

Sophos Anti-Virus Competitors List.txt.

avremove.log

Both will be in either %temp% or c:\windows\temp\

http://www.sophos.com/support/knowledgebase/article/27907.html

http://www.sophos.com/support/knowledgebase/article/38139.html

OD

A search of the entire hard drive fails to produce either "Sophos Anti-Virus Competitors List.txt" or "avremove.log".

There's an "AVRemove.exe" and a "AVRemoveW.exe" in c:\escw_9_sa\crt

Henry

Hi,

You can execute avremove.exe manually from a command prompt window to see if it returns anything helpful, though since you aren't getting the avremove.log, this likely won't be helpful. In a jam, you can open the zip file in the crt directory titled Data.zip and then open the productcatalog.xml file. Next, open the windows Registry editor (disclaimer on editing the registry http://www.sophos.com/support/knowledgebase/article/10388.html) and navigate to HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall. You will see several sub-keys with the format of {3F2504E0-4F89-11D3-9A0C-0305E82C3301}, commonly referred to as a GUID. Highlight each GUID and copy the GUID string. Then, search for that string in the ProductCatalog.xml. You should find that one matches an entry in our ProductCatalog.xml file. If so, this is the offending party. You should confirm that this product is uninstalled, make a backup of the reg key to be safe (right click, export), then delete this reg key. Once that is done, you can retry your installation and it should go through successfully. If not, repeat the process above. If no other entries are found, opening a support ticket with a Sophos Diagnostic Utility output is your next best option. KB 33533 has download instructions for the Diagnostic Utility.

Regards,

I've run into situations where something is being detected by the CRT and all attempts to find the offending fragment are futile.

I'm pretty sure this is a last resort type option, but it is documented in the Sophos knowledgebase. If you are absolutely certain the other product has been disabled or removed:

HKLM\Software\Sophos\SAVService\SetupOptions\SuppressCompetitorDetection
You can add this key, with a string value (REG_SZ type) and a value of 1 to stop the Sophos Competitor Removal Tool from running on deployment.

HKLM\Software\Sophos\SAVService\SetupOptions\SuppressPreSAVCDT
You can add this key, with a string value (REG_SZ type) and a value of 1 to stop the Sophos Competitor List Check from running on deployment.

When set to zero, this key checks for competitor security software and reports on its presence, but does not attempt removal.

Detailed in this KB:

http://www.sophos.com/support/knowledgebase/article/36207.html

I spent many hours this afternoon and finally found the little McAfee fragment deep in the registry.  Yes the sophos competitor file did exist and I looked straight past the instruction that said Start Run %temp%, as this is where the file was hiding in the local settings of the current user.  Once I located it, I found the fragment and removed it from the registry.  Be patient and find that file and you will be rewarded.  I am a happy little camper now.