Uninstall Sophos endpoint security and control

I am also trying to uninstall Sophos Endpoint from an XP Pro (SR3) computer too.  I have disabled Tamper Protection and been able (through Control Panel - Remove Programs) to remove the SOPHOS AUTO-UPDATING.

I then tried to remove the FIREWALL program but got ERROR 1324. The path My Pictures contains an invalid character.

How do I proceed?

Paul

Hello Paul,

could you show the corresponding log?

Christian

Thanks Christian.

There is nothing at that location either and yes SAV is still is showing in Add/Remove Programs.  Pushing the Remove it gathers all the information etc. then rolls back and Fails with the Fatal error during installation still.

Paul

Hello Paul,

strange that Add/Remove and the Installer disagree in this manner (usually it's the other way round, not in Add/Remove but the Installer considers it installed). Please search the registry for 09863DA9-7A9B-4430-9561-E04D178D7017 and 9AD36890B9A7034459160ED471D80771.

Apart from it being listed in Add/Remove - is SAV installed (e.g. the Sophos Anti-Virus service still present and running)? You want to remove Sophos because you are considering another and still supported AV product? You still have a thirds XP machine with Sophos 10.6.3 installed? If so do not uninstall.

Christian

Hi Christian

I searched on both 09863DA9-7A9B-4430-9561-E04D178D7017 and 9AD36890B9A7034459160ED471D80771 and came up with nothing.

Yes, because Sophos no longer supports AV for XP-Pro (and AVAST do) I am migrating all our network to AVAST.  Installing AVAST while there are any remnants of SOPHOS around causes issues.  After this current XP machine I still have one further machine on XP and then one on Windows 10 to go.

Am I correct in thinking (given the timing of your replies) that you are in the UK?  I am very pleased that we are making some progress - one machine done and 3 to go - but it is slow progress!!  Thank you for hanging in with this.

Paul

Christian

Well having played around a bit with msconfig and regedit I have got rid of everything now except SavShellExt.dll in C:\Program Files\Sophos\Sophos Anti-Virus.

When I try to delete this file I get the message

Cannot delete SavShellExt.dll Access is denied

Presumably because the file is still getting loaded somehow or other.

How do I proceed please?

Thanks

Hello Paul,

not U.K., Austria, Vienna.

SavShellExt.dll is a shell extension (there are several references in the registry), loaded by Explorer when you right-click to get the context menu. You can delete it after the login provided you don't open the context menu. The Sysinternals MoveFile utility lets you schedule the deletion.  

Christian

Well thank you anyway Christian and Guten Tag!

Am trying the Move and rebooting.

SO I wrote the following bat file:
C:\Documents_and_Settings\Paul\My_Documents\Downloads\pendmoves.exe C:\Program_Files\Sophos\Sophos_Anti-Virus\SavShellExt.dll DELETE

and ran it and i got the reply from CMD The system cannot find the path specified.

What did I do wrong please?  Microsoft webpage was not helpful.

Paul

Hello Paul,

did you indeed use underscores? Normally you'd put a path with special characters like blank between double quotes like this: "C:\Documents and Settings\Paul\My Documents\Downloads\pendmoves.exe". Same for the DLL of course.

Christian 

I removed the underscores and reran it and got back C: Documents is not recognized as an internal or external command.

I used the " " and got The system cannot finf the path specified.

Hello Paul,

with blanks in both the command's and the target's path it's "\path to\command.exe" "\path to\the target" parameter. Cannot find the path suggests that either you didn't put quotes around the full path of the DLL or it isn't there.

Christian

Hello Paul,

with blanks in both the command's and the target's path it's "\path to\command.exe" "\path to\the target" parameter. Cannot find the path suggests that either you didn't put quotes around the full path of the DLL or it isn't there.

Christian

So as you can see - here is the file ...

And this is a copy from the batch file Christian

"C:\Documents_and_Settings\Paul\My_Documents\Downloads\pendmoves.exe" "C:\Program_Files\Sophos\Sophos_Anti-Virus\SavShellExt.dll" DELETE

What did I get wrong?

Paul

Hello Paul,

could you show what's in the cmd window (the PendMoves command and its output)? ... I see you did. Well, there's still the underscores (or did you put them in just for this post)

Christian

Sorry - deleted the spaces saved the file and reran it.

Below is the screen

Hello Paul,

argh! Dementia, I'm getting old! I've overlooked that you use (and I did use it as well) PendMoves instead of MoveFile (at least this shows that screenshots have their merit).

Christian

Thanks again - success!  2 down one to go!

I will work on that in a few days and post back here as to how it works out.  Thank you Christian for your hard work.  Do you work for Sophos?

Paul

Hello Paul,

Do you work for Sophos?
Apparently in a certain sense. But no - I'm neither an employee nor a partner, reseller, or freelancer.

Christian

Ha-ha!  Well I will run the batch command on the remaining XP machine and see where that takes me I guess.

So running the bat file on the last XP Pro machine I have Christian I got the following log files:

Uninstall_SAV9-10_SophosLog1.txt

=== Verbose logging started: 13/12/2017  12:01:27  Build type: SHIP UNICODE 3.01.4001.5512  Calling process: C:\WINDOWS\system32\msiexec.exe ===
MSI (c) (D0:40) [12:01:27:343]: Resetting cached policy values
MSI (c) (D0:40) [12:01:27:343]: Machine policy value 'Debug' is 0
MSI (c) (D0:40) [12:01:27:343]: ******* RunEngine:
           ******* Product: {A805FB2A-A844-4cba-8088-CA64087D59E1}
           ******* Action:
           ******* CommandLine: **********
MSI (c) (D0:40) [12:01:27:343]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (D0:40) [12:01:27:343]: Grabbed execution mutex.
MSI (c) (D0:40) [12:01:27:406]: Cloaking enabled.
MSI (c) (D0:40) [12:01:27:406]: Attempting to enable all disabled priveleges before calling Install on Server
MSI (c) (D0:40) [12:01:27:421]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (E4:4C) [12:01:27:468]: Grabbed execution mutex.
MSI (s) (E4:40) [12:01:27:468]: Resetting cached policy values
MSI (s) (E4:40) [12:01:27:468]: Machine policy value 'Debug' is 0
MSI (s) (E4:40) [12:01:27:468]: ******* RunEngine:
           ******* Product: {A805FB2A-A844-4cba-8088-CA64087D59E1}
           ******* Action:
           ******* CommandLine: **********
MSI (s) (E4:40) [12:01:27:484]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (E4:40) [12:01:27:484]: MainEngineThread is returning 1605
MSI (c) (D0:40) [12:01:27:484]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (D0:40) [12:01:27:484]: MainEngineThread is returning 1605
=== Verbose logging stopped: 13/12/2017  12:01:27 ===

And for Uninstall_SAV9-10_SophosLog2.txt

=== Verbose logging started: 13/12/2017  12:01:27  Build type: SHIP UNICODE 3.01.4001.5512  Calling process: C:\WINDOWS\system32\msiexec.exe ===
MSI (c) (64:80) [12:01:27:546]: Resetting cached policy values
MSI (c) (64:80) [12:01:27:546]: Machine policy value 'Debug' is 0
MSI (c) (64:80) [12:01:27:546]: ******* RunEngine:
           ******* Product: {09863DA9-7A9B-4430-9561-E04D178D7017}
           ******* Action:
           ******* CommandLine: **********
MSI (c) (64:80) [12:01:27:546]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (64:80) [12:01:27:546]: Grabbed execution mutex.
MSI (c) (64:80) [12:01:27:546]: Cloaking enabled.
MSI (c) (64:80) [12:01:27:546]: Attempting to enable all disabled priveleges before calling Install on Server
MSI (c) (64:80) [12:01:27:546]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (E4:4C) [12:01:27:562]: Grabbed execution mutex.
MSI (s) (E4:60) [12:01:27:562]: Resetting cached policy values
MSI (s) (E4:60) [12:01:27:562]: Machine policy value 'Debug' is 0
MSI (s) (E4:60) [12:01:27:562]: ******* RunEngine:
           ******* Product: {09863DA9-7A9B-4430-9561-E04D178D7017}
           ******* Action:
           ******* CommandLine: **********
MSI (s) (E4:60) [12:01:27:562]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (E4:60) [12:01:27:562]: MainEngineThread is returning 1605
MSI (c) (64:80) [12:01:27:562]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (64:80) [12:01:27:562]: MainEngineThread is returning 1605
=== Verbose logging stopped: 13/12/2017  12:01:27 ===

Nothing seems to have uninstalled on this machine!

The bat file was

MsiExec.exe /X{A805FB2A-A844-4cba-8088-CA64087D59E1} /qn REBOOT=SUPPRESS /L*v %windir%\Temp\Uninstall_SAV9-10_SophosLog1.txt
MsiExec.exe /X{09863DA9-7A9B-4430-9561-E04D178D7017} /qn REBOOT=SUPPRESS /L*v %windir%\Temp\Uninstall_SAV9-10_SophosLog2.txt

as before.

Paul