Uninstall Sophos endpoint security and control

Dare I say it Christian - it looks to have worked???

Thank you a thousand times over.  I will now have another go with installing the alternate firewall and AV.  It is a pity that SOPHOS stopped supporting XP-Pro for AV otherwise I would not have moved providers but I have a couple of older machines that provide invaluable services and that are running happily on XP-Pro.

Really appreciate your time in following through with this one.

Paul

Hi Christian

Me again.  This time I am on the second (of three) XP machines to remove Sophos Endpoint from it.

I ran exactly the same sophos.bat removal file as before and was able to remove the registry entries and all but 4 of the folders namely:

1. C:\Documents and Settings\All Users\Application Data
2. C:\Documents and Settings\All Users\Application Data\Sophos
3. C:\Program Files and
4. C:\Program Files\Sophos

Despite several reboots I still cannot get rid of these folders as the Laptop says they are in use and indeed the Sophos APP does pop up in the SYSTRAY.

What did I miss or what is different please about this UNINSTALL?  All other folders are now gone!  I note that there still appear to be some references to SOPHOS in the Registry (running REGEDIT).  Should I delete those, reboot and then be able to remove the remaining folders?

Thanks

Paul

Hello Paul,

you wouldn't want to remove 1. and 3.
Which folder(s) under C:\Program Files\Sophos\ are still there? the Sophos APP does pop up in the SYSTRAY - if the Sophos icon is still there it suggests that AutoUpdate hasn't been uninstalled correctly. Is it gone from Add/Remove Programs?

Christian

Hi Christian

I will try and remove them via Add/remove programs as you said ... they are still there!  Add/remove seems to have worked for the Auto Update.  I forgot to use that and it has taken the Auto update out of the systray.  The SAV though failed to uninstall via Add/Remove programs.

Paul

Hello Paul,

if Add/Remove fails (did it pop up an error?) please retry with msiexec.exe requesting a log. This should tell more.

Christian

Hi Christian

Yes the error on uninstalling Sophos Anti Virus is Fatal error during installation.

The error log show:

=== Verbose logging started: 12/4/2017  17:47:34  Build type: SHIP UNICODE 3.01.4001.5512  Calling process: C:\windows\system32\msiexec.exe ===
MSI (c) (EC:B0) [17:47:34:815]: Resetting cached policy values
MSI (c) (EC:B0) [17:47:34:815]: Machine policy value 'Debug' is 0
MSI (c) (EC:B0) [17:47:34:815]: ******* RunEngine:
           ******* Product: {09863DA9-7A9B-4430-9561-E04D178D7017}
           ******* Action:
           ******* CommandLine: **********
MSI (c) (EC:B0) [17:47:34:815]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (EC:B0) [17:47:34:815]: Grabbed execution mutex.
MSI (c) (EC:B0) [17:47:34:875]: Cloaking enabled.
MSI (c) (EC:B0) [17:47:34:875]: Attempting to enable all disabled priveleges before calling Install on Server
MSI (c) (EC:B0) [17:47:34:885]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (F8:A8) [17:47:34:905]: Grabbed execution mutex.
MSI (s) (F8:9C) [17:47:34:905]: Resetting cached policy values
MSI (s) (F8:9C) [17:47:34:905]: Machine policy value 'Debug' is 0
MSI (s) (F8:9C) [17:47:34:905]: ******* RunEngine:
           ******* Product: {09863DA9-7A9B-4430-9561-E04D178D7017}
           ******* Action:
           ******* CommandLine: **********
MSI (s) (F8:9C) [17:47:34:905]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (F8:9C) [17:47:34:905]: MainEngineThread is returning 1605
MSI (c) (EC:B0) [17:47:34:905]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (EC:B0) [17:47:34:905]: MainEngineThread is returning 1605
=== Verbose logging stopped: 12/4/2017  17:47:34 ===

Paul

Hello Paul,

somewhat strange - 1605 is ERROR_UNKNOWN_PRODUCT This action is only valid for products that are currently installed. Is it still in Add/Remove, if so - please check both HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\. There should be an UninstallString in one of these locations (might or might not name 09863DA9-... as the product). Retry the msiexec.exe with this product code as before but omit the /qn switch.

Christian

It is on an XP Pro 32 bit system Christian so there are only HKEY_ registry entries nothing like what you describe above.

Paul

Hello Paul,

sorry, thought that everybody is aware of the HKLM and HKCU shorthands for HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER.

Christian

My bad then!

My Registry has neither entry Christian.

Paul