This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cannot uninstall Sophos AV Standalone from home machine - because Sophos client firewall cannot be removed either.

Windows 10

I previously protected my home computer as standalone from my previous company. That company have stopped using Sophos so i need to uninstall so that i can install Sophos Home.

 

However whenever I try to uninstall Sophos firewall I get an error message:-

 

 "the operating system does not support running sophos client firewall"



Sophos Endpoint cannot be uninstalled until Sophos firewall has been uninstalled

 

I have tried Microsoft Fix It tool to try to remove this Sophos component but it does not find Sophos firewall as an app.

I have tried Opening Windows Services - Stopping any Sophos related services and then uninstall, but that also does not work and gives the same error

 

Any suggestions please

Graham



This thread was automatically locked due to age.
  • Given this error:

    MSI (s) (CC:98) [17:07:27:819]: Doing action: LaunchConditions
    Action ended 17:07:27: AppSearch. Return value 1.
    Action start 17:07:27: LaunchConditions.
    MSI (s) (CC:98) [17:07:27:821]: Product: Sophos Client Firewall -- The operating system does not support running Sophos Client Firewall.

    The operating system does not support running Sophos Client Firewall.
    Action ended 17:07:27: LaunchConditions. Return value 3.
    Action ended 17:07:27: INSTALL. Return value 3.

    I wonder if you could bypass this by editing the MSI file you're using to uninstall.  How about:

    1. Locate the file "Sophos Client Firewall.msi" which is in the AutoUpdate Cache directory. E..g \programdata\sophos\autoupdate\cache\...  I assume this is the same version as the version installed.  If not maybe try taking a copy of C:\Windows\Installer\ca4ec1.msi and editing that.

    2. Make a copy of it "Sophos Client Firewall.msi" so you have a backup.

    3. Create a new text file called editMSI.vbs (ensure it has the extension .vbs and not .vbs.txt) and paste the following.

    Dim oInstaller : Set oInstaller = CreateObject("WindowsInstaller.Installer")
    Dim oDatabase : Set oDatabase = oInstaller.OpenDatabase(WScript.Arguments(0),1)
    Dim sql : sql = "delete FROM `InstallExecuteSequence` WHERE `Action` = 'LaunchConditions'"
    Dim oUpdate : Set regView = oDatabase.OpenView(sql)
    oUpdate.Execute
    oDatabase.Commit
    oUpdate.Close
    Set oUpdate = Nothing
    Set oDatabase = Nothing
    Set oInstaller = Nothing

    4. Save the VBS file next to the "Sophos Client Firewall.msi" file.

    5. In a command prompt CD to the location of the file and run:
    cscript editmsi.vbs "Sophos Client Firewall.msi"

    This should update the file  "Sophos Client Firewall.msi", deleting the LaunchConditions action from the InstallExeccuteSequence table.

    6. Once edited, you could use this MSI to uninstall.

    MsiExec.exe /x "Sophos Client Firewall.msi" /qn REBOOT=SUPPRESS /L*v %windir%\Temp\SCFUninstallLog.txt 

     

    If this fails, maybe change the VBS line:

    Dim sql : sql = "delete FROM `InstallExecuteSequence` WHERE `Action` = 'LaunchConditions'"

    To

    Dim sql : sql = "delete FROM `InstallUISequence` WHERE `Action` = 'LaunchConditions'"

    To update the MSI file a second time (updating the other table that references this action) before retrying.

    Hope it help.

    Regards,

    Jak

  • jak

     

    Thanks, i followed the instructions but i am afraid it has not resulted in uninstall sophos cient firewall.. the same error still appears.

    Here is the log file

    === Verbose logging started: 14/01/2018 13:03:47 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\WINDOWS\system32\MsiExec.exe ===
    MSI (c) (34:90) [13:03:47:212]: Resetting cached policy values
    MSI (c) (34:90) [13:03:47:212]: Machine policy value 'Debug' is 0
    MSI (c) (34:90) [13:03:47:212]: ******* RunEngine:
    ******* Product: Sophos Client Firewall.msi
    ******* Action:
    ******* CommandLine: **********
    MSI (c) (34:90) [13:03:47:213]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (34:90) [13:03:50:214]: Failed to grab execution mutex. System error 258.
    MSI (c) (34:90) [13:03:50:267]: Cloaking enabled.
    MSI (c) (34:90) [13:03:50:267]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (34:90) [13:03:50:282]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (8C:48) [13:03:50:290]: Running installation inside multi-package transaction C:\WINDOWS\system32\Sophos Client Firewall.msi
    MSI (s) (8C:48) [13:03:50:290]: Grabbed execution mutex.
    MSI (s) (8C:7C) [13:03:50:293]: Resetting cached policy values
    MSI (s) (8C:7C) [13:03:50:293]: Machine policy value 'Debug' is 0
    MSI (s) (8C:7C) [13:03:50:293]: ******* RunEngine:
    ******* Product: C:\WINDOWS\system32\Sophos Client Firewall.msi
    ******* Action:
    ******* CommandLine: **********
    MSI (s) (8C:7C) [13:03:50:293]: Note: 1: 2203 2: C:\WINDOWS\system32\Sophos Client Firewall.msi 3: -2147287038
    MSI (s) (8C:7C) [13:03:50:294]: MainEngineThread is returning 2
    MSI (s) (8C:48) [13:03:50:296]: User policy value 'DisableRollback' is 0
    MSI (s) (8C:48) [13:03:50:296]: Machine policy value 'DisableRollback' is 0
    MSI (s) (8C:48) [13:03:50:297]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (8C:48) [13:03:50:298]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
    MSI (c) (34:90) [13:03:50:301]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
    MSI (c) (34:90) [13:03:50:302]: MainEngineThread is returning 2
    === Verbose logging stopped: 14/01/2018 13:03:50 ===

  • This message:

    Failed to grab execution mutex. System error 258.

    would suggest that MSI is performing another installation.

    If you wait/reboot and try again, do you keep getting this?

    Regards,

    Jak