Can't Uninstall Sophos Endpoint 9.5

Hi everyone,

One of my Windows 2003 server (out of about 15 already installed with Sophos 9.5) is having strange Sophos issues. I can't get it to auto update, doesn't show up correctly in the enterprise manager, things like that.

As a first step in troubleshooting, I'm trying to completely uninstall Sophos from that server. Everytime I try this using the Add/Remove programs, I get:

The feature you are trying to use is on a network resource that is unavailable.

..enter an alternate path to a folder containing "sophos anti-virus.msi" in the box below.

Problem is, I don't have this msi file on any network location. If I manually navigate to the SophosUpdate share / CIDs / S000 /  SAVSCFXP / savxp, I can see a MSI file with that name, but it doesn't work for the uninstaller.

I still see the Sophos shield icon, and when I try to double click it, I get many error boxes starting with one related to CVersionPanelDLG: Initialize: Line 110. All those errors tells me something is seriously hosed with my current Sophos installation.

I cannot reinstall the product from the Enterpise Console - it errors out, which makes sense because there's obviously something very wrong with what is currently running on that server.

What's the trick to uninstalling Sophos on this server so I can reinstall it and start over? Thanks!

:7695
  • Hi,

    Typically you get this sort of error removing Sophos AV if the cache of AutoUpdate is removed before you try and remove Sophos in the managed install scenario.  For a managed install AutoUpdate installs Sophos Anti-Virus and therefore the source of the install is:

    "C:\ProgramData\Sophos\AutoUpdate\cache\savxp\" on a Vista+ machine (adjust for other platforms), this source location is stored in the InstallSource value for the product in the registry, I.e.

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9ACB414D-9347-40B6-A453-5EFB2DB59DFA}\InstallSource

    on 64-bit adjust again as required.

    The DisplayName key will show "Sophos Anti-Virus" so you know you've found the right key.

    So typically you should be able to copy the cache directory from a machine running the same version to this machine and just browse when prompted or move it to the location that is in the registry key InstallSource.

    Another option might be to use the copy of the msi file that is stored in the "\windows\installer\" directory.  The filenames are a bit cryptic but if you look at the "Subject" properties (suggest adding this column in the Explorer view), you should be able to spot the MSI file of SAV.  Once you find that you could right click on it and choose uninstall.  

    I would opt for the first method first though and then try the installer directory technique.

    Jak

    :7707
  • Thanks for the help. Unfortunately, doing a full search for the file it's requesting on the local file system "Sophos Anti-Virus.msi" brings up only two results, and right clicking on those and selecting Uninstall errors out with "only valid for products that are installed".

    Checking the registry location you suggested didn't exist, but I did find what I think could be the problem. I think the entry in the Add/remove programs is for version 7.6, which would make sense because we did recently upgrade to 9.5. I still have the old Interchck folder on my Enterprise server, and that contained the file "sophos anti-virus.msi" in lower case, which is what the Uninstaller was asking for.

    Unfortunately, it still errored out as my original post. But I have confirmed that the Product Version for the entry that is in my Add/Remove programs is 7.6.20, which makes sense why the MSI file for 9.5 isn't working as an uninstaller.

    Also, in my Program Files / Sophos / Sophos Antivirus folder, I have files in there with a version number of 9.5 - probably leftover from my previous failed attempts to install 9.5. But again, using the right-click-to-uninstall method on a 9.5 MSI file errors out with "the product is not installed".

    So basically I'm thinking I need to get rid of every trace of every version of Sophos on this server in order to truly start over. Any thoughts?

    :7711
  • I have seen similar issues on some machines. We've used msicuu2.exe to remove the Installer information for the Sophos products.

    Christian

    :7723
  • Did you find the MSI file of Sophos AV in the directory:

    \windows\installer\

    It will not be called "Sophos Anti-Virus.msi", for that reason you need to add on the column heading "Subject" to help you find it.

    What happens if you right click on that file and select uninstall?

    Jak

    :7731
  • Yes, sorry I wasn't accurate before. Right clicking the appropriate Sophos msi file in windows/installer (after showing Subject and finding it that way) returns "The action is only valid for products that are currently installed".

    I'm trying the msicuu2.exe route now, will let you know.

    After using msicuu2.exe, I the old 7.x entry in Add/remove programs was gone, and I uninstalled the other Sophos entries as well (Remote Management and Auto Update).

    Now, unfortuantely, the Sophos services are still installed and running, and C:\Program Files\Sophos still has a ton of in use files on it, telling me that SOphos actually did not properly uninstall. So aggravating! Any ideas?

    :7761
  • If that approach doesn't work I would suggest a manual removal.

    I've put some detail in this post:

    about things to remove.

    If you stop all the services you should be able to start hacking out files.  The other option is to call support and see if they have any scripts to remove SAV.

    Regards

    Jak

    :7767
  • We have had this issue and its not that you're missing any files, its just that Sophos is running.

    Go in an run task manager.  Go and kill your SAVSerice and SAVAdminService.  After killing them (it may take a few trys) uninstall the product.  This will take care of it.

    :7771
  • There are no Sophos related services running, and nothing running in the taskbar. When I try to delete the Sophos folder, the first thing it yells at me is for SavShellExt.dll, which makes me think that I truly need a dedicated uninstaller app or script. I'm going to start following the manual uninstall method posted above before contacting Support.

    On another note, is there any method for making this **bleep** Sophos forum remember my login and password?!? I've had to type it in something like 5 times today, basically every time I visit.

    :7781
  • Oh @*!# - sorry, I should have mentioned that msicuu2 does not uninstall a product. It just deletes the Installer information so the next time an install is attempted the path for a "first install" is taken. So after using it one either has to scrape the remains but the idea is that you then can successfully install the product again (and in case you want to get rid of it that the uninstall will work also).

    Christian   

    :7817
  • Thanks JAK perfect solution....

    :19991
  • Sorry for the delay answer, I have this issue too, I use the stand alone installer to solve, I just start the installation, and install before this I uninstall the endpoint, and install again from the console, hope to help anyone.

    :20001

  • jak wrote:

    Did you find the MSI file of Sophos AV in the directory:

    \windows\installer\

    It will not be called "Sophos Anti-Virus.msi", for that reason you need to add on the column heading "Subject" to help you find it.

    What happens if you right click on that file and select uninstall?

    Jak


    This worked well for us with a borked 9.0.5 client installation. Add points to this user!!!

    If you are doing this for a broken client installation, note that the MSI file had to be renamed to match the original file. In this case 'Sophos Anti-Virus.msi'. It didn't work until the rename. Then the regular uninstall worked pointing to the \windows\installer directory (hidden system folder).

    :37385
  • I know this is an older thread, but after following it, it set me on the right  track. When I tried removing the A/V from control panel, I got the same message saying the source wasn't available. I didn't have the MSI in any folder I could find. What I ended up doing was searching C:\windows\installer for "sophos" (without the quotes) and it found two msi files. I right-clicked on the files and went to properties, and then the summary tab and it showed me that it was a Sophos A/V file. The first was named 6cd0d5c2.msi. I made a note of this file name, just in case it was the wrong one, and renamed it sophos anti-virus.msi. Pointed the uninstaller prompt to this path and file, and it went straight through. The dates on the two files were a couple of years apart. I went for the newest file available.

    That's what worked for me - oh, and this was on an XP machine.

    Thanks everyone else for getting me on the right track.

    :44777
  • I was getting the error also and could not uninstall and was able to run the new MS tool that replaced the Office installer cleanup tool.

     

    https://support.microsoft.com/en-us/help/17588/windows-fix-problems-that-block-programs-being-installed-or-removed

     

  • In reply to shawn williams:

    Hello Shawn,

    Were you able to remove Sophos completely and reinstall?

    Please let us know if you still need assistance.