This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Uninstall Sophos endpoint security and control

My PC (Windows XP) has been running Sophos endpoint security and control for many years i a domain environment.

When I retired the PC was disconnected from the domain and the updates are not running any longer.

I still have the PC and need to uninstall this software.

In Add or Remove programs three Sophos entries:

Sophos Anti-Virus

Sophos AutoUpdate

Sophos Remote Management System

How should I do?

:33387


This thread was automatically locked due to age.
Parents
  • I am also trying to uninstall Sophos Endpoint from an XP Pro (SR3) computer too.  I have disabled Tamper Protection and been able (through Control Panel - Remove Programs) to remove the SOPHOS AUTO-UPDATING.

    I then tried to remove the FIREWALL program but got ERROR 1324. The path My Pictures contains an invalid character.

    How do I proceed?

    Paul

  • Hello Paul,

    could you show the corresponding log?

    Christian

  • Hello Paul,

    somewhat strange - 1605 is ERROR_UNKNOWN_PRODUCT This action is only valid for products that are currently installed. Is it still in Add/Remove, if so - please check both HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\. There should be an UninstallString in one of these locations (might or might not name 09863DA9-... as the product). Retry the msiexec.exe with this product code as before but omit the /qn switch.

    Christian

  • It is on an XP Pro 32 bit system Christian so there are only HKEY_ registry entries nothing like what you describe above.

    Paul

  • Hello Paul,

    sorry, thought that everybody is aware of the HKLM and HKCU shorthands for HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER.

    Christian

  • My bad then!

    My Registry has neither entry Christian.

    Paul

  • Hello Paul,

    and SAV is still in Add/Remove? Similar data is under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\ (in case of User type installs under the user's SID), if you can't find the ProductID you should find at least the DisplayName (Sophos Anti-Virus).

    Christian

  • Thanks Christian.

    There is nothing at that location either and yes SAV is still is showing in Add/Remove Programs.  Pushing the Remove it gathers all the information etc. then rolls back and Fails with the Fatal error during installation still.

     

    Paul

  • Hello Paul,

    strange that Add/Remove and the Installer disagree in this manner (usually it's the other way round, not in Add/Remove but the Installer considers it installed). Please search the registry for 09863DA9-7A9B-4430-9561-E04D178D7017 and 9AD36890B9A7034459160ED471D80771.

    Apart from it being listed in Add/Remove - is SAV installed (e.g. the Sophos Anti-Virus service still present and running)? You want to remove Sophos because you are considering another and still supported AV product? You still have a thirds XP machine with Sophos 10.6.3 installed? If so do not uninstall.

    Christian

  • Hi Christian

    I searched on both 09863DA9-7A9B-4430-9561-E04D178D7017 and 9AD36890B9A7034459160ED471D80771 and came up with nothing.

    Yes, because Sophos no longer supports AV for XP-Pro (and AVAST do) I am migrating all our network to AVAST.  Installing AVAST while there are any remnants of SOPHOS around causes issues.  After this current XP machine I still have one further machine on XP and then one on Windows 10 to go.

    Am I correct in thinking (given the timing of your replies) that you are in the UK?  I am very pleased that we are making some progress - one machine done and 3 to go - but it is slow progress!!  Thank you for hanging in with this.

    Paul

  • Christian

    Well having played around a bit with msconfig and regedit I have got rid of everything now except SavShellExt.dll in C:\Program Files\Sophos\Sophos Anti-Virus.

    When I try to delete this file I get the message

    Cannot delete SavShellExt.dll Access is denied

    Presumably because the file is still getting loaded somehow or other.

    How do I proceed please?

    Thanks

  • Hello Paul,

    not U.K., Austria, Vienna.

    SavShellExt.dll is a shell extension (there are several references in the registry), loaded by Explorer when you right-click to get the context menu. You can delete it after the login provided you don't open the context menu. The Sysinternals MoveFile utility lets you schedule the deletion.  

    Christian

Reply Children