anti-anti-virus virus???

I am currently deploying Symantec Anti-Virus Corporate edition 10, but for some reason when i push the install to one of the clients (only one of them, the others worked fine) it will install, but after a few minutes it uninstalls, i can't figure out why.... i've tried scanning with several anti-virus programs (stinger, and norton (after that scan finished it uninstalled again...)) and all the scans came up clean. i tried scanning the disk for errors, and looked for processes that shouldn't be there etc.... but i can't find anything wrong.
the system is running Win2k

could this be a virus? if so how would i find and eliminate it?

Alittle off subject...but relevant.

Recently I had an issue with MS Office...I run 3 versions 97 for Access , 200 Retail and 2003 outlook (comes with the server).

Realized I needed a tool for Access after installing all versions...stuck in the 97 disk installed the tools and the damn thing F&*ked my newer offices versions...started with unable to send email from open docs..then progressivly became worse...and worse..and worse

I tried to fix, repair reinstall...wasted a whole day, followed MS articles, used tools..and still could not get it to work...hacked the registry...

Then..after wasting far to many hours trying to fix it...the next morning....I formatted and reinstalled the machine from scratch....had a running stable machine by noon.

Sometimes...you just have to start fresh...

Being in a server enviroment...all data should reside on the server....

MLF

yea, thats what i'd like to do, but the pc is in regina, and i'm in manitoba....... its a pretty big hassle to do a clean install when you have to have it mailed to you then mail it back, and the whole time you have it the user is breathing down your neck asking when you'll be done..... :(

From what I understood about previous versions of Symantec AV CE....

you cannot update remote machines??

Have you used the removal tool posted in your previous thread??


MLF

well, since i only started here awhile ago i'm not exactly sure how the whole network setup works, but the updates do work over the network, and yes i did try that removal tool, but i wasn't really expecting it to work since v 10 isn't in the list of versions it removes... and i haven't been able to find a manual uninstall guide for v 10

i only had a minute to look over the thread but some viruses do prevent AV from installing, do a scan i safe mode... try to install another AV and see if it works (AVG ?).

Yes I understand updates work over the network...you update the server and then use that to update the clients....but when I contacted tech support...and asked about updating my remote vpn clients..they said that wasnt supported (v8.0)

Maybe you will just have to call symantec??

I have worked with them before and they were very knowledgable\helpful?

They also have a monitored newsgroup.

MLF

AVG [free] will not install onto a server, and as you already pay for Symantec ?????

You do ALL repairs / upgrades remotely ?

No IT type local to do the basics ?

yes symantec is paid for... and i'm not trying to install avg on a server, just on the problem pc.
i suppose there are people there that could do some very basic stuff, but most everything is done remotely from Head Office

Don't you have / couldn't you get a 'spare' PC, and send that out to them ?
They return the suspect item, for you to sort at your 'leisure' ?

My bad re: the AVG, I assumed YOU would install it via your system.

only spare we have that i know of is an xp machine thats nicer than what they have now, probably wouldn't get it back ;)

http://search.symantec.com/custom/us...256fc700654267

Symantec has pages on troubleshooting the "Cannot install" issues.

So I guess it depends on the error you are receiving.

Good idea Foxy.....

No down time.

MLF

xp..built in remote desktop....may make it easier to manage with the remote being xp.

Also....does the remote machine have any previous AV on it, or firewall...antispyware??

What do you use to administer it now???

How does it connect to you...just read something about port 139 needing to be open for updates???

MLF

thanks MLF, but that was one of the first places i looked, and its not so much that i can't install it, it just dosen't stay installed... :confused: does that make any sense??

i use VNC, and the machine had the previous version of Symantec (version 9.0.3)

the program...just uninstalls it self???

Or is hidden from the task bar??

I hide norton...the engineers always complain..."It slows down my machine, I dont need av, blah blah blah"...so I hide it.... ;)

How do you admin the machine?????

MLF

yea, i'm pretty sure it uninstalls itself, it is configured to be hidden on the taskbar, but i installed it, and while i was looking at the files (c:\program files\symantec (or something like that)) all the files dissappeared, and then i couldn't find it in the start menu either...


i'm not sure i understand what you mean by how do I admin the machine?

How do you connect to the machine if it is remote??

Ultra@VNC Viewer
is that what you mean? if not, i apoligize for my ignorance, i am rather new to the field, and there is much i don't know yet, so i'm not always sure what people are talking about....

anyway i just finished running AVG on that PC logged in as administrator, and it still came up clean.

yes

so you have admin rights on the machine??

Any other AV on the machine..ever??

You sure the machine is clean.???

I have never seen anything like that.....short of the install failing..and rolling back

Is the remote machine updated...I had one machine that needed an update of the MS Installer to put norton on it???

I think you are infected with something....MHO..of course.

MLF

yup, i have admin rights, as far as i know there has not been any other AV on there (of course i only just started here awhile back for my work practicum so i don't know the pcs history, tho i'm certain they've always been using symantec. ) i've run several different scans and they've all come up clean.... of course i guess a virus could be hiding somewhere, thats kinda what i suspect cause i've never seen anything do this before.

its not updated (43 critical/service packs) but neither where any of the others, and they all worked fine, but i am looking thru the available ones to see if any look relevant. (or will if i can get that stupid page to load....)

This is very odd.............I have come across viruses that kill running AV processes and block websites, but not one that uninstalls the whole application :confused:

All I can suggest is trying to catch the process that is doing it?

You might also look in the event logs to see if there are any clues there?

:)

Are there any errors/warnings in the system or application logs.

well, the other pcs that appear as "offline" on the symantec system center also have the same problem.

when logging in it gives the error " cannot find c:\prog~\common~\syman~\SNDInst.exe"
tho this isn't much of a suprise since the entire symantec program is deleted

i could not find any errors/warnings in the system or application logs of note...

i'm going to try installing an older version to see if it does the same thing, if not maybe i can push the update and get it to stick :killcompu

Older versions of the client will still connect to the server...and get updates.

Only thing with the newer version of the client...they seem to have fixed the extensive use of resources and problems with communications....if the machine doesnt consume alot of resources in the first place...shouldnt be an issue.

MLF

well, version 9.0.3 does the same thing, this time i watched the processes list and when the files started deleting the process msiexec came up, which is the same process that runs when it is installing.

I think that this will help:

Windows Installer CleanUp Utility

http://support.microsoft.com/default...b;en-us;290301

And then you can try to run
http://www.alonewolfsoft.narod.ru/page23.htm
click on "Загрузить" to download, it is registry cleaner/repair tool, freeware, noneed to install.

thanks MrBabis, the Windows Installer CleanUp Utility didn't do anything, but the registry cleaner worked! now i don't have to format all those PCs :D