Workaround for Symantec/Windows Installer Program problems on XP SP2

From: A. Wood (awood7_at_MSN.COM)
Date: 12/05/04

  • Next message: GreyMagic Security: "Online Script Decoder"
    Date:         Sat, 4 Dec 2004 23:33:24 -0800
    To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
    
    

    Hello all!

    For all of you who have had problems with Installing, upgrading, patching,
    or even using Symantec's products on Windows XP SP2, here is a document on
    how to undo the inoperable state that XP SP2 Leaves your computer in,
    manually uninstall your Symantec program, re-install Norton/Symantec
    products on your XP SP2 Box successfully and be able to be a happy camper.

    This paper also may solve people's problems with the XP SP2 version of
    Windows Installer not allowing even Administrators to install or even
    execute *.msi files.

    This is a very lenghty and very technical paper and was born out of the
    frustruation of inaccurate and poorly tested/researched articles on
    Symantec's website coupled with the huge amounts of people in Newsgroups and
    Bulletin Boards who are frustruated about this problem.

    If you do a search on Microsoft's XP Newsgroups for 'Symantec', 'Norton' or
    WMI, you'll see what I mean.

    If you'll notice from the XP and Symantec Symptoms in my paper below, XP
    gets locked down VERY hard as a result of installing Symantec's products on
    an XP SP2 Box.

    My Hopes are that this paper may save you all countless lost man hours in
    troubleshooting or even rebuilding your XP SP2 Boxes as a result of
    installing Symantec's Products on an XP SP2 Box.

    I'm not trying to be harsh or critical of Symantec, I'm just trying to make
    sure that no one else has to go through what I went through to get my
    Symantec Product (Norton SystemWorks 2005 - Standard) working correctly.

    Feel free to use this information in documentation or other related media
    (Especially if you're from Microsoft or Symantec and you're reading this
    mail!) so people can be educated about how to work around the new features
    of XP SP2. All that I ask is credit for the work that I have done.

    Finally, I may update/upgrade this paper as I look at the deeper cause of
    why this happened.

    I'm going to try and post this in as many places as possible so the most
    amount of people can get educated about this issue.

    Cheers!

    Aaron Wood
    Seattle, WA
    awood7@msn.com

    URL's Below May be Wrapped or Broken depending on your mail reader.

    =====================================================

                                    Manually Uninstalling a Corrupt Installation
    of Symantec/Norton Products.

                                    Repairing a Corrupt/Broken XP SP2 Version of
    Windows Installer/msiexec.

                                    By Aaron Wood - 12/3/2004

    Feel Free to re-publish or modify the information for your needs.

    Just give me credit if you wish to use this information on your web sites as
    this was a pain in the ass to figure out.

    Norton SystemWorks 2005 - Standard Edition used as the example in this
    paper.

    Norton SystemWorks includes the following Products:

    Norton AntiVirus

    Norton Utilities

    Norton GoBack (Not installed in this Example)

    CheckIt® Diagnostics

    System Optimizer

    The unofficial title of this paper is:
    _______________________________________

    "The Official 'How To Repair your XP SP2 Box from Buggy, poorly tested
    Symantec Products that lock down your XP Box' paper."

    (This paper can be used as a 'how to' guide to repair your Windows
    Installer/msiexec or as toilet paper if you need it)

    ##################

        Intro

    ##################

    I created this document as a guide for others who are experience problems
    with their XP SP2 Box when attempting to install Norton/Symantec Products or
    dealing with broken or corrupt installations following the installation of
    Windows XP SP2 over their currently installed Norton Products.

    What I found in my tests/trials is that the Symantec products seem to cause
    the Microsoft Windows Management Interface (WMI) to remove all permissions
    and access from even the Local Aministrator and essentially put the XP SP2
    into a lockdown of Programs, processes and permissions. To me it's very
    similar to the way ZoneAlarm puts a computer into Lockdown when it 'Protects
    the Client' from unauthorized program access or execution.

    I haven't determined what, how, or even when this lockdown happened, I'm
    just providing a fix for all those people I've noted in Newsgroups and other
    boards that are having a problem with their Symantec Installs and Windows
    Installer on XP SP2.

    If I were to make an educated guess, I would say that something with XP
    SP2's new 'Data Execution Prevention' (DEP) Feature and the Norton/Symantec
    installation process puts the XP computer into a lockdown. I haven't read
    all the Microsoft Public information regarding DEP so, at this point in my
    investigation, my deduction is nothing more than a 'best guess'.

    I have links at the bottom of this paper about DEP if anyone wants more
    information regarding this new feature in XP SP2.

    From what I have read on the public MS sites, XP SP2 includes a new version
    of Windows Installer (3.0 if memory serves) that is installed as part of the
    XP SP2 Service Pack installation process. Unfortunately, XP SP2 Windows
    Installer Redistributables are not available to the public at this time.
    (From what I've read on the MS Public Web site, it is available in the XP
    SP2 SDK) Regardless, this puts customers with XP SP2 Windows Installer
    issues in a bit of a Bind.

    I believe I have discovered an additional troubleshooting step that people
    can try to repair their Windows Installer issues. These Steps should be
    performed when all the steps in the MS KB Article "How to Resolve Common
    'Windows Installer' Problems" has been followed (a link is at the bottom of
    the page) and exhausted.

    ***********
      Scope
    ***********

    The Scope of this paper is to:

    - Provide a guide (not hard directions) that people can follow to remove
    most if not all traces of the Norton/Symantec Products on XP SP2. This
    guide was created after exhausting most, if not all, of Symantec's and
    Microsoft's KB articles (most of which don’t work or even exist IMO) on how
    to Uninstall Symantec's products from an XP SP2 box.

    - Provide a manual workaround for people who are not only unable to install
    Norton/Symantec Products but to provide another alternate solution to repair
    people's XP SP2 Windows Installer issues.

    *****************
    Disclaimer
    *****************

    Please note that this is only a guide and you should take precautions and
    steps to back up your work before beginning any of the steps I have
    described below. As previously stated, these directions were preformed on a
    clean XP SP2 install. Symantec's SystemWorks 2005 was installed over XP
    SP2.

    Furthermore, I did quite a few tests as well as flattening and rebuilding my
    XP Box from the ground up so all of the Symptoms noted below are the results
    of my tests.

    I would also recommend not attempting to use most of Symantec's KB articles
    on how to uninstall their products on XP SP2 as they clearly lack the
    correct steps for customers to remove the product from their XP SP2
    machines. There are a very few Symantec articles I would recommend using for
    this process and I will note them in the directions accordingly or in the
    reference section at the bottom of this paper.

    These directions are for the technically minded so If you don't know your
    way around the registry or don't feel comfortable tweaking your operating
    system in this manner, please do not attempt these steps. If you do perform
    these steps, you do so at your own risk and cost. This paper is just a
    documentation of the steps I took to repair my Machine.

    Contents:

    * Section 1 - Preparation for the Uninstall/Install/Repair Process

    This section covers the steps I took before I beginning the tweakage of my
    operating system.

    * Section 2 - Manual Uninstall of Symantec's SystemWorks 2005 - Standard
    Edition

    These are the steps I took to remove a corrupt installation of Symantec
    products from my computer.

    * Section 3 - WMI Lockdown workaround for Norton/Symantec and Windows
    Installer issues

    This section covers how to workaround the WMI 'Lockdown' and get your
    operating system back.

    * References

    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
    Section 1 - Preparation for the Uninstall/Install/Repair Process
    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

    One thing to keep in the back of your head is that you will need to reboot
    your XP SP2 box after EVERY single point in the Symantec
    install/uninstall/upgrade process.

    ****First, make sure your computer is off the network when you perform these
    steps****

    The Steps in Section 3 involve the stopping of the WMI service (winmgmt).
    Thw WMI service has a dependency on the XP 'Security Center' Service. This
    means that both services will stop as a result of Stopping the WMI Service.

    ****Secondly, BACK UP YOUR REGISTRY BEFORE YOU BEGIN!!!****

    You're going to be doing alot of Registry hacking so you will need to in the
    very least back up your HKLM hive.

    Here's how (you must have administrator/backup privileges to do this):

    1) Click 'Start'->'Run'

    2) In the space provided type (without the quotes 'regedit')

    3) Right-Click on 'My Computer' and select 'Export'.

    4) Enter the file name you would like to call this file and save it.

    It's going to take a quite a while to create this file so don't interrupt
    it.

    Make sure you back up the ENTIRE registry!!!

    ++++++++++++++++++++++++++++++++++

    Step 1 - Download Symantec Patches

    ++++++++++++++++++++++++++++++++++

    Before you begin, download any Symantec Updates for your product.

    Download for SystemWorks 2005 Standard Edition:

    ftp://ftp.symantec.com/public/english_us_canada/linked_files/nsw/patchNSW-std.exe

    ++++++++++++++++++++++++++++++++++

    Step 2 - For ZoneAlarm Users

    ++++++++++++++++++++++++++++++++++

    - If you are Running Zone Alarm Firewall Products on your XP Box,
    Temporarily Disable 'Protect the Client' option on your firewall until the
    uninstall, patch, and/or install process is completed.

    - If you're running both the XP and Zone Alarm Firewall, disable the XP
    Firewall.

    ++++++++++++++++++++++++++++++++++

    Step 3 - Disable System Restore

    ++++++++++++++++++++++++++++++++++

    If there's one thing that I agree with Symantec on is to disable your System
    Restore Service until you are sure that there aren't any viruses on your
    computer. The last thing you want is to have a restore point that contains
    viruses.

    %SystemRoot%\system32\services.msc

    Find the System Restore Service, select the properties, stop and disable the
    service until this process is completed and you have verified that you do
    not have any viruses on your computer.

    ++++++++++++++++++++++++++++++++++

    Step 4 - Modify XP SP2 boot.ini

    ++++++++++++++++++++++++++++++++++

    - If you have the '/noexecute=optin' option in your boot.ini file, run the
    Steps noted in the 'Workaround' Section of this article to temporarily
    disable XP SP2's new 'Data Execution Prevention' (DEP) Feature.

    Ignore the rest of the article but use the steps in the 'Workaround' section
    to disable/re-enable the DEP Feature in XP SP2.

    http://support.microsoft.com/default.aspx?scid=kb;en-us;873155

    MAKE SURE YOU ARE NOT CONNECTED TO THE INTERNET WHILE PERFORMING THIS
    Uninstall/Reinstall Process!!!

    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

    Section 2 - Manual Uninstall of Symantec's SystemWorks 2005 - Standard
    Edition

    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

    Symptoms, error messages and other observations of the problems I saw:

    ============================================

    Microsoft Windows XP SP2 Symptoms:

    ============================================

    You may receive some or all of these messages during the process of
    installing your Symantec product on Windows XP2 SP2.

    - Microsoft Product Activation is Rendered Useless. You are not able to
    activate your Windows XP SP 2 Operating System over the internet using
    'Activate Windows' (msoobe.exe) regardless of whether or not your firewall
    is activated or not. Furthermore, none of the 'Activate Windows' graphics
    populate.

    - When attempting to maneuver through the (DCOM) 'Component Services' (aka.
    dcomcnfg.exe) MMC, the MMC disappears when you click the 'Computer' Folder.

    - All *.msi files on your XP SP2 box (May it be from CD, Locally, or from
    the Network) fail to execute and you get an error message stating:

    "The Windows Installer Service could not be accessed. This can occur if you
    are running Windows in safe mode, or if the Windows Installer is not
    correctly installed. Contact your support personnel for assistance."

    - You are unable to create a scheduled Task or restart the 'Task Scheduler'
    Service. You may receive 'Access Denied' errors or be prompted for your
    credentials during and following the creation of a scheduled task.

    - You right click a service in Computer Management, (compmgmt.msc) select
    the properties of a given service, and then click the Dependencies Tab you
    get a
    Win32 pop up error not allowing you to see the dependencies of a service.

    - You click 'Search’ in XP and nothing happens.

    - You Right Click 'WMI Control' (In Computer Management) and select
    properties, you receive an access denied. You are not able to click on any
    of the Tabs in the WMI Window.

    - Windows Update is rendered useless.

    - IE Web Page Scripting is rendered useless. An example of this would be
    not being able to expand sections in a Symantec Knowledge Base Document.
    This is even is you install/re-install the latest version of the Windows
    Scripting Host.

    - All Attempts to reinstall, re-register or refresh windows
    Installer/msiexec files, according to Microsoft KB Articles and Newsgroups,
    fail on all attempts. (A perfect example is this article
    http://support.microsoft.com/default.aspx?scid=kb;en-us;555175&Product=winxp)

    - All attempts to query WMI via script come back with access denied errors.
    Even simple queries fail with 'Access Denied' Errors.

    - Microsoft Help Files are execute but are completely inoperable.

    Event Log Errors Related to this issue:

    - Com+ Error 4689 in the event log appears with great frequency. The
    description for this event is "The run-time environment has detected an
    inconsistency in its internal state. This indicates a potential instability
    in the process that could be caused by the custom components running in the
    COM+ application, the components they make use of, or other factors. Error
    in d:\qxp_slp\com\com1x\src\comsvcs\package\cpackage.cpp(1184), hr =
    80070005: InitEventCollector failed"

    - Com+ Event ID 778. "Application image dump failed. Server Application
    ID: {5844D582-32EC-4B8E-9150-CF859413D4ED} Server Application Instance ID:
    {7EDCE3E3-19C2-4550-A500-CB34D0C3FB65} Server Application Name: MS Software
    Shadow Copy Provider Error Code = 0x80004005 : Unspecified error COM+
    Services Internals Information: File:
    d:\qxp_slp\com\com1x\src\shared\util\svcerr.cpp, Line: 1259 Comsvcs.dll
    file version: ENU 2001.12.4414.258 shp"
    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    - Eventsystem Error 4609 in the event log appears with great frequency. "The
    COM+ Event System detected a bad return code during its internal processing.
      HRESULT was 80070005 from line 44 of
    d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact
    Microsoft Product Support Services to report this error."

    - MsiInstaller Event ID 1015. "Failed to connect to server. Error:
    0x80070005"

    - MsiInstaller Event ID 1015. "Failed to connect to server. Error:
    0x800706BA"

    - WinMgmt Event ID 43. "WMI ADAP failed to connect to namespace
    \\.\root\cimv2 with the following error: 0x80070005"

    - Userenv Error 1090. "Windows couldn't log the RSoP (Resultant Set of
    Policies) session status. An attempt to connect to WMI failed. No more RSoP
    logging will be done for this application of policy."

    ============================================

    Symantec Related SYMPTOMS:

    ============================================

    You get the following errors in Norton/Symantec Products no matter where the
    Norton program files are located (CD, Hard drive, network, Web download).
    You may receive one, a few, or all of the errors noted below:

    - "Norton <program name> installation has failed. Do you want to try to
    install again?"

    - "The application failed to initialize properly (0xc00000005)"

    - "Error 1722. There is a problem with this Windows Installer package . . .
    when installing Norton <program name>"

    - Errors When Attempting to Download/Install Norton's WMI Update

    - Redirector Errors

    - "LiveUpdate was not able to install any of the <number> updates that you
    selected . . . "

    - "Setup has detected that a previous install or uninstall has been
    completed but requires a restart..."

    - "Norton <program name> has encountered an internal program error"

    - "The Norton AntiVirus component is not installed or failed to load . . . "

    - "Another version of this product is already installed..."

    - "Norton <program name> does not support the repair feature. Please
    uninstall and reinstall."

    - "The MSI must be launched through setup..."

    - "Norton <program name> has encountered an internal program error.
    Uninstall and re-install LiveUpdate."

    - "The LiveUpdate Install failed because you do not have Long Pathnames
    enabled. Please enable Long Pathnames and re-install."

    - "A previous version of <program name> was detected. You must uninstall the
    old version before installing the new one"

    - "<program name> did not install correctly. You may have to uninstall
    <program name> and try again"

    - "Error 1722. An error occurred while performing the task. There is a
    problem with this Windows Installer package. A program run as part of the
    setup did not finish as expected. Contact your support personnel or package
    vendor"

    - "The setup has detected that a previous install or uninstall has completed
    but requires a restart"

    - "Norton AntiVirus was unable to scan your computer for infections because
    virus definitions could not be loaded. Start LiveUpdate to get latest virus
    definitions and scan again."

    - Using Symantec's directions to 'Start the computer with no programs
    loading on startup' does not work when attempting to uninstall/reinstall
    your Norton/Symantec Product.

    XP Event Log Errors:

    - Application Error 1004. "Faulting application NPROTECT.EXE, version
    18.0.0.62, faulting module NPROTECT.EXE, version 18.0.0.62, fault address
    0x0000168c."

    - Application Error 1004. "Faulting application NPFMntor.exe, version
    11.0.2.4, faulting module kernel32.dll, version 5.1.2600.2180, fault address
      0x0001eb33."

    - Application Error 1000. "Faulting application sdntc.exe, version
    18.0.0.62, faulting module sdntc.exe, version 18.0.0.62, fault address
    0x0000831f."

    ===========================================

    Other Symantec/Norton symptoms include:

    ===========================================

    - Cannot install one or more of the Norton/Symantec <program name> component
    products.

    - You are not able to uninstall Norton/Symantec <program name> when
    upgrading to XP SP2.

    - You are able to install, patch, and/or configure your Norton Product on an
    XP Box that is below XP SP 2 Patch Level (SP1 and No SP). However, when you
    install Windows XP SP 2 Your Norton/Symantec Product is Rendered Useless.

    - Using any of Symantec's Program Removal Tools (Symevent.exe, CCRemove.reg,
    nsw*xp_reg_remval.reg, etc) do not work at all or only partially work.

    - Attempts to install a newer Version of a Symantec Product over an older
    version of a Symantec product prompt you to uninstall the older product on
    an XP SP2 Box.

    - Removing Norton/Symantec Products from the Add/Remove Programs fails to
    fully remove all of the program(s) on your XP SP2 Box. When attempting to
    reinstall (regardless of whether or not the box was rebooted). Setup still
    notes that there are some products still installed.

    - The CD Autoplay Start Window for your Symantec product takes a VERY long
    time to appear.

    #############################################################

    Section 2 - Manual removal of Norton/Symantec Products from your XP SP2
    Computer

    #############################################################

    ===================================================

    Step 1 - Uninstalled Programs via the Control Panel

    ===================================================

    - Removed All Symantec/Norton Programs from 'Add or Remove Programs' in the
    Control Panel

    The Programs to uninstall are:

    checkIt Diagnostics (Optional Uninstalled with no issues)
    LiveReg
    LiveUpdate <Version number>
    Norton SystemWorks 2005

    - Rebooted

    - Tried installing SystemWorks 2005 again.

    - Install Failed due to programs that were still active so I went deeper
    into the operating system to remove the programs.

    =======================================

    Step 2 - Stopped All Norton/Symantec Services

    =======================================

    Stopped the following Services:

    ("sc query type= service state= all" piped to a text file can get you this
    information)

    SERVICE_NAME: ccEvtMgr
    DISPLAY_NAME: Symantec Event Manager

    SERVICE_NAME: ccPwdSvc
    DISPLAY_NAME: Symantec Password Validation

    SERVICE_NAME: ccSetMgr
    DISPLAY_NAME: Symantec Settings Manager

    SERVICE_NAME: navapsvc
    DISPLAY_NAME: Norton AntiVirus Auto-Protect Service

    SERVICE_NAME: NPFMntor
    DISPLAY_NAME: Norton AntiVirus Firewall Monitor Service

    SERVICE_NAME: NProtectService
    DISPLAY_NAME: Norton Unerase Protection

    SERVICE_NAME: SAVScan
    DISPLAY_NAME: SAVScan

    SERVICE_NAME: SBService
    DISPLAY_NAME: ScriptBlocking Service

    SERVICE_NAME: SNDSrvc
    DISPLAY_NAME: Symantec Network Drivers Service

    SERVICE_NAME: SPBBCSvc
    DISPLAY_NAME: Symantec SPBBCSvc

    SERVICE_NAME: Speed Disk service
    DISPLAY_NAME: Speed Disk service

    SERVICE_NAME: Symantec Core LC
    DISPLAY_NAME: Symantec Core LC

    =============================================================

    Step 3 - Manually Deleted Symantec Program Related Directories

    =============================================================

    Manually Deleted the following directories:

    %PROGRAMFILES%\Common Files\Symantec Shared

    %PROGRAMFILES%\Norton SystemWorks

    %PROGRAMFILES%\Symantec

    %PROGRAMFILES%\SymNetDrv

    %PROGRAMFILES%\Checkit (Optional Post SystemWorks Install)

    =============================================================

    Step 4 - Manually Deleted Software/Program Settings in the Registry

    =============================================================

    Deleted the HKLM\Software\Symantec regkey
    Deleted the HKLM\Software\Smith Micro regkey (This is the Optional CheckIt
    Diagnostics Program Registry Key)

    =============================================================

    Step 5 - Manually Deleted Symantec Related Services in the Registry

    =============================================================

    Removed the following keys under HKLM\SYSTEM\CurrentControlSet\SERVICES

    (Note: Not all of the keys existed but they may appear depending on what
    Version and Type of Symantec's are installed. The Optional CheckIt
    Diagnostics is not installed as a Service.)

    ccEvtMgr
    ccPwdSvc
    ccSetMgr
    navapsvc
    NAVENG
    NAVEX15
    NPDriver
    NPFMntor
    NProtectService
    SAVRT
    SAVRTPEL
    SAVScan
    SBService
    SDDriver
    SNDSRvc
    SPBBCDDrv
    SPBBCSvc
    Speed Disk Service
    Symantec Core LC
    symdns
    symevent
    symfw
    symids
    symlcbrd
    symndis
    symredir
    symredrv
    symtdi

    =============================================================

    Step 6 - Manually Removed Symantec Related Programs that start up at OS
    Boot/Login

    =============================================================

    Removed any of the following registry entries from

    (Note: not all of the keys existed but they may depend what is installed)

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    ccApp
    ccRegVfy
    GhostStartTrayApp
    AcctMgr
    Norton SystemWorks
    NAV Cfgwiz
    symdns
    symevent
    symfw
    symids
    symlcbrd
    symndis
    symredir
    symredrv
    symtdi
    SBBCDrv
    SYMDNS
    SYMDISCO
    SAVRTPEL
    sndmon.exe

    ==========================================

    Step 7 - Manually Deleted Symantec Related Drivers

    =========================================

    Within the following directory:

    C:\Windows\System32\Drivers

    I deleted:

    qdfsdrv.sys
    symdns.sys
    symevent.sys
    symfw.sys
    symids.sys
    symlcbrd.sys
    symndis.sys
    symredir.sys
    symredir.sys
    symredrv.sys
    symtdi.sys
    NPDriver.sys

    One good thing about this is that you can hover your mouse over the driver
    in question and the properties of the Symantec drivers will appear stating
    whether or not it's from Symantec. If it states the Driver is from
    Symantec, delete it. Otherwise, leave it alone.

    =============================================================

    Step 8 - Removing Symantec Products from the Windows Installer Database

    =============================================================

    If at this point, Symantec Setup is detecting programs still installed on
    your computer download and install the Windows Installer Clean Up Utility
    and Remove the following programs:

    ccCommon
    Internet Worm Protection
    Norton AntiVirus 2005
    Norton AntiVirus Parent MSI
    Norton CleanSweep
    Norton SystemWorks (1.0)
    Norton systemWorks 2005 (8.2.0.6)
    Norton Utilities
    Norton WMI Update
    NSW_DMR_COLLECTION
    SPBBC
    Symantec Network Drivers Update
    Symantec Script Blocking Installer
    SymNet

    This is probably the only KB Article I would Recommend everyone looking to
    Symantec's site for references as they have a list of programs installed by
    the various types and versions

    ===============================

    Step 9 - Deleting %Temp% Files

    ===============================

    Regarding Symantec's statements about blowing away all the contents of your
    %TEMP% directory as stated in this article...

    http://service1.symantec.com/SUPPORT/sharedtech.nsf/docid/2004090914191713?OpenDocument&csm=no&src=con_web_nam

    ...is utter crap.

    Don't ever delete everything in the temp directory.

    In this day and age many other non-Symantec products write
    install/patch/uninstall logs to this directory. If you needed to call a non
    Symantec Product support professional and you blew away directories that
    will be needed to troubleshoot a given issue, you'd be up the proverbial
    creek without a paddle.

    Anyways, here's a list Symantec related %TEMP% directory files you can
    delete:

    Norton Systemworks 2005*.log
    NGBINST.log
    msicu.log
    LSinstall.log
    *.tmp
    SymSCLiveupdate.dat
    symcprop.dat
    ssaliveupdate.dat
    prescan.log
    SND*.log

    =============================================================

    Step 10 - If the Symantec Services are STILL installed at this point.....

    =============================================================

    If services are still present on your computer after removing them from the
    registry and rebooting your computer, use SC.exe from the command line to
    remove the following Norton/Symantec services:

    SERVICE_NAME: ccEvtMgr

    SERVICE_NAME: ccPwdSvc

    SERVICE_NAME: ccSetMgr

    SERVICE_NAME: navapsvc

    SERVICE_NAME: NPFMntor

    SERVICE_NAME: NProtectService

    SERVICE_NAME: SAVScan

    SERVICE_NAME: SBService

    SERVICE_NAME: SNDSrvc

    SERVICE_NAME: SPBBCSvc

    SERVICE_NAME: Speed Disk service

    SERVICE_NAME: Symantec Core LC

    At this point Symantec's SystemWorks 2005 should be completely removed
    enough for the SystemWorks Setup Program to be able run a fresh install.

    However, there's one more thing to do before re-installing
    SystemWorks.......

    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

    Section 3 - WMI Lockdown workaround for Norton/Symantec and Windows
    Installer issues

    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

    Long Story short, I found the root of all the problems I had (and I'm
    betting that everyone else is having too) on my XP Box. Since the WMI
    Control (and many other parts of the Operating System) were getting 'Access
    Denied' errors I decided to try delete and restore my WMI settings based on
    something I tried on a Win 2K3 Domain Controller at work.

    Take a look at this article:

    http://www.microsoft.com/technet/scriptcenter/resources/wmifaq.mspx#EGAA

    Scroll down to the Section entitled "Rebuild the Repository". These are the
    steps I took to re-enable WMI and evetually my operating system.

    + The first thing I did before starting these sets of directions is I ran
    the following command from the command prompt:

    msiexec /unreg

    This Unregisters the Windows Installer for repair and refreshing purposes
    and is one of the steps taken when attempting to repair a Windows Installer
    installation (see the 'References' Section at the end of this paper for more
    information).

    + Next I Followed the first set of directions for the 'AutoRecover' of the
    WMI.

    + Once I completed these steps, I right-clicked WMI Control within Computer
    Management (compmgmt.msc) and selected properties. The WMI Control
    refreshed and repopulated.

    If You get prompted to re-register products that you recognize, click yes.

    As a result, not only was I able to successfully install, configure, and
    update my XP box, but my Windows Installer/msiexec worked once again!

    ===========
    Sidenote
    ===========

    Regarding Symantec's Article about the Windows Installer:

    http://service1.symantec.com/SUPPORT/sharedtech.nsf/docid/2004071407423813?Open&src=hot&docid=2002071915240913&nsf=sharedtech.nsf&view=docid&dtype=&prod=Norton%20SystemWorks&ver=2005&osv=&osv_lvl=

    Regarding the Reinstall of the MS Windows Installer Util, these processes
    will not work on XP SP2 as the service pack updated the Windows Installer to
    a new version. Furthermore, there is not an Updated version of Windows
    Installer for XP SP2 (the Redistributable) currently available on the MS
    Public Web Site (the Exception is to Download the Mammoth SDK for SP2).

    I would suggest following the troubleshooting steps in this article before
    proceeding to something as complex as what I just described.

    http://support.microsoft.com/default.aspx?scid=kb;en-us;555175

    Remember to re-enable all the services, processes, and programs you turned
    off or modified!

    Cheers!

    Aaron Wood
    awood7@msn.com

    *******************

    References

    *******************

    =================================
    Microsoft References
    =================================

    windows XP Newsgroups:

    http://www.microsoft.com/windowsxp/expertzone/newsgroups.mspx

    XP SP2's Data Execution Prevention Feature:

    http://support.microsoft.com/default.aspx?scid=kb;en-us;875352
    http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2mempr.mspx

    How to edit the Boot.ini in Windows XP - KB Article:

    http://support.microsoft.com/kb/289022

    “0x80070005: Access is denied" error message when you create a scheduled
    task in Windows XP Service Pack 2 or Windows XP Tablet PC Edition 2005:

    http://support.microsoft.com/default.aspx?scid=kb;en-us;884573

    How to Resolve Common 'Windows Installer' Problems:

    http://support.microsoft.com/default.aspx?scid=kb;en-us;555175

    Windows Management Interface Frequently Asked Questions:

    http://www.microsoft.com/technet/scriptcenter/resources/wmifaq.mspx

    Code Access Security for WMI:

    http://support.microsoft.com/default.aspx?scid=kb;en-us;823915

    Securing a Remote WMI Connection:

    http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/securing_a_remote_wmi_connection.asp

    Windows Installer Clean Up Utility

    http://support.microsoft.com/default.aspx?scid=kb;en-us;290301

    =================================
    Symantec References
    =================================

    How To Install Norton SystemWorks 2005:

    http://service1.symantec.com/SUPPORT/nsw.nsf/docid/2004082309385607?OpenDocument&src=hot&prod=Norton%20SystemWorks&ver=2005%20Premier%20Edition&csm=no&tpr
    e=

    Reinstalling your Symantec program after a failed installation or after you
    see error messages:

    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2004021112313539?Open&src=sg&docid=2004100114163006&nsf=nav.nsf&view=5faa3ca6df6f549888256edd0061
    c0a4&dtype=&prod=Norton%20SystemWorks&ver=2005&osv=&osv_lvl=

    Using the Microsoft Windows Installer Cleanup Utility to remove Symantec
    Products:

    http://service1.symantec.com/SUPPORT/nav.nsf/5faa3ca6df6f549888256edd0061c0a4/30978a179dde786388256f35006ce45a?OpenDocument&prod=Norton%20SystemWorks&ver=
    2005&src=sg&pcode=nsys&svy=&csm=no

    Obtaining the Microsoft Installer Cleanup Utility:

    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001091412490807?Open&src=hot&docid=2001112111324439&nsf=tsgeninfo.nsf&view=docid&dtype=&prod=Nor
    ton%20SystemWorks&ver=2005%20Premier%20Edition&osv=&osv_lvl=

    Removing Norton SystemWorks 2005 in Windows XP/2000 after Add/Remove
    Programs does not work

    http://service1.symantec.com/SUPPORT/nsw.nsf/a25cbe8c4ecc2e9088256ee5005acd4f/7f9931f898f8baf688256ee8007abed5?OpenDocument&prod=Norton%20SystemWorks&ver=
    2005%20Premier%20Edition&src=sg&pcode=nsys&svy=&csm=no

    _________________________________________________________________
    Express yourself instantly with MSN Messenger! Download today - it's FREE!
    http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

    --
    Editor's Note: The 43rd Most Powerful Person in Networking says...
    Register today to take the TruSecure ICSA exam by 12/31/04  at
    <http://www.2test.com> ,  use promo code "CT1204" and you will pay just
    $221.25 US Dollars for domestic exam delivery and  $296.25 US Dollars
    for international delivery.
    Visit <https://ticsa.trusecure.com>  for complete details regarding the
    TICSA credential and to take the free sample exam.
    --
    

  • Next message: GreyMagic Security: "Online Script Decoder"

    Relevant Pages

    • Re: After SP2 and the LU Patches Norton Products Still Have a Panopoly of Problems
      ... They want to use SP2 to sell as many 2005 boxes as they can. ... It's up and it's runnin'--after Symantec. ... the Norton developers wrote Code that says doesn't work with SP2 RTM ... refresh freeze problem which is basically an IE J-script problem/ Windows ...
      (microsoft.public.windowsxp.customize)
    • Re: After SP2 and the LU Patches Norton Products Still Have a Panopoly of Problems
      ... Seems to work for a lot of other people after SP2 is installed, ... suggest you contact Symantec or Norton with your specifics. ... Microsoft Windows MVP/Tablet PC ...
      (microsoft.public.windowsxp.customize)
    • Re: After SP2 software will not work; Norton dragging their feet--a lot!
      ... patches for *Norton* products would entail. ... The importance of SP2 working for enterprises and home was in Microsoft's ... Windows XP Service Pack 2 is critical because it ... The disingenuous comment by Symantec Senior Vice-President Stephen Cullen is ...
      (microsoft.public.windowsxp.customize)
    • Re: After SP2 software will not work; Norton dragging their feet--a lot!
      ... of SP2 not showing Norton's AV as running. ... Microsoft Windows MVP / Tablet PC ... > yet delivered patches for *Norton* products would entail. ... > The disingenuous comment by Symantec Senior Vice-President Stephen Cullen ...
      (microsoft.public.windowsxp.customize)
    • Re: Windows Installer
      ... Why am I getting the "Windows installer" window? ... When I click ok or red X it out, I get a popup from Symantec that states, "Norton Antivirus ... What "repair feature" is Symantec referring to? ...
      (microsoft.public.windowsxp.general)