Norton Internet Security keeping us from installing ESET NOD32

[DiPersiaTech 2]

So it appears more and more machines are coming with Norton Internet Security on them out of the box. 

 

We always uninstall it through add/remove programs, and always tell it to take all traces along with it.

 

Problem is, ESET still detects it and won't install unless we run the Norton Removal Tool.  Problem is, we're migrating ~200 machines to ESET (via script) and keep running into this.  There's no automated way to run the Norton Removal Tool. 

 

So we spent hours pouring over a machine in question.  Not one thing on the hard drive we can find reference Norton, Symantec, etc.  Also did the same in the registry.

 

Finally did a snapshot of the registry and hard drive before and after running the removal tool and still can't find anything being cleaned up.  But ESET always installs fine after we run the tool.

 

Any ideas?  Is there some kind of "definition" file that we can look at to see what ESET actually looks for when it comes to conflicting apps?

[Podrska2NORT 5]

Hi,

 

We noticed same problems with Symantec/Norton products. They are connected with user rights on Registry (Symantec messes with them too), and their  regular uninstaller does not turn this back in regular status :-(

 

So only (regular) solution for problems with Symantec is: use their uninstaller.

 

Sorry to any ex Symantec user -> bad luck ...

[DiPersiaTech 2]

So the ESET installer is actually checking the specific rights on registry keys to determine if a Symantec product is installed?  I find that hard to believe. . .

[Arakasi 549]

I believe its the same code when running the ESET Uninstaller.

Its not just Norton, i think it checks for drivers that conflict. Whether it be by a database, or the name of certain main ones packed into the program.

[Aryeh Goretsky 378]

Hello,

Have you tried generating an ESET SysInspector log from a machine to see if you can identify any Symantec Norton remnants (registry keys, services, files) left over after uninstalling the program via the Control Panel? If so, perhaps you could create a script to remove those specific components prior to installing ESET Endpoint Antivirus.

Regards,

Aryeh Goretsky

[Arakasi 549]

Hello,

Have you tried generating an ESET SysInspector log from a machine to see if you can identify any Symantec Norton remnants (registry keys, services, files) left over after uninstalling the program via the Control Panel? If so, perhaps you could create a script to remove those specific components prior to installing ESET Endpoint Antivirus.

Regards,

Aryeh Goretsky

 

Awesome Idea !

This is true, you could deploy a vbs with keys and directories to delete forcefully and with domain admin priv of course embedded.

 

This is the heart of IT, making your own uninstaller catered to you, thank Symantec later on.

If you need assistance with the code, post back, sounds like a fun small project.

[GravesZ 0]

I have ran into this problem as well. There is a Norton Uninstall tool you can download and run. Always seems to fix the problem for me.

[DiPersiaTech 2]

The Norton uninstall tool does work for us.  Just not well when we have to do it 200x manually.  It would be nice if ESET could tell us via a log or tool or something WHAT it is detecting so we can script a cleanup.  EVERY Lenovo that we deploy now has this and doing 200+ machines in the field isn't fun.

 

Never found anything in terms of the sysinspector results.  Ran a sysinspector before and after the Norton uninstaller and did a compare and nothing helpful.

[Aryeh Goretsky 378]

Hello,

Perhaps if you could upload the ESET SysInspector log(s) in question to a server and send download instructions via Private Message, one of our support engineers could take a look glance through the logs. Sometimes a second set of eyeballs helps.

I understand your frustration about the Symantec Norton Removal Tool requiring manual intervention to remove NIS from your Lenovo computers. Just to check, have you asked your Lenovo rep about getting machines without the NIS preload? If you are buying 200 systems at a time, I would think they is something they could accomplish via a CTO build. Also, have you tried contacting Symantec directly to see if they offer a non-interactive version of the Symantec Norton Removal Tool that could be scripted? I can understand them not wanting to provide such a tool for public download as it could be componentized by malware authors, but perhaps something is available upon request.

Regards,

Aryeh Goretsky

[Arakasi 549]

Also, have you tried contacting Symantec directly to see if they offer a non-interactive version of the Symantec Norton Removal Tool that could be scripted? I can understand them not wanting to provide such a tool for public download as it could be componentized by malware authors, but perhaps something is available upon request.

 

Brilliant idea, if they have something to offer you.

[DiPersiaTech 2]

Aryeh,

 

Just sent you a PM with the files in my Dropbox.  Hoping your engineers can tell us something good.  Thanks!!!

 

--Pat

[DiPersiaTech 2]

Aryeh - was hoping to hear something back from you guys. . .  Anything?

[Aryeh Goretsky 378]

Hello,

Sorry, my visits into the forum have been irregular. Let me take a look and see what I can come up with.

Regards,

Aryeh Goretsky

[DiPersiaTech 2]

Great, thanks!

[Aryeh Goretsky 378]

Hello,

I didn't see anything in the log file from the OCHxxxxx machine that I could immediately identify as a remnant of a Symantec product. Going to ask the folks from business support to take a look.

Regards,

Aryeh Goretsky

[DiPersiaTech 2]

Thanks.  As an aside, would be REALLY helpful if we could see the list of items you guys look for during install for conflicting apps.  Or include in the install log file exactly WHAT was found as a conflict (As opposed to just the app name.)

[Chadh 45]

Hello DiPersiaTech,

 

We were unable to find any indication of Norton Internet Security in the files you provided. To ensure all remaining files, folders, and registry keys from the previous antivirus are removed, please follow the steps below.

 

IMPORTANT

• Before following the steps below, uninstall the detected antivirus product using the recommended steps from the product’s manufacturer.
• After attempting to remove the software using the recommended steps, please try using the appropriate uninstall tool provided by the manufacturer. For a list of uninstall tools, please click to open the following ESET Knowledgebase article:
  Uninstallers (removal tools) for common Windows antivirus software

 

First, please ensure all hidden files and folders are visible by using the steps below:

1. Open Windows Explorer.
2. On the Tools menu, click Folder Options (Note: In Windows 7 or Vista, press the ALT key to display the menu bar).
3. Click the View tab.
4. In the Advanced settings pane, under Hidden files and folders, click Show hidden files and folders.
5. Uncheck the box next to Hide extensions for known file types.
6. Click OK, and then close the open windows.

Next, please remove all files and folders from the existing antivirus product detected by your ESET installation. Please ensure you remove all files and folders that have the name of the antivirus product or the manufacturer’s company name (e.g. NOD32 Antivirus and ESET). Please follow the steps below for each of the file paths:

1. Click Start.
2. Click All Programs -> Accessories (skip this step in Windows XP).
3. Click Run.
4. Type %ProgramFiles% and then click OK.
5. Please delete all files and folders that have the name of the antivirus product or the manufacturer’s company name (e.g. NOD32 Antivirus and ESET).

Please repeat the steps above for each of the following file paths:

• %ProgramFiles%
• %CommonProgramFiles%
• %ProgramFiles(x86)%
• %CommonProgramFiles(x86)%
• %appdata%
• %localappdata%
• %AllUsersprofile%\Application Data

Then, please clear the Windows temporary folders using the steps below:

1. Click Start.
2. Click All Programs -> Accessories (skip this step in Windows XP).
3. Click Run.
4. Type %temp% and then click OK.
5. Press CTRL + A on your keyboard to select all items in the folder.
6. Press Delete (or DEL) on your keyboard to delete all files and folders. If prompted, click Yes to confirm deletion. This may take some time to complete.

Note: If you receive a File In Use pop-up error message, check the box next to Do this for all current items and click Skip to continue deleting the other files

1. After the deletion process finishes, please close Windows Explorer.
2. Click Start.
3. Click All Programs -> Accessories (skip this step in Windows XP).
4. Click Run.
5. Type %localappdata%\temp and then click OK.
6. Press CTRL + A on your keyboard to select all items in the folder.
7. Press Delete (or DEL) on your keyboard to delete all files and folders. If prompted, click Yes to confirm deletion. This may take some time to complete.
8. After the deletion process finishes, please close Windows Explorer.

After clearing the Windows temporary folders, please delete any registry key that has the name of the antivirus product or the manufacturer’s company name (e.g. NOD32 Antivirus and ESET). To do this, please follow the steps below:

 

Warning: Use Registry Editor at your own risk

• Making incorrect changes in the Window Registry Editor can cause serious problems that may require you to reinstall your operating system, or that cannot be resolved at all.
• Some of the registry keys referenced below may not exist in all environments (based on the operating system and other factors).

1. Create a restore point by following the steps in the following Microsoft Knowledge Base article: hxxp://windows.microsoft.com/en-us/windows7/create-a-restore-point
2. Back up the registry by following the steps in the following Microsoft Knowledge Base article: hxxp://windows.microsoft.com/en-us/windows-vista/back-up-the-registry
3. Click Start.
4. Click All Programs -> Accessories (skip this step in Windows XP).
5. Click Run.
6. Type regedit and then click OK.
7. Navigate to HKEY_CURRENT_USER\Software.
8. Please delete all registry keys that have the name of the antivirus product or the manufacturer’s company name (e.g. NOD32 Antivirus and ESET).

Please repeat the Steps 7 and 8 above for each of the following registry paths:

• HKEY_CURRENT_USER\Software
• HKEY_LOCAL_MACHINE\SOFTWARE
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Upgrade Codes\
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\
• HKEY_CLASSES_ROOT\Installer

After following these steps, please reboot your system. After rebooting, please try the installation of your ESET product again.

 

Thank you,

ChadH

[DiPersiaTech 2]

Thanks, Chad - but we've been over these machines with a fine tooth comb.  Spent hours looking at the drive, registry, etc.  We've even captured an image of the machine BEFORE we run the Norton Removal Tool and an image after and compared them.  Nothing jumps out at us.

 

Would be GREAT if you guys noted in the install log WHAT tripped the installer up.  It does tell us Norton Internet Security, but a reference to what specifically would be outstanding.

[frank419 2]

Got to the end of this one hoping for some closure. Any resolution to this? What a pain this causes when trying to deploy ESET via Labtech.

[DiPersiaTech 2]

Frank - no resolution yet.  I DO have an idea though - the next machine we get in with Norton Internet Security, I'm going to run Process Monitor while I run the Norton Removal Tool and see if that gives me any indication as to what's happening.  I'm expecting it to be a nightmare though as I'm sure the removal tool checks a multitude of registry entries and files, so weeding through it will be a joy.

 

Too bad ESET can't say what specifically it found in the install log.

[mik 0]

In my environment ( 100+ Lenovo's)  , removing empty key HKLM\Software\NORTON solved problem . Even no  restart needed.

Regards 

MiK

[job 0]

_{Thanks for this post. I've had problems using Remote Push install on a PC. The validation worked, but the actual push install did not. Looking in the Windows Event viewer there was an issue starting a service during the install. I tried doing a manual install on the machine and this revealed a trace of Norton Internet Security. So that landed me here. I looked for removal tools from Norton and found one. After running it the Push install worked perfectly. I got the tool here: hxxps://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us}

[DaveKlatka 0]

I realize this issue is going on a year now but I was able to get past the issue of Eset detecting Norton Internet Security even after uninstalling the software from programs. for me it was as simple as removing a registry key entry HKEY_LOCAL_MACHINE\SOFTWARE\Norton\

 

After I removed that key Eset did not detect any other AV installs and continued on its way to install.

[Marcos 5,071]

I realize this issue is going on a year now but I was able to get past the issue of Eset detecting Norton Internet Security even after uninstalling the software from programs. for me it was as simple as removing a registry key entry HKEY_LOCAL_MACHINE\SOFTWARE\Norton\

 

After I removed that key Eset did not detect any other AV installs and continued on its way to install.

 

Did you actually use Endpoint v6 (the version with ESET AV Remover embedded hxxp://www.eset.com/int/download/utilities/detail/family/265/)?