Error Uninstalling Suite with Symantec Endpoint Protection

[rguggisberg]

I have a problem uninstalling a Suite on 2008 R2. It uninstalls just fine if I do not have Symantec Endpoint Protection installed or if I have it installed with:
Virus and Spyware Protection May 16, 2011 r40
Proactive Threat Protection May 14, 2011 r1
Network Threat Protection May 14, 2011 r5

If I update Symantec Endpoint Protection (04/23/2012) the Suite uninstall fails because Symantec Endpoint Protection thinks there is a virus!
_is96b3.exe (this file name may vary). Screen shots attached.

The Suite project remains in the ARP list. If I try to uninstall a second time I get the error:
"An error occurred while trying to uninstall.... It may have already been uninstalled."

This is with IS 2012. I have not tried IS2012 Spring Beta because that is on another ghosted image of the same box. I could do that if I had to, but hopefully someone at Flexera will respond with some ideas. I can submit an incident under our maintenance contract if that helps.

BTW, I do not have this problem on my 32 bit Windows 7 box.
Thanks!

[CHANDINATHREDDY]

it seems like you have set the exe as an key file and as the Symantec thought it to be virus it deleted and now to uninstall it will try to find the file and as it is missing it shows up the message that it is already uninstalled.....
for this problem the flexera cant help you atleast they say so ..contact symantic..

[rguggisberg]

Thanks for the reply. I respectfully disagree. The problem is in the Suite. All of my individual Basic MSI packages are still installed and can be manually uninstalled (without error, BTW).
c:\users\administrator\appdata\local\temp\_isb96b3.exe
is not my file! That is gernerated by Flexera and the name varies from machine to machine and sometimes from one install to the next.

[rguggisberg]

After I get the error, the Suite is still in the ARP list. If I try to uninstall again I get an error saying that it has already been uninstalled... do you want to remove it from the list of features? So I say yes and it is gone.

Now I can execute my Suite setup.exe, and it will successfully remove all of my packages... which is what I wanted it to do in the first place! This is too much of a bother to ask of my users. Any ideas from Flexera?
Thanks!

[DebbieL]

It sounds like as a workaround, if you sign your files, end users will not encounter this issue.

As far as we know, the executable file as you described is virus free, and we have escalated this issue to Symantec to resolve this.

[rguggisberg]

Thanks Debbie... you probably have a better chance of getting Symantec's attention than I would 🙂

When you say sign my files... do you mean in the Suite... as opposed to in each MSI package?

I have not done any signing before. Can you point me to a good place for info?
What is the trick for viewing some of the older Flexera KB sites with IE9?
Seems like there is a setting to change to be able to do that?
Many of them are not visible.
Thanks.

[DebbieL]

Yes, signing the Suite files is what I meant, but signing each .msi package would also be a good idea.

The Signing tab in the Releases view is where you specify the digital signature information that you want InstallShield to use when digitally signing your installation and its files. For more information, see Digital Signing and Security.

If you are having trouble viewing KB articles, click the Compatibility View button. It's to the right of the address bar in IE. Its icon has a broken page.

[rguggisberg]

The previously stated problem occurs only if I uninstall the Suite from ARP. If I uninstall all packages by running the Suite Setup.exe everything works as it should and I do not have this problem.

[DebbieL]

This morning Symantec pushed out a new Proactive Thread Protection definition, and it seems to resolve the issue. Can you verify whether this resolves the problem that you saw?

Thanks!

[rguggisberg]

Thanks Debbie
I tested the Symantec update and it does resolve the problem.
Would be nice if they were all that easy! 🙂
Next...

[DebbieL]

FYI: Here's a KB article that explains the issue.
Q206327: INFO: Symantec Endpoint Protection Version 12 Incorrectly Flags Launchers Created By InstallShield and InstallAnywhere