Expiring Today—Celebrate National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Cannot install Trend Micro as it says that Kaspersky Internet Agent is still installed.

Posted on 2017-03-06
24
Medium Priority
?
255 Views
Last Modified: 2017-05-06
We're trying to install Trend Micro on a clients computer and Kaspersky has something somewhere that's triggering Trend into failing the installation. Here are the things we've tried, but the issue is still happening.
-Add/Remove Programs shows no Kaspersky Installed
-Searched Registry for anything "Kaspersky" and removed all keys
-Ran multiple "Removal Tools" from the Kaspersky community

The error Trend gets is attached. Image of the error.
0
Comment
Question by:OAC Technology
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 10
  • 5
  • 4
  • +3
24 Comments
 
LVL 19

Expert Comment

by:Ramin
ID: 42036281
did you try agent remover ?
https://support.kaspersky.com/3456
0
 
LVL 14

Expert Comment

by:Joseph Hornsey
ID: 42036284
Yeah, this stuff will drive you crazy.

The next thing I'd try would be to log onto that machine and do a manual install instead of an automated one.  Generally, doing that will take care of the problem.
0
 
LVL 4

Expert Comment

by:dovidf
ID: 42036293
Have you used Revo uninstaller?
0
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

 
LVL 2

Author Comment

by:OAC Technology
ID: 42036311
@Ramin Yes, already tried that and it returned 1.
@Joseph Manually installing Trend? Like from the msi?
0
 
LVL 19

Expert Comment

by:Ramin
ID: 42036315
try Kaspersky Security Center 10 Network agent removal tool, if available run it in safe mode.
https://support.kaspersky.com/13088
0
 
LVL 14

Expert Comment

by:Joseph Hornsey
ID: 42036361
Pretty much.

We use ESET for our anti-virus and if we need to do something manually, it's a matter of getting the installation package off our server and using that to do the manual install.  The installation package from our server contains all of our default settings including configuring the client to connect to our server for updates, etc.

For Trend, I'm sure it's a similar process if you have your own server.  If it's a hosted solution, it'll probably be a little different, but the same general idea.
0
 
LVL 2

Author Comment

by:OAC Technology
ID: 42036369
@dovidf I used CCleaner's uninstaller to cleanup the remnants left by the Windows Uninstaller. I just tried Revo and Kaspersky doesn't show up anywhere.
@Ramin I've tried using the tool you linked, but no commands are returned and nothing seems to happen. Additionally, I don't see ak_cleaner-YYYY-MM-DD-HH-MM-SS.log in any Temp folder. As this is a remote issue, I'm unable to connect with our software while that computer is in safe-mode.
0
 
LVL 4

Expert Comment

by:dovidf
ID: 42036392
It probably makes sense to contact Trend Micro at this point. They probably have experience dealing with this issue.
0
 
LVL 2

Author Comment

by:OAC Technology
ID: 42036398
After trying to run the manual install, the first thing we see when launching it is "An error has stopped the Trend Micro Security Agent from installing. No changes have been made to this computer. Please try running the installer again later." We may just have to reach out to Trend.
0
 
LVL 30

Expert Comment

by:Sudeep Sharma
ID: 42037571
Could you please clear the TEMP and user TEMP area then try to install and if it fails (most likely) paste the logs files from the TEMP and User Temp?

Logs would most likely would point to the package/file/registry which is detecting Kaspersky agent on the system.

Another option would be using Process Monitor and checking what all areas (File/Registry) Trend Micro access while installing the software, but it would be overkill, unless log files point us to the problematic registry keys or files.

Process Monitor:
https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx

Thanks.
Sudeep
0
 
LVL 2

Author Comment

by:OAC Technology
ID: 42038264
Great Idea Sudeep, I did just that. I've attached the output files from the Trend install to this comment. The installer also output a 300 MB file that is too big to put on here, but I skimmed through these log files and can see that it mentions by name Kaspersky.
RestartManager.log
wofie_msi.log
wofie_msi.log
0
 
LVL 30

Assisted Solution

by:Sudeep Sharma
Sudeep Sharma earned 2000 total points
ID: 42039298
Hi OAC Technology,

Just looking at these few lines, I am highlighting the ones which are my concerns:

03/07 14:32:44 1874-3a5c (5) [2017/03/07 14:32:44][1874:3a5c]Found AV competitor Kaspersky Security Center Network Agent 10.0.3361 (supported) - .\libWixUninstallCompetitor.cpp:159 - libWixUninstallCompetitor.cpp(159)
03/07 14:32:44 1874-3a5c (5) [2017/03/07 14:32:44][1874:3a5c][SearchProduct]GetPrivateProfileSectionNames return: 136 - .\inst_wsc_UninstallCompet.cpp:124 - inst_wsc_UninstallCompet.cpp(124)
03/07 14:32:44 1874-3a5c (5) [2017/03/07 14:32:44][1874:3a5c][SearchProduct]Uninstall Password required :112779976 - .\inst_wsc_UninstallCompet.cpp:128 - inst_wsc_UninstallCompet.cpp(128)
03/07 14:32:44 1874-3a5c (5) [2017/03/07 14:32:44][1874:3a5c]Silent mode: 1. UI is: 5 - .\libWixUninstallCompetitor.cpp:193 - libWixUninstallCompetitor.cpp(193)
03/07 14:32:44 1874-3a5c (5) [2017/03/07 14:32:44][1874:3a5c]In silent mode will not show dialog - .\libWixUninstallCompetitor.cpp:197 - libWixUninstallCompetitor.cpp(197)

So it has found Kaspersky Security Center Network Agent 10.0.3361 for which an uninstall password is required, however the TrendMicro's uninstaller is running in silent mode, UI mode is 5 and in silent mode it will not show the dialog for uninstall string.

So this would not help much, now we should try getting the debug logs from MSI installer and see if it could provide us some more information.

To enable Windows Installer logging
To enable Windows Installer logging yourself, open the registry by using Regedit.exe, and then create the following subkey and keys:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
Reg_SZ: Logging
Value: voicewarmupx

https://support.microsoft.com/en-gb/help/223300/how-to-enable-windows-installer-logging

This would generate the extra log files in %temp%, compress them and post them here for further analysis.

Thanks,
Sudeep
0
 
LVL 2

Author Comment

by:OAC Technology
ID: 42043207
Hello Sudeep,

I got the log files from the windows installer. I'll add it here.
MSI3f165.LOG
0
 
LVL 19

Expert Comment

by:Ramin
ID: 42043252
do you have any registry cleaner tools? , it can be a registry entries.
0
 
LVL 2

Author Comment

by:OAC Technology
ID: 42046039
Any ideas from the log files? Anyone?
0
 
LVL 19

Expert Comment

by:Ramin
ID: 42046052
I would try to install kaspersky security center network agent 10, and then try to uninstall it.
0
 
LVL 30

Expert Comment

by:Sudeep Sharma
ID: 42049283
Open the device manager, (Windows+Run, type devmgmt.msc and press enter).

Click on View and select "Show Hidden Devicess". After that do you see any device which has Exclamation Mark (Yellow mark) against it?

If found, right click it and select uninstall. Most likely you have some files or drivers left which are not removed.

Further, use Autoruns from Microsoft sysinternal tools and see what remnant drivers or files you could find related to Kaspersky.

Info:
https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Download:
https://download.sysinternals.com/files/Autoruns.zip 

Thanks,
Sudeep
0
 
LVL 2

Author Comment

by:OAC Technology
ID: 42051613
I will try both of your answers. Thanks.
0
 
LVL 2

Author Comment

by:OAC Technology
ID: 42063303
Neither worked.
0
 
LVL 19

Expert Comment

by:Ramin
ID: 42063391
0
 
LVL 30

Expert Comment

by:Sudeep Sharma
ID: 42079943
Would you be able to provide the ARN file of your system using Autoruns?

Sudeep
0
 
LVL 12

Expert Comment

by:Dmitri Farafontov
ID: 42114919
Why not simply use a native Kaspersky Removal tool to remove the NetAgent:
https://support.kaspersky.com/common/service.aspx?el=1464#block2
Please click on "Additional information for business products"

If still no go try to use Cleaner from Kaspersky which had been designed for force removal:
https://support.kaspersky.com/13088
0
 
LVL 2

Accepted Solution

by:
OAC Technology earned 0 total points
ID: 42115443
None of these worked, I ended up reformatting the drive and reinstalling Windows. Thanks for your suggestions.
0
 
LVL 2

Author Closing Comment

by:OAC Technology
ID: 42123341
No answer found.
0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is written by John Gates, CISSP. Gates, the SNUG President-Elect, currently holds the position of Manager of Information Systems at Lake Park High School in Roselle, Illinois.
Check out what's been happening in the Experts Exchange community.
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question