Cannot install Trend Micro as it says that Kaspersky Internet Agent is still installed.

We're trying to install Trend Micro on a clients computer and Kaspersky has something somewhere that's triggering Trend into failing the installation. Here are the things we've tried, but the issue is still happening.
-Add/Remove Programs shows no Kaspersky Installed
-Searched Registry for anything "Kaspersky" and removed all keys
-Ran multiple "Removal Tools" from the Kaspersky community

The error Trend gets is attached. Image of the error.
LVL 2
OAC TechnologyProfessional NerdsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

RaminTechnical AdvisorCommented:
did you try agent remover ?
https://support.kaspersky.com/3456
0
Joseph HornseyPresident and JanitorCommented:
Yeah, this stuff will drive you crazy.

The next thing I'd try would be to log onto that machine and do a manual install instead of an automated one.  Generally, doing that will take care of the problem.
0
dovidfCEOCommented:
Have you used Revo uninstaller?
0
What were the top attacks of Q1 2018?

The Threat Lab team analyzes data from WatchGuard’s Firebox Feed, internal and partner threat intelligence, and a research honeynet, to provide insightful analysis about the top threats on the Internet. Check out our Q1 2018 report for smart, practical security advice today!

OAC TechnologyProfessional NerdsAuthor Commented:
@Ramin Yes, already tried that and it returned 1.
@Joseph Manually installing Trend? Like from the msi?
0
RaminTechnical AdvisorCommented:
try Kaspersky Security Center 10 Network agent removal tool, if available run it in safe mode.
https://support.kaspersky.com/13088
0
Joseph HornseyPresident and JanitorCommented:
Pretty much.

We use ESET for our anti-virus and if we need to do something manually, it's a matter of getting the installation package off our server and using that to do the manual install.  The installation package from our server contains all of our default settings including configuring the client to connect to our server for updates, etc.

For Trend, I'm sure it's a similar process if you have your own server.  If it's a hosted solution, it'll probably be a little different, but the same general idea.
0
OAC TechnologyProfessional NerdsAuthor Commented:
@dovidf I used CCleaner's uninstaller to cleanup the remnants left by the Windows Uninstaller. I just tried Revo and Kaspersky doesn't show up anywhere.
@Ramin I've tried using the tool you linked, but no commands are returned and nothing seems to happen. Additionally, I don't see ak_cleaner-YYYY-MM-DD-HH-MM-SS.log in any Temp folder. As this is a remote issue, I'm unable to connect with our software while that computer is in safe-mode.
0
dovidfCEOCommented:
It probably makes sense to contact Trend Micro at this point. They probably have experience dealing with this issue.
0
OAC TechnologyProfessional NerdsAuthor Commented:
After trying to run the manual install, the first thing we see when launching it is "An error has stopped the Trend Micro Security Agent from installing. No changes have been made to this computer. Please try running the installer again later." We may just have to reach out to Trend.
0
Sudeep SharmaTechnical DesignerCommented:
Could you please clear the TEMP and user TEMP area then try to install and if it fails (most likely) paste the logs files from the TEMP and User Temp?

Logs would most likely would point to the package/file/registry which is detecting Kaspersky agent on the system.

Another option would be using Process Monitor and checking what all areas (File/Registry) Trend Micro access while installing the software, but it would be overkill, unless log files point us to the problematic registry keys or files.

Process Monitor:
https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx

Thanks.
Sudeep
0
OAC TechnologyProfessional NerdsAuthor Commented:
Great Idea Sudeep, I did just that. I've attached the output files from the Trend install to this comment. The installer also output a 300 MB file that is too big to put on here, but I skimmed through these log files and can see that it mentions by name Kaspersky.
RestartManager.log
wofie_msi.log
wofie_msi.log
0
Sudeep SharmaTechnical DesignerCommented:
Hi OAC Technology,

Just looking at these few lines, I am highlighting the ones which are my concerns:

03/07 14:32:44 1874-3a5c (5) [2017/03/07 14:32:44][1874:3a5c]Found AV competitor Kaspersky Security Center Network Agent 10.0.3361 (supported) - .\libWixUninstallCompetitor.cpp:159 - libWixUninstallCompetitor.cpp(159)
03/07 14:32:44 1874-3a5c (5) [2017/03/07 14:32:44][1874:3a5c][SearchProduct]GetPrivateProfileSectionNames return: 136 - .\inst_wsc_UninstallCompet.cpp:124 - inst_wsc_UninstallCompet.cpp(124)
03/07 14:32:44 1874-3a5c (5) [2017/03/07 14:32:44][1874:3a5c][SearchProduct]Uninstall Password required :112779976 - .\inst_wsc_UninstallCompet.cpp:128 - inst_wsc_UninstallCompet.cpp(128)
03/07 14:32:44 1874-3a5c (5) [2017/03/07 14:32:44][1874:3a5c]Silent mode: 1. UI is: 5 - .\libWixUninstallCompetitor.cpp:193 - libWixUninstallCompetitor.cpp(193)
03/07 14:32:44 1874-3a5c (5) [2017/03/07 14:32:44][1874:3a5c]In silent mode will not show dialog - .\libWixUninstallCompetitor.cpp:197 - libWixUninstallCompetitor.cpp(197)

So it has found Kaspersky Security Center Network Agent 10.0.3361 for which an uninstall password is required, however the TrendMicro's uninstaller is running in silent mode, UI mode is 5 and in silent mode it will not show the dialog for uninstall string.

So this would not help much, now we should try getting the debug logs from MSI installer and see if it could provide us some more information.

To enable Windows Installer logging
To enable Windows Installer logging yourself, open the registry by using Regedit.exe, and then create the following subkey and keys:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
Reg_SZ: Logging
Value: voicewarmupx

https://support.microsoft.com/en-gb/help/223300/how-to-enable-windows-installer-logging

This would generate the extra log files in %temp%, compress them and post them here for further analysis.

Thanks,
Sudeep
0
OAC TechnologyProfessional NerdsAuthor Commented:
Hello Sudeep,

I got the log files from the windows installer. I'll add it here.
MSI3f165.LOG
0
RaminTechnical AdvisorCommented:
do you have any registry cleaner tools? , it can be a registry entries.
0
OAC TechnologyProfessional NerdsAuthor Commented:
Any ideas from the log files? Anyone?
0
RaminTechnical AdvisorCommented:
I would try to install kaspersky security center network agent 10, and then try to uninstall it.
0
Sudeep SharmaTechnical DesignerCommented:
Open the device manager, (Windows+Run, type devmgmt.msc and press enter).

Click on View and select "Show Hidden Devicess". After that do you see any device which has Exclamation Mark (Yellow mark) against it?

If found, right click it and select uninstall. Most likely you have some files or drivers left which are not removed.

Further, use Autoruns from Microsoft sysinternal tools and see what remnant drivers or files you could find related to Kaspersky.

Info:
https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Download:
https://download.sysinternals.com/files/Autoruns.zip 

Thanks,
Sudeep
0
OAC TechnologyProfessional NerdsAuthor Commented:
I will try both of your answers. Thanks.
0
OAC TechnologyProfessional NerdsAuthor Commented:
Neither worked.
0
RaminTechnical AdvisorCommented:
0
Sudeep SharmaTechnical DesignerCommented:
Would you be able to provide the ARN file of your system using Autoruns?

Sudeep
0
Dmitri FarafontovLinux Systems AdminCommented:
Why not simply use a native Kaspersky Removal tool to remove the NetAgent:
https://support.kaspersky.com/common/service.aspx?el=1464#block2
Please click on "Additional information for business products"

If still no go try to use Cleaner from Kaspersky which had been designed for force removal:
https://support.kaspersky.com/13088
0
OAC TechnologyProfessional NerdsAuthor Commented:
None of these worked, I ended up reformatting the drive and reinstalling Windows. Thanks for your suggestions.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
OAC TechnologyProfessional NerdsAuthor Commented:
No answer found.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.