- Uninstall any relation to Sophos AutoUpdate, Sophos Remote Management System and "Sophos Diagnostic Utility"
- If uninstallation ask for binaries you give him this path
C:\ProgramData\Sophos\AutoUpdate\Cache\sau\sophos autoupdate.msi
C:\Program Files\Sophos\AutoUpdate\sau\Sophos AutoUpdate.msi - If net stop "sophos AutoUpdate Service"
- Stop any Sophs services
- Stop "almon.exe" process
- Delete this register key HKLM\Software\Sophos
- Start --> cmd
sc delete savonaccesscontrol
sc delete savonaccessfilter
sc delete skmscan
sc delete savadminservice
sc delete savonaccess - net stop "sophos AutoUpdate Service"
- sc delete "sophos AutoUpdate Service"
- If you get error 1060 (service is not installed) you can not consider it
- Create .reg file like in appendix
- Delete this folders:
C:\Program Files (x86)\Sophos\ - Restart Server (in my case it was not necessary)
- Reinstall Anvitivus
In case of less sophos services and differs from policies errors I followed this procedure
1. On server/client you need to stop all sophos services (10 or 11)
2. You must copy and overwrite all binaries from these paths:
\\xxxxxxx\SophosUpdate\CIDs\S005\SAVSCFXP
To C:\Program Files (x86)\Sophos\AutoUpdate
3. Reinstall AV from standard path as usually:
\\xxxxxx\SophosUpdate\CIDs\S005\
APPENDIX
Windows Registry Editor Version 5.00
;Removes Basic MSI info for SAU.
;x86
;SAU 2
[-HKEY_CLASSES_ROOT\Installer\Features\BE814C515767eb242B3B829125AD10D4]
[-HKEY_CLASSES_ROOT\Installer\Products\BE814C515767eb242B3B829125AD10D4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\BE814C515767eb242B3B829125AD10D4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\BE814C515767eb242B3B829125AD10D4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15C418EB-7675-42be-B2B3-281952DA014D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\BE814C515767eb242B3B829125AD10D4]
;SAU 3
[-HKEY_CLASSES_ROOT\Installer\Features\F132429DD20DB0E45B11CCA4E0E35D74]
[-HKEY_CLASSES_ROOT\Installer\Products\F132429DD20DB0E45B11CCA4E0E35D74]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\F132429DD20DB0E45B11CCA4E0E35D74]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\F132429DD20DB0E45B11CCA4E0E35D74]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D924231F-D02D-4E0B-B511-CC4A0E3ED547}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F132429DD20DB0E45B11CCA4E0E35D74]
;SAU 4
[-HKEY_CLASSES_ROOT\Installer\Features\C0A62DC795B948E45BEE3B682B7FAA61]
[-HKEY_CLASSES_ROOT\Installer\Products\C0A62DC795B948E45BEE3B682B7FAA61]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\C0A62DC795B948E45BEE3B682B7FAA61]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\C0A62DC795B948E45BEE3B682B7FAA61]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7CD26A0C-9B59-4E84-B5EE-B386B2F7AA16}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C0A62DC795B948E45BEE3B682B7FAA61]
;SAU 5
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BCF53039-A7FC-4C79-A3E3-437AE28FD918}]
[-HKEY_CLASSES_ROOT\Installer\Features\93035FCBCF7A97C43A3E34A72EF89D81]
[-HKEY_CLASSES_ROOT\Installer\Products\93035FCBCF7A97C43A3E34A72EF89D81]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\93035FCBCF7A97C43A3E34A72EF89D81]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\93035FCBCF7A97C43A3E34A72EF89D81]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\93035FCBCF7A97C43A3E34A72EF89D81]
;x64
;SAU 2
[-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{15C418EB-7675-42be-B2B3-281952DA014D}]
;SAU 3
[-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D924231F-D02D-4E0B-B511-CC4A0E3ED547}]
;SAU 4
[-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7CD26A0C-9B59-4E84-B5EE-B386B2F7AA16}]
;SAU 5
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BCF53039-A7FC-4C79-A3E3-437AE28FD918}]
;common
[-HKEY_CLASSES_ROOT\Installer\UpgradeCodes\0D6888B32A8929940ACA98A3DEBB94B4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0D6888B32A8929940ACA98A3DEBB94B4]