Sophos Endpoint Security and Control: installation error 'Cancelled Sophos installation because existing third party security software could not be uninstalled'

Issue
When using the 'Protect computers' wizard with 'Remove third-party software' selected in Enterprise Console, version 3.1 and above, the message 'Cancelled Sophos installation because existing third party security software could not be uninstalled' is displayed in Enterprise Console.

Removal of third-party software and the installation of Sophos products fails.

Note: this error message will also appear if you have run the Sophos installer directly from your Central Installation Directory (CID).

Sophos product and version
Sophos Endpoint Security and Control, version 8.0 and above
Sophos Enterprise Console, version 3.1 and above

Operating system
Windows 2000+

What to do

Disable tamper protection on your affected computers and then use the 'Protect computers' wizard again.

To disable tamper protection in:

Kaspersky Antivirus 2009

1. Right-click the Kaspersky "K" symbol in the system tray. The Settings window opens
2. Select the Options node in the left menu.
3. Remove the check marks from the options "Enable Self-Defense" and "Disable external service control".
4. Click Apply to apply the changes, then click OK to close the window.

Cisco (CSA)

1. Right-click on the Cisco Security Agent icon in the system tray.
2. Select Security Level, then choose Off.
3. In the prompt that follows, choose Yes. Click Apply.

A notification in the system tray will display the time limit after which security will be switched back on.

Symantec

1. Open Symantec AntiVirus on the computer.
2. On the 'Configure' menu, select Tamper Protection.
3. Remove the check mark from the 'Enable Tamper Protection' check box.

Norton Internet Security 2009 and 2010

1. Right-click on the Norton Internet Security icon in the system tray, select "Open Norton Internet Security.
2. In the main screen, choose "Settings" next to "Computer".
3. In the Settings screen, expand the "Miscellaneous Settings" section.
4. Under the "Product Security" setting, drag the slider next to "Norton Product Tamper Protection" to Off.
5. Click OK. Choose "Permanently" when prompted with a security alert. Click OK.
6. Close the main interface.

McAfee Internet Security Suite

1. Right-click the McAfee icon in the system tray.
2. In the menu, choose Change Settings, then View All Settings.
3. At the bottom of the screen, expand "Access Protection".
4. Remove the check mark from from "Use Access Protection". Click Apply.

McAfee VirusScan

1. Right-click on the Virusscan icon in the system tray.
2. Select VirusScan Console.
3. In the console, double-click Access Protection.
4. In the Access Protection properties, remove the check mark from the ‘Enable Access Protection’ and the ‘Prevent McAfee services from being stopped’ check boxes.
5. Click OK and close the Console.

If it is not possible to open the VirusScan Console or modify the Access Protection properties, contact McAfee technical support for further information.

McAfee Hips

Do one of the following:

• remove HIPS using ePO Console (refer to the ePO Console documentation on how to do this)
• unlock HIPS on the endpoint with a password (refer to your McAfee documentation) and then remove McAfee Agent + VirusScan as normal,
• follow the instructions at https://kc.mcafee.com/corporate/index?page=content&id=KB51699

avast!

1. Right-click on the avast! icon in the system tray.
2. Select Program Settings.
3. In the avast! Settings, choose Troubleshooting.
4. In the Troubleshooting properties, add a check mark to the ‘Disable avast! self-defense module’ check box.
5. Click OK. You will receive a warning about avast! Self defense being switched off.
6. Click Yes to continue.

Avira Antivir Personal and Avira Antivir Professional

1. Double-click the Avira red umbrella icon in the system tray. The console opens.
2. Select Extras from the menu, then choose Configuration (or press F8 from the console window).
3. A new screen opens. Add a check mark to the option "Expert Mode". Additional options will then appear.
4. Under General, choose Security.
5. Under Product Protection, remove the check mark from "Protect Avira processes from unwanted termination" and, if it exists, from "Protect files and registry entries from manipulation".
6. Click OK to close the console.

Technical Information
Tamper protection actively monitors the files and services installed by the third-party security software and prevents them from being removed, edited or shut down. If tamper protection is enabled on any of your computers when you use the 'Protect computers' wizard, the wizard will fail.