Can't upgrade to new version of Returnil Home Lux

In a thread I started earlier today, I was told that there was a new version of Returnil. I decided to upgrade to it, but I ran into problems because I forgot I needed to disable my security software first. As I explained in the earlier thread, I finally went back to a Restore Point from yesterday, then (with the security software disabled), uninstalled the old version of Returnil, rebooted, and went to install the new version.

To my dismay, I've gotten the same messages I had earlier. First, that Returnil Setup Wizard ended prematurely because of an error, and then "A prior uninstall of a Returnil product did not complete properly. Please acomplete the uninstall of this software and restart your computer before installing Returnil Virtual System 2010." Of course, as was the case before, no version of Returnil was listed in Add/Remove Programs. Indeed, this time I thought I had successfully uninstalled the earlier version. The only thing I could do, again, was go back to yesterday's restore point. I've done that, and I seem to have a working copy of the old Returnil on my computer, but I am completely unable to upgrade. I have no idea what to do and would be most grateful for some help. Again.

 

Hi,
Don't panic...

Now that you are restored, turn off all other security programs - make sure your AV/HIPS resident monitor(s) are set to only reactivate when you tell it to or for a period of time that will enable a full uninstall and reboot.

Then go ahead and install a fresh copy after you have restarted after the uninstall. Let me know the results.

Mike

 

Mike, the problem is that what you're telling me to do is exactly what I did before. I went back to a restore point, turned off the security programs, successfully uninstalled Returnil, rebooted, again turned off the security software, and then tried to install the new version. But the installation didn't complete, and I got the error messages I mentioned in my previous message. Why should it work this time?

 

Well, I decided to give it another try. Unfortunately, as I'd feared, I had exactly the same experience as before. Apparently, I cannot completely uninstall whatever failed uninstallation is still on my system. The problem may be that I can't find a way to prevent McAfee Enterprise Edition antivirus from starting at startup. I can disable it, but as soon as I reboot, it starts again.

I've again gone back to a restore point. I'm at a loss as to how to manage to deal with this problem, short of totally uninstalling McAfee, something I really am not eager to do.

 

I've had the same problem with the last two versions of Returnil. I spent hours trying to uninstall an older version (following the recommended procedure of turning off my AV and not using a third-party uninstaller such as Revo) only to get a message saying the new version couldn't be installed because the previous version hadn't been completely uninstalled. How can a person finish the uninstallation as Returnil's message advises when it no longer appears in add/remove programs? I kept restoring my PC using FirstDefense-ISR until, after numerous attempts, one uninstall/reinstall was finally successful after I ran a registry cleaner.

I purchased a new PC with Windows 7 64-bit a few days ago and promptly installed Returnil. The next day, I learned a new version of Returnil was available. I turned off my AV, exited Returnil (which had not been enabled), used Windows to uninstall Returnil then rebooted. When I started installing the latest version of Returnil, I received a message saying a Returnil process was already running. Using Process Explorer, I discovered rvsmon was active; there was also 2.37 MB leftover in the Returnil folder in my C drive's Program Files. How this was possible when Returnil should have been completely uninstalled baffled me.

I killed rvsmon, deleted the Returnil folder and attempted to continue installing the latest version. Another message appeared saying a previous version hadn't been fully uninstalled. Since my beloved FD-ISR isn't compatible with Win 7, I used a backup image to restore my PC. Here's how I finally got the latest Returnil installed on both my PCs: I exited Returnil then used Process Explorer to kill rvsmon. I left my AV active and used Windows to uninstall Returnil. After rebooting, I checked and there was no rvsmon process running and no Returnil folder in Program Files. I was then able to install the latest version of Returnil without any problem. Based on my experiences, the trick to updating Returnil is killing the rvsmon process before uninstalling your current version. Why rvsmon continues to run after you exit Returnil eludes me. I don't know how folks who don't use backup imaging or ISR software could easily resolve the problem of a failed Returnil uninstallation.

 

Are you the Administrator or do you have a managed system?

Mike

 

I am the administrator.

 

What version/build of MAV Enterprise?

 

8.7.0i

Here's some additional info:
Scan Engine Version [32 bit] - 5400.1158
DAT version: 5853.0000
DAT created on: January 6, 2010

Number of signatures in extra.dat: None
Names of threats that extra.dat can detect: None
Buffer Overflow and Acces Protection DAT Version: 410
Installed Patches: 1
Installed Modules: None

 

Are you also using the ePolicy Orchestrator?

* After some research on the EPO:

Product Guide

And then search for the following on the General TAB:

Turn these options off, restart your computer, and then attempt another RVS installation. If successful, reactivate each MAV option (one at a time) and check for any issues.

 

Wow, thanks VERY much, ColdMoon! I confess that I didn't even know what the ePolicy Orchestrator was, so I doubt that I'm using it, though one never knows . I get McAfee for free through my university's site license, and though it's something of a resource hog, it has served me well. Anyway, the directions you've supplied seem as if they don't depend on the EPO--just opening the VirusScan Console should enable me to do what the instructions say. I'll give this a try later today and let you know.

 

Well, now I AM beginning to panic. I tried again to uninstall Returnil. I tried to turn off every bit of security software, including following your instructions for McAfee. I then uninstalled Returnil via Add/Remove Programs and was asked whether I wanted to restart my computer now or do it later. I was going to do it now, but I thought I'd first be sure there were no more security-related processes and services running. Malwarebytes' MBAM Service was running, in spite of my having closed that program (and I don't have it start at startup). I chose to suspend that service--and my computer hung! I had to force a shutdown. I then rebooted again, but it didn't do any good. when I tried to install the new version of Returnil, I got the by now very familiar message telling me that an earlier uninstall had not been completed, and the installation of the new version couldn't take place until I had uninstalled the old one. Which, of course, was no longer in Add/Remove Programs.

I went back to a restore point I had set and then wrote this message. I confess that in all the years I have used computers and installed and uninstalled software, I have NEVER experienced anything like this. I'd be most grateful for more help.

 

Hi,
Let me check with the team on this and do a little more research. See your PM and send me the file asked for to help me with the research.

Thanks
Mike

 

Hi Cyberdiva

When I was having problems uninstalling RVS2010 where I got the incomplete uninstall error message it was due to two files - rvsmon.sys and rvsmonf.sys - buried in C:\windows\system32\drivers (that's on windows XP) that were being left behind after an uninstall.

I did an uninstall then removed these files that were left behind and it re-installed fine.

Hope this helps

Uli

 

One thing I discovered is that, because rvsmon runs as a service, it's better to stop the service rather than just killing the process. Killing the process doesn't terminate RVS cleanly as any active RVS File Protection remains enabled. Stopping the service allows RVS time to disable all program features before ending.

 

Thanks very much, Karen76, Uli, and pegr, for your helpful and reassuring messages. They should prove very useful when I try again to uninstall Returnil and install the new version. I think I'll hold off doing that for a while. I sent Mike a file he asked for in a PM, and I'd like to hear back from him before I try again. Also, I don't think I can stand seeing those frustrating error messages one more time today!

I'm both encouraged and appalled that the problem I've been having is apparently pretty common among Returnil users. People should not have to jump through so many hoops just to uninstall software or upgrade to a new version.

 

Well, it sure worked for me ... certainly better than the official advice of turning off any AV program and not using a third-party uninstaller. I never had any problem uninstalling old versions of Returnil using Revo Uninstaller, but I sure have with the last two versions using the recommended Windows uninstaller.

Why would a person attempt to uninstall Returnil when its protection was currently enabled? I wouldn't think that would work at all.

The issue as I see it is why Returnil's uninstaller doesn't terminate rvsmon and any other active process/service as the first step in uninstalling the program. That was certainly the problem I repeatedly experienced and I don't appear to be alone.

cyberdiva, you're very welcome. Good luck to you.

I heartily concur.

 

Hi cyberdiva

You're welcome. Good luck.

Uli

 

Hi,
A follow up to some of the commentary and a new instruction for cyberdiva:

1. This is not widespread among all users, in fact, it is very rare when compared to the total number of RVS users/customers. It may appear to be that way from the posts here in the forums, but forums are "fishbowls" that tend to overemphasize the actual impact. This is understandable as those posting reports are also very likely to be angry and demanding an immediate fix for their situation.

Please be assured however, that we take the reports very seriously and are working hard to discover the root cause.

2. Asking users to deactivate other security, third party uninstallers, and imaging software is there to address the low hanging fruit. For the majority of non-forum support requests, this recommendation is effective at resolving their install/uninstall issues.

With this said however, there are a very small number of users that do not get relief using this recommendation.

So now to what we need from cyberdiva:

Thanks
Mike

 

Thanks very much, Mike, for your response and your continued help. When you say "download the new 3.1 installer," are you talking about the file I downloaded two days ago from Major Geeks: RVS_SETUP_3.1.7414-REL.exe? If so, can I use the copy I already have? And can I simply copy and paste the line you said I should be sure to enter EXACTLY? By the way, the file is not downloaded to my desktop. I almost never download files to my desktop, preferring to download them to a specific directory. Is it necessary that I move this file to my desktop instead? I suspect it is not, but i just want to be sure.

 

Yes and yes

Yes

No, the instructions are generic and detailed to be as simple as possible for a wide range of users. Just be sure to navigate to the correct directory within the Command Prompt window so the command line is executed within the directory where you have the RVS installer file.

Mike

 

I'm not sure you've understood what I was saying. I never said that System Safe (Virtual System) was enabled. I said that killing the rvsmon process leaves any active file protection enabled, which is not the same thing. File Protection is a Virus Guard feature and is independent of whether or not System Safe is enabled.

The fact that killing the rvsmon process leaves file protection active suggest that a file filter driver may still be running. All I was saying is that ending RVS 2010 cleanly by stopping the service rather than killing the process has got to be better in principle. As to whether that could possibly have any bearing on the uninstall process, well that depends on how the uninstaller has been written and I don't know the answer to that. Uli9000 has already said that .sys driver files were left behind after uninstalling RVS 2010 and it's just possible that if these files were still in use and locked by Windows during uninstallation, it could have resulted in an incomplete uninstallation.

I discovered this feature of RVS 2010 purely as a result of experimentation, not as a result of an attempt to uninstall the program. Whenever, I have uninstalled and reinstalled RVS 2010 it has always done so perfectly, so the install/uninstall issue that is being discussed in this thread isn't one that affects everybody.

 

Hi pegr,
Just a quick clarification here:

1. RVS does not use file filtering except where a VG scan is concerned.
2. RVS virtualization is independent of the GUI. This means that even if you Exit or kill the GUI, the virtualization state will persist. This is an important self-protection feature that eliminates the possibility that malware (or other) could terminate the virtualization when active. It also assures that the virtualization will be active if a user simply logs out of their account without a restart.

The virtualization and Virtual Disk drivers are kernel level so require a very precise uninstall procedure. The RVS uninstaller/installer is designed to preform these steps and in almost all cases is effective at removing all traces of a previous install (upgrading in place simply upgrades portions of the current RVS installation so may or may not require a restart).

If there is something that interferes or blocks the termination of the drivers, service, or the removal of their applicable registry entries, the uninstall could fail. There could also be an unknown "collision" between the RVS components discussed here and other programs (ref: earlier 3x versions and Secunia...).

HTH
Mike

 

Thanks, Mike, for your quick response. I hate to seem feebleminded (or to let the world know that I am ), but if what I'm about to do, following your detailed instructions, is "a more advanced installation," how can I install the new version when apparently the old version is still present? So should I go through the same business of turning off/closing down every bit of security software and then trying once again to uninstall the old version first? And if by some miracle that succeeds, then and only then use the advanced installation procedure you described?

 

The object goal at this point is to get the verbose debug log which will provide the QC team with more detailed information and help with their investigation so you should still deactivate other security programs to keep the environment the same as your previous attempts. Though (most likely) related to an issue already corrected in the 3.1 installer, there may be specific variations that your log can help identify.

Mike