Since yesterday I get the error that Sophos Antivirus could not updated. In the SEC I can read the error-code 000000d0.
A new installation or a deinstallation with the removal-tool always fails.
I have a MacBook with Mac OS X Sierra. The actual Sophos version is 9.5.4 .It is possible to reinstall or deinstall Sophos manually?
Greetings
Gerhard
Hello Gerhard,
this sounds like it's SEC-managed - Endpoint would be the better group.
Anyway, unless something really bad happened a reinstall (from a copy of the ESCOSX directory or otherwise similar to the initial install) should work. The removal tool is only necessary if a) you want to uninstall and b) the on-board removal utility has disappeared. Again this is supposed to work - most of the time but might fail for the same reason the Remove (and prior to that apparently the regular updating) failed. Please see the article for further steps (checking the Installer log is for example a good idea).
IMO especially for a managed version (regardless of the OS) it's better to check the logs as first response and not to immediately and unconditionally try a reinstall, uninstall, removal tool sequence in whatever order as the repeated attempts likely obscure the initial issue in the logs. Too late for this issue though.
You can post the (relevant part of) the log here, just want to mention that the managed licensed version entitles you to direct Support as well.
Christian
Hello,
thanks for the answer!
Now, I checked the logfile on my MacBook and I checked the log on the SEC.
This ist the logfile from the MacBook:
com.sophos.autoupdate: Version 9.5.3
com.sophos.autoupdate: Copyright © 1989-2013 Sophos Ltd. Alle Rechte vorbehalten.
com.sophos.autoupdate:
com.sophos.oas:
com.sophos.oas: Sophos Anti-Virus
com.sophos.oas: Product Version: 9.5.4
com.sophos.oas: Engine Version: 3.65.2
com.sophos.oas: Threat Data Version 5.34, 29. November 2016
com.sophos.oas: Includes detection for 12412760 threats
com.sophos.oas: Copyright (c) 1989-2016 Sophos Ltd, www.sophos.com
com.sophos.oas:
com.sophos.oas: Using IDE files:
com.sophos.oas: fare-boh.ide dride-wf.ide rans-dwk.ide fare-bol.ide chisb-lh.ide zeus-k.ide fare-bom.ide docd-fjt.ide
com.sophos.oas: msil-ioe.ide msil-iof.ide msil-iog.ide fare-bon.ide msil-iol.ide docd-fjv.ide msil-iom.ide rans-dwr.ide
com.sophos.oas: rans-dws.ide kovte-fq.ide limit-ny.ide banl-cqi.ide dwnl-puf.ide certor-d.ide locky-su.ide delf-gba.ide
com.sophos.oas: fare-boy.ide locky-tp.ide htadl-o.ide fare-bpc.ide docd-fkz.ide adwin-kr.ide upatr-xr.ide chisb-lr.ide
com.sophos.oas: nanoc-jx.ide fare-bpf.ide irc-c.ide emogen-z.ide ltbot-a.ide cerbe-sc.ide mdro-hoz.ide esapro-l.ide
com.sophos.oas: nanoc-ke.ide docd-fju.ide cerbe-sd.ide rans-dxh.ide mdro-hpf.ide locky-so.ide docd-fmi.ide fare-bpm.ide
com.sophos.oas: dwnl-pxo.ide fare-bpn.ide zbot-lms.ide cerbe-sj.ide andro-on.ide docd-fmq.ide msil-iqf.ide rans-dxl.ide
com.sophos.oas: dride-wk.ide andro-or.ide nanoc-jm.ide shiot-bw.ide docd-fnw.ide rans-dwy.ide docd-foh.ide fare-bqf.ide
com.sophos.oas: docd-for.ide zbot-lnb.ide chisb-mc.ide netwi-hr.ide mdro-hpy.ide hawke-iy.ide rans-dxu.ide inje-cee.ide
com.sophos.oas: cerbe-ss.ide docd-fpv.ide docd-fqa.ide bonda-an.ide msil-irk.ide chisb-lp.ide locky-tq.ide cerbe-sv.ide
com.sophos.oas: miner-bm.ide hawke-iz.ide msil-ipo.ide msil-irl.ide hawke-ja.ide badur-ad.ide fare-bnq.ide fare-bqk.ide
com.sophos.oas: gozi-fe.ide age-aulx.ide zbot-lng.ide hawke-jb.ide locky-tz.ide msil-iro.ide locky-ud.ide vawtr-hu.ide
com.sophos.oas: hawke-iu.ide docd-frl.ide fare-brb.ide vbinj-kj.ide locky-ui.ide fare-brg.ide xtbl-o.ide fare-brk.ide
com.sophos.oas: pdfur-qc.ide xtrat-cr.ide shell-ae.ide hawke-jg.ide pdfur-qi.ide inje-cem.ide cerbe-tl.ide htmldw-h.ide
com.sophos.oas: fare-brp.ide msil-isx.ide hawke-jj.ide fare-brq.ide emoge-ah.ide cerbe-tq.ide fare-brr.ide fare-brs.ide
com.sophos.oas: zbot-lnm.ide cerbe-tr.ide xtbl-p.ide cerbe-tu.ide bbind-ai.ide neure-ao.ide androm-r.ide vdl.dat
com.sophos.oas: fare-brz.ide netwi-ic.ide delfi-da.ide blada-cq.ide inje-cer.ide gozi-fj.ide injec-km.ide hawke-jo.ide
com.sophos.oas: locky-ux.ide docd-fvh.ide nanoc-la.ide bank-grg.ide zbot-lnx.ide nanoc-lb.ide dride-wn.ide limit-oj.ide
com.sophos.oas: bank-gri.ide fare-btc.ide hawke-jt.ide bank-grj.ide phish-mr.ide kovte-fy.ide rans-dzh.ide hawke-ju.ide
com.sophos.oas: vawtr-hw.ide age-auph.ide locky-vh.ide cerbe-uh.ide dwnl-qil.ide ircb-amp.ide dwnl-qio.ide dorkb-lq.ide
com.sophos.oas: fare-btd.ide phish-mw.ide limit-ol.ide cerbe-un.ide andro-pg.ide nanoc-le.ide chisb-mj.ide emoge-al.ide
com.sophos.oas: locky-vq.ide rans-dzo.ide vawtr-ia.ide
com.sophos.oas:
com.sophos.oas:
com.sophos.oas: Stopped On-access protection within ScanD at 08:21 on 12. Dezember 2016
com.sophos.oas:
com.sophos.oas:
com.sophos.autoupdate: Fehler: Sophos Anti-Virus konnte nicht aktualisiert werden um 08:25 am 12 Dezember 2016
com.sophos.autoupdate: Update fehlgeschlagen
com.sophos.autoupdate:
com.sophos.autoupdate: Fehler: Sophos Anti-Virus konnte nicht aktualisiert werden um 08:26 am 12 Dezember 2016
com.sophos.autoupdate: Update fehlgeschlagen
com.sophos.autoupdate:
My first idea was to check the logfiles on SEC and locally on my MacBook. I can mount the update-directories manually. This is not the problem. The client gets the guidelines very well but at least I get the error: Installer Error.
The uninstallation with the Sophos Removal Tool or a new installation allways failed.
Now I need a method to deinstall the Sophos Antivirus manually (without Removal Tool).
Greetings
Gerhard
Hello Gerhard,
Installer Error
install/uninstall errors are not on the Sophos log but usually in /var/log/install.log. And as said, the Removal tool is not the magic wand but might fail for the same reason as the Installer.
I need a method to deinstall
obviously - but the only reasonable method to deal with cases where the "standard" procedures and "emergency" tools fail is to determine (and resolve) the actual cause. An installer performs dozens of actions and while in theory you could do this by hand it'd take quite some time and likely you'll also run into the same error.
Christian
Hello,
now I copy the logfile:
Dec 12 13:39:15 ZEHNM002 Install Helper[71638]: [InstallHelper.m:126] SophosAutoUpdate: Installation Deployer
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEInstallController.m:230] Installing opm version 9.5.4
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEInstallController.m:825] Upgrading the "opm" product
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEAggregateInstallStrategy.m:92] "installer.prepare.stopProcesses" success: YES
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEAggregateInstallStrategy.m:92] "installer.prepare.removeComponents" success: YES
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEAggregateInstallStrategy.m:92] "installer.prepare.removeKeychains" success: YES
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEReceiptClient.m:198] Failed to launch receipt at /Library/Application Support/Sophos/opm/Installer.app/Contents/MacOS/tools/InstallationDeployer. launch path not accessible
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEReceiptClient.m:55] Failed to launch receipt.
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEReceiptClient.m:198] Failed to launch receipt at /Library/Application Support/Sophos/opm/Installer.app/Contents/MacOS/tools/InstallationDeployer. launch path not accessible
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEReceiptClient.m:72] Failed to launch receipt.
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEBuildInstallPlanStrategy.m:94] Failed to connect with receipt
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.buildPlan" success: NO
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.cacheManifestComponents" success: NO
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.remoteRemove" success: NO
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.createUsersAndGroups" success: NO
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.installComponents" success: NO
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.processStart" success: NO
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEAggregateInstallStrategy.m:92] "installer.writeReceipt" success: NO
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEInstallController.m:440] "installer" success: NO
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SMEInstallController.m:320] Successfully send the installer telemetry
Dec 12 13:39:16 ZEHNM002 Sophos Installer[71639]: [SGCServerAuthenticator.m:159] Server connection successfully validated
Dec 12 13:39:17 ZEHNM002 Sophos Installer[71639]: [SGCCDFSBroker.m:306] Feedback json file was successfully uploaded (status code: 201).
Dec 12 13:39:17 ZEHNM002 Sophos Installer[71639]: [SMEInstallController.m:350] Failed to update opm to 9.5.4
Dec 12 13:39:17 ZEHNM002 Sophos Installer[71639]: [SMEInstallController.m:363] Installation complete
Dec 12 13:39:49 ZEHNM002 Install Helper[71654]: [InstallHelper.m:126] SophosAutoUpdate: Installation Deployer
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEInstallController.m:230] Installing opm version 9.5.4
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEInstallController.m:825] Upgrading the "opm" product
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEAggregateInstallStrategy.m:92] "installer.prepare.stopProcesses" success: YES
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEAggregateInstallStrategy.m:92] "installer.prepare.removeComponents" success: YES
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEAggregateInstallStrategy.m:92] "installer.prepare.removeKeychains" success: YES
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEReceiptClient.m:198] Failed to launch receipt at /Library/Application Support/Sophos/opm/Installer.app/Contents/MacOS/tools/InstallationDeployer. launch path not accessible
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEReceiptClient.m:55] Failed to launch receipt.
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEReceiptClient.m:198] Failed to launch receipt at /Library/Application Support/Sophos/opm/Installer.app/Contents/MacOS/tools/InstallationDeployer. launch path not accessible
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEReceiptClient.m:72] Failed to launch receipt.
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEBuildInstallPlanStrategy.m:94] Failed to connect with receipt
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.buildPlan" success: NO
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.cacheManifestComponents" success: NO
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.remoteRemove" success: NO
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.createUsersAndGroups" success: NO
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.installComponents" success: NO
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.processStart" success: NO
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEAggregateInstallStrategy.m:92] "installer.writeReceipt" success: NO
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEInstallController.m:440] "installer" success: NO
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SMEInstallController.m:320] Successfully send the installer telemetry
Dec 12 13:39:50 ZEHNM002 Sophos Installer[71655]: [SGCServerAuthenticator.m:159] Server connection successfully validated
Dec 12 13:39:51 ZEHNM002 Sophos Installer[71655]: [SGCCDFSBroker.m:306] Feedback json file was successfully uploaded (status code: 201).
Dec 12 13:39:51 ZEHNM002 Sophos Installer[71655]: [SMEInstallController.m:350] Failed to update opm to 9.5.4
Dec 12 13:39:51 ZEHNM002 Sophos Installer[71655]: [SMEInstallController.m:363] Installation complete
Dec 12 13:41:04 ZEHNM002 Install Helper[71661]: [InstallHelper.m:126] SophosAutoUpdate: Installation Deployer
Dec 12 13:41:05 ZEHNM002 Sophos Installer[71662]: [SMEInstallController.m:230] Installing opm version 9.5.4
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEInstallController.m:825] Upgrading the "opm" product
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEAggregateInstallStrategy.m:92] "installer.prepare.stopProcesses" success: YES
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEAggregateInstallStrategy.m:92] "installer.prepare.removeComponents" success: YES
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEAggregateInstallStrategy.m:92] "installer.prepare.removeKeychains" success: YES
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEReceiptClient.m:198] Failed to launch receipt at /Library/Application Support/Sophos/opm/Installer.app/Contents/MacOS/tools/InstallationDeployer. launch path not accessible
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEReceiptClient.m:55] Failed to launch receipt.
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEReceiptClient.m:198] Failed to launch receipt at /Library/Application Support/Sophos/opm/Installer.app/Contents/MacOS/tools/InstallationDeployer. launch path not accessible
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEReceiptClient.m:72] Failed to launch receipt.
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEBuildInstallPlanStrategy.m:94] Failed to connect with receipt
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.buildPlan" success: NO
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.cacheManifestComponents" success: NO
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.remoteRemove" success: NO
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.createUsersAndGroups" success: NO
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.installComponents" success: NO
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.processStart" success: NO
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEAggregateInstallStrategy.m:92] "installer.writeReceipt" success: NO
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEInstallController.m:440] "installer" success: NO
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEInstallController.m:320] Successfully send the installer telemetry
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SGCServerAuthenticator.m:159] Server connection successfully validated
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SGCCDFSBroker.m:306] Feedback json file was successfully uploaded (status code: 201).
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEInstallController.m:350] Failed to update opm to 9.5.4
Dec 12 13:41:06 ZEHNM002 Sophos Installer[71662]: [SMEInstallController.m:363] Installation complete
Dec 12 13:41:10 ZEHNM002 Install Helper[71672]: [InstallHelper.m:126] SophosAutoUpdate: Installation Deployer
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEInstallController.m:230] Installing opm version 9.5.4
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEInstallController.m:825] Upgrading the "opm" product
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEAggregateInstallStrategy.m:92] "installer.prepare.stopProcesses" success: YES
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEAggregateInstallStrategy.m:92] "installer.prepare.removeComponents" success: YES
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEAggregateInstallStrategy.m:92] "installer.prepare.removeKeychains" success: YES
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEReceiptClient.m:198] Failed to launch receipt at /Library/Application Support/Sophos/opm/Installer.app/Contents/MacOS/tools/InstallationDeployer. launch path not accessible
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEReceiptClient.m:55] Failed to launch receipt.
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEReceiptClient.m:198] Failed to launch receipt at /Library/Application Support/Sophos/opm/Installer.app/Contents/MacOS/tools/InstallationDeployer. launch path not accessible
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEReceiptClient.m:72] Failed to launch receipt.
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEBuildInstallPlanStrategy.m:94] Failed to connect with receipt
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.buildPlan" success: NO
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.cacheManifestComponents" success: NO
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.remoteRemove" success: NO
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.createUsersAndGroups" success: NO
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.installComponents" success: NO
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEAggregateInstallStrategy.m:92] "installer.localPayload.processStart" success: NO
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEAggregateInstallStrategy.m:92] "installer.writeReceipt" success: NO
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEInstallController.m:440] "installer" success: NO
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEInstallController.m:320] Successfully send the installer telemetry
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SGCServerAuthenticator.m:159] Server connection successfully validated
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SGCCDFSBroker.m:306] Feedback json file was successfully uploaded (status code: 201).
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEInstallController.m:350] Failed to update opm to 9.5.4
Dec 12 13:41:11 ZEHNM002 Sophos Installer[71673]: [SMEInstallController.m:363] Installation complete
but I don´t understand the errors exactly.
It´s possible that the rights are wrong???
Greetings
Gerhard
Hello Gerhard,
I think [SMEReceiptClient.m:198] Failed to launch receipt at /Library/Application Support/Sophos/opm/Installer.app/Contents/MacOS/tools/InstallationDeployer. launch path not accessible indicates the error. Unfortunately I don't know what it actually means, all I know is that the receipts should be in /var/db/receipts/ (with names matching com.sophos.*). But then, I thought that the Removal tool should handle errors with the receipts - do you get the same messages in the log when running the tool?
Maybe someone from Sophos (Aditya Patel?) can say more?
Christian
Hello,
in /var/db/receipts I only find
com.sophos.9.0.0.installer.bom
com.lsophos.9.0.0.installer.plist
actually installed is Sophos Antivirus 9.5.4
Greetings
Gerhard
Hello Gerhard,
all I can say is that these are correct. As for the Removal tool - as you said it failed - did it display an error?
As for the Failed to launch receipt/launch path not accessible - I've no idea which path it is referring to. I'd suggest that you contact Support directly, this is the licensed on-premise version and support is included.
Christian
So you got a "fix" from support? I'm having the same issues.
