This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Failed to install savxp: uninstalling an older product failed.

skyisbluescreen over 3 years ago

Most likely Post WINDOWS Monthly Patch Installation, Sophos status is broken.

We started the Windows updates rollout this week and already have multiple devices with this issues now.

Ex- This device was all okay once the update was installed and rebooted Sophos events shows this error.

Anyone else with this problem?

This thread was automatically locked due to age.

Parents

0 Shweta over 3 years ago

Hi skyisbluescreen

Would you please suggest what is the exact error it is showing under the events?

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 skyisbluescreen over 3 years ago in reply to Shweta

Hello there,

I have updated the Event log in the post. All the machines show the below error :

Jun 3, 2020 1:54 PM
Failed to install savxp: uninstalling an older product failed.

Everything was normal in these devices Sophos was working fine perfectly. However there was 1903 installed they rebooted and boom Sophos AV service goes missing and other ones too.

Hoping someone from the community can help me through.

------------------------------------------------------------------

I have tried Support:Here is what happens

SDU Logs shared for impacted PC's

Request us back to re install

We Do, and Still same problem.

We Report back, they connect and run a PS SCRIPT or BATCH to remove Sophos, Still issue persists after re install

Request to Re Install the OS

-------------------------------------
Cancel
Vote Up 0 Vote Down

Cancel
0 Jiri Hadamek over 3 years ago in reply to Shweta

It haven´t service stopped. It simply haven´t service installed.

Now - after several restarts AND several "update NOW" from Sophos UI on PCs we have the following state:

In Sophos Control Central - OK

ALL Sophos services ARE running - OK

On workstation - Sophos show errors - see the attached pictures.
Cancel
Vote Up 0 Vote Down

Cancel
0 Shweta over 3 years ago in reply to Jiri Hadamek

Hi Jiri Hadamek

Could you please translate the error message shown in the Endpoint UI? Which service state is in the stopped state?

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Jiri Hadamek over 3 years ago in reply to Shweta

Translated freely into English " Some services aren´t started. Call IT" But ALL services ARE running. (After several restart and reinstall from LOCAL Sophos UI)
Cancel
Vote Up 0 Vote Down

Cancel
0 Yashraj S over 3 years ago in reply to Jiri Hadamek

Hi Jiri Hadamek

Can you please click on About > Open Endpoint Self Help Tool > Services and check which services are not running? Do you see any components which are not installed?

Thanks,

Yashraj Singha
Manager | Global Community Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Jiri Hadamek over 3 years ago in reply to Yashraj S

All services ARE running

and

ALL services ARE installed.
Cancel
Vote Up 0 Vote Down

Cancel
0 Nec1or over 3 years ago in reply to Jiri Hadamek

Yep, same here.

Console:

" Failed to install savxp: uninstalling an older product failed."

Log:

"WARN Failed to install product E17FE03B-0501-4aaa-BC69-0129D965F311 10.8.7.1000."

Version agent: 10.8.6 VE3.78.5
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 3 years ago in reply to Nec1or

Can you find (and attach) the install and uninstall logs of SAV in \windows\temp\ (if this is an AutoUpdate initiated install attempt) or under %temp% if you are performing an install with say the Sophos Central installer they would be under %temp%.
Cancel
Vote Up 0 Vote Down

Cancel
0 Nec1or over 3 years ago in reply to jak

Hi jak,

Here is it what I found:

Sophos Anti-Virus Major Install Log

https://pastebin.com/fdBLBRf7

Sophos Anti-Virus Uninstall log

https://pastebin.com/N83VsS2J

SophosUpdate log when I initialization update from Console, maybe could help as well

https://pastebin.com/W1zLQf6r
Cancel
Vote Up 0 Vote Down

Cancel
+1 DianneY over 3 years ago in reply to Nec1or

Seeing error 1612 on SAV uninstall and install logs. The uninstall process is looking for the MSI which is missing in this path: C:\WINDOWS\Installer\60e64.msi.

You can try uninstalling Sophos using the SophosZap tool, and then reinstall Sophos.
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 3 years ago in reply to Nec1or

The install is finding a version of Sophos Anti-Virus installed (ProductCode - BEEB46C0-1983-4DF2-AD40-8C464842DF24) which appears to be broken:

2020-06-15 10:26:49 There is an incomplete SAV installation, forcing a Major Update to recover
2020-06-15 10:26:49 Info: Performing major update of Sophos Anti-Virus using msi.
2020-06-15 10:26:49 Info: Update is signalled.
2020-06-15 10:26:49 In KB2918614Workaround().
2020-06-15 10:26:49 Leaving KB2918614Workaround().
2020-06-15 10:26:49 Product code of SAV currently installed: {BEEB46C0-1983-4DF2-AD40-8C464842DF24}
2020-06-15 10:26:49 Product code of SAV to be installed: {D89312B9-A62F-4FF1-A7E9-077D4C4FE002}

It is then starting the uninstall of it:

2020-06-15 10:26:58 Info: Uninstall SAV
2020-06-15 10:26:58 Unable to delete registry key: SOFTWARE\Sophos\Telemetry\Plugins!
2020-06-15 10:26:58 Info: Running Uninstall of previous version using command line: msiexec.exe /x {BEEB46C0-1983-4DF2-AD40-8C464842DF24} REBOOT=ReallySuppress /qn UNINSTALLDRIVERS=0 UNINSTALLCLASSFILTER=0 UNINSTALLBOOTDRIVERS=1 UNINSTALLKMSDRIVERS=1 CHECKFORSCF=0 INSTALLINGVERSION="10.8.7.1000" /Lvp "C:\WINDOWS\TEMP\Sophos Anti-Virus Uninstall Log_200615_082658.txt"
2020-06-15 10:26:58 Info: Finished waiting for Uninstallation of previous version. Status returned was 0l.
2020-06-15 10:26:58 WARNING: SAV uninstall failed with error 1612

The issue is, the uninstall is failing with1612, which is ERROR_INSTALL_SOURCE_ABSENT. So there is no cached MSI for the product code BEEB46C0-1983-4DF2-AD40-8C464842DF24.

The easiest thing at this point is probably to run SophosZap - https://community.sophos.com/products/endpoint-security-control/b/blog/posts/sophos-zap-is-now-available The alternative is trying to piece together a number of files from another computer.

Regards,
Jak
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 jak over 3 years ago in reply to Nec1or

The install is finding a version of Sophos Anti-Virus installed (ProductCode - BEEB46C0-1983-4DF2-AD40-8C464842DF24) which appears to be broken:

2020-06-15 10:26:49 There is an incomplete SAV installation, forcing a Major Update to recover
2020-06-15 10:26:49 Info: Performing major update of Sophos Anti-Virus using msi.
2020-06-15 10:26:49 Info: Update is signalled.
2020-06-15 10:26:49 In KB2918614Workaround().
2020-06-15 10:26:49 Leaving KB2918614Workaround().
2020-06-15 10:26:49 Product code of SAV currently installed: {BEEB46C0-1983-4DF2-AD40-8C464842DF24}
2020-06-15 10:26:49 Product code of SAV to be installed: {D89312B9-A62F-4FF1-A7E9-077D4C4FE002}

It is then starting the uninstall of it:

2020-06-15 10:26:58 Info: Uninstall SAV
2020-06-15 10:26:58 Unable to delete registry key: SOFTWARE\Sophos\Telemetry\Plugins!
2020-06-15 10:26:58 Info: Running Uninstall of previous version using command line: msiexec.exe /x {BEEB46C0-1983-4DF2-AD40-8C464842DF24} REBOOT=ReallySuppress /qn UNINSTALLDRIVERS=0 UNINSTALLCLASSFILTER=0 UNINSTALLBOOTDRIVERS=1 UNINSTALLKMSDRIVERS=1 CHECKFORSCF=0 INSTALLINGVERSION="10.8.7.1000" /Lvp "C:\WINDOWS\TEMP\Sophos Anti-Virus Uninstall Log_200615_082658.txt"
2020-06-15 10:26:58 Info: Finished waiting for Uninstallation of previous version. Status returned was 0l.
2020-06-15 10:26:58 WARNING: SAV uninstall failed with error 1612

The issue is, the uninstall is failing with1612, which is ERROR_INSTALL_SOURCE_ABSENT. So there is no cached MSI for the product code BEEB46C0-1983-4DF2-AD40-8C464842DF24.

The easiest thing at this point is probably to run SophosZap - https://community.sophos.com/products/endpoint-security-control/b/blog/posts/sophos-zap-is-now-available The alternative is trying to piece together a number of files from another computer.

Regards,
Jak
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data