Failed to install ntp64: general error - Windows 10

Hello!

We have been seeing the Failed to install ntp64: general error in a lot of our machines since around November. Most of the computers affected were new machines we imaged with SCCM. I see that this error was common with Windows 7 due to an update and I was wondering if that is the case here. I believe all machines should be Windows 10 build version 2004.

Is there a fix, or do I need to reinstall? The last time I tried to uninstall it didn't, and then I was locked out of Tamper Protection and it was showing it was still on, even though I turned it off...

Thank you in advance!

James

Top Replies

Sophos User930 25 days ago +1 suggested

Could you link an install log from a client? If AutoUpdate keeps retrying evert hour to install, which it should be, there will probably be quite a few under \windows\temp\

E.g.
Sophos Network Threat Protection…

Parents

0 Sophos User930 25 days ago

Could you link an install log from a client? If AutoUpdate keeps retrying evert hour to install, which it should be, there will probably be quite a few under \windows\temp\

E.g.
Sophos Network Threat Protection Install Log 20210203 150932.txt

Thanks.
Cancel
Up +1 Down

Reply

Verify Answer

Reject Answer

Cancel
0 CapMReynolds 17 days ago in reply to Sophos User930

Since I can't upload the text file, here is the log:

ProductSetup::ProductSetup: Begin product setup
ProductSetup::InstUninstEntry: Begin install
setup::TamperProtectionControl::TamperProtectionControl: Disabled tamper protection for component NTP
setup::TamperProtectionControl::TamperProtectionControl: Disabled tamper protection for service Sophos Network Threat Protection
setup::TamperProtectionControl::TamperProtectionControl: Disabled tamper protection for service sntp
ProductSetup::InstUninstEntry: Show gui: false
ProductSetup::InstUninstEntry: Existing product code: {4B1F9009-CD85-43C0-BCBD-D491908D5A52}
ProductSetup::InstUninstEntry: Install from: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64
ProductSetup::InstUninstEntry: Install to: <default>
=== Verbose logging started: 2/14/2021 18:01:45 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\su-setup32.exe ===
MSI (c) (F4:F0) [18:01:45:457]: Cloaking enabled.
MSI (c) (F4:F0) [18:01:45:457]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (F4:F0) [18:01:45:473]: End dialog not enabled
MSI (c) (F4:F0) [18:01:45:473]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
MSI (c) (F4:F0) [18:01:45:473]: Package we're running from ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
MSI (c) (F4:F0) [18:01:45:473]: Machine policy value 'DisableUserInstalls' is 0
MSI (c) (F4:F0) [18:01:45:473]: APPCOMPAT: Compatibility mode property overrides found.
MSI (c) (F4:F0) [18:01:45:473]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'.
MSI (c) (F4:F0) [18:01:45:473]: APPCOMPAT: no matching ProductCode found in database.
MSI (c) (F4:F0) [18:01:45:488]: MSCOREE not loaded loading copy from system32
MSI (c) (F4:F0) [18:01:45:488]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'.
MSI (c) (F4:F0) [18:01:45:488]: APPCOMPAT: no matching ProductCode found in database.
MSI (c) (F4:F0) [18:01:45:488]: Transforms are not secure.
MSI (c) (F4:F0) [18:01:45:488]: Note: 1: 2205 2: 3: Control
MSI (c) (F4:F0) [18:01:45:488]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\Sophos Network Threat Protection Install Log 20210214 180145.txt'.
MSI (c) (F4:F0) [18:01:45:488]: No Command Line.
MSI (c) (F4:F0) [18:01:45:488]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{BDBDC64C-EB88-4135-BD3F-FE19CA9893E3}'.
MSI (c) (F4:F0) [18:01:45:488]: Product Code passed to Engine.Initialize: '(none)'
MSI (c) (F4:F0) [18:01:45:488]: Product Code from property table before transforms: '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'
MSI (c) (F4:F0) [18:01:45:488]: Product Code from property table after transforms: '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'
MSI (c) (F4:F0) [18:01:45:488]: Product not registered: beginning first-time install
MSI (c) (F4:F0) [18:01:45:488]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
MSI (c) (F4:F0) [18:01:45:488]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2
MSI (c) (F4:F0) [18:01:45:488]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (c) (F4:F0) [18:01:45:488]: User policy value 'SearchOrder' is 'nmu'
MSI (c) (F4:F0) [18:01:45:488]: Adding new sources is allowed.
MSI (c) (F4:F0) [18:01:45:488]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
MSI (c) (F4:F0) [18:01:45:488]: Package name extracted from package path: 'Sophos Network Threat Protection.msi'
MSI (c) (F4:F0) [18:01:45:488]: Package to be registered: 'Sophos Network Threat Protection.msi'
MSI (c) (F4:F0) [18:01:45:488]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (c) (F4:F0) [18:01:45:488]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
MSI (c) (F4:F0) [18:01:45:488]: TRANSFORMS property is now:
MSI (c) (F4:F0) [18:01:45:488]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'.
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\ProgramData
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (c) (F4:F0) [18:01:45:504]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MSI (c) (F4:F0) [18:01:45:504]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
MSI (c) (F4:F0) [18:01:45:504]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
MSI (c) (F4:F0) [18:01:45:504]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
MSI (c) (F4:F0) [18:01:45:504]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
MSI (c) (F4:F0) [18:01:45:504]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
MSI (c) (F4:F0) [18:01:45:504]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
MSI (c) (F4:F0) [18:01:45:519]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation
MSI (c) (F4:F0) [18:01:45:519]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
MSI (c) (F4:F0) [18:01:45:519]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'PBC-COM'.
MSI (c) (F4:F0) [18:01:45:519]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'COMPHX'.
MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi'.
MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi'.
MSI (c) (F4:F0) [18:01:45:519]: Machine policy value 'MsiDisableEmbeddedUI' is 0
MSI (c) (F4:F0) [18:01:45:519]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI
MSI (c) (F4:F0) [18:01:45:519]: EEUI - Disabling MsiEmbeddedUI in quiet mode
=== Logging started: 2/14/2021 18:01:45 ===
MSI (c) (F4:F0) [18:01:45:519]: Machine policy value 'DisableRollback' is 0
MSI (c) (F4:F0) [18:01:45:519]: User policy value 'DisableRollback' is 0
MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
MSI (c) (F4:F0) [18:01:45:519]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (c) (F4:F0) [18:01:45:519]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
MSI (c) (F4:F0) [18:01:45:519]: Creating MSIHANDLE (1) of type 790537 for thread 5616
MSI (c) (F4:F0) [18:01:45:519]: MsiOpenPackageEx is returning 0
MSI (c) (F4:F0) [18:01:45:519]: Closing MSIHANDLE (1) of type 790537 for thread 5616
=== Verbose logging stopped: 2/14/2021 18:01:45 ===

setup::MsiInstaller::install: New version: {2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}, version: 1.11.194.0
=== Verbose logging started: 2/14/2021 18:01:45 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\su-setup32.exe ===
MSI (c) (F4:F0) [18:01:45:551]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\WINDOWS\Installer\4978e5.msi' against software restriction policy
MSI (c) (F4:F0) [18:01:45:551]: SOFTWARE RESTRICTION POLICY: C:\WINDOWS\Installer\4978e5.msi has a digital signature
MSI (c) (F4:F0) [18:01:45:551]: SOFTWARE RESTRICTION POLICY: C:\WINDOWS\Installer\4978e5.msi is permitted to run because the user token authorizes execution (system or service token).
MSI (c) (F4:F0) [18:01:45:551]: Cloaking enabled.
MSI (c) (F4:F0) [18:01:45:551]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (F4:F0) [18:01:45:551]: End dialog not enabled
MSI (c) (F4:F0) [18:01:45:551]: Original package ==> C:\WINDOWS\Installer\4978e5.msi
MSI (c) (F4:F0) [18:01:45:551]: Package we're running from ==> C:\WINDOWS\Installer\4978e5.msi
MSI (c) (F4:F0) [18:01:45:551]: APPCOMPAT: Uninstall Flags override found.
MSI (c) (F4:F0) [18:01:45:551]: APPCOMPAT: Uninstall VersionNT override found.
MSI (c) (F4:F0) [18:01:45:551]: APPCOMPAT: Uninstall ServicePackLevel override found.
MSI (c) (F4:F0) [18:01:45:551]: APPCOMPAT: looking for appcompat database entry with ProductCode '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'.
MSI (c) (F4:F0) [18:01:45:551]: APPCOMPAT: no matching ProductCode found in database.
MSI (c) (F4:F0) [18:01:45:566]: MSCOREE not loaded loading copy from system32
MSI (c) (F4:F0) [18:01:45:566]: Machine policy value 'DisablePatch' is 0
MSI (c) (F4:F0) [18:01:45:566]: Machine policy value 'AllowLockdownPatch' is 0
MSI (c) (F4:F0) [18:01:45:566]: Machine policy value 'DisableLUAPatching' is 0
MSI (c) (F4:F0) [18:01:45:566]: Machine policy value 'DisableFlyWeightPatching' is 0
MSI (c) (F4:F0) [18:01:45:566]: Enabling baseline caching for this transaction since all active patches are MSI 3.0 style MSPs or at least one MSI 3.0 minor update patch is active
MSI (c) (F4:F0) [18:01:45:566]: APPCOMPAT: looking for appcompat database entry with ProductCode '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'.
MSI (c) (F4:F0) [18:01:45:566]: APPCOMPAT: no matching ProductCode found in database.
MSI (c) (F4:F0) [18:01:45:566]: Transforms are not secure.
MSI (c) (F4:F0) [18:01:45:566]: Note: 1: 2205 2: 3: Control
MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\Sophos Network Threat Protection Install Log 20210214 180145.txt'.
MSI (c) (F4:F0) [18:01:45:566]: No Command Line.
MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{0B95A4E2-4953-4CE7-B8F7-53BB197E234A}'.
MSI (c) (F4:F0) [18:01:45:566]: Product Code passed to Engine.Initialize: '(none)'
MSI (c) (F4:F0) [18:01:45:566]: Product Code from property table before transforms: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'
MSI (c) (F4:F0) [18:01:45:566]: Product Code from property table after transforms: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'
MSI (c) (F4:F0) [18:01:45:566]: Product registered: entering maintenance mode
MSI (c) (F4:F0) [18:01:45:566]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding ProductState property. Its value is '5'.
MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding ProductToBeRegistered property. Its value is '1'.
MSI (c) (F4:F0) [18:01:45:566]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2
MSI (c) (F4:F0) [18:01:45:566]: Package name retrieved from configuration data: 'Sophos Network Threat Protection.msi'
MSI (c) (F4:F0) [18:01:45:566]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (c) (F4:F0) [18:01:45:566]: Machine policy value 'DisableMsi' is 0
MSI (c) (F4:F0) [18:01:45:566]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (c) (F4:F0) [18:01:45:566]: User policy value 'AlwaysInstallElevated' is 0
MSI (c) (F4:F0) [18:01:45:566]: Product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} is admin assigned: LocalSystem owns the publish key.
MSI (c) (F4:F0) [18:01:45:566]: Product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} is managed.
MSI (c) (F4:F0) [18:01:45:566]: Running product '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}' with elevated privileges: Product is assigned.
MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
MSI (c) (F4:F0) [18:01:45:566]: TRANSFORMS property is now:
MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding PRODUCTLANGUAGE property. Its value is '1033'.
MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'.
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\ProgramData
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
MSI (c) (F4:F0) [18:01:45:566]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
MSI (c) (F4:F0) [18:01:45:582]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation
MSI (c) (F4:F0) [18:01:45:582]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
MSI (c) (F4:F0) [18:01:45:582]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'PBC-COM'.
MSI (c) (F4:F0) [18:01:45:582]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'COMPHX'.
MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding Installed property. Its value is '00:00:00'.
MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\WINDOWS\Installer\4978e5.msi'.
MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\WINDOWS\Installer\4978e5.msi'.
MSI (c) (F4:F0) [18:01:45:582]: Machine policy value 'MsiDisableEmbeddedUI' is 0
MSI (c) (F4:F0) [18:01:45:582]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI
MSI (c) (F4:F0) [18:01:45:582]: EEUI - Disabling MsiEmbeddedUI in quiet mode
=== Logging started: 2/14/2021 18:01:45 ===
MSI (c) (F4:F0) [18:01:45:582]: Note: 1: 2205 2: 3: PatchPackage
MSI (c) (F4:F0) [18:01:45:582]: Machine policy value 'DisableRollback' is 0
MSI (c) (F4:F0) [18:01:45:582]: User policy value 'DisableRollback' is 0
MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
MSI (c) (F4:F0) [18:01:45:582]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (c) (F4:F0) [18:01:45:582]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
MSI (c) (F4:F0) [18:01:45:582]: Creating MSIHANDLE (2) of type 790537 for thread 5616
MSI (c) (F4:F0) [18:01:45:582]: MsiOpenPackageEx is returning 0
MSI (c) (F4:F0) [18:01:45:582]: MsiOpenPackage is returning 0
MSI (c) (F4:F0) [18:01:45:582]: Closing MSIHANDLE (2) of type 790537 for thread 5616
=== Verbose logging stopped: 2/14/2021 18:01:45 ===

setup::MsiInstaller::install: Installed version: {4B1F9009-CD85-43C0-BCBD-D491908D5A52}, version: 1.9.2235.0
setup::MsiInstaller::install: Removing IPS rules registry values because the product code or version is different
setup::MsiInstaller::install: Performing major upgrade
setup::MsiInstaller::cleanInstall: Running clean install
setup::MsiInstaller::installOrUpgrade: Executing: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi INSTALLDIR="" REBOOT=ReallySuppress INSTALLINGVERSION="1.11.194.0" ARPSYSTEMCOMPONENT=1
setup::MsiInstaller::tryRunMsi: Running MSI command, attempt (1 of 10)
=== Verbose logging started: 2/14/2021 18:01:45 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\su-setup32.exe ===
MSI (c) (F4:3C) [18:01:45:676]: Resetting cached policy values
MSI (c) (F4:3C) [18:01:45:676]: Machine policy value 'Debug' is 0
MSI (c) (F4:3C) [18:01:45:676]: ******* RunEngine:
******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
******* Action:
******* CommandLine: **********
MSI (c) (F4:3C) [18:01:45:676]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (F4:3C) [18:01:45:676]: Grabbed execution mutex.
MSI (c) (F4:3C) [18:01:45:676]: Cloaking enabled.
MSI (c) (F4:3C) [18:01:45:676]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (F4:3C) [18:01:45:676]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (20:DC) [18:01:45:676]: Running installation inside multi-package transaction C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
MSI (s) (20:DC) [18:01:45:676]: Grabbed execution mutex.
MSI (s) (20:00) [18:01:45:691]: Resetting cached policy values
MSI (s) (20:00) [18:01:45:691]: Machine policy value 'Debug' is 0
MSI (s) (20:00) [18:01:45:691]: ******* RunEngine:
******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
******* Action:
******* CommandLine: **********
MSI (s) (20:00) [18:01:45:691]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 00006109C80000000100000000F01FEC
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 00006109C80000000100000000F01FEC
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 00006109C80090400100000000F01FEC
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 00006109C80090400100000000F01FEC
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 00006109E70000000100000000F01FEC
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 00006109E70000000100000000F01FEC
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 12B8D03ED28D112328CCF0A0D541598E
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 12B8D03ED28D112328CCF0A0D541598E
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 1A9098E3DF554C64F80C06343133A12A
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 1A9098E3DF554C64F80C06343133A12A
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 30E9055DEC34B074CB47440033875276
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 30E9055DEC34B074CB47440033875276
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 44DB0475D85BA123FA0CD6D35465DDC6
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 44DB0475D85BA123FA0CD6D35465DDC6
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 51DDCFE42A4298D4484A58D7B16FF88A
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 51DDCFE42A4298D4484A58D7B16FF88A
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 5C793CEDE7B8FEA47894C96DDD001D0C
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 5C793CEDE7B8FEA47894C96DDD001D0C
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 61A5A901E90E28B47A481D87F011096D
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 61A5A901E90E28B47A481D87F011096D
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 68AB67CA7DA73301B744CAF070E41400
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 68AB67CA7DA73301B744CAF070E41400
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 71DCBBF1304249742B8A3ADADDB3A08F
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 71DCBBF1304249742B8A3ADADDB3A08F
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 7B31A6F17A59782499A4C68EC265845E
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 7B31A6F17A59782499A4C68EC265845E
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 810B660DB8445C04094352B9CB4C3915
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 810B660DB8445C04094352B9CB4C3915
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 8520DAD7C5154DD39846DB1714990E7F
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 8520DAD7C5154DD39846DB1714990E7F
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 89A6161325839E94DB6D771ABA5875A1
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 89A6161325839E94DB6D771ABA5875A1
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 96F071321C0420729100000010000000
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 96F071321C0420729100000010000000
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 99E80CA9B0328e74791254777B1F42AE
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 99E80CA9B0328e74791254777B1F42AE
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: A49D3069829097449B5C9CDB74DE89F0
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: A49D3069829097449B5C9CDB74DE89F0
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: AAB6F137689A4A549863C7A3AAAA67B0
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: AAB6F137689A4A549863C7A3AAAA67B0
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: AD8F0D823DBB4454492E8DBEA63BB91F
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: AD8F0D823DBB4454492E8DBEA63BB91F
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: C21BB7D84586FD646AD78FD277D8578C
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: C21BB7D84586FD646AD78FD277D8578C
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: C94587080FFC5C84B977B64AA84176D3
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: C94587080FFC5C84B977B64AA84176D3
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: CAFC5ACA99E946747ADAFAC53FAF51FB
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: CAFC5ACA99E946747ADAFAC53FAF51FB
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: CE6380BC270BD863282B3D74B09F7570
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: CE6380BC270BD863282B3D74B09F7570
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: D2821382915801943B93322048A0EB3F
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: D2821382915801943B93322048A0EB3F
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: DCDEC83B99B45A244A039364FFAC22A9
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: DCDEC83B99B45A244A039364FFAC22A9
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: DFDFBE4C55C0F5E39A913E5C949420A4
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: DFDFBE4C55C0F5E39A913E5C949420A4
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: F40B9456628EA0E4C8F38358040F5814
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: F40B9456628EA0E4C8F38358040F5814
MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: FED6F71CC43D57B4791E8D012604B8A4
MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: FED6F71CC43D57B4791E8D012604B8A4
MSI (s) (20:00) [18:01:45:691]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (20:00) [18:01:45:691]: SRSetRestorePoint skipped for this transaction.
MSI (s) (20:00) [18:01:45:691]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2
MSI (s) (20:00) [18:01:45:691]: File will have security applied from OpCode.
MSI (s) (20:00) [18:01:45:691]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi' against software restriction policy
MSI (s) (20:00) [18:01:45:707]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi has a digital signature
MSI (s) (20:00) [18:01:45:707]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi is permitted to run because the user token authorizes execution (system or service token).
MSI (s) (20:00) [18:01:45:707]: Creating MSIHANDLE (1) of type 790542 for thread 8960
MSI (s) (20:00) [18:01:45:707]: MSCOREE not loaded loading copy from system32
MSI (s) (20:00) [18:01:45:707]: End dialog not enabled
MSI (s) (20:00) [18:01:45:707]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
MSI (s) (20:00) [18:01:45:707]: Package we're running from ==> C:\WINDOWS\Installer\5e8d70f4.msi
MSI (s) (20:00) [18:01:45:707]: APPCOMPAT: Compatibility mode property overrides found.
MSI (s) (20:00) [18:01:45:707]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'.
MSI (s) (20:00) [18:01:45:707]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (20:00) [18:01:45:723]: Machine policy value 'TransformsSecure' is 0
MSI (s) (20:00) [18:01:45:723]: User policy value 'TransformsAtSource' is 0
MSI (s) (20:00) [18:01:45:723]: Machine policy value 'DisablePatch' is 0
MSI (s) (20:00) [18:01:45:723]: Machine policy value 'AllowLockdownPatch' is 0
MSI (s) (20:00) [18:01:45:723]: Machine policy value 'DisableLUAPatching' is 0
MSI (s) (20:00) [18:01:45:723]: Machine policy value 'DisableFlyWeightPatching' is 0
MSI (s) (20:00) [18:01:45:723]: Enabling baseline caching for this transaction since all active patches are MSI 3.0 style MSPs or at least one MSI 3.0 minor update patch is active
MSI (s) (20:00) [18:01:45:723]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'.
MSI (s) (20:00) [18:01:45:723]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (20:00) [18:01:45:723]: Transforms are not secure.
MSI (s) (20:00) [18:01:45:723]: Note: 1: 2205 2: 3: Control
MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\Sophos Network Threat Protection Install Log 20210214 180145.txt'.
MSI (s) (20:00) [18:01:45:723]: Command Line: INSTALLDIR= REBOOT=ReallySuppress INSTALLINGVERSION=1.11.194.0 ARPSYSTEMCOMPONENT=1 CURRENTDIRECTORY=C:\WINDOWS\system32 CLIENTUILEVEL=3 MSICLIENTUSESEXTERNALUI=1 CLIENTPROCESSID=1012
MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{BDBDC64C-EB88-4135-BD3F-FE19CA9893E3}'.
MSI (s) (20:00) [18:01:45:723]: Product Code passed to Engine.Initialize: ''
MSI (s) (20:00) [18:01:45:723]: Product Code from property table before transforms: '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'
MSI (s) (20:00) [18:01:45:723]: Product Code from property table after transforms: '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'
MSI (s) (20:00) [18:01:45:723]: Product not registered: beginning first-time install
MSI (s) (20:00) [18:01:45:723]: Product {2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA} is not managed.
MSI (s) (20:00) [18:01:45:723]: MSI_LUA: Credential prompt not required, user is an admin
MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
MSI (s) (20:00) [18:01:45:723]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (s) (20:00) [18:01:45:723]: User policy value 'SearchOrder' is 'nmu'
MSI (s) (20:00) [18:01:45:723]: Adding new sources is allowed.
MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
MSI (s) (20:00) [18:01:45:723]: Package name extracted from package path: 'Sophos Network Threat Protection.msi'
MSI (s) (20:00) [18:01:45:723]: Package to be registered: 'Sophos Network Threat Protection.msi'
MSI (s) (20:00) [18:01:45:723]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (s) (20:00) [18:01:45:723]: Machine policy value 'DisableMsi' is 0
MSI (s) (20:00) [18:01:45:723]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (20:00) [18:01:45:723]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (20:00) [18:01:45:723]: Product installation will be elevated because user is admin and product is being installed per-machine.
MSI (s) (20:00) [18:01:45:723]: Running product '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}' with elevated privileges: Product is assigned.
MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding REBOOT property. Its value is 'ReallySuppress'.
MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding INSTALLINGVERSION property. Its value is '1.11.194.0'.
MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding ARPSYSTEMCOMPONENT property. Its value is '1'.
MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'C:\WINDOWS\system32'.
MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'.
MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding MSICLIENTUSESEXTERNALUI property. Its value is '1'.
MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '1012'.
MSI (s) (20:00) [18:01:45:723]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0
MSI (s) (20:00) [18:01:45:723]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality.
MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
MSI (s) (20:00) [18:01:45:723]: TRANSFORMS property is now:
MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'.
MSI (s) (20:00) [18:01:45:723]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
MSI (s) (20:00) [18:01:45:723]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
MSI (s) (20:00) [18:01:45:723]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
MSI (s) (20:00) [18:01:45:723]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\ProgramData
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
MSI (s) (20:00) [18:01:45:738]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
MSI (s) (20:00) [18:01:45:754]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
MSI (s) (20:00) [18:01:45:754]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'PBC-COM'.
MSI (s) (20:00) [18:01:45:754]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'COMPHX'.
MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\WINDOWS\Installer\5e8d70f4.msi'.
MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi'.
MSI (s) (20:00) [18:01:45:754]: Machine policy value 'MsiDisableEmbeddedUI' is 0
MSI (s) (20:00) [18:01:45:754]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI
MSI (s) (20:00) [18:01:45:754]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install
MSI (s) (20:00) [18:01:45:754]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (20:00) [18:01:45:754]: Machine policy value 'DisableRollback' is 0
MSI (s) (20:00) [18:01:45:754]: User policy value 'DisableRollback' is 0
MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
=== Logging started: 2/14/2021 18:01:45 ===
MSI (s) (20:00) [18:01:45:754]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (20:00) [18:01:45:754]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
MSI (s) (20:00) [18:01:45:754]: Doing action: INSTALL
MSI (s) (20:00) [18:01:45:754]: Note: 1: 2205 2: 3: ActionText
Action start 18:01:45: INSTALL.
MSI (s) (20:00) [18:01:45:754]: Running ExecuteSequence
MSI (s) (20:00) [18:01:45:754]: Doing action: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C
MSI (s) (20:00) [18:01:45:754]: Note: 1: 2205 2: 3: ActionText
MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C property. Its value is 'C:\WINDOWS\system32\'.
Action start 18:01:45: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C.
MSI (s) (20:00) [18:01:45:754]: Doing action: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA
MSI (s) (20:00) [18:01:45:754]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:45: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C. Return value 1.
MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA property. Its value is 'C:\WINDOWS\SysWOW64\'.
Action start 18:01:45: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA.
MSI (s) (20:00) [18:01:45:754]: Doing action: FindRelatedProducts
MSI (s) (20:00) [18:01:45:754]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:45: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA. Return value 1.
MSI (s) (20:00) [18:01:45:769]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:00) [18:01:45:769]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:00) [18:01:45:769]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
Action start 18:01:45: FindRelatedProducts.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding WIX_UPGRADE_DETECTED property. Its value is '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding MIGRATE property. Its value is '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'.
MSI (s) (20:00) [18:01:45:769]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:00) [18:01:45:769]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:00) [18:01:45:769]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:00) [18:01:45:769]: Doing action: AppSearch
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:45: FindRelatedProducts. Return value 1.
Action start 18:01:45: AppSearch.
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2262 2: Signature 3: -2147287038
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding INSTALLTYPE_IS_CENTRAL property. Its value is '#1'.
MSI (s) (20:00) [18:01:45:769]: Doing action: LaunchConditions
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:45: AppSearch. Return value 1.
Action start 18:01:45: LaunchConditions.
MSI (s) (20:00) [18:01:45:769]: Doing action: ValidateProductID
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:45: LaunchConditions. Return value 1.
Action start 18:01:45: ValidateProductID.
MSI (s) (20:00) [18:01:45:769]: Skipping action: TamperProtectionCheckRemove (condition is false)
MSI (s) (20:00) [18:01:45:769]: Doing action: CostInitialize
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:45: ValidateProductID. Return value 1.
MSI (s) (20:00) [18:01:45:769]: Machine policy value 'MaxPatchCacheSize' is 10
MSI (s) (20:00) [18:01:45:769]: Baseline: Sorting baselines for {2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}.
MSI (s) (20:00) [18:01:45:769]: Baseline: New baseline 1.11.194 from transaction.
MSI (s) (20:00) [18:01:45:769]: Baseline: Sorted order Native: Order 0.
MSI (s) (20:00) [18:01:45:769]: Baseline Data Table:
MSI (s) (20:00) [18:01:45:769]: ProductCode: {2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA} Version: 1.11.194 Attributes: 0 PatchId: Native BaselineId: -2147483648 Order: 0
MSI (s) (20:00) [18:01:45:769]: Baseline File Table:
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding ROOTDRIVE property. Its value is 'C:\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding CostingComplete property. Its value is '0'.
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: Patch
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: MsiPatchHeaders
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: __MsiPatchFileList
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2228 2: 3: PatchPackage 4: SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId`
MSI (s) (20:00) [18:01:45:769]: Delta compression fallback method for this product transaction is 'MSI 2.0 legacy obsolescence'
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: Patch
Action start 18:01:45: CostInitialize.
MSI (s) (20:00) [18:01:45:769]: Doing action: FileCost
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:45: CostInitialize. Return value 1.
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: MsiAssembly
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: Class
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: Extension
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: TypeLib
Action start 18:01:45: FileCost.
MSI (s) (20:00) [18:01:45:769]: Doing action: CostFinalize
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:45: FileCost. Return value 1.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding OutOfDiskSpace property. Its value is '0'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding OutOfNoRbDiskSpace property. Its value is '0'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceAvailable property. Its value is '0'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRequired property. Its value is '0'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRemaining property. Its value is '0'.
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: Patch
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: Condition
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding TARGETDIR property. Its value is 'C:\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 property. Its value is 'C:\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding SophosAppData property. Its value is 'C:\ProgramData\Sophos\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding HeartbeatData property. Its value is 'C:\ProgramData\Sophos\Heartbeat\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding HeartbeatPersist property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Persist\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding HeartbeatLogs property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Logs\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding HeartbeatConfig property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Config\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding ProductData property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding SnortData property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding Logs property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding Config property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding Status property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding Sophos property. Its value is 'C:\Program Files\Sophos\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding INSTALLDIR property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding plugins property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding SnortConfDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding SnortPreProcDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding SnortDynModulesDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\'.
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding SophosNTPLWFDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\'.
MSI (s) (20:00) [18:01:45:769]: Target path resolution complete. Dumping Directory table...
MSI (s) (20:00) [18:01:45:769]: Note: target paths subject to change (via custom actions or browsing)
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: TARGETDIR , Object: C:\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: WindowsFolder , Object: C:\WINDOWS\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: System64Folder , Object: C:\WINDOWS\system32\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C , Object: C:\WINDOWS\system32\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SystemFolder , Object: C:\WINDOWS\SysWOW64\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA , Object: C:\WINDOWS\SysWOW64\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: CommonAppDataFolder , Object: C:\ProgramData\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SophosAppData , Object: C:\ProgramData\Sophos\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: HeartbeatData , Object: C:\ProgramData\Sophos\Heartbeat\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: HeartbeatPersist , Object: C:\ProgramData\Sophos\Heartbeat\Persist\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: HeartbeatLogs , Object: C:\ProgramData\Sophos\Heartbeat\Logs\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: HeartbeatConfig , Object: C:\ProgramData\Sophos\Heartbeat\Config\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: ProductData , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SnortData , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: Logs , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: Config , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: Status , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: ProgramFiles64Folder , Object: C:\Program Files\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: Sophos , Object: C:\Program Files\Sophos\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: INSTALLDIR , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: plugins , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SnortConfDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SnortPreProcDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SnortDynModulesDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\
MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SophosNTPLWFDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\
MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding INSTALLLEVEL property. Its value is '1'.
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: MsiAssembly
MSI (s) (20:00) [18:01:45:769]: Note: 1: 2228 2: 3: MsiAssembly 4: SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?
MSI (s) (20:00) [18:01:45:769]: Disallowing installation of component: {14E8634F-8AEA-4CD1-AC48-BEBFDA18523A} since the same component with higher versioned keyfile exists
MSI (s) (20:00) [18:01:45:785]: Disallowing installation of component: {570C624B-D57C-4CD1-9013-1B80C800093B} since the same component with higher versioned keyfile exists
MSI (s) (20:00) [18:01:45:785]: Disallowing installation of component: {E5B92048-5859-4AF1-AEAD-B97EBF00B087} since the same component with higher versioned keyfile exists
MSI (s) (20:00) [18:01:45:785]: Disallowing installation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since the same component with higher versioned keyfile exists
MSI (s) (20:00) [18:01:45:785]: Disallowing installation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since the same component with higher versioned keyfile exists
MSI (s) (20:00) [18:01:45:785]: Disallowing installation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since the same component with higher versioned keyfile exists
MSI (s) (20:00) [18:01:45:801]: Disallowing installation of component: {4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1} since the keyfile exists and the component is marked to never overwrite existing installations
Action start 18:01:45: CostFinalize.
MSI (s) (20:00) [18:01:45:801]: Doing action: MigrateFeatureStates
MSI (s) (20:00) [18:01:45:801]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:45: CostFinalize. Return value 1.
MSI (s) (20:00) [18:01:45:801]: Migrating feature settings from product(s) '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'
MSI (s) (20:00) [18:01:45:816]: MigrateFeatureStates: based on existing product, setting feature 'AllComponents' to 'Local' state.
MSI (s) (20:00) [18:01:45:816]: Disallowing installation of component: {4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1} since the keyfile exists and the component is marked to never overwrite existing installations
MSI (s) (20:00) [18:01:45:832]: Disallowing installation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since the same component with higher versioned keyfile exists
MSI (s) (20:00) [18:01:45:832]: Disallowing installation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since the same component with higher versioned keyfile exists
MSI (s) (20:00) [18:01:45:832]: Disallowing installation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since the same component with higher versioned keyfile exists
MSI (s) (20:00) [18:01:45:832]: Disallowing installation of component: {E5B92048-5859-4AF1-AEAD-B97EBF00B087} since the same component with higher versioned keyfile exists
MSI (s) (20:00) [18:01:45:832]: Disallowing installation of component: {570C624B-D57C-4CD1-9013-1B80C800093B} since the same component with higher versioned keyfile exists
MSI (s) (20:00) [18:01:45:847]: Disallowing installation of component: {14E8634F-8AEA-4CD1-AC48-BEBFDA18523A} since the same component with higher versioned keyfile exists
Action start 18:01:45: MigrateFeatureStates.
MSI (s) (20:00) [18:01:45:847]: Doing action: InstallValidate
MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:45: MigrateFeatureStates. Return value 1.
MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: Dialog
MSI (s) (20:00) [18:01:45:847]: Feature: AllComponents; Installed: Absent; Request: Local; Action: Local
MSI (s) (20:00) [18:01:45:847]: Component: InstallationFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: ProductDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: ConfigDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: StatusFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: LogsDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: SnortDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: HeartbeatProductDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: HeartbeatConfigFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: HeartbeatLogsFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: HeartbeatPersistFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: Driver; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: LWF; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: navl.dll; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: integrity.dat; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: ProductInformation; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: ServiceInstallWin8Plus; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: ServiceInstallWin7Only; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: ServiceCommon; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: NTPAdapter; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: Heartbeat.dll; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: HeartbeatRegistry; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: HeartbeatNativeRegistry; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: Heartbeat.xml; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: Notice.txt; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: HealthApi; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: HbtAdapter; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: SspInterface; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: Telemetry.exe; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: TelemetryRegistry; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: RemoveObsoleteAutoUpdateRegistration; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: ScfDat; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: SofDat; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: SnortExe; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: SnortDynModules; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: SnortDynPreProc; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: SnortConf; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: SnortDefaultRules; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_40D84364EA842FA136B8FD13DDC0D56B; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_39878D1E6847FC98DBBF4DBC681E5084; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_915D4DE5AC2958F4E9E11A531B9EA835; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_9E6863D5DA03BD69631F202C92D19A60; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_71A947406F71D3B309E337B64A7F7832; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_E78A19C76D60702926ABE2296C875F1E; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_4C8A5B3AC90DB17E9DA4ED49BAD39538; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_8ECE5DB0F042F762611EBFD2289574C7; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_CEECECE51D82B086879DBF78B65862E7; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_7CF78A9132C1A81C68F7ABC5FDF24E2A; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_DA1F2B183C5BCE4FD603A6EC3B54243A; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_28A5FAF0643E13309FAFC807839EC90D; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_B661BE2CDE2C76B03E876B04E7FB2B12; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_3893BC5956C7BE355DDE9E37446A6D03; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_EBDC9486A0E1230D5EC092D7E8CBB4BC; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_1C9216A348BA2BDC09A1060BA5F72823; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_7ADD905B2E5619CCA9D17EEC5053A4A6; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_14CC9F77B2DFDC9FD42754DAA16F7D2C; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_52DCF994F3D451DE25E6C6175FA8A569; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_3D360AE2084BA5DD98F03E35FC2A4426; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_16CE291FE9D32F0D2F408BCBC247D190; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_8AF263AEF732721ECE1F45C4D699210A; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_9AF859CEDF9D329E2E6CD220D4A89A0C; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_B688306A458B84E28816F8D6778A34E1; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_A3F6487E5CC9E500FA56EEAB3F26C1C8; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_7AEC367EBDB5BF4C39E3667551695B48; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_E7E3239C29419031F40F31EABB9C5C5A; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_D089A4389D1A4310245EFD436E285512; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_13CF16406E509062B6836D9F815D988F; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_0C0C9CFE97F0C684A8B464A70B0DB6D3; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_3AE2E2073BC5F8F5B9E80E6F52F9EE7C; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_BF934AA7F81A8CB8E376BAB607CA930F; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_B52FC07FFE74FDCB8247ACBE7F11134A; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_13497740688A2F012E248B466BEDADA8; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_12A8AFCDF13801350D980FEC432E08AB; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_B4FFE1991E42464048BC746529DD8726; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_B1BC50FE23021C628A3A572821D40D62; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_0EBC8368A1140301A827EFC762022373; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_2E9EA86FD6182A7FC5F64866BE3922CB; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_5BF7215406895F158FD7F8CD49117FB7; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_C76CDD15946ADD012F33BACEBF54EBBD; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_F36646D6066C98ADFB776FB7983F5D92; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_D6ED6891FB6E750E41BCBFA158FE52AB; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_E04EEE8DCDEFB517011CE58E0BB9CD09; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_CC76C1F8918257084D13AF2045641E6E; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: cmp64_792D7E761DFC7E91E500387604E2A68D; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: C_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: C_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: C_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: C_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: C_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: C_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
MSI (s) (20:00) [18:01:45:847]: Component: __ServiceCommon65; Installed: Null; Request: Local; Action: Local; Client State: Null
MSI (s) (20:00) [18:01:45:847]: Component: __TelemetryRegistry65; Installed: Null; Request: Local; Action: Local; Client State: Null
MSI (s) (20:00) [18:01:45:847]: Component: __ProductInformation65; Installed: Null; Request: Local; Action: Local; Client State: Null
MSI (s) (20:00) [18:01:45:847]: Component: __HeartbeatRegistry65; Installed: Null; Request: Local; Action: Local; Client State: Null
MSI (s) (20:00) [18:01:45:847]: Component: __HeartbeatNativeRegistry65; Installed: Null; Request: Local; Action: Local; Client State: Null
MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: BindImage
MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: ProgId
MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: PublishComponent
MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: SelfReg
MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: Extension
MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: Font
MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: Shortcut
MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: Class
MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: TypeLib
Action start 18:01:45: InstallValidate.
MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: _RemoveFilePath
MSI (s) (20:00) [18:01:46:207]: PROPERTY CHANGE: Modifying CostingComplete property. Its current value is '0'. Its new value: '1'.
MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: BindImage
MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: ProgId
MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: PublishComponent
MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: SelfReg
MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: Extension
MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: Font
MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: Shortcut
MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: Class
MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: TypeLib
MSI (s) (20:00) [18:01:46:207]: Note: 1: 2727 2:
MSI (s) (20:00) [18:01:47:019]: Note: 1: 2727 2:
MSI (s) (20:00) [18:01:47:019]: Doing action: RemoveExistingProducts
MSI (s) (20:00) [18:01:47:019]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:47: InstallValidate. Return value 1.
Action start 18:01:47: RemoveExistingProducts.
MSI (s) (20:4C) [18:01:47:035]: Resetting cached policy values
MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'Debug' is 0
MSI (s) (20:4C) [18:01:47:035]: ******* RunEngine:
******* Product: {4B1F9009-CD85-43C0-BCBD-D491908D5A52}
******* Action:
******* CommandLine: **********
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: SRSetRestorePoint skipped for this transaction.
MSI (s) (20:4C) [18:01:47:035]: Creating MSIHANDLE (2) of type 790542 for thread 8012
MSI (s) (20:4C) [18:01:47:035]: End dialog not enabled
MSI (s) (20:4C) [18:01:47:035]: Original package ==> C:\WINDOWS\Installer\4978e5.msi
MSI (s) (20:4C) [18:01:47:035]: Package we're running from ==> C:\WINDOWS\Installer\4978e5.msi
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: Uninstall Flags override found.
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: Uninstall VersionNT override found.
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: Uninstall ServicePackLevel override found.
MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: looking for appcompat database entry with ProductCode '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'.
MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'DisablePatch' is 0
MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'AllowLockdownPatch' is 0
MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'DisableLUAPatching' is 0
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'DisableFlyWeightPatching' is 0
MSI (s) (20:4C) [18:01:47:035]: Enabling baseline caching for this transaction since all active patches are MSI 3.0 style MSPs or at least one MSI 3.0 minor update patch is active
MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: looking for appcompat database entry with ProductCode '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'.
MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (20:4C) [18:01:47:035]: Transforms are not secure.
MSI (s) (20:4C) [18:01:47:035]: Note: 1: 2205 2: 3: Control
MSI (s) (20:4C) [18:01:47:035]: Command Line: UPGRADINGPRODUCTCODE={2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA} CLIENTPROCESSID=1012 CLIENTUILEVEL=3 MSICLIENTUSESEXTERNALUI=1 REMOVE=ALL
MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{0B95A4E2-4953-4CE7-B8F7-53BB197E234A}'.
MSI (s) (20:4C) [18:01:47:035]: Product Code passed to Engine.Initialize: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'
MSI (s) (20:4C) [18:01:47:035]: Product Code from property table before transforms: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'
MSI (s) (20:4C) [18:01:47:035]: Product Code from property table after transforms: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'
MSI (s) (20:4C) [18:01:47:035]: Product registered: entering maintenance mode
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
MSI (s) (20:4C) [18:01:47:035]: MSI_LUA: Nested installation UAC elevation tracks that of parent (is not elevated)
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} is admin assigned: LocalSystem owns the publish key.
MSI (s) (20:4C) [18:01:47:035]: Product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} is managed.
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: MSI_LUA: Credential prompt not required, user is an admin
MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding ProductState property. Its value is '5'.
MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding ProductToBeRegistered property. Its value is '1'.
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Package name retrieved from configuration data: 'Sophos Network Threat Protection.msi'
MSI (s) (20:4C) [18:01:47:035]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'DisableMsi' is 0
MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (20:4C) [18:01:47:035]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:035]: Product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} is admin assigned: LocalSystem owns the publish key.
MSI (s) (20:4C) [18:01:47:035]: Product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} is managed.
MSI (s) (20:4C) [18:01:47:035]: Running product '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}' with elevated privileges: Product is assigned.
MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding UPGRADINGPRODUCTCODE property. Its value is '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'.
MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '1012'.
MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'.
MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding MSICLIENTUSESEXTERNALUI property. Its value is '1'.
MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding REMOVE property. Its value is 'ALL'.
MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0
MSI (s) (20:4C) [18:01:47:035]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality.
MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
MSI (s) (20:4C) [18:01:47:035]: TRANSFORMS property is now:
MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding PRODUCTLANGUAGE property. Its value is '1033'.
MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'.
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\ProgramData
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
MSI (s) (20:4C) [18:01:47:035]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
MSI (s) (20:4C) [18:01:47:050]: MSI_LUA: Setting AdminUser property to 1 because the product is already installed managed and per-machine
MSI (s) (20:4C) [18:01:47:050]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
MSI (s) (20:4C) [18:01:47:050]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:050]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'PBC-COM'.
MSI (s) (20:4C) [18:01:47:050]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'COMPHX'.
MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding Installed property. Its value is '00:00:00'.
MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\WINDOWS\Installer\4978e5.msi'.
MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\WINDOWS\Installer\4978e5.msi'.
MSI (s) (20:4C) [18:01:47:050]: Machine policy value 'MsiDisableEmbeddedUI' is 0
MSI (s) (20:4C) [18:01:47:050]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI
MSI (s) (20:4C) [18:01:47:050]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install
MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (20:4C) [18:01:47:050]: Machine policy value 'DisableRollback' is 0
MSI (s) (20:4C) [18:01:47:050]: User policy value 'DisableRollback' is 0
MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding Preselected property. Its value is '1'.
MSI (s) (20:4C) [18:01:47:050]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
MSI (s) (20:4C) [18:01:47:050]: Doing action: INSTALL
MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
Action start 18:01:47: INSTALL.
MSI (s) (20:4C) [18:01:47:050]: Running ExecuteSequence
MSI (s) (20:4C) [18:01:47:050]: Doing action: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C
MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C property. Its value is 'C:\WINDOWS\system32\'.
Action start 18:01:47: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C.
MSI (s) (20:4C) [18:01:47:050]: Doing action: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA
MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:47: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C. Return value 1.
MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA property. Its value is 'C:\WINDOWS\SysWOW64\'.
Action start 18:01:47: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA.
MSI (s) (20:4C) [18:01:47:050]: Doing action: FindRelatedProducts
MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:47: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA. Return value 1.
MSI (s) (20:4C) [18:01:47:050]: Skipping FindRelatedProducts action: not run in maintenance mode
Action start 18:01:47: FindRelatedProducts.
MSI (s) (20:4C) [18:01:47:050]: Doing action: AppSearch
MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:47: FindRelatedProducts. Return value 0.
Action start 18:01:47: AppSearch.
MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2262 2: Signature 3: -2147287038
MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding INSTALLTYPE_IS_CENTRAL property. Its value is '#1'.
MSI (s) (20:4C) [18:01:47:050]: Doing action: LaunchConditions
MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:47: AppSearch. Return value 1.
Action start 18:01:47: LaunchConditions.
MSI (s) (20:4C) [18:01:47:050]: Doing action: ValidateProductID
MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:47: LaunchConditions. Return value 1.
Action start 18:01:47: ValidateProductID.
MSI (s) (20:4C) [18:01:47:050]: Skipping action: TamperProtectionCheckRemove (condition is false)
MSI (s) (20:4C) [18:01:47:050]: Doing action: CostInitialize
MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:47: ValidateProductID. Return value 1.
MSI (s) (20:4C) [18:01:47:066]: Machine policy value 'MaxPatchCacheSize' is 10
MSI (s) (20:4C) [18:01:47:066]: Baseline: Sorting baselines for {4B1F9009-CD85-43C0-BCBD-D491908D5A52}.
MSI (s) (20:4C) [18:01:47:066]: Baseline: New baseline 1.9.2235 from transaction.
MSI (s) (20:4C) [18:01:47:066]: Baseline: Sorted order Native: Order 0.
MSI (s) (20:4C) [18:01:47:066]: Baseline Data Table:
MSI (s) (20:4C) [18:01:47:066]: ProductCode: {4B1F9009-CD85-43C0-BCBD-D491908D5A52} Version: 1.9.2235 Attributes: 0 PatchId: Native BaselineId: -2147483648 Order: 0
MSI (s) (20:4C) [18:01:47:066]: Baseline File Table:
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding ROOTDRIVE property. Its value is 'C:\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding CostingComplete property. Its value is '0'.
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: Patch
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: MsiPatchHeaders
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: __MsiPatchFileList
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2228 2: 3: PatchPackage 4: SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId`
MSI (s) (20:4C) [18:01:47:066]: Delta compression fallback method for this product transaction is 'MSI 2.0 legacy obsolescence'
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: Patch
Action start 18:01:47: CostInitialize.
MSI (s) (20:4C) [18:01:47:066]: Doing action: FileCost
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:47: CostInitialize. Return value 1.
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: MsiAssembly
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: Class
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: Extension
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: TypeLib
Action start 18:01:47: FileCost.
MSI (s) (20:4C) [18:01:47:066]: Doing action: CostFinalize
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:47: FileCost. Return value 1.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding OutOfDiskSpace property. Its value is '0'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding OutOfNoRbDiskSpace property. Its value is '0'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceAvailable property. Its value is '0'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRequired property. Its value is '0'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRemaining property. Its value is '0'.
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: MsiAssembly
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2228 2: 3: MsiAssembly 4: SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding INSTALLDIR property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding ProductData property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding Config property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding Status property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding Logs property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding SnortData property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding HeartbeatData property. Its value is 'C:\ProgramData\Sophos\Heartbeat'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding HeartbeatConfig property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Config'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding HeartbeatLogs property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Logs'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding HeartbeatPersist property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Persist'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding TARGETDIR property. Its value is 'C:'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA property. Its current value is 'C:\WINDOWS\SysWOW64\'. Its new value: 'C:\Windows\SysWOW64'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C property. Its current value is 'C:\WINDOWS\system32\'. Its new value: 'C:\Windows\system32'.
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: Patch
MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: Condition
MSI (s) (20:4C) [18:01:47:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:066]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (20:4C) [18:01:47:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying TARGETDIR property. Its current value is 'C:'. Its new value: 'C:\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C property. Its current value is 'C:\Windows\system32'. Its new value: 'C:\Windows\system32\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA property. Its current value is 'C:\Windows\SysWOW64'. Its new value: 'C:\Windows\SysWOW64\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 property. Its value is 'C:\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding SophosAppData property. Its value is 'C:\ProgramData\Sophos\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying HeartbeatData property. Its current value is 'C:\ProgramData\Sophos\Heartbeat'. Its new value: 'C:\ProgramData\Sophos\Heartbeat\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying HeartbeatPersist property. Its current value is 'C:\ProgramData\Sophos\Heartbeat\Persist'. Its new value: 'C:\ProgramData\Sophos\Heartbeat\Persist\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying HeartbeatLogs property. Its current value is 'C:\ProgramData\Sophos\Heartbeat\Logs'. Its new value: 'C:\ProgramData\Sophos\Heartbeat\Logs\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying HeartbeatConfig property. Its current value is 'C:\ProgramData\Sophos\Heartbeat\Config'. Its new value: 'C:\ProgramData\Sophos\Heartbeat\Config\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying ProductData property. Its current value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection'. Its new value: 'C:\ProgramData\Sophos\Sophos Network Threat Protection\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying SnortData property. Its current value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS'. Its new value: 'C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying Logs property. Its current value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs'. Its new value: 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying Config property. Its current value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config'. Its new value: 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying Status property. Its current value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status'. Its new value: 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding Sophos property. Its value is 'C:\Program Files\Sophos\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying INSTALLDIR property. Its current value is 'C:\Program Files\Sophos\Sophos Network Threat Protection'. Its new value: 'C:\Program Files\Sophos\Sophos Network Threat Protection\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding SnortConfDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding SnortPreProcDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding SnortDynModulesDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding plugins property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\'.
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding SophosNTPLWFDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\'.
MSI (s) (20:4C) [18:01:47:066]: Target path resolution complete. Dumping Directory table...
MSI (s) (20:4C) [18:01:47:066]: Note: target paths subject to change (via custom actions or browsing)
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: TARGETDIR , Object: C:\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: WindowsFolder , Object: C:\WINDOWS\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: System64Folder , Object: C:\WINDOWS\system32\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C , Object: C:\Windows\system32\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SystemFolder , Object: C:\WINDOWS\SysWOW64\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA , Object: C:\Windows\SysWOW64\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: CommonAppDataFolder , Object: C:\ProgramData\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SophosAppData , Object: C:\ProgramData\Sophos\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: HeartbeatData , Object: C:\ProgramData\Sophos\Heartbeat\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: HeartbeatPersist , Object: C:\ProgramData\Sophos\Heartbeat\Persist\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: HeartbeatLogs , Object: C:\ProgramData\Sophos\Heartbeat\Logs\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: HeartbeatConfig , Object: C:\ProgramData\Sophos\Heartbeat\Config\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: ProductData , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SnortData , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: Logs , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: Config , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: Status , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: ProgramFiles64Folder , Object: C:\Program Files\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: Sophos , Object: C:\Program Files\Sophos\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: INSTALLDIR , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SnortConfDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SnortPreProcDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SnortDynModulesDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: plugins , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\
MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SophosNTPLWFDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\
MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding INSTALLLEVEL property. Its value is '1'.
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {14E8634F-8AEA-4CD1-AC48-BEBFDA18523A} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {14E8634F-8AEA-4CD1-AC48-BEBFDA18523A} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {570C624B-D57C-4CD1-9013-1B80C800093B} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {570C624B-D57C-4CD1-9013-1B80C800093B} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {E5B92048-5859-4AF1-AEAD-B97EBF00B087} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {E5B92048-5859-4AF1-AEAD-B97EBF00B087} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1} since another client exists
MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1} since another client exists
Action start 18:01:47: CostFinalize.
MSI (s) (20:4C) [18:01:47:082]: Doing action: MigrateFeatureStates
MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:47: CostFinalize. Return value 1.
MSI (s) (20:4C) [18:01:47:082]: Skipping MigrateFeatureStates action: not run in maintenance mode
Action start 18:01:47: MigrateFeatureStates.
MSI (s) (20:4C) [18:01:47:082]: Doing action: InstallValidate
MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:47: MigrateFeatureStates. Return value 0.
MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: Dialog
MSI (s) (20:4C) [18:01:47:082]: Feature: AllComponents; Installed: Local; Request: Absent; Action: Absent
MSI (s) (20:4C) [18:01:47:082]: Component: InstallationFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: ProductDataFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: ConfigDataFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: StatusFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: LogsDataFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: SnortDataFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: HeartbeatProductDataFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: HeartbeatConfigFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: HeartbeatLogsFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: HeartbeatPersistFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: Driver; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: LWF; Installed: Local; Request: Absent; Action: Null; Client State: Not Used
MSI (s) (20:4C) [18:01:47:082]: Component: navl.dll; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: integrity.dat; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: ProductInformation; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: ServiceInstallWin8Plus; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: ServiceInstallWin7Only; Installed: Local; Request: Absent; Action: Null; Client State: Not Used
MSI (s) (20:4C) [18:01:47:082]: Component: ServiceCommon; Installed: Local; Request: Absent; Action: Absent; Client State: Absent
MSI (s) (20:4C) [18:01:47:082]: Component: NTPAdapter; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: Heartbeat.dll; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: HeartbeatRegistry; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: HeartbeatNativeRegistry; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: Heartbeat.xml; Installed: Local; Request: Absent; Action: Null; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: Notice.txt; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: HealthApi; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: HbtAdapter; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: SspInterface; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: Telemetry.exe; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: TelemetryRegistry; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: RemoveObsoleteAutoUpdateRegistration; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: ScfDat; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: SofDat; Installed: Local; Request: Absent; Action: Absent; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: C_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Local; Request: Absent; Action: Null; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: C_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Local; Request: Absent; Action: Null; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: C_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Local; Request: Absent; Action: Null; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: C_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Local; Request: Absent; Action: Null; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: C_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Local; Request: Absent; Action: Null; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: C_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Local; Request: Absent; Action: Null; Client State: Local
MSI (s) (20:4C) [18:01:47:082]: Component: __ServiceCommon65; Installed: Null; Request: Absent; Action: Absent; Client State: Null
MSI (s) (20:4C) [18:01:47:082]: Component: __TelemetryRegistry65; Installed: Null; Request: Absent; Action: Absent; Client State: Null
MSI (s) (20:4C) [18:01:47:082]: Component: __ProductInformation65; Installed: Null; Request: Absent; Action: Absent; Client State: Null
MSI (s) (20:4C) [18:01:47:082]: Component: __HeartbeatRegistry65; Installed: Null; Request: Absent; Action: Absent; Client State: Null
MSI (s) (20:4C) [18:01:47:082]: Component: __HeartbeatNativeRegistry65; Installed: Null; Request: Absent; Action: Absent; Client State: Null
MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: BindImage
MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: ProgId
MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: PublishComponent
MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: SelfReg
MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: Extension
MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: Font
MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: Shortcut
MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: Class
MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: TypeLib
Action start 18:01:47: InstallValidate.
MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: _RemoveFilePath
MSI (s) (20:4C) [18:01:47:410]: PROPERTY CHANGE: Modifying CostingComplete property. Its current value is '0'. Its new value: '1'.
MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: BindImage
MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: ProgId
MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: PublishComponent
MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: SelfReg
MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: Extension
MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: Font
MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: Shortcut
MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: Class
MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: TypeLib
MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2727 2:
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2727 2:
MSI (s) (20:4C) [18:01:48:066]: Doing action: RemoveExistingProducts
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: InstallValidate. Return value 1.
MSI (s) (20:4C) [18:01:48:066]: Skipping RemoveExistingProducts action: current configuration is maintenance mode or an uninstall
Action start 18:01:48: RemoveExistingProducts.
MSI (s) (20:4C) [18:01:48:066]: Doing action: InstallInitialize
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: RemoveExistingProducts. Return value 0.
MSI (s) (20:4C) [18:01:48:066]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (20:4C) [18:01:48:066]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (20:4C) [18:01:48:066]: BeginTransaction: Locking Server
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (20:4C) [18:01:48:066]: SRSetRestorePoint skipped for this transaction.
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (20:4C) [18:01:48:066]: Server not locked: locking for product {4B1F9009-CD85-43C0-BCBD-D491908D5A52}
MSI (s) (20:4C) [18:01:48:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:48:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:48:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: ActionText
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: ActionText
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: ActionText
Action start 18:01:48: InstallInitialize.
MSI (s) (20:4C) [18:01:48:066]: PROPERTY CHANGE: Deleting ProductToBeRegistered property. Its current value is '1'.
MSI (s) (20:4C) [18:01:48:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: Class
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2228 2: 3: Class 4: SELECT `CLSID` FROM `Class` WHERE `Icon_`=? AND `Class`.`Attributes`=1
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: Shortcut
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2228 2: 3: Shortcut 4: SELECT `Component`,`Shortcut`,`Target` FROM `Component`,`Shortcut` WHERE `Component`=`Component_` AND `Icon_`=? AND (`Component`.`Installed` <> 0 AND `Component`.`Action` <> 0)
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: Class
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2228 2: 3: Class 4: SELECT `Component`,`CLSID` FROM `Component`,`Class` WHERE `Component`=`Component_` AND `Icon_`=? AND (`Component`.`Installed` <> 0 AND `Component`.`Action` <> 0)
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: Extension
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2228 2: 3: Extension 4: SELECT `Component`,`Extension` FROM `Component`,`Extension`,`ProgId` WHERE `Component`.`Component`=`Extension`.`Component_` AND `ProgId`.`ProgId`=`Extension`.`ProgId_` AND `ProgId`.`Icon_`=? AND (`Component`.`Installed` <> 0 AND `Component`.`Action` <> 0)
MSI (s) (20:4C) [18:01:48:066]: 'shield.ico' icon will be removed.
MSI (s) (20:4C) [18:01:48:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:48:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:48:066]: Skipping action: CheckMaxNumFilters (condition is false)
MSI (s) (20:4C) [18:01:48:066]: Doing action: ProcessComponents
MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: InstallInitialize. Return value 1.
Action start 18:01:48: ProcessComponents.
MSI (s) (20:4C) [18:01:48:081]: Doing action: UnpublishFeatures
MSI (s) (20:4C) [18:01:48:081]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: ProcessComponents. Return value 1.
MSI (s) (20:4C) [18:01:48:081]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
Action start 18:01:48: UnpublishFeatures.
MSI (s) (20:4C) [18:01:48:081]: Doing action: SchedSecureObjectsRollback_x64
MSI (s) (20:4C) [18:01:48:081]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: UnpublishFeatures. Return value 1.
MSI (s) (20:4C) [18:01:48:081]: Creating MSIHANDLE (3) of type 790542 for thread 8012
MSI (s) (20:80) [18:01:48:081]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7A4C.tmp, Entrypoint: SchedSecureObjectsRollback
MSI (s) (20:78) [18:01:48:081]: Generating random cookie.
MSI (s) (20:78) [18:01:48:081]: Created Custom Action Server with PID 7860 (0x1EB4).
MSI (s) (20:20) [18:01:48:113]: Running as a service.
MSI (s) (20:20) [18:01:48:128]: Hello, I'm your 64bit Elevated Non-remapped custom action server.
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (4) of type 790541 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (5) of type 790540 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (6) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (7) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (7) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (8) of type 790540 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (9) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (10) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (11) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (11) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (9) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (10) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (8) of type 790540 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: PROPERTY CHANGE: Adding ExecSecureObjectsRollback_64 property. Its value is '**********'.
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (12) of type 790531 for thread 5044
Action start 18:01:48: SchedSecureObjectsRollback_x64.
MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (12) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Doing action: ExecSecureObjectsRollback_64
MSI (s) (20!B4) [18:01:48:128]: Note: 1: 2205 2: 3: ActionText
Action start 18:01:48: ExecSecureObjectsRollback_64.
MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (6) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (13) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (14) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (14) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (15) of type 790540 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (16) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (17) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (18) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (18) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (16) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (17) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (15) of type 790540 for thread 5044
MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (19) of type 790531 for thread 5044
Action ended 18:01:48: ExecSecureObjectsRollback_64. Return value 1.
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (19) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Doing action: ExecSecureObjectsRollback_64
MSI (s) (20!B4) [18:01:48:144]: Note: 1: 2205 2: 3: ActionText
Action start 18:01:48: ExecSecureObjectsRollback_64.
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (13) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (20) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (21) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (21) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (22) of type 790540 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (23) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (24) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (25) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (25) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (23) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (24) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (22) of type 790540 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (26) of type 790531 for thread 5044
Action ended 18:01:48: ExecSecureObjectsRollback_64. Return value 1.
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (26) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Doing action: ExecSecureObjectsRollback_64
MSI (s) (20!B4) [18:01:48:144]: Note: 1: 2205 2: 3: ActionText
Action start 18:01:48: ExecSecureObjectsRollback_64.
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (20) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (27) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (28) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (28) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (29) of type 790540 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (30) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (31) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (32) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (32) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (30) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (31) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (29) of type 790540 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (33) of type 790531 for thread 5044
Action ended 18:01:48: ExecSecureObjectsRollback_64. Return value 1.
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (33) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Doing action: ExecSecureObjectsRollback_64
MSI (s) (20!B4) [18:01:48:144]: Note: 1: 2205 2: 3: ActionText
Action start 18:01:48: ExecSecureObjectsRollback_64.
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (27) of type 790531 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (4) of type 790541 for thread 5044
MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (5) of type 790540 for thread 5044
MSI (s) (20:80) [18:01:48:144]: Closing MSIHANDLE (3) of type 790542 for thread 8012
Action ended 18:01:48: ExecSecureObjectsRollback_64. Return value 1.
MSI (s) (20:4C) [18:01:48:144]: Doing action: SetUnregisterHbtManagementAdapterRollback
MSI (s) (20:4C) [18:01:48:144]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: SchedSecureObjectsRollback_x64. Return value 1.
MSI (s) (20:4C) [18:01:48:144]: PROPERTY CHANGE: Adding UnregisterHbtManagementAdapterRollback property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll'.
Action start 18:01:48: SetUnregisterHbtManagementAdapterRollback.
MSI (s) (20:4C) [18:01:48:144]: Doing action: UnregisterHbtManagementAdapterRollback
MSI (s) (20:4C) [18:01:48:144]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: SetUnregisterHbtManagementAdapterRollback. Return value 1.
Action start 18:01:48: UnregisterHbtManagementAdapterRollback.
MSI (s) (20:4C) [18:01:48:159]: Doing action: UnregisterHbtManagementAdapter
MSI (s) (20:4C) [18:01:48:159]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: UnregisterHbtManagementAdapterRollback. Return value 1.
Action start 18:01:48: UnregisterHbtManagementAdapter.
MSI (s) (20:4C) [18:01:48:175]: Doing action: SetUnregisterManagementAdapterRollback
MSI (s) (20:4C) [18:01:48:175]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: UnregisterHbtManagementAdapter. Return value 1.
MSI (s) (20:4C) [18:01:48:175]: PROPERTY CHANGE: Adding UnregisterManagementAdapterRollback property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll'.
Action start 18:01:48: SetUnregisterManagementAdapterRollback.
MSI (s) (20:4C) [18:01:48:175]: Doing action: UnregisterManagementAdapterRollback
MSI (s) (20:4C) [18:01:48:175]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: SetUnregisterManagementAdapterRollback. Return value 1.
Action start 18:01:48: UnregisterManagementAdapterRollback.
MSI (s) (20:4C) [18:01:48:175]: Doing action: UnregisterManagementAdapter
MSI (s) (20:4C) [18:01:48:175]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: UnregisterManagementAdapterRollback. Return value 1.
Action start 18:01:48: UnregisterManagementAdapter.
MSI (s) (20:4C) [18:01:48:191]: Doing action: StopServices
MSI (s) (20:4C) [18:01:48:191]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: UnregisterManagementAdapter. Return value 1.
Action start 18:01:48: StopServices.
MSI (s) (20:4C) [18:01:48:191]: Doing action: UninstallSophosNTPLWF.Property
MSI (s) (20:4C) [18:01:48:191]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: StopServices. Return value 1.
MSI (s) (20:4C) [18:01:48:191]: PROPERTY CHANGE: Adding UninstallSophosNTPLWF property. Its value is '"C:\WINDOWS\system32\\netcfg.exe" /u SOPHOS_SOPHOSNTPLWF'.
Action start 18:01:48: UninstallSophosNTPLWF.Property.
MSI (s) (20:4C) [18:01:48:191]: Doing action: UninstallSophosNTPLWF
MSI (s) (20:4C) [18:01:48:191]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: UninstallSophosNTPLWF.Property. Return value 1.
Action start 18:01:48: UninstallSophosNTPLWF.
MSI (s) (20:4C) [18:01:48:191]: Skipping action: RollbackRemoveTrustedPublisher.Property (condition is false)
MSI (s) (20:4C) [18:01:48:191]: Skipping action: RollbackRemoveTrustedPublisher (condition is false)
MSI (s) (20:4C) [18:01:48:191]: Skipping action: RollbackUninstallSophosNTPLWF.Property (condition is false)
MSI (s) (20:4C) [18:01:48:191]: Skipping action: RollbackUninstallSophosNTPLWF (condition is false)
MSI (s) (20:4C) [18:01:48:191]: Skipping action: RollbackAddTrustedPublisher.Property (condition is false)
MSI (s) (20:4C) [18:01:48:191]: Skipping action: RollbackAddTrustedPublisher (condition is false)
MSI (s) (20:4C) [18:01:48:191]: Doing action: CleanUpSsspUserAccount.SetProperty
MSI (s) (20:4C) [18:01:48:191]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: UninstallSophosNTPLWF. Return value 1.
MSI (s) (20:4C) [18:01:48:191]: PROPERTY CHANGE: Adding CleanUpSsspUserAccount property. Its value is 'NT SERVICE\sntpservice'.
Action start 18:01:48: CleanUpSsspUserAccount.SetProperty.
MSI (s) (20:4C) [18:01:48:191]: Doing action: CleanUpSsspUserAccountRollback.SetProperty
MSI (s) (20:4C) [18:01:48:191]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: CleanUpSsspUserAccount.SetProperty. Return value 1.
MSI (s) (20:4C) [18:01:48:206]: PROPERTY CHANGE: Adding CleanUpSsspUserAccountRollback property. Its value is 'NT SERVICE\sntpservice'.
Action start 18:01:48: CleanUpSsspUserAccountRollback.SetProperty.
MSI (s) (20:4C) [18:01:48:206]: Doing action: CleanUpSsspUserAccountRollback
MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: CleanUpSsspUserAccountRollback.SetProperty. Return value 1.
Action start 18:01:48: CleanUpSsspUserAccountRollback.
MSI (s) (20:4C) [18:01:48:206]: Doing action: CleanUpSsspUserAccount
MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: CleanUpSsspUserAccountRollback. Return value 1.
Action start 18:01:48: CleanUpSsspUserAccount.
MSI (s) (20:4C) [18:01:48:206]: Doing action: RemoveSIPSSubmitterUserAccount.SetProperty
MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: CleanUpSsspUserAccount. Return value 1.
MSI (s) (20:4C) [18:01:48:206]: PROPERTY CHANGE: Adding RemoveSIPSSubmitterUserAccount property. Its value is 'NT SERVICE\SntpService'.
Action start 18:01:48: RemoveSIPSSubmitterUserAccount.SetProperty.
MSI (s) (20:4C) [18:01:48:206]: Doing action: RemoveSIPSSubmitterUserAccountRollback.SetProperty
MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: RemoveSIPSSubmitterUserAccount.SetProperty. Return value 1.
MSI (s) (20:4C) [18:01:48:206]: PROPERTY CHANGE: Adding RemoveSIPSSubmitterUserAccountRollback property. Its value is 'NT SERVICE\SntpService'.
Action start 18:01:48: RemoveSIPSSubmitterUserAccountRollback.SetProperty.
MSI (s) (20:4C) [18:01:48:206]: Doing action: RemoveSIPSSubmitterUserAccountRollback
MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: RemoveSIPSSubmitterUserAccountRollback.SetProperty. Return value 1.
Action start 18:01:48: RemoveSIPSSubmitterUserAccountRollback.
MSI (s) (20:4C) [18:01:48:206]: Doing action: RemoveSIPSSubmitterUserAccount
MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: RemoveSIPSSubmitterUserAccountRollback. Return value 1.
Action start 18:01:48: RemoveSIPSSubmitterUserAccount.
MSI (s) (20:4C) [18:01:48:206]: Doing action: SetUnregisterSntpEventManifest
MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: RemoveSIPSSubmitterUserAccount. Return value 1.
MSI (s) (20:4C) [18:01:48:206]: PROPERTY CHANGE: Adding UnregisterSntpEventManifest property. Its value is '"wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"'.
Action start 18:01:48: SetUnregisterSntpEventManifest.
MSI (s) (20:4C) [18:01:48:206]: Doing action: SetUnregisterSntpEventManifestRollback
MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: SetUnregisterSntpEventManifest. Return value 1.
MSI (s) (20:4C) [18:01:48:206]: PROPERTY CHANGE: Adding UnregisterSntpEventManifestRollback property. Its value is '"wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"'.
Action start 18:01:48: SetUnregisterSntpEventManifestRollback.
MSI (s) (20:4C) [18:01:48:206]: Doing action: UnregisterSntpEventManifestRollback
MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: SetUnregisterSntpEventManifestRollback. Return value 1.
Action start 18:01:48: UnregisterSntpEventManifestRollback.
MSI (s) (20:4C) [18:01:48:222]: Doing action: UnregisterSntpEventManifest
MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: UnregisterSntpEventManifestRollback. Return value 1.
Action start 18:01:48: UnregisterSntpEventManifest.
MSI (s) (20:4C) [18:01:48:222]: Doing action: DeleteServices
MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: UnregisterSntpEventManifest. Return value 1.
Action start 18:01:48: DeleteServices.
MSI (s) (20:4C) [18:01:48:222]: Doing action: RemoveRegistryValues
MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: DeleteServices. Return value 1.
Action start 18:01:48: RemoveRegistryValues.
MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveLogFiles.Property (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveLogFiles (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemovePolicyFile.Property (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemovePolicyFile (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveStatusFile.Property (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveStatusFile (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveReloadTrigger.Property (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveReloadTrigger (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveIpsFiles.Property (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveIpsFiles (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Doing action: RemoveFiles
MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: RemoveRegistryValues. Return value 1.
Action start 18:01:48: RemoveFiles.
MSI (s) (20:4C) [18:01:48:222]: Doing action: RemoveFolders
MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: RemoveFiles. Return value 1.
Action start 18:01:48: RemoveFolders.
MSI (s) (20:4C) [18:01:48:222]: Doing action: CreateFolders
MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: RemoveFolders. Return value 1.
Action start 18:01:48: CreateFolders.
MSI (s) (20:4C) [18:01:48:222]: Skipping action: FixupProductDataFiles.Property (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Skipping action: FixupProductDataFiles (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Skipping action: FixupHeartbeatDataFiles.Property (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Skipping action: FixupHeartbeatDataFiles (condition is false)
MSI (s) (20:4C) [18:01:48:222]: Doing action: InstallFiles
MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: CreateFolders. Return value 1.
MSI (s) (20:4C) [18:01:48:222]: The file represented by File table key 'Sntp.sys' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'SophosNTPLWF.sys' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'navl.dll' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'integrity.dat' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'SophosNtpServiceExeWin8Plus' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'SophosNtpServiceExeWin7Only' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'NTPAdapter.dll' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'Heartbeat.dll' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'Heartbeat.xml' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'Notice.txt' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'HealthApi.dll' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'HbtAdapter.dll' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'BPAIF.dll' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'SophosNtpTelemetry.exe' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'scf.dat' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'sof.dat' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'Sntp.inf' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'Sntp.cat' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'Sntp.man' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'SophosNTPLWF.inf' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'SophosNTPLWF.cat' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C' has no eligible binary patches
MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2205 2: 3: Patch
MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence`
MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2205 2: 3: MsiSFCBypass
MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2228 2: 3: MsiSFCBypass 4: SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ?
MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2205 2: 3: MsiPatchHeaders
MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2228 2: 3: MsiPatchHeaders 4: SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ?
Action start 18:01:48: InstallFiles.
MSI (s) (20:4C) [18:01:48:238]: Doing action: FixupDIFxAppRegistry
MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: InstallFiles. Return value 1.
MSI (s) (20:4C) [18:01:48:238]: Creating MSIHANDLE (34) of type 790542 for thread 8012
MSI (s) (20:34) [18:01:48:238]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7AE9.tmp, Entrypoint: FixupDIFxAppRegistry
MSI (s) (20!3C) [18:01:48:253]: Creating MSIHANDLE (35) of type 790541 for thread 9532
MSI (s) (20!3C) [18:01:48:253]: Creating MSIHANDLE (36) of type 790531 for thread 9532
Action start 18:01:48: FixupDIFxAppRegistry.
MSI (s) (20!3C) [18:01:48:253]: Closing MSIHANDLE (36) of type 790531 for thread 9532
MSI (s) (20!3C) [18:01:48:253]: Creating MSIHANDLE (37) of type 790531 for thread 9532
FixupDIFxAppRegistry: FixupDIFxAppRegistry called
MSI (s) (20!3C) [18:01:48:253]: Closing MSIHANDLE (37) of type 790531 for thread 9532
MSI (s) (20!3C) [18:01:48:253]: Creating MSIHANDLE (38) of type 790531 for thread 9532
FixupDIFxAppRegistry: Failed to open registry key, err: 2, key: SOFTWARE\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{76F354A6-97D5-4872-9781-2F2642A4F18A}
MSI (s) (20!3C) [18:01:48:253]: Closing MSIHANDLE (38) of type 790531 for thread 9532
MSI (s) (20!3C) [18:01:48:253]: Closing MSIHANDLE (35) of type 790541 for thread 9532
MSI (s) (20:34) [18:01:48:253]: Closing MSIHANDLE (34) of type 790542 for thread 8012
FixupDIFxAppRegistry: No registry key changes made
MSI (s) (20:4C) [18:01:48:253]: Doing action: MsiProcessDrivers
MSI (s) (20:4C) [18:01:48:253]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: FixupDIFxAppRegistry. Return value 1.
MSI (s) (20:4C) [18:01:48:253]: Creating MSIHANDLE (39) of type 790542 for thread 8012
MSI (s) (20:00) [18:01:48:253]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7AFA.tmp, Entrypoint: ProcessDriverPackages
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (40) of type 790531 for thread 9484
Action start 18:01:48: MsiProcessDrivers.
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (40) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (41) of type 790541 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (42) of type 790540 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (43) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (44) of type 790531 for thread 9484
DIFXAPP: ENTER: ProcessDriverPackages()
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (44) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (45) of type 790531 for thread 9484
DIFXAPP: INFO: 'Component' is 'Driver'
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (45) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (46) of type 790541 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (47) of type 790540 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (48) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (48) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (47) of type 790540 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (46) of type 790541 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (49) of type 790531 for thread 9484
DIFXAPP: INFO: Component state 0x3 -> 0x2
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (49) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (50) of type 790531 for thread 9484
DIFXAPP: INFO: 'ComponentId' is {76F354A6-97D5-4872-9781-2F2642A4F18A}
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (50) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (51) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (52) of type 790531 for thread 9484
DIFXAPP: INFO: 'Flags' is 21
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (52) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (53) of type 790531 for thread 9484
DIFXAPP: INFO: component path is
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (53) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (54) of type 790531 for thread 9484
DIFXAPP: INFO: user SID of user performing the install is 'S-1-5-18'.
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (54) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: PROPERTY CHANGE: Adding MsiUninstallDrivers property. Its value is '2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}21Sophos Network Threat ProtectionSophos Limited'.
MSI (s) (20!0C) [18:01:48:269]: Doing action: MsiUninstallDrivers
MSI (s) (20!0C) [18:01:48:269]: Note: 1: 2205 2: 3: ActionText
DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{76F354A6-97D5-4872-9781-2F2642A4F18A} (User's SID: 'S-1-5-18') ...
Action start 18:01:48: MsiUninstallDrivers.
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (51) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (43) of type 790531 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (42) of type 790540 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (41) of type 790541 for thread 9484
MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (55) of type 790531 for thread 9484
Action ended 18:01:48: MsiUninstallDrivers. Return value 1.
MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (55) of type 790531 for thread 9484
MSI (s) (20:00) [18:01:48:269]: Closing MSIHANDLE (39) of type 790542 for thread 8012
DIFXAPP: RETURN: ProcessDriverPackages() 0 (0x0)
MSI (s) (20:4C) [18:01:48:269]: Doing action: SetRegisterSntpEventManifestRollback
MSI (s) (20:4C) [18:01:48:269]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: MsiProcessDrivers. Return value 1.
MSI (s) (20:4C) [18:01:48:284]: PROPERTY CHANGE: Adding RegisterSntpEventManifestRollback property. Its value is '"wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"'.
Action start 18:01:48: SetRegisterSntpEventManifestRollback.
MSI (s) (20:4C) [18:01:48:284]: Skipping action: RegisterSntpEventManifestRollback (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Doing action: SetRegisterSntpEventManifest
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: SetRegisterSntpEventManifestRollback. Return value 1.
MSI (s) (20:4C) [18:01:48:284]: PROPERTY CHANGE: Adding RegisterSntpEventManifest property. Its value is '"wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"'.
Action start 18:01:48: SetRegisterSntpEventManifest.
MSI (s) (20:4C) [18:01:48:284]: Skipping action: RegisterSntpEventManifest (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Doing action: WriteRegistryValues
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: SetRegisterSntpEventManifest. Return value 1.
Action start 18:01:48: WriteRegistryValues.
MSI (s) (20:4C) [18:01:48:284]: Doing action: InstallServices
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: WriteRegistryValues. Return value 1.
Action start 18:01:48: InstallServices.
MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddSIPSSubmitterUserAccount.SetProperty (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddSIPSSubmitterUserAccountRollback.SetProperty (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddSIPSSubmitterUserAccountRollback (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddSIPSSubmitterUserAccount (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: SchedSecureObjects_x64 (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: SchedServiceConfig (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: SetupSspUserAccount.SetProperty (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: SetupSspUserAccountRollback.SetProperty (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: SetupSspUserAccountRollback (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: SetupSspUserAccount (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Doing action: MsiConfigureServices
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: InstallServices. Return value 1.
Action start 18:01:48: MsiConfigureServices.
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: MsiServiceConfigFailureActions
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2228 2: 3: MsiServiceConfigFailureActions 4: SELECT `Name`, `Event`, `ResetPeriod`, `RebootMessage`,`Command`, `Actions`, `DelayActions`, `Action` FROM `MsiServiceConfigFailureActions`, `Component` WHERE `Component_` = `Component` AND (`Action` = 0 OR `Action` = 1 OR `Action` = 3)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddTrustedPublisher.Property (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddTrustedPublisherRollback.Property (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddTrustedPublisherRollback (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddTrustedPublisher (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: InstallSophosNTPLWF.Property (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: RollbackInstallSophosNTPLWF.Property (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: RollbackInstallSophosNTPLWF (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: InstallSophosNTPLWF (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: RemoveTrustedPublisher.Property (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: RemoveTrustedPublisher (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Doing action: StartServices
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: MsiConfigureServices. Return value 1.
Action start 18:01:48: StartServices.
MSI (s) (20:4C) [18:01:48:284]: Skipping action: RegisterHbtManagementAdapterRollback (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Doing action: SetRegisterHbtManagementAdapter
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: StartServices. Return value 1.
MSI (s) (20:4C) [18:01:48:284]: PROPERTY CHANGE: Adding RegisterHbtManagementAdapter property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll'.
Action start 18:01:48: SetRegisterHbtManagementAdapter.
MSI (s) (20:4C) [18:01:48:284]: Skipping action: RegisterHbtManagementAdapter (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Skipping action: RegisterManagementAdapterRollback (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Doing action: SetRegisterManagementAdapter
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: SetRegisterHbtManagementAdapter. Return value 1.
MSI (s) (20:4C) [18:01:48:284]: PROPERTY CHANGE: Adding RegisterManagementAdapter property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll'.
Action start 18:01:48: SetRegisterManagementAdapter.
MSI (s) (20:4C) [18:01:48:284]: Skipping action: RegisterManagementAdapter (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Doing action: RegisterUser
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: SetRegisterManagementAdapter. Return value 1.
Action start 18:01:48: RegisterUser.
MSI (s) (20:4C) [18:01:48:284]: Doing action: RegisterProduct
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: RegisterUser. Return value 0.
Action start 18:01:48: RegisterProduct.
MSI (s) (20:4C) [18:01:48:284]: Doing action: PublishFeatures
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: RegisterProduct. Return value 1.
Action start 18:01:48: PublishFeatures.
MSI (s) (20:4C) [18:01:48:284]: Doing action: PublishProduct
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: PublishFeatures. Return value 1.
MSI (s) (20:4C) [18:01:48:284]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:48:284]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
Action start 18:01:48: PublishProduct.
MSI (s) (20:4C) [18:01:48:284]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:48:284]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:48:284]: Skipping action: WixFailWhenDeferred (condition is false)
MSI (s) (20:4C) [18:01:48:284]: Doing action: InstallFinalize
MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
Action ended 18:01:48: PublishProduct. Return value 1.
MSI (s) (20:4C) [18:01:48:284]: Running Script: C:\WINDOWS\Installer\MSI7A3B.tmp
MSI (s) (20:4C) [18:01:48:284]: PROPERTY CHANGE: Adding UpdateStarted property. Its value is '1'.
MSI (s) (20:4C) [18:01:48:300]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (20:4C) [18:01:48:300]: Machine policy value 'DisableRollback' is 0
MSI (s) (20:4C) [18:01:48:300]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:01:48:300]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:01:48:300]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (20:4C) [18:01:48:300]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1380880441,LangId=1033,Platform=589824,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
Action start 18:01:48: InstallFinalize.
MSI (s) (20:4C) [18:01:48:300]: Executing op: ProductInfo(ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductName=Sophos Network Threat Protection,PackageName=Sophos Network Threat Protection.msi,Language=1033,Version=17369275,Assignment=1,ObsoleteArg=0,ProductIcon=shield.ico,,PackageCode={0B95A4E2-4953-4CE7-B8F7-53BB197E234A},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3)
MSI (s) (20:4C) [18:01:48:300]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (20:4C) [18:01:48:300]: Executing op: DialogInfo(Type=1,Argument=Sophos Network Threat Protection)
MSI (s) (20:4C) [18:01:48:300]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
MSI (s) (20:4C) [18:01:48:300]: Executing op: SetBaseline(Baseline=0,)
MSI (s) (20:4C) [18:01:48:300]: Executing op: SetBaseline(Baseline=1,)
MSI (s) (20:4C) [18:01:48:300]: Executing op: ActionStart(Name=InstallInitialize,,)
MSI (s) (20:4C) [18:01:48:300]: Executing op: ProductUnregister(UpgradeCode={A6CF693D-C171-4DF5-AE49-223B66F65A1A})
MSI (s) (20:4C) [18:01:48:300]: Note: 1: 1402 2: UNKNOWN\Products\9009F1B458DC0C34CBDB4D1909D8A525\Transforms 3: 2
MSI (s) (20:4C) [18:01:48:300]: Note: 1: 1402 2: UNKNOWN\Products\9009F1B458DC0C34CBDB4D1909D8A525\Transforms 3: 2
MSI (s) (20:4C) [18:01:48:300]: Scheduling file 'C:\WINDOWS\Installer\4978e5.msi' for deletion during post-install cleanup (not post-reboot).
MSI (s) (20:4C) [18:01:48:316]: Note: 1: 1402 2: UNKNOWN\Products\9009F1B458DC0C34CBDB4D1909D8A525\Usage 3: 2
MSI (s) (20:4C) [18:01:48:316]: Executing op: ProductCPDisplayInfoUnregister()
MSI (s) (20:4C) [18:01:48:316]: Executing op: ProductUnpublish(PackageKey={0B95A4E2-4953-4CE7-B8F7-53BB197E234A})
MSI (s) (20:4C) [18:01:48:316]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
MSI (s) (20:4C) [18:01:48:316]: Executing op: UpgradeCodeUnpublish(UpgradeCode={A6CF693D-C171-4DF5-AE49-223B66F65A1A})
MSI (s) (20:4C) [18:01:48:316]: Executing op: IconRemove(Icon=shield.ico,)
MSI (s) (20:4C) [18:01:48:316]: Scheduling file 'C:\WINDOWS\Installer\{4B1F9009-CD85-43C0-BCBD-D491908D5A52}\shield.ico' for deletion during post-install cleanup (not post-reboot).
MSI (s) (20:4C) [18:01:48:316]: Executing op: ProductUnpublishClient(,,)
MSI (s) (20:4C) [18:01:48:316]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525 3: 2
MSI (s) (20:4C) [18:01:48:316]: Executing op: SourceListUnpublish(,)
MSI (s) (20:4C) [18:01:48:316]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525\SourceList 3: 2
MSI (s) (20:4C) [18:01:48:316]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,)
MSI (s) (20:4C) [18:01:48:316]: Executing op: ProgressTotal(Total=38,Type=1,ByteEquivalent=24000)
MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={07B90057-705F-44F2-8465-C2A4C77784E7},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={07B90057-705F-44F2-8465-C2A4C77784E7},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={E1E87C49-DD4A-4C77-8D42-3ACD20DBC536},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={E1E87C49-DD4A-4C77-8D42-3ACD20DBC536},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={4D81D62C-8373-45B8-ABF2-0C0D6ED2DE34},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={4D81D62C-8373-45B8-ABF2-0C0D6ED2DE34},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={74F91047-4C42-457F-B531-A83EF6EC85E2},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={74F91047-4C42-457F-B531-A83EF6EC85E2},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={F1B8B8D7-46D7-4CA9-B109-35931536EA8A},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={F1B8B8D7-46D7-4CA9-B109-35931536EA8A},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={270CF92A-C3C0-4385-B596-337555FE9560},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={270CF92A-C3C0-4385-B596-337555FE9560},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={8D83ACDA-6DCE-41F3-B5C1-7C01BD45026C},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={8D83ACDA-6DCE-41F3-B5C1-7C01BD45026C},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={14456086-9032-4E19-9F29-9F1F9DD21F4E},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={14456086-9032-4E19-9F29-9F1F9DD21F4E},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={9DAD77F9-1B7B-4731-8A40-3EC32A42ACC7},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={9DAD77F9-1B7B-4731-8A40-3EC32A42ACC7},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={43CBB64E-B6FD-496B-8B4D-9D8842C8E5B2},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={43CBB64E-B6FD-496B-8B4D-9D8842C8E5B2},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={76F354A6-97D5-4872-9781-2F2642A4F18A},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={FC337C28-D909-4BF7-826A-F06F35C592F8},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={FC337C28-D909-4BF7-826A-F06F35C592F8},,BinaryType=1,PreviouslyPinned=1)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={355DC0F9-A6B5-4FCA-8121-00847E59A436},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={355DC0F9-A6B5-4FCA-8121-00847E59A436},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={173F7C99-1A05-4365-B40A-D4EE897D94DE},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={173F7C99-1A05-4365-B40A-D4EE897D94DE},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={38879DEA-36FA-41BE-ACF3-B084CB40689B},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={38879DEA-36FA-41BE-ACF3-B084CB40689B},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={8E48EE2F-1444-46BF-BCD4-B5F66A4AFF10},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={8E48EE2F-1444-46BF-BCD4-B5F66A4AFF10},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={B7D2E43B-E8A6-4483-9BF7-5195F70225EF},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={B7D2E43B-E8A6-4483-9BF7-5195F70225EF},,BinaryType=1,PreviouslyPinned=1)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={DF927ABB-6A5F-44F2-A430-137AAC79AA71},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={DF927ABB-6A5F-44F2-A430-137AAC79AA71},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={4E691ABE-115D-4721-9F9A-3547D17077C5},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={4E691ABE-115D-4721-9F9A-3547D17077C5},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={668853A5-00CE-412E-B21F-0721B6A8A0A9},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={668853A5-00CE-412E-B21F-0721B6A8A0A9},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={53CBCC30-891C-4EDC-9106-456F524A7547},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={53CBCC30-891C-4EDC-9106-456F524A7547},,BinaryType=0,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={B77F9317-494B-4351-897B-D7676F0A553D},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={B77F9317-494B-4351-897B-D7676F0A553D},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1},,BinaryType=1,PreviouslyPinned=1)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={D27928F9-1751-4CE1-817A-C94C9DDFA521},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={D27928F9-1751-4CE1-817A-C94C9DDFA521},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={1FCDB37D-595F-4837-919B-EC3B0753CEA3},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={1FCDB37D-595F-4837-919B-EC3B0753CEA3},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={BE16C094-CC09-4502-8856-ED495E915D2D},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={BE16C094-CC09-4502-8856-ED495E915D2D},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={B9C8E32A-5EB9-4B7F-91AF-9FD883FB729C},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={B9C8E32A-5EB9-4B7F-91AF-9FD883FB729C},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={6EFE6551-BEDB-470F-9B98-4DD9D50BD010},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={6EFE6551-BEDB-470F-9B98-4DD9D50BD010},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={5FDACC4C-306D-434E-8DF0-F356318B9B39},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={5FDACC4C-306D-434E-8DF0-F356318B9B39},,BinaryType=0,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={1B63A9FF-509B-4CD9-BA54-256A7D62B724},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={1B63A9FF-509B-4CD9-BA54-256A7D62B724},,BinaryType=0,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={7C58F223-7247-466F-BFB7-7AFCF335E96D},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={7C58F223-7247-466F-BFB7-7AFCF335E96D},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={73F7BF07-5A6C-45CF-B42D-786698434BCA},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={73F7BF07-5A6C-45CF-B42D-786698434BCA},,BinaryType=1,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={0835C947-D6D2-4E52-AF14-0231D04E88EA},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={0835C947-D6D2-4E52-AF14-0231D04E88EA},,BinaryType=0,PreviouslyPinned=1)
MSI (s) (20:4C) [18:01:48:347]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcr120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={74260D9F-D644-423B-B2D4-0291EA4BA8BE},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={74260D9F-D644-423B-B2D4-0291EA4BA8BE},,BinaryType=0,PreviouslyPinned=1)
MSI (s) (20:4C) [18:01:48:347]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcp120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={63B83B20-1AB9-4F49-B0B2-4489724CA96C},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={63B83B20-1AB9-4F49-B0B2-4489724CA96C},,BinaryType=0,PreviouslyPinned=1)
MSI (s) (20:4C) [18:01:48:347]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\vccorlib120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={E5B92048-5859-4AF1-AEAD-B97EBF00B087},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={E5B92048-5859-4AF1-AEAD-B97EBF00B087},,BinaryType=1,PreviouslyPinned=1)
MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={570C624B-D57C-4CD1-9013-1B80C800093B},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={570C624B-D57C-4CD1-9013-1B80C800093B},,BinaryType=1,PreviouslyPinned=1)
MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},,BinaryType=1,PreviouslyPinned=1)
MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
MSI (s) (20:4C) [18:01:48:347]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0,,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTick()
MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
MSI (s) (20:4C) [18:01:48:347]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0,,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTick()
MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
MSI (s) (20:4C) [18:01:48:347]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0,,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTick()
MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
MSI (s) (20:4C) [18:01:48:347]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=1,,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTick()
MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
MSI (s) (20:4C) [18:01:48:347]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=1,,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTick()
MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
MSI (s) (20:4C) [18:01:48:347]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=1,,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTick()
MSI (s) (20:4C) [18:01:48:347]: Executing op: ActionStart(Name=UnpublishFeatures,Description=Unpublishing Product Features,Template=Feature: [1])
MSI (s) (20:4C) [18:01:48:347]: Executing op: FeatureUnpublish(Feature=AllComponents,,Absent=2,Component=@p{P%*BW1=zd&z]$)mJsdaW[qjB%Y@U4ZzjvKD[5OsJv@s}cJ=1oT4'~aF~4CQXZM}~YD=K6f.8uiFmqd,Xcv8TA_@VbUBW=+!`T%nnV0vM_d9sEnaMsf]&GlD$QUD{d49sg^P!D(ceJiKkS)R0[+AZ!s1-[w=,A6.YbZ3{ss=JEohg_[p2i8w+l98ljZ?~=1vSw1@Rb4dZ7NP)4@?Ay3?02Rl`TRfq'zN,GK@vS'}KY[htxv%v05IXn_AO3,LR+RiW5?B,P*E21a9U[TiuMN_Upq)D26Y?%.9S)}_R4*WyYsY(gU,`eg=gKq@xBGEO(!Er)d%fi$=MA=~W3(2ru}Bhqp$+W1=1!z7OkB7ULd_*5ATP2r=0iFt=RAXOhfI)zHg2_y8x,@]-~5&T_DI6xBNcJEAusiiK'M1{=`Z{{cQL&_9mRpGI0qTe78f`d9~7Zy=A!C`^NHWEqA?u_ljl9e@6]gb@m*7n-F0p6-acr5?!O(=7Jl~_]RT$+fEcA3==X[i?MRDY2dmLeda@S=@3Gw]nbS$@ZL67bKoECp=)rPpn?oAJ(}f_mFWDe^9FoNyCexjS6Pt8m+6=Ld@rqk,J59'm.iy%{OBC6_=mqN0zSy_CKZL,?MY1.M==wExHp,N$jwf@_%sbe2Au(qh3f62HtpO'DMliL@9C'V[VqeV?fJ[7'H?Q~PAYa$-TR,SwJ+Skorl$F*@hZ~fPvko[S5W(}CCJ^c@h2e2Q1wj{6('3f)giZc@F=6^fRo9h6)
MSI (s) (20:4C) [18:01:48:347]: Note: 1: 1402 2: UNKNOWN\Installer\Features\9009F1B458DC0C34CBDB4D1909D8A525 3: 2
MSI (s) (20:4C) [18:01:48:347]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
MSI (s) (20:4C) [18:01:48:347]: Executing op: CustomActionSchedule(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
MSI (s) (20:4C) [18:01:48:363]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
MSI (s) (20:4C) [18:01:48:363]: Executing op: CustomActionSchedule(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
MSI (s) (20:4C) [18:01:48:363]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
MSI (s) (20:4C) [18:01:48:363]: Executing op: CustomActionSchedule(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
MSI (s) (20:4C) [18:01:48:363]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
MSI (s) (20:4C) [18:01:48:363]: Executing op: CustomActionSchedule(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
MSI (s) (20:4C) [18:01:48:363]: Executing op: ActionStart(Name=UnregisterHbtManagementAdapterRollback,,)
MSI (s) (20:4C) [18:01:48:363]: Executing op: CustomActionSchedule(Action=UnregisterHbtManagementAdapterRollback,ActionType=1345,Source=BinaryData,Target=RegisterHbtManagementAdapter,CustomActionData=C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll)
MSI (s) (20:4C) [18:01:48:363]: Executing op: ActionStart(Name=UnregisterHbtManagementAdapter,,)
MSI (s) (20:4C) [18:01:48:378]: Executing op: CustomActionSchedule(Action=UnregisterHbtManagementAdapter,ActionType=1089,Source=BinaryData,Target=UnregisterHbtManagementAdapter,)
MSI (s) (20:4C) [18:01:48:378]: Creating MSIHANDLE (56) of type 790536 for thread 8012
MSI (s) (20:CC) [18:01:48:378]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7B78.tmp, Entrypoint: UnregisterHbtManagementAdapter
MSI (s) (20!30) [18:01:48:378]: Creating MSIHANDLE (57) of type 790531 for thread 9776
MSI (s) (20!30) [18:01:48:394]: Closing MSIHANDLE (57) of type 790531 for thread 9776
MSI (s) (20!30) [18:01:48:394]: Creating MSIHANDLE (58) of type 790531 for thread 9776
UnregisterManagementAdapter: UnregisterManagementAdapter called
MSI (s) (20!30) [18:01:48:394]: Closing MSIHANDLE (58) of type 790531 for thread 9776
MSI (s) (20!30) [18:01:48:394]: Creating MSIHANDLE (59) of type 790531 for thread 9776
UnregisterManagementAdapter: Adapter = HBT
MSI (s) (20!30) [18:01:48:394]: Closing MSIHANDLE (59) of type 790531 for thread 9776
MSI (s) (20!30) [18:01:48:394]: Creating MSIHANDLE (60) of type 790531 for thread 9776
UnregisterManagementAdapter: Management adapter successfully unregistered
MSI (s) (20!30) [18:01:48:394]: Closing MSIHANDLE (60) of type 790531 for thread 9776
MSI (s) (20!30) [18:01:48:394]: Creating MSIHANDLE (61) of type 790531 for thread 9776
UnregisterManagementAdapter: Waiting for adapter to be unloaded
MSI (s) (20!30) [18:01:48:394]: Closing MSIHANDLE (61) of type 790531 for thread 9776
MSI (s) (20!30) [18:02:48:403]: Creating MSIHANDLE (62) of type 790531 for thread 9776
UnregisterManagementAdapter: Adapter path=C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll
MSI (s) (20!30) [18:02:48:403]: Closing MSIHANDLE (62) of type 790531 for thread 9776
MSI (s) (20:CC) [18:02:48:403]: Closing MSIHANDLE (56) of type 790536 for thread 8012
MSI (s) (20:4C) [18:02:48:403]: Executing op: ActionStart(Name=UnregisterManagementAdapterRollback,,)
UnregisterManagementAdapter: Failed to unload the adapter - continuing.
MSI (s) (20:4C) [18:02:48:403]: Executing op: CustomActionSchedule(Action=UnregisterManagementAdapterRollback,ActionType=1345,Source=BinaryData,Target=RegisterManagementAdapter,CustomActionData=C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll)
MSI (s) (20:4C) [18:02:48:403]: Executing op: ActionStart(Name=UnregisterManagementAdapter,,)
MSI (s) (20:4C) [18:02:48:403]: Executing op: CustomActionSchedule(Action=UnregisterManagementAdapter,ActionType=1089,Source=BinaryData,Target=UnregisterManagementAdapter,)
MSI (s) (20:4C) [18:02:48:418]: Creating MSIHANDLE (63) of type 790536 for thread 8012
MSI (s) (20:80) [18:02:48:418]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI65E9.tmp, Entrypoint: UnregisterManagementAdapter
MSI (s) (20!84) [18:02:48:418]: Creating MSIHANDLE (64) of type 790531 for thread 4740
MSI (s) (20!84) [18:02:48:418]: Closing MSIHANDLE (64) of type 790531 for thread 4740
MSI (s) (20!84) [18:02:48:418]: Creating MSIHANDLE (65) of type 790531 for thread 4740
UnregisterManagementAdapter: UnregisterManagementAdapter called
MSI (s) (20!84) [18:02:48:418]: Closing MSIHANDLE (65) of type 790531 for thread 4740
MSI (s) (20!84) [18:02:48:418]: Creating MSIHANDLE (66) of type 790531 for thread 4740
UnregisterManagementAdapter: Adapter = NTP
MSI (s) (20!84) [18:02:48:418]: Closing MSIHANDLE (66) of type 790531 for thread 4740
MSI (s) (20!84) [18:02:48:418]: Creating MSIHANDLE (67) of type 790531 for thread 4740
UnregisterManagementAdapter: Management adapter successfully unregistered
MSI (s) (20!84) [18:02:48:434]: Closing MSIHANDLE (67) of type 790531 for thread 4740
MSI (s) (20!84) [18:02:48:434]: Creating MSIHANDLE (68) of type 790531 for thread 4740
UnregisterManagementAdapter: Waiting for adapter to be unloaded
MSI (s) (20!84) [18:02:48:434]: Closing MSIHANDLE (68) of type 790531 for thread 4740
MSI (s) (20!84) [18:02:48:449]: Creating MSIHANDLE (69) of type 790531 for thread 4740
UnregisterManagementAdapter: Adapter path=C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll
MSI (s) (20!84) [18:02:48:449]: Closing MSIHANDLE (69) of type 790531 for thread 4740
MSI (s) (20:80) [18:02:48:449]: Closing MSIHANDLE (63) of type 790536 for thread 8012
MSI (s) (20:4C) [18:02:48:449]: Executing op: ActionStart(Name=StopServices,Description=Stopping services,Template=Service: [1])
UnregisterManagementAdapter: Management adapter has been unloaded.
MSI (s) (20:4C) [18:02:48:449]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000)
MSI (s) (20:4C) [18:02:48:449]: Executing op: ServiceControl(,Name=SntpService,Action=2,Wait=1,)
MSI (s) (20:4C) [18:02:49:481]: Executing op: ActionStart(Name=UninstallSophosNTPLWF,,)
MSI (s) (20:4C) [18:02:49:481]: Executing op: CustomActionSchedule(Action=UninstallSophosNTPLWF,ActionType=1089,Source=BinaryData,Target=WixQuietExec64,CustomActionData="C:\WINDOWS\system32\\netcfg.exe" /u SOPHOS_SOPHOSNTPLWF)
MSI (s) (20:4C) [18:02:49:481]: Creating MSIHANDLE (70) of type 790536 for thread 8012
MSI (s) (20:2C) [18:02:49:481]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI6A20.tmp, Entrypoint: WixQuietExec64
MSI (s) (20:78) [18:02:49:481]: Generating random cookie.
MSI (s) (20:78) [18:02:49:481]: Created Custom Action Server with PID 9668 (0x25C4).
MSI (s) (20:20) [18:02:49:527]: Running as a service.
MSI (s) (20:20) [18:02:49:527]: Hello, I'm your 32bit Elevated Non-remapped custom action server.
MSI (s) (20!6C) [18:02:50:199]: Creating MSIHANDLE (71) of type 790531 for thread 6252
MSI (s) (20!6C) [18:02:50:199]: Closing MSIHANDLE (71) of type 790531 for thread 6252
MSI (s) (20!6C) [18:02:50:199]: Creating MSIHANDLE (72) of type 790531 for thread 6252
WixQuietExec64: Trying to uninstall SOPHOS_SOPHOSNTPLWF ...
MSI (s) (20!6C) [18:02:50:199]: Closing MSIHANDLE (72) of type 790531 for thread 6252
MSI (s) (20!6C) [18:02:50:199]: Creating MSIHANDLE (73) of type 790531 for thread 6252
WixQuietExec64:

MSI (s) (20!6C) [18:02:50:199]: Closing MSIHANDLE (73) of type 790531 for thread 6252
MSI (s) (20!6C) [18:02:50:199]: Creating MSIHANDLE (74) of type 790531 for thread 6252
WixQuietExec64: ... SOPHOS_SOPHOSNTPLWF is not installed.
MSI (s) (20!6C) [18:02:50:199]: Closing MSIHANDLE (74) of type 790531 for thread 6252
MSI (s) (20!6C) [18:02:50:199]: Creating MSIHANDLE (75) of type 790531 for thread 6252
WixQuietExec64:

MSI (s) (20!6C) [18:02:50:199]: Closing MSIHANDLE (75) of type 790531 for thread 6252
MSI (s) (20!6C) [18:02:50:199]: Creating MSIHANDLE (76) of type 790531 for thread 6252
WixQuietExec64: ... done.
MSI (s) (20!6C) [18:02:50:199]: Closing MSIHANDLE (76) of type 790531 for thread 6252
MSI (s) (20:2C) [18:02:50:199]: Closing MSIHANDLE (70) of type 790536 for thread 8012
MSI (s) (20:4C) [18:02:50:199]: Executing op: ActionStart(Name=CleanUpSsspUserAccountRollback,,)
WixQuietExec64:

MSI (s) (20:4C) [18:02:50:199]: Executing op: CustomActionSchedule(Action=CleanUpSsspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sntpservice)
MSI (s) (20:4C) [18:02:50:199]: Executing op: ActionStart(Name=CleanUpSsspUserAccount,,)
MSI (s) (20:4C) [18:02:50:199]: Executing op: CustomActionSchedule(Action=CleanUpSsspUserAccount,ActionType=1025,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\sntpservice)
MSI (s) (20:4C) [18:02:50:199]: Creating MSIHANDLE (77) of type 790536 for thread 8012
MSI (s) (20:10) [18:02:50:199]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI6CEF.tmp, Entrypoint: CleanUpSsspUserAccount
MSI (s) (20!10) [18:02:50:214]: Creating MSIHANDLE (78) of type 790531 for thread 8464
MSI (s) (20!10) [18:02:50:214]: Closing MSIHANDLE (78) of type 790531 for thread 8464
MSI (s) (20:10) [18:02:50:214]: Closing MSIHANDLE (77) of type 790536 for thread 8012
MSI (s) (20:4C) [18:02:50:214]: Executing op: ActionStart(Name=RemoveSIPSSubmitterUserAccountRollback,,)
CleanUpSsspUserAccount: Initialized.
MSI (s) (20:4C) [18:02:50:214]: Executing op: CustomActionSchedule(Action=RemoveSIPSSubmitterUserAccountRollback,ActionType=1281,Source=BinaryData,Target=AddSIPSManagementUser,CustomActionData=NT SERVICE\SntpService)
MSI (s) (20:4C) [18:02:50:214]: Executing op: ActionStart(Name=RemoveSIPSSubmitterUserAccount,,)
MSI (s) (20:4C) [18:02:50:214]: Executing op: CustomActionSchedule(Action=RemoveSIPSSubmitterUserAccount,ActionType=1025,Source=BinaryData,Target=RemoveSIPSManagementUser,CustomActionData=NT SERVICE\SntpService)
MSI (s) (20:4C) [18:02:50:214]: Creating MSIHANDLE (79) of type 790536 for thread 8012
MSI (s) (20:74) [18:02:50:214]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI6D00.tmp, Entrypoint: RemoveSIPSManagementUser
MSI (s) (20!1C) [18:02:50:214]: Creating MSIHANDLE (80) of type 790531 for thread 5404
MSI (s) (20!1C) [18:02:50:214]: Closing MSIHANDLE (80) of type 790531 for thread 5404
MSI (s) (20!1C) [18:02:50:230]: Creating MSIHANDLE (81) of type 790531 for thread 5404
RemoveSIPSManagementUser Enter (290)
MSI (s) (20!1C) [18:02:50:230]: Closing MSIHANDLE (81) of type 790531 for thread 5404
MSI (s) (20:74) [18:02:50:230]: Closing MSIHANDLE (79) of type 790536 for thread 8012
MSI (s) (20:4C) [18:02:50:230]: Executing op: ActionStart(Name=UnregisterSntpEventManifestRollback,,)
RemoveSIPSManagementUser Exit (338)
MSI (s) (20:4C) [18:02:50:230]: Executing op: CustomActionSchedule(Action=UnregisterSntpEventManifestRollback,ActionType=3393,Source=BinaryData,Target=WixQuietExec,CustomActionData="wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man")
MSI (s) (20:4C) [18:02:50:230]: Executing op: ActionStart(Name=UnregisterSntpEventManifest,,)
MSI (s) (20:4C) [18:02:50:230]: Executing op: CustomActionSchedule(Action=UnregisterSntpEventManifest,ActionType=3137,Source=BinaryData,Target=WixQuietExec,CustomActionData="wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man")
MSI (s) (20:4C) [18:02:50:230]: Creating MSIHANDLE (82) of type 790536 for thread 8012
MSI (s) (20:AC) [18:02:50:230]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI6D11.tmp, Entrypoint: WixQuietExec
MSI (s) (20:AC) [18:02:50:371]: Closing MSIHANDLE (82) of type 790536 for thread 8012
MSI (s) (20:4C) [18:02:50:371]: Executing op: ActionStart(Name=DeleteServices,Description=Deleting services,Template=Service: [1])
MSI (s) (20:4C) [18:02:50:371]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000)
MSI (s) (20:4C) [18:02:50:371]: Executing op: ServiceControl(,Name=SntpService,Action=8,Wait=1,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: ActionStart(Name=RemoveRegistryValues,Description=Removing system registry values,Template=Key: [1], Name: [2])
MSI (s) (20:4C) [18:02:50:371]: Executing op: ProgressTotal(Total=15,Type=1,ByteEquivalent=13200)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat\Status,,BinaryType=0,,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat,,BinaryType=0,,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Telemetry\Plugins\NTP,,BinaryType=0,,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegRemoveValue(Name=Path,Value=[INSTALLDIR]SophosNtpTelemetry.exe,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegRemoveValue(Name=Cmd,Value=SophosNtpTelemetry.exe,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Application,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegRemoveValue(Name=ProductCode,Value=[ProductCode],)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegRemoveValue(Name=ProductVersion,Value=[ProductVersion],)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegRemoveValue(Name=Path,Value=[INSTALLDIR],)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry\Heartbeat,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry\MTD,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegRemoveValue(,Value=service,)
MSI (s) (20:4C) [18:02:50:371]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService 3: 2
MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:50:371]: Executing op: ActionStart(Name=RemoveFiles,Description=Removing files,Template=File: [1], Directory: [9])
MSI (s) (20:4C) [18:02:50:371]: Executing op: ProgressTotal(Total=16,Type=1,ByteEquivalent=175000)
MSI (s) (20:4C) [18:02:50:371]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\)
MSI (s) (20:4C) [18:02:50:371]: Executing op: FileRemove(,FileName=Sntp.sys,,ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A})
MSI (s) (20:4C) [18:02:50:371]: Verifying accessibility of file: Sntp.sys
MSI (s) (20:4C) [18:02:50:386]: Executing op: FileRemove(,FileName=navl.dll,,ComponentId={355DC0F9-A6B5-4FCA-8121-00847E59A436})
MSI (s) (20:4C) [18:02:50:386]: Verifying accessibility of file: navl.dll
MSI (s) (20:4C) [18:02:50:589]: Executing op: FileRemove(,FileName=integrity.dat,,ComponentId={173F7C99-1A05-4365-B40A-D4EE897D94DE})
MSI (s) (20:4C) [18:02:50:589]: Verifying accessibility of file: integrity.dat
MSI (s) (20:4C) [18:02:50:589]: Executing op: FileRemove(,FileName=SophosNtpService.exe,,ComponentId={8E48EE2F-1444-46BF-BCD4-B5F66A4AFF10})
MSI (s) (20:4C) [18:02:50:605]: Verifying accessibility of file: SophosNtpService.exe
MSI (s) (20:4C) [18:02:50:699]: Executing op: FileRemove(,FileName=NTPAdapter.dll,,ComponentId={4E691ABE-115D-4721-9F9A-3547D17077C5})
MSI (s) (20:4C) [18:02:50:699]: Verifying accessibility of file: NTPAdapter.dll
MSI (s) (20:4C) [18:02:50:714]: Executing op: FileRemove(,FileName=Heartbeat.dll,,ComponentId={668853A5-00CE-412E-B21F-0721B6A8A0A9})
MSI (s) (20:4C) [18:02:50:730]: Verifying accessibility of file: Heartbeat.dll
MSI (s) (20:4C) [18:02:50:839]: Executing op: FileRemove(,FileName=Notice.txt,,ComponentId={D27928F9-1751-4CE1-817A-C94C9DDFA521})
MSI (s) (20:4C) [18:02:50:839]: Verifying accessibility of file: Notice.txt
MSI (s) (20:4C) [18:02:50:839]: Executing op: FileRemove(,FileName=HealthApi.dll,,ComponentId={1FCDB37D-595F-4837-919B-EC3B0753CEA3})
MSI (s) (20:4C) [18:02:50:855]: Verifying accessibility of file: HealthApi.dll
MSI (s) (20:4C) [18:02:50:855]: Executing op: FileRemove(,FileName=HbtAdapter.dll,,ComponentId={BE16C094-CC09-4502-8856-ED495E915D2D})
MSI (s) (20:4C) [18:02:50:855]: Verifying accessibility of file: HbtAdapter.dll
MSI (s) (20:4C) [18:02:50:933]: Executing op: FileRemove(,FileName=BPAIF.dll,,ComponentId={B9C8E32A-5EB9-4B7F-91AF-9FD883FB729C})
MSI (s) (20:4C) [18:02:50:933]: Verifying accessibility of file: BPAIF.dll
MSI (s) (20:4C) [18:02:50:949]: Executing op: FileRemove(,FileName=SophosNtpTelemetry.exe,,ComponentId={6EFE6551-BEDB-470F-9B98-4DD9D50BD010})
MSI (s) (20:4C) [18:02:50:949]: Verifying accessibility of file: SophosNtpTelemetry.exe
MSI (s) (20:4C) [18:02:50:964]: Executing op: FileRemove(,FileName=scf.dat,,ComponentId={7C58F223-7247-466F-BFB7-7AFCF335E96D})
MSI (s) (20:4C) [18:02:50:980]: Verifying accessibility of file: scf.dat
MSI (s) (20:4C) [18:02:50:980]: Executing op: FileRemove(,FileName=sof.dat,,ComponentId={73F7BF07-5A6C-45CF-B42D-786698434BCA})
MSI (s) (20:4C) [18:02:50:980]: Verifying accessibility of file: sof.dat
MSI (s) (20:4C) [18:02:50:980]: Executing op: FileRemove(,FileName=Sntp.inf,,ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A})
MSI (s) (20:4C) [18:02:50:980]: Verifying accessibility of file: Sntp.inf
MSI (s) (20:4C) [18:02:50:980]: Executing op: FileRemove(,FileName=Sntp.cat,,ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A})
MSI (s) (20:4C) [18:02:50:980]: Verifying accessibility of file: Sntp.cat
MSI (s) (20:4C) [18:02:50:980]: Executing op: FileRemove(,FileName=Sntp.man,,ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A})
MSI (s) (20:4C) [18:02:50:980]: Verifying accessibility of file: Sntp.man
MSI (s) (20:4C) [18:02:50:996]: Executing op: ActionStart(Name=RemoveFolders,Description=Removing folders,Template=Folder: [1])
MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\,Foreign=0)
MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\,Foreign=0)
MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\,Foreign=0)
MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\,Foreign=0)
MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\,Foreign=0)
MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\,Foreign=0)
MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\,Foreign=0)
MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Heartbeat\,Foreign=0)
MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Heartbeat\Config\,Foreign=0)
MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Heartbeat\Logs\,Foreign=0)
MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Heartbeat\Persist\,Foreign=0)
MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:011]: Executing op: FolderRemove(Folder=C:\,Foreign=0)
MSI (s) (20:4C) [18:02:51:011]: Executing op: ActionStart(Name=MsiUninstallDrivers,,)
MSI (s) (20:4C) [18:02:51:011]: Executing op: CustomActionSchedule(Action=MsiUninstallDrivers,ActionType=3073,Source=BinaryData,Target=UninstallDriverPackages,CustomActionData=2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}21Sophos Network Threat ProtectionSophos Limited)
MSI (s) (20:4C) [18:02:51:011]: Creating MSIHANDLE (83) of type 790536 for thread 8012
MSI (s) (20:8C) [18:02:51:011]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI701F.tmp, Entrypoint: UninstallDriverPackages
MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (84) of type 790531 for thread 2632
MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (84) of type 790531 for thread 2632
MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (85) of type 790531 for thread 2632
DIFXAPP: UninstallDriverPackages()
MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (85) of type 790531 for thread 2632
MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (86) of type 790531 for thread 2632
DIFXAPP: 'CustomActionData' property 'DIFxApp Version' is 2.1.
MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (86) of type 790531 for thread 2632
MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (87) of type 790531 for thread 2632
DIFXAPP: 'CustomActionData' property 'UI Level' is 2.
MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (87) of type 790531 for thread 2632
MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (88) of type 790531 for thread 2632
DIFXAPP: 'CustomActionData' property 'componentId' is {76F354A6-97D5-4872-9781-2F2642A4F18A}.
MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (88) of type 790531 for thread 2632
MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (89) of type 790531 for thread 2632
DIFXAPP: 'CustomActionData' property 'flags' is 0x15.
MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (89) of type 790531 for thread 2632
MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (90) of type 790531 for thread 2632
DIFXAPP: 'CustomActionData' property 'ProductName' is Sophos Network Threat Protection.
MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (90) of type 790531 for thread 2632
MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (91) of type 790531 for thread 2632
DIFXAPP: 'CustomActionData' property 'ManufacturerName' is Sophos Limited.
MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (91) of type 790531 for thread 2632
MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (92) of type 790531 for thread 2632
DIFXAPP: ERROR 0x2 encountered while opening persistent-info key for component '{76F354A6-97D5-4872-9781-2F2642A4F18A}'
MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (92) of type 790531 for thread 2632
MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (93) of type 790531 for thread 2632
DIFXAPP: UninstallDriverPackages failed with error 0x2
MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (93) of type 790531 for thread 2632
DIFXAPP: RETURN: UninstallDriverPackages() 2 (0x2)
MSI (s) (20:8C) [18:02:51:027]: Closing MSIHANDLE (83) of type 790536 for thread 8012
CustomAction MsiUninstallDrivers returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (20:4C) [18:02:51:027]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (20:4C) [18:02:51:027]: User policy value 'DisableRollback' is 0
MSI (s) (20:4C) [18:02:51:027]: Machine policy value 'DisableRollback' is 0
MSI (s) (20:4C) [18:02:51:027]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:042]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1380880441,LangId=1033,Platform=589824,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
MSI (s) (20:4C) [18:02:51:042]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (20:4C) [18:02:51:042]: Executing op: DialogInfo(Type=1,Argument=Sophos Network Threat Protection)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70f8.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70f9.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70fa.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70fb.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70fc.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70fd.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70fe.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70ff.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7100.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7101.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7102.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7103.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7104.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7105.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7106.rbf)
MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7107.rbf)
Action ended 18:02:51: InstallFinalize. Return value 3.
MSI (s) (20:4C) [18:02:51:042]: Executing op: ActionStart(Name=MsiUninstallDrivers,,)
MSI (s) (20:4C) [18:02:51:042]: Executing op: ProductInfo(ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductName=Sophos Network Threat Protection,PackageName=Sophos Network Threat Protection.msi,Language=1033,Version=17369275,Assignment=1,ObsoleteArg=0,ProductIcon=shield.ico,,PackageCode={0B95A4E2-4953-4CE7-B8F7-53BB197E234A},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3)
MSI (s) (20:4C) [18:02:51:042]: Executing op: ActionStart(Name=RemoveFolders,Description=Removing folders,Template=Folder: [1])
MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Heartbeat\Persist\,Foreign=0,SecurityDescriptor=BinaryData,)
MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Heartbeat\Logs\,Foreign=0,SecurityDescriptor=BinaryData,)
MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Heartbeat\Config\,Foreign=0,SecurityDescriptor=BinaryData,)
MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Heartbeat\,Foreign=0,SecurityDescriptor=BinaryData,)
MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\,Foreign=0,SecurityDescriptor=BinaryData,)
MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\,Foreign=0,SecurityDescriptor=BinaryData,)
MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\,Foreign=0,SecurityDescriptor=BinaryData,)
MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\,Foreign=0,SecurityDescriptor=BinaryData,)
MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\,Foreign=0,SecurityDescriptor=BinaryData,)
MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\,Foreign=0,SecurityDescriptor=BinaryData,)
MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:042]: Error in rollback skipped. Return: 3
Info 1926.Could not set file security for file 'C:\Program Files\Sophos\'. Error: 0. Verify that you have sufficient privileges to modify the security permissions for this file.
MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\,Foreign=0,SecurityDescriptor=BinaryData,)
MSI (s) (20:4C) [18:02:51:042]: Executing op: ActionStart(Name=RemoveFiles,Description=Removing files,Template=File: [1], Directory: [9])
MSI (s) (20:4C) [18:02:51:042]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\)
MSI (s) (20:4C) [18:02:51:042]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7107.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man,Attributes=32800,FileSize=17080,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:042]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:042]: Verifying accessibility of file: 5e8d7107.rbf
MSI (s) (20:4C) [18:02:51:058]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:058]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7106.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.cat,Attributes=32800,FileSize=19854,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:058]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.cat; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:058]: Verifying accessibility of file: 5e8d7106.rbf
MSI (s) (20:4C) [18:02:51:058]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:058]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7105.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.inf,Attributes=32800,FileSize=1825,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:058]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.inf; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:058]: Verifying accessibility of file: 5e8d7105.rbf
MSI (s) (20:4C) [18:02:51:058]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:058]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7104.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\sof.dat,Attributes=32800,FileSize=2916,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:058]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\sof.dat; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:058]: Verifying accessibility of file: 5e8d7104.rbf
MSI (s) (20:4C) [18:02:51:058]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:058]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7103.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\scf.dat,Attributes=32800,FileSize=2884,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:058]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\scf.dat; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:058]: Verifying accessibility of file: 5e8d7103.rbf
MSI (s) (20:4C) [18:02:51:058]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:058]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7102.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe,Attributes=32800,FileSize=454080,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:058]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:058]: Verifying accessibility of file: 5e8d7102.rbf
MSI (s) (20:4C) [18:02:51:089]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:089]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7101.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\BPAIF.dll,Attributes=32800,FileSize=312728,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:089]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\BPAIF.dll; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:089]: Verifying accessibility of file: 5e8d7101.rbf
MSI (s) (20:4C) [18:02:51:089]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:089]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7100.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll,Attributes=32800,FileSize=2641728,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:089]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:089]: Verifying accessibility of file: 5e8d7100.rbf
MSI (s) (20:4C) [18:02:51:121]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:121]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70ff.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\HealthApi.dll,Attributes=32800,FileSize=323088,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:121]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\HealthApi.dll; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:121]: Verifying accessibility of file: 5e8d70ff.rbf
MSI (s) (20:4C) [18:02:51:136]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:136]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70fe.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\Notice.txt,Attributes=32800,FileSize=32245,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:136]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Notice.txt; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:136]: Verifying accessibility of file: 5e8d70fe.rbf
MSI (s) (20:4C) [18:02:51:136]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:136]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70fd.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\Heartbeat.dll,Attributes=32800,FileSize=6026256,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:136]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Heartbeat.dll; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:136]: Verifying accessibility of file: 5e8d70fd.rbf
MSI (s) (20:4C) [18:02:51:214]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:214]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70fc.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll,Attributes=32800,FileSize=1100816,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:214]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:214]: Verifying accessibility of file: 5e8d70fc.rbf
MSI (s) (20:4C) [18:02:51:230]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:230]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70fb.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe,Attributes=32800,FileSize=4927592,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:230]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:230]: Verifying accessibility of file: 5e8d70fb.rbf
MSI (s) (20:4C) [18:02:51:277]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:277]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70fa.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\integrity.dat,Attributes=32800,FileSize=4086,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:277]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\integrity.dat; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:277]: Verifying accessibility of file: 5e8d70fa.rbf
MSI (s) (20:4C) [18:02:51:292]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:292]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70f9.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\navl.dll,Attributes=32800,FileSize=10420880,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:292]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\navl.dll; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:292]: Verifying accessibility of file: 5e8d70f9.rbf
MSI (s) (20:4C) [18:02:51:402]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:402]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70f8.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys,Attributes=32800,FileSize=227152,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (20:4C) [18:02:51:402]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys; To be installed; Won't patch; No existing file
MSI (s) (20:4C) [18:02:51:402]: Verifying accessibility of file: 5e8d70f8.rbf
MSI (s) (20:4C) [18:02:51:402]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:51:402]: Executing op: ActionStart(Name=RemoveRegistryValues,Description=Removing system registry values,Template=Key: [1], Name: [2])
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegRemoveKey()
MSI (s) (20:4C) [18:02:51:402]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService 3: 2
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry\MTD,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry\Heartbeat,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Application,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegAddValue(Name=Path,Value=C:\Program Files\Sophos\Sophos Network Threat Protection\,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegAddValue(Name=ProductVersion,Value=1.9.2235.0,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegAddValue(Name=ProductCode,Value={4B1F9009-CD85-43C0-BCBD-D491908D5A52},)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Telemetry\Plugins\NTP,SecurityDescriptor=BinaryData,BinaryType=0,,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegAddValue(Name=Cmd,Value=SophosNtpTelemetry.exe,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegAddValue(Name=Path,Value=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat,SecurityDescriptor=BinaryData,BinaryType=0,,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat\Status,SecurityDescriptor=BinaryData,BinaryType=0,,)
MSI (s) (20:4C) [18:02:51:402]: Executing op: ActionStart(Name=DeleteServices,Description=Deleting services,Template=Service: [1])
MSI (s) (20:4C) [18:02:51:402]: Executing op: ServiceInstall(Name=SntpService,DisplayName=Sophos Network Threat Protection,ImagePath="C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe",ServiceType=16,StartType=2,ErrorControl=1,,Dependencies=bfe[~]rpcss[~]sntp[~][~],TagId=0,StartName=NT AUTHORITY\LocalService,Password=**********,Description=Protects the computer against network-based threats.,SecurityDescriptor=BinaryData,)
MSI (s) (20:4C) [18:02:51:417]: Executing op: ActionStart(Name=UnregisterSntpEventManifest,,)
MSI (s) (20:4C) [18:02:51:417]: Executing op: ActionStart(Name=UnregisterSntpEventManifestRollback,,)
MSI (s) (20:4C) [18:02:51:417]: Executing op: CustomActionRollback(Action=UnregisterSntpEventManifestRollback,ActionType=3393,Source=BinaryData,Target=WixQuietExec,CustomActionData="wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man")
MSI (s) (20:4C) [18:02:51:417]: Creating MSIHANDLE (94) of type 790536 for thread 8012
MSI (s) (20:9C) [18:02:51:417]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI71B6.tmp, Entrypoint: WixQuietExec
MSI (s) (20:9C) [18:02:51:589]: Closing MSIHANDLE (94) of type 790536 for thread 8012
MSI (s) (20:4C) [18:02:51:589]: Executing op: ActionStart(Name=RemoveSIPSSubmitterUserAccount,,)
MSI (s) (20:4C) [18:02:51:589]: Executing op: ActionStart(Name=RemoveSIPSSubmitterUserAccountRollback,,)
MSI (s) (20:4C) [18:02:51:589]: Executing op: CustomActionRollback(Action=RemoveSIPSSubmitterUserAccountRollback,ActionType=1281,Source=BinaryData,Target=AddSIPSManagementUser,CustomActionData=NT SERVICE\SntpService)
MSI (s) (20:4C) [18:02:51:605]: Creating MSIHANDLE (95) of type 790536 for thread 8012
MSI (s) (20:DC) [18:02:51:605]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7263.tmp, Entrypoint: AddSIPSManagementUser
MSI (s) (20!14) [18:02:51:605]: Creating MSIHANDLE (96) of type 790531 for thread 1044
MSI (s) (20!14) [18:02:51:605]: Closing MSIHANDLE (96) of type 790531 for thread 1044
MSI (s) (20!14) [18:02:51:605]: Creating MSIHANDLE (97) of type 790531 for thread 1044
AddSIPSManagementUser Enter (234)
MSI (s) (20!14) [18:02:51:605]: Closing MSIHANDLE (97) of type 790531 for thread 1044
MSI (s) (20:DC) [18:02:51:605]: Closing MSIHANDLE (95) of type 790536 for thread 8012
AddSIPSManagementUser Exit (283)
MSI (s) (20:4C) [18:02:51:605]: Executing op: ActionStart(Name=CleanUpSsspUserAccount,,)
MSI (s) (20:4C) [18:02:51:605]: Executing op: ActionStart(Name=CleanUpSsspUserAccountRollback,,)
MSI (s) (20:4C) [18:02:51:605]: Executing op: CustomActionRollback(Action=CleanUpSsspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sntpservice)
MSI (s) (20:4C) [18:02:51:605]: Creating MSIHANDLE (98) of type 790536 for thread 8012
MSI (s) (20:44) [18:02:51:605]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7274.tmp, Entrypoint: SetupSspUserAccount
MSI (s) (20!5C) [18:02:51:620]: Creating MSIHANDLE (99) of type 790531 for thread 6492
MSI (s) (20!5C) [18:02:51:620]: Closing MSIHANDLE (99) of type 790531 for thread 6492
MSI (s) (20!5C) [18:02:51:745]: Creating MSIHANDLE (100) of type 790531 for thread 6492
SetupSspUserAccount: Initialized.
MSI (s) (20!5C) [18:02:51:745]: Closing MSIHANDLE (100) of type 790531 for thread 6492
MSI (s) (20!5C) [18:02:51:745]: Creating MSIHANDLE (101) of type 790531 for thread 6492
SetupSspUserAccount: OLDUSERGROUP does not exist - not adding permissions
MSI (s) (20!5C) [18:02:51:745]: Closing MSIHANDLE (101) of type 790531 for thread 6492
MSI (s) (20:44) [18:02:51:761]: Closing MSIHANDLE (98) of type 790536 for thread 8012
SetupSspUserAccount: Granting permissions to user "NT SERVICE\sntpservice"
MSI (s) (20:4C) [18:02:51:761]: Executing op: ActionStart(Name=UninstallSophosNTPLWF,,)
MSI (s) (20:4C) [18:02:51:761]: Executing op: ActionStart(Name=StopServices,Description=Stopping services,Template=Service: [1])
MSI (s) (20:4C) [18:02:51:761]: Executing op: ServiceControl(,Name=SntpService,Action=1,Wait=1,)
MSI (s) (20:4C) [18:02:52:839]: Executing op: ActionStart(Name=UnregisterManagementAdapter,,)
MSI (s) (20:4C) [18:02:52:839]: Executing op: ActionStart(Name=UnregisterManagementAdapterRollback,,)
MSI (s) (20:4C) [18:02:52:839]: Executing op: CustomActionRollback(Action=UnregisterManagementAdapterRollback,ActionType=1345,Source=BinaryData,Target=RegisterManagementAdapter,CustomActionData=C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll)
MSI (s) (20:4C) [18:02:52:839]: Creating MSIHANDLE (102) of type 790536 for thread 8012
MSI (s) (20:84) [18:02:52:839]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7747.tmp, Entrypoint: RegisterManagementAdapter
MSI (s) (20!68) [18:02:52:855]: Creating MSIHANDLE (103) of type 790531 for thread 9576
MSI (s) (20!68) [18:02:52:855]: Closing MSIHANDLE (103) of type 790531 for thread 9576
MSI (s) (20!68) [18:02:52:855]: Creating MSIHANDLE (104) of type 790531 for thread 9576
RegisterManagementAdapter: RegisterManagementAdapter called
MSI (s) (20!68) [18:02:52:855]: Closing MSIHANDLE (104) of type 790531 for thread 9576
MSI (s) (20!68) [18:02:52:855]: Creating MSIHANDLE (105) of type 790531 for thread 9576
RegisterManagementAdapter: Adapter = NTP: C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll
MSI (s) (20!68) [18:02:52:855]: Closing MSIHANDLE (105) of type 790531 for thread 9576
MSI (s) (20:84) [18:02:52:855]: Closing MSIHANDLE (102) of type 790536 for thread 8012
RegisterManagementAdapter: Management adapter successfully registered
MSI (s) (20:4C) [18:02:52:855]: Executing op: ActionStart(Name=UnregisterHbtManagementAdapter,,)
MSI (s) (20:4C) [18:02:52:855]: Executing op: ActionStart(Name=UnregisterHbtManagementAdapterRollback,,)
MSI (s) (20:4C) [18:02:52:855]: Executing op: CustomActionRollback(Action=UnregisterHbtManagementAdapterRollback,ActionType=1345,Source=BinaryData,Target=RegisterHbtManagementAdapter,CustomActionData=C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll)
MSI (s) (20:4C) [18:02:52:855]: Creating MSIHANDLE (106) of type 790536 for thread 8012
MSI (s) (20:24) [18:02:52:855]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7758.tmp, Entrypoint: RegisterHbtManagementAdapter
MSI (s) (20!88) [18:02:52:870]: Creating MSIHANDLE (107) of type 790531 for thread 9864
MSI (s) (20!88) [18:02:52:870]: Closing MSIHANDLE (107) of type 790531 for thread 9864
MSI (s) (20!88) [18:02:52:870]: Creating MSIHANDLE (108) of type 790531 for thread 9864
RegisterManagementAdapter: RegisterManagementAdapter called
MSI (s) (20!88) [18:02:52:870]: Closing MSIHANDLE (108) of type 790531 for thread 9864
MSI (s) (20!88) [18:02:52:870]: Creating MSIHANDLE (109) of type 790531 for thread 9864
RegisterManagementAdapter: Adapter = HBT: C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll
MSI (s) (20!88) [18:02:52:870]: Closing MSIHANDLE (109) of type 790531 for thread 9864
MSI (s) (20:24) [18:02:52:870]: Closing MSIHANDLE (106) of type 790536 for thread 8012
RegisterManagementAdapter: Management adapter successfully registered
MSI (s) (20:4C) [18:02:52:870]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
MSI (s) (20:4C) [18:02:52:870]: Executing op: CustomActionRollback(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
MSI (s) (20:4C) [18:02:52:870]: Creating MSIHANDLE (110) of type 790536 for thread 8012
MSI (s) (20:C4) [18:02:52:886]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7768.tmp, Entrypoint: ExecSecureObjectsRollback
MSI (s) (20:C4) [18:02:52:886]: Closing MSIHANDLE (110) of type 790536 for thread 8012
MSI (s) (20:4C) [18:02:52:886]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
MSI (s) (20:4C) [18:02:52:886]: Executing op: CustomActionRollback(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
MSI (s) (20:4C) [18:02:52:886]: Creating MSIHANDLE (111) of type 790536 for thread 8012
MSI (s) (20:18) [18:02:52:886]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7779.tmp, Entrypoint: ExecSecureObjectsRollback
MSI (s) (20:18) [18:02:52:901]: Closing MSIHANDLE (111) of type 790536 for thread 8012
MSI (s) (20:4C) [18:02:52:901]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
MSI (s) (20:4C) [18:02:52:901]: Executing op: CustomActionRollback(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
MSI (s) (20:4C) [18:02:52:901]: Creating MSIHANDLE (112) of type 790536 for thread 8012
MSI (s) (20:04) [18:02:52:901]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI778A.tmp, Entrypoint: ExecSecureObjectsRollback
MSI (s) (20:04) [18:02:52:917]: Closing MSIHANDLE (112) of type 790536 for thread 8012
MSI (s) (20:4C) [18:02:52:917]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
MSI (s) (20:4C) [18:02:52:917]: Executing op: CustomActionRollback(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
MSI (s) (20:4C) [18:02:52:917]: Creating MSIHANDLE (113) of type 790536 for thread 8012
MSI (s) (20:1C) [18:02:52:917]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI779A.tmp, Entrypoint: ExecSecureObjectsRollback
MSI (s) (20:1C) [18:02:52:933]: Closing MSIHANDLE (113) of type 790536 for thread 8012
MSI (s) (20:4C) [18:02:52:933]: Executing op: ActionStart(Name=UnpublishFeatures,Description=Unpublishing Product Features,Template=Feature: [1])
MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\Features,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:933]: Executing op: RegAddValue(Name=AllComponents,Value=@p{P%*BW1=zd&z]$)mJsdaW[qjB%Y@U4ZzjvKD[5OsJv@s}cJ=1oT4'~aF~4CQXZM}~YD=K6f.8uiFmqd,Xcv8TA_@VbUBW=+!`T%nnV0vM_d9sEnaMsf]&GlD$QUD{d49sg^P!D(ceJiKkS)R0[+AZ!s1-[w=,A6.YbZ3{ss=JEohg_[p2i8w+l98ljZ?~=1vSw1@Rb4dZ7NP)4@?Ay3?02Rl`TRfq'zN,GK@vS'}KY[htxv%v05IXn_AO3,LR+RiW5?B,P*E21a9U[TiuMN_Upq)D26Y?%.9S)}_R4*WyYsY(gU,`eg=gKq@xBGEO(!Er)d%fi$=MA=~W3(2ru}Bhqp$+W1=1!z7OkB7ULd_*5ATP2r=0iFt=RAXOhfI)zHg2_y8x,@]-~5&T_DI6xBNcJEAusiiK'M1{=`Z{{cQL&_9mRpGI0qTe78f`d9~7Zy=A!C`^NHWEqA?u_ljl9e@6]gb@m*7n-F0p6-acr5?!O(=7Jl~_]RT$+fEcA3==X[i?MRDY2dmLeda@S=@3Gw]nbS$@ZL67bKoECp=)rPpn?oAJ(}f_mFWDe^9FoNyCexjS6Pt8m+6=Ld@rqk,J59'm.iy%{OBC6_=mqN0zSy_CKZL,?MY1.M==wExHp,N$jwf@_%sbe2Au(qh3f62HtpO'DMliL@9C'V[VqeV?fJ[7'H?Q~PAYa$-TR,SwJ+Skorl$F*@hZ~fPvko[S5W(}CCJ^c@h2e2Q1wj{6('3f)giZc@F=6^fRo9h6,)
MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Features\9009F1B458DC0C34CBDB4D1909D8A525,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:933]: Executing op: RegRemoveKey()
MSI (s) (20:4C) [18:02:52:933]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\9009F1B458DC0C34CBDB4D1909D8A525 3: 2
MSI (s) (20:4C) [18:02:52:933]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,)
MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=0,,)
MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=0,,)
MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=0,,)
MSI (s) (20:4C) [18:02:52:933]: Executing op: ComponentRegister(ComponentId={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},KeyPath=C:\Windows\system32\vccorlib120.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=1)
MSI (s) (20:4C) [18:02:52:933]: Executing op: ComponentRegister(ComponentId={570C624B-D57C-4CD1-9013-1B80C800093B},KeyPath=C:\Windows\system32\msvcp120.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=1)
MSI (s) (20:4C) [18:02:52:933]: Executing op: ComponentRegister(ComponentId={E5B92048-5859-4AF1-AEAD-B97EBF00B087},KeyPath=C:\Windows\system32\msvcr120.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=1)
MSI (s) (20:4C) [18:02:52:933]: Executing op: ComponentRegister(ComponentId={63B83B20-1AB9-4F49-B0B2-4489724CA96C},KeyPath=C:\Windows\SysWOW64\vccorlib120.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=0)
MSI (s) (20:4C) [18:02:52:933]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\vccorlib120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
MSI (s) (20:4C) [18:02:52:933]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\vccorlib120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
MSI (s) (20:4C) [18:02:52:933]: Executing op: RegisterSharedComponentProvider(,,,Component={63B83B20-1AB9-4F49-B0B2-4489724CA96C},,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,,,,,)
MSI (s) (20:4C) [18:02:52:933]: Executing op: ComponentRegister(ComponentId={74260D9F-D644-423B-B2D4-0291EA4BA8BE},KeyPath=C:\Windows\SysWOW64\msvcp120.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=0)
MSI (s) (20:4C) [18:02:52:933]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcp120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
MSI (s) (20:4C) [18:02:52:933]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcp120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
MSI (s) (20:4C) [18:02:52:933]: Executing op: RegisterSharedComponentProvider(,,,Component={74260D9F-D644-423B-B2D4-0291EA4BA8BE},,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,,,,,)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={0835C947-D6D2-4E52-AF14-0231D04E88EA},KeyPath=C:\Windows\SysWOW64\msvcr120.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=0)
MSI (s) (20:4C) [18:02:52:948]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcr120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
MSI (s) (20:4C) [18:02:52:948]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcr120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
MSI (s) (20:4C) [18:02:52:948]: Executing op: RegisterSharedComponentProvider(,,,Component={0835C947-D6D2-4E52-AF14-0231D04E88EA},,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,,,,,)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={73F7BF07-5A6C-45CF-B42D-786698434BCA},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\sof.dat,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={7C58F223-7247-466F-BFB7-7AFCF335E96D},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\scf.dat,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={1B63A9FF-509B-4CD9-BA54-256A7D62B724},KeyPath=C:\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=0)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={5FDACC4C-306D-434E-8DF0-F356318B9B39},KeyPath=02:\Software\Sophos\Telemetry\Plugins\NTP\Path,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=0)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={6EFE6551-BEDB-470F-9B98-4DD9D50BD010},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={B9C8E32A-5EB9-4B7F-91AF-9FD883FB729C},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\BPAIF.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=1)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={BE16C094-CC09-4502-8856-ED495E915D2D},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={1FCDB37D-595F-4837-919B-EC3B0753CEA3},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\HealthApi.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={D27928F9-1751-4CE1-817A-C94C9DDFA521},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\Notice.txt,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1},KeyPath=C:\ProgramData\Sophos\Heartbeat\Config\Heartbeat.xml,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={B77F9317-494B-4351-897B-D7676F0A553D},KeyPath=C:\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={53CBCC30-891C-4EDC-9106-456F524A7547},KeyPath=C:\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=0)
MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={668853A5-00CE-412E-B21F-0721B6A8A0A9},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\Heartbeat.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={4E691ABE-115D-4721-9F9A-3547D17077C5},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={DF927ABB-6A5F-44F2-A430-137AAC79AA71},KeyPath=22:\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={B7D2E43B-E8A6-4483-9BF7-5195F70225EF},,State=-7,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={8E48EE2F-1444-46BF-BCD4-B5F66A4AFF10},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={38879DEA-36FA-41BE-ACF3-B084CB40689B},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={173F7C99-1A05-4365-B40A-D4EE897D94DE},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\integrity.dat,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={355DC0F9-A6B5-4FCA-8121-00847E59A436},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\navl.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={FC337C28-D909-4BF7-826A-F06F35C592F8},,State=-7,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={43CBB64E-B6FD-496B-8B4D-9D8842C8E5B2},KeyPath=C:\ProgramData\Sophos\Heartbeat\Persist\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={9DAD77F9-1B7B-4731-8A40-3EC32A42ACC7},KeyPath=C:\ProgramData\Sophos\Heartbeat\Logs\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={14456086-9032-4E19-9F29-9F1F9DD21F4E},KeyPath=C:\ProgramData\Sophos\Heartbeat\Config\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={8D83ACDA-6DCE-41F3-B5C1-7C01BD45026C},KeyPath=C:\ProgramData\Sophos\Heartbeat\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={270CF92A-C3C0-4385-B596-337555FE9560},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={F1B8B8D7-46D7-4CA9-B109-35931536EA8A},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={74F91047-4C42-457F-B531-A83EF6EC85E2},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={4D81D62C-8373-45B8-ABF2-0C0D6ED2DE34},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:979]: Executing op: ComponentRegister(ComponentId={E1E87C49-DD4A-4C77-8D42-3ACD20DBC536},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:979]: Executing op: ComponentRegister(ComponentId={07B90057-705F-44F2-8465-C2A4C77784E7},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
MSI (s) (20:4C) [18:02:52:979]: Executing op: ActionStart(Name=InstallInitialize,,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525\SourceList,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegRemoveKey()
MSI (s) (20:4C) [18:02:52:979]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525\SourceList 3: 2
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegRemoveKey()
MSI (s) (20:4C) [18:02:52:979]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525 3: 2
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegRemoveValue(Name=C:\WINDOWS\Installer\{4B1F9009-CD85-43C0-BCBD-D491908D5A52}\shield.ico,Value=#1,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\UpgradeCodes\D396FC6A171C5FD4EA9422B3666FA5A1,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=9009F1B458DC0C34CBDB4D1909D8A525,,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Features\9009F1B458DC0C34CBDB4D1909D8A525,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=AllComponents,,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Features\9009F1B458DC0C34CBDB4D1909D8A525,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=AdvertiseFlags,Value=#388,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=Assignment,Value=#1,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=AuthorizedLUAApp,Value=#0,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=Clients,Value=[~]:[~],)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=DeploymentFlags,Value=#3,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=InstanceType,Value=#0,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=Language,Value=#1033,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=PackageCode,Value=2E4A59B035947EC48B7F35BB91E732A4,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=ProductIcon,Value=C:\WINDOWS\Installer\{4B1F9009-CD85-43C0-BCBD-D491908D5A52}\shield.ico,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=ProductName,Value=Sophos Network Threat Protection,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=Version,Value=#17369275,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525\SourceList,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=LastUsedSource,Value=#%n;1;C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=PackageName,Value=Sophos Network Threat Protection.msi,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525\SourceList\Net,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=1,Value=#%C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525\SourceList\Media,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=1,Value=;,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Uninstall\{4B1F9009-CD85-43C0-BCBD-D491908D5A52},SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=DisplayName,Value=Sophos Network Threat Protection,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\InstallProperties,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=DisplayName,Value=Sophos Network Threat Protection,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\InstallProperties,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\Usage,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegRemoveKey()
MSI (s) (20:4C) [18:02:52:995]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\Usage 3: 2
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\Usage,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\D396FC6A171C5FD4EA9422B3666FA5A1,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=9009F1B458DC0C34CBDB4D1909D8A525,,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Uninstall\{4B1F9009-CD85-43C0-BCBD-D491908D5A52},SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=Language,Value=#1033,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=Version,Value=#17369275,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=WindowsInstaller,Value=#1,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=VersionMinor,Value=#9,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=VersionMajor,Value=#1,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=URLUpdateInfo,Value=www.sophos.com/.../updates,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=URLInfoAbout,Value=http://www.sophos.com/,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=UninstallString,Value=#%MsiExec.exe /X{4B1F9009-CD85-43C0-BCBD-D491908D5A52},)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=SystemComponent,Value=#1,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=EstimatedSize,Value=#29481,)
MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=Size,,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Readme,,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Publisher,Value=Sophos Limited,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=NoRepair,Value=#1,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=NoModify,Value=#1,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=ModifyPath,Value=#%MsiExec.exe /X{4B1F9009-CD85-43C0-BCBD-D491908D5A52},)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=InstallSource,Value=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=InstallLocation,,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=InstallDate,Value=20200515,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=HelpTelephone,,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=HelpLink,Value=#%www.sophos.com/.../,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=DisplayVersion,Value=1.9.2235.0,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Contact,Value=Sophos Technical Support,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Comments,Value=Network threat protection,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=AuthorizedCDFPrefix,,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\InstallProperties,SecurityDescriptor=BinaryData,BinaryType=1,,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Language,Value=#1033,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Version,Value=#17369275,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=WindowsInstaller,Value=#1,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=VersionMinor,Value=#9,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=VersionMajor,Value=#1,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=URLUpdateInfo,Value=www.sophos.com/.../updates,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=URLInfoAbout,Value=http://www.sophos.com/,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=UninstallString,Value=#%MsiExec.exe /X{4B1F9009-CD85-43C0-BCBD-D491908D5A52},)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=SystemComponent,Value=#1,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=EstimatedSize,Value=#29481,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Size,,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Readme,,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Publisher,Value=Sophos Limited,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=NoRepair,Value=#1,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=NoModify,Value=#1,)
MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=ModifyPath,Value=#%MsiExec.exe /X{4B1F9009-CD85-43C0-BCBD-D491908D5A52},)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=LocalPackage,Value=C:\WINDOWS\Installer\4978e5.msi,)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegCreateKey()
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=InstallSource,Value=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\,)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=InstallLocation,,)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=InstallDate,Value=20200515,)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=HelpTelephone,,)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=HelpLink,Value=#%www.sophos.com/.../,)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=DisplayVersion,Value=1.9.2235.0,)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=Contact,Value=Sophos Technical Support,)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=Comments,Value=Network threat protection,)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=AuthorizedCDFPrefix,,)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegRemoveValue(Name=C:\WINDOWS\Installer\4978e5.msi,Value=#0,)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegRemoveKey()
MSI (s) (20:4C) [18:02:53:026]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages 3: 2
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\Transforms,,BinaryType=1,,)
MSI (s) (20:4C) [18:02:53:026]: Executing op: RegRemoveKey()
MSI (s) (20:4C) [18:02:53:026]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\Transforms 3: 2
MSI (s) (20:4C) [18:02:53:026]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (20:4C) [18:02:53:026]: Error in rollback skipped. Return: 5
MSI (s) (20:4C) [18:02:53:026]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:53:026]: Note: 1: 2318 2:
MSI (s) (20:4C) [18:02:53:026]: No System Restore sequence number for this installation.
MSI (s) (20:4C) [18:02:53:026]: Unlocking Server
MSI (s) (20:4C) [18:02:53:026]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 18:02:53: INSTALL. Return value 3.
Property(N): UpgradeCode = {A6CF693D-C171-4DF5-AE49-223B66F65A1A}
Property(N): INSTALLTYPE_IS_CENTRAL = #1
Property(N): INSTALLDIR = C:\Program Files\Sophos\Sophos Network Threat Protection\
Property(N): ProductData = C:\ProgramData\Sophos\Sophos Network Threat Protection\
Property(N): Config = C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\
Property(N): Status = C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\
Property(N): Logs = C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\
Property(N): SnortData = C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\
Property(N): HeartbeatData = C:\ProgramData\Sophos\Heartbeat\
Property(N): HeartbeatConfig = C:\ProgramData\Sophos\Heartbeat\Config\
Property(N): HeartbeatLogs = C:\ProgramData\Sophos\Heartbeat\Logs\
Property(N): HeartbeatPersist = C:\ProgramData\Sophos\Heartbeat\Persist\
Property(N): SophosNTPLWFDir = C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\
Property(N): TARGETDIR = C:\
Property(N): VersionNT64 = 603
Property(N): RegisterSntpEventManifest = "wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"
Property(N): RegisterSntpEventManifestRollback = "wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"
Property(N): UnregisterSntpEventManifest = "wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"
Property(N): UnregisterSntpEventManifestRollback = "wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"
Property(N): MsiUninstallDrivers = 2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}21Sophos Network Threat ProtectionSophos Limited
Property(N): UninstallSophosNTPLWF = "C:\WINDOWS\system32\\netcfg.exe" /u SOPHOS_SOPHOSNTPLWF
Property(N): ExecSecureObjectsRollback_64 = **********
Property(N): UnregisterManagementAdapterRollback = C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll
Property(N): RegisterManagementAdapter = C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll
Property(N): UnregisterHbtManagementAdapterRollback = C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll
Property(N): RegisterHbtManagementAdapter = C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll
Property(N): CleanUpSsspUserAccount = NT SERVICE\sntpservice
Property(N): CleanUpSsspUserAccountRollback = NT SERVICE\sntpservice
Property(N): RemoveSIPSSubmitterUserAccount = NT SERVICE\SntpService
Property(N): RemoveSIPSSubmitterUserAccountRollback = NT SERVICE\SntpService
Property(N): plugins = C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\
Property(N): SnortDynModulesDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\
Property(N): SnortPreProcDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\
Property(N): SnortConfDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\
Property(N): Sophos = C:\Program Files\Sophos\
Property(N): ProgramFiles64Folder = C:\Program Files\
Property(N): SophosAppData = C:\ProgramData\Sophos\
Property(N): CommonAppDataFolder = C:\ProgramData\
Property(N): VersionNT = 603
Property(N): Installed = 00:00:00
Property(N): ALLUSERS = 1
Property(N): MSIRESTARTMANAGERCONTROL = Disable
Property(N): ARPCOMMENTS = Network threat protection
Property(N): ARPCONTACT = Sophos Technical Support
Property(N): ARPHELPLINK = http://www.sophos.com/support/
Property(N): ARPNOMODIFY = 1
Property(N): ARPNOREPAIR = 1
Property(N): ARPPRODUCTICON = shield.ico
Property(N): ARPURLINFOABOUT = http://www.sophos.com/
Property(N): ARPURLUPDATEINFO = www.sophos.com/.../updates
Property(N): Manufacturer = Sophos Limited
Property(N): ProductCode = {4B1F9009-CD85-43C0-BCBD-D491908D5A52}
Property(N): ProductLanguage = 1033
Property(N): ProductName = Sophos Network Threat Protection
Property(N): ProductVersion = 1.9.2235.0
Property(N): RegisterWithAutoUpdate = {8087796B-2289-4897-98A5-58FF23DAAFD0};ntp64
Property(N): SecureCustomProperties = WIX_DOWNGRADE_DETECTED;WIX_UPGRADE_DETECTED
Property(N): MsiHiddenProperties = ExecSecureObjects_64;ExecSecureObjectsRollback_64
Property(N): INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 = C:\
Property(N): SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA = C:\Windows\SysWOW64\
Property(N): SystemFolder = C:\WINDOWS\SysWOW64\
Property(N): DirectoryTable100_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA = DirectoryTable
Property(N): System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C = C:\Windows\system32\
Property(N): System64Folder = C:\WINDOWS\system32\
Property(N): DirectoryTable100_amd64.05F0B5F5_44A8_3793_976B_A4F17AECF92C = DirectoryTable
Property(N): PackageCode = {0B95A4E2-4953-4CE7-B8F7-53BB197E234A}
Property(N): ProductState = 5
Property(N): UPGRADINGPRODUCTCODE = {2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}
Property(N): CLIENTPROCESSID = 1012
Property(N): CLIENTUILEVEL = 3
Property(N): MSICLIENTUSESEXTERNALUI = 1
Property(N): REMOVE = ALL
Property(N): MsiSystemRebootPending = 1
Property(N): PRODUCTLANGUAGE = 1033
Property(N): VersionDatabase = 405
Property(N): VersionMsi = 5.00
Property(N): WindowsBuild = 9600
Property(N): ServicePackLevel = 0
Property(N): ServicePackLevelMinor = 0
Property(N): MsiNTProductType = 1
Property(N): WindowsFolder = C:\WINDOWS\
Property(N): WindowsVolume = C:\
Property(N): RemoteAdminTS = 1
Property(N): TempFolder = C:\WINDOWS\TEMP\
Property(N): ProgramFilesFolder = C:\Program Files (x86)\
Property(N): CommonFilesFolder = C:\Program Files (x86)\Common Files\
Property(N): CommonFiles64Folder = C:\Program Files\Common Files\
Property(N): AppDataFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\
Property(N): FavoritesFolder = C:\WINDOWS\system32\config\systemprofile\Favorites\
Property(N): NetHoodFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\
Property(N): PersonalFolder = C:\WINDOWS\system32\config\systemprofile\Documents\
Property(N): PrintHoodFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\
Property(N): RecentFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\
Property(N): SendToFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\
Property(N): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\
Property(N): LocalAppDataFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Local\
Property(N): MyPicturesFolder = C:\WINDOWS\system32\config\systemprofile\Pictures\
Property(N): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\
Property(N): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Property(N): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
Property(N): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\
Property(N): DesktopFolder = C:\Users\Public\Desktop\
Property(N): FontsFolder = C:\WINDOWS\Fonts\
Property(N): GPTSupport = 1
Property(N): OLEAdvtSupport = 1
Property(N): ShellAdvtSupport = 1
Property(N): MsiAMD64 = 6
Property(N): Msix64 = 6
Property(N): Intel = 6
Property(N): PhysicalMemory = 8074
Property(N): VirtualMemory = 5598
Property(N): AdminUser = 1
Property(N): MsiTrueAdminUser = 1
Property(N): LogonUser = SYSTEM
Property(N): UserSID = S-1-5-18
Property(N): UserLanguageID = 1033
Property(N): ComputerName = PBC-1ZHCPN2-LT
Property(N): SystemLanguageID = 1033
Property(N): ScreenX = 1024
Property(N): ScreenY = 768
Property(N): CaptionHeight = 19
Property(N): BorderTop = 1
Property(N): BorderSide = 1
Property(N): TextHeight = 16
Property(N): TextInternalLeading = 3
Property(N): ColorBits = 32
Property(N): TTCSupport = 1
Property(N): Time = 18:02:53
Property(N): Date = 2/14/2021
Property(N): MsiNetAssemblySupport = 4.8.4084.0
Property(N): MsiWin32AssemblySupport = 6.3.19041.546
Property(N): RedirectedDllSupport = 2
Property(N): MsiRunningElevated = 1
Property(N): Privileged = 1
Property(N): USERNAME = PBC-COM
Property(N): COMPANYNAME = COMPHX
Property(N): DATABASE = C:\WINDOWS\Installer\4978e5.msi
Property(N): OriginalDatabase = C:\WINDOWS\Installer\4978e5.msi
Property(N): UILevel = 2
Property(N): Preselected = 1
Property(N): ACTION = INSTALL
Property(N): ROOTDRIVE = C:\
Property(N): CostingComplete = 1
Property(N): OutOfDiskSpace = 0
Property(N): OutOfNoRbDiskSpace = 0
Property(N): PrimaryVolumeSpaceAvailable = 0
Property(N): PrimaryVolumeSpaceRequired = 0
Property(N): PrimaryVolumeSpaceRemaining = 0
MSI (s) (20:4C) [18:02:53:042]: Closing MSIHANDLE (2) of type 790542 for thread 8012
Property(N): INSTALLLEVEL = 1
CustomAction returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (20:00) [18:02:53:042]: Note: 1: 2205 2: 3: Control
Action ended 18:02:53: RemoveExistingProducts. Return value 3.
Action ended 18:02:53: INSTALL. Return value 3.
Property(S): UpgradeCode = {A6CF693D-C171-4DF5-AE49-223B66F65A1A}
Property(S): INSTALLTYPE_IS_CENTRAL = #1
Property(S): INSTALLDIR = C:\Program Files\Sophos\Sophos Network Threat Protection\
Property(S): ProductData = C:\ProgramData\Sophos\Sophos Network Threat Protection\
Property(S): Config = C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\
Property(S): Status = C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\
Property(S): Logs = C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\
Property(S): SnortData = C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\
Property(S): HeartbeatData = C:\ProgramData\Sophos\Heartbeat\
Property(S): HeartbeatConfig = C:\ProgramData\Sophos\Heartbeat\Config\
Property(S): HeartbeatLogs = C:\ProgramData\Sophos\Heartbeat\Logs\
Property(S): HeartbeatPersist = C:\ProgramData\Sophos\Heartbeat\Persist\
Property(S): SophosNTPLWFDir = C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\
Property(S): TARGETDIR = C:\
Property(S): VersionNT64 = 603
Property(S): SnortDynModulesDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\
Property(S): SnortPreProcDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\
Property(S): SnortConfDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\
Property(S): plugins = C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\
Property(S): Sophos = C:\Program Files\Sophos\
Property(S): ProgramFiles64Folder = C:\Program Files\
Property(S): SophosAppData = C:\ProgramData\Sophos\
Property(S): CommonAppDataFolder = C:\ProgramData\
Property(S): VersionNT = 603
Property(S): ALLUSERS = 1
Property(S): MSIRESTARTMANAGERCONTROL = Disable
Property(S): ARPCOMMENTS = Network threat protection
Property(S): ARPCONTACT = Sophos Technical Support
Property(S): ARPHELPLINK = http://www.sophos.com/support/
Property(S): ARPNOMODIFY = 1
Property(S): ARPNOREPAIR = 1
Property(S): ARPPRODUCTICON = shield.ico
Property(S): ARPURLINFOABOUT = http://www.sophos.com/
Property(S): ARPURLUPDATEINFO = www.sophos.com/.../updates
Property(S): Manufacturer = Sophos Limited
Property(S): ProductCode = {2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}
Property(S): ProductLanguage = 1033
Property(S): ProductName = Sophos Network Threat Protection
Property(S): ProductVersion = 1.11.194.0
Property(S): RegisterWithAutoUpdate = {8087796B-2289-4897-98A5-58FF23DAAFD0};ntp64
Property(S): SecureCustomProperties = WIX_DOWNGRADE_DETECTED;WIX_UPGRADE_DETECTED
Property(S): MsiHiddenProperties = ExecSecureObjects_64;ExecSecureObjectsRollback_64
Property(S): WIX_UPGRADE_DETECTED = {4B1F9009-CD85-43C0-BCBD-D491908D5A52}
Property(S): INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 = C:\
Property(S): SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA = C:\WINDOWS\SysWOW64\
Property(S): SystemFolder = C:\WINDOWS\SysWOW64\
Property(S): DirectoryTable100_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA = DirectoryTable
Property(S): System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C = C:\WINDOWS\system32\
Property(S): System64Folder = C:\WINDOWS\system32\
Property(S): DirectoryTable100_amd64.05F0B5F5_44A8_3793_976B_A4F17AECF92C = DirectoryTable
Property(S): MsiLogFileLocation = C:\WINDOWS\TEMP\Sophos Network Threat Protection Install Log 20210214 180145.txt
Property(S): PackageCode = {BDBDC64C-EB88-4135-BD3F-FE19CA9893E3}
Property(S): ProductState = -1
Property(S): PackagecodeChanging = 1
Property(S): REBOOT = ReallySuppress
Property(S): INSTALLINGVERSION = 1.11.194.0
Property(S): ARPSYSTEMCOMPONENT = 1
Property(S): CURRENTDIRECTORY = C:\WINDOWS\system32
Property(S): CLIENTUILEVEL = 3
Property(S): MSICLIENTUSESEXTERNALUI = 1
Property(S): CLIENTPROCESSID = 1012
Property(S): MsiSystemRebootPending = 1
Property(S): VersionDatabase = 405
Property(S): VersionMsi = 5.00
Property(S): WindowsBuild = 9600
Property(S): ServicePackLevel = 0
Property(S): ServicePackLevelMinor = 0
Property(S): MsiNTProductType = 1
Property(S): WindowsFolder = C:\WINDOWS\
Property(S): WindowsVolume = C:\
Property(S): RemoteAdminTS = 1
Property(S): TempFolder = C:\WINDOWS\TEMP\
Property(S): ProgramFilesFolder = C:\Program Files (x86)\
Property(S): CommonFilesFolder = C:\Program Files (x86)\Common Files\
Property(S): CommonFiles64Folder = C:\Program Files\Common Files\
Property(S): AppDataFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\
Property(S): FavoritesFolder = C:\WINDOWS\system32\config\systemprofile\Favorites\
Property(S): NetHoodFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\
Property(S): PersonalFolder = C:\WINDOWS\system32\config\systemprofile\Documents\
Property(S): PrintHoodFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\
Property(S): RecentFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\
Property(S): SendToFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\
Property(S): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\
Property(S): LocalAppDataFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Local\
Property(S): MyPicturesFolder = C:\WINDOWS\system32\config\systemprofile\Pictures\
Property(S): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\
Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Property(S): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
Property(S): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\
Property(S): DesktopFolder = C:\Users\Public\Desktop\
Property(S): FontsFolder = C:\WINDOWS\Fonts\
Property(S): GPTSupport = 1
Property(S): OLEAdvtSupport = 1
Property(S): ShellAdvtSupport = 1
Property(S): MsiAMD64 = 6
Property(S): Msix64 = 6
Property(S): Intel = 6
Property(S): PhysicalMemory = 8074
Property(S): VirtualMemory = 5605
Property(S): AdminUser = 1
Property(S): MsiTrueAdminUser = 1
Property(S): LogonUser = SYSTEM
Property(S): UserSID = S-1-5-18
Property(S): UserLanguageID = 1033
Property(S): ComputerName = PBC-1ZHCPN2-LT
Property(S): SystemLanguageID = 1033
Property(S): ScreenX = 1024
Property(S): ScreenY = 768
Property(S): CaptionHeight = 19
Property(S): BorderTop = 1
Property(S): BorderSide = 1
Property(S): TextHeight = 16
Property(S): TextInternalLeading = 3
Property(S): ColorBits = 32
Property(S): TTCSupport = 1
Property(S): Time = 18:02:53
Property(S): Date = 2/14/2021
Property(S): MsiNetAssemblySupport = 4.8.4084.0
Property(S): MsiWin32AssemblySupport = 6.3.19041.546
Property(S): RedirectedDllSupport = 2
Property(S): MsiRunningElevated = 1
Property(S): Privileged = 1
Property(S): USERNAME = PBC-COM
Property(S): COMPANYNAME = COMPHX
Property(S): DATABASE = C:\WINDOWS\Installer\5e8d70f4.msi
Property(S): OriginalDatabase = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
Property(S): UILevel = 2
Property(S): ACTION = INSTALL
Property(S): MIGRATE = {4B1F9009-CD85-43C0-BCBD-D491908D5A52}
Property(S): ROOTDRIVE = C:\
Property(S): CostingComplete = 1
Property(S): OutOfDiskSpace = 0
Property(S): OutOfNoRbDiskSpace = 0
Property(S): PrimaryVolumeSpaceAvailable = 0
Property(S): PrimaryVolumeSpaceRequired = 0
Property(S): PrimaryVolumeSpaceRemaining = 0
Property(S): INSTALLLEVEL = 1
MSI (s) (20:00) [18:02:53:058]: Note: 1: 1708
MSI (s) (20:00) [18:02:53:058]: Product: Sophos Network Threat Protection -- Installation failed.

MSI (s) (20:00) [18:02:53:058]: Windows Installer installed the product. Product Name: Sophos Network Threat Protection. Product Version: 1.11.194.0. Product Language: 1033. Manufacturer: Sophos Limited. Installation success or error status: 1603.

MSI (s) (20:00) [18:02:53:058]: Closing MSIHANDLE (1) of type 790542 for thread 8960
MSI (s) (20:00) [18:02:53:073]: Deferring clean up of packages/files, if any exist
MSI (s) (20:00) [18:02:53:073]: MainEngineThread is returning 1603
MSI (s) (20:DC) [18:02:53:073]: No System Restore sequence number for this installation.
=== Logging stopped: 2/14/2021 18:02:53 ===
MSI (s) (20:DC) [18:02:53:073]: User policy value 'DisableRollback' is 0
MSI (s) (20:DC) [18:02:53:073]: Machine policy value 'DisableRollback' is 0
MSI (s) (20:DC) [18:02:53:073]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (20:DC) [18:02:53:073]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (20:DC) [18:02:53:073]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (20:DC) [18:02:53:073]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (s) (20:DC) [18:02:53:073]: Destroying RemoteAPI object.
MSI (s) (20:78) [18:02:53:073]: Custom Action Manager thread ending.
MSI (c) (F4:3C) [18:02:53:073]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (F4:3C) [18:02:53:073]: MainEngineThread is returning 1603
=== Verbose logging stopped: 2/14/2021 18:02:53 ===

setup::MsiInstaller::installOrUpgrade: Install/upgrade returned 1603
`anonymous-namespace'::setResult: installation failed
setup::TamperProtectionControl::enable: Registered tamper protection integrity.dat for NTP
setup::TamperProtectionControl::enable: Enabled tamper protection for NTP
ProductSetup::~ProductSetup: End product setup

So am I reading this right that the tamper protection is causing the issue?
Cancel
Up 0 Down

Reply

Verify Answer

Cancel
+1 Sophos User930 16 days ago in reply to CapMReynolds

This appears to be the fatal event:

MSI (s) (20:4C) [18:02:51:011]: Executing op: ActionStart(Name=MsiUninstallDrivers,,)
MSI (s) (20:4C) [18:02:51:011]: Executing op: CustomActionSchedule(Action=MsiUninstallDrivers,ActionType=3073,Source=BinaryData,Target=UninstallDriverPackages,CustomActionData=2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}21Sophos Network Threat ProtectionSophos Limited)
MSI (s) (20:4C) [18:02:51:011]: Creating MSIHANDLE (83) of type 790536 for thread 8012
MSI (s) (20:8C) [18:02:51:011]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI701F.tmp, Entrypoint: UninstallDriverPackages
DIFXAPP: UninstallDriverPackages()
DIFXAPP: 'CustomActionData' property 'DIFxApp Version' is 2.1.
DIFXAPP: 'CustomActionData' property 'UI Level' is 2.
DIFXAPP: 'CustomActionData' property 'componentId' is {76F354A6-97D5-4872-9781-2F2642A4F18A}.
DIFXAPP: 'CustomActionData' property 'flags' is 0x15.
DIFXAPP: 'CustomActionData' property 'ProductName' is Sophos Network Threat Protection.
DIFXAPP: 'CustomActionData' property 'ManufacturerName' is Sophos Limited.
DIFXAPP: ERROR 0x2 encountered while opening persistent-info key for component '{76F354A6-97D5-4872-9781-2F2642A4F18A}'
DIFXAPP: UninstallDriverPackages failed with error 0x2
DIFXAPP: RETURN: UninstallDriverPackages() 2 (0x2)
CustomAction MsiUninstallDrivers returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

DIFX is a Microsoft Driver installer framework. Here the NTP MSI is running the MsiUninstallDrivers custom action. This appears to be failing to locate a registry key associated with the SNTP.sys driver component.

Looking at the MSI with Orca, here is the CA, it points at the code being utilized being in the standard Microsoft DIFX library DLL (can be exported from the Binary table if needed) so there isn't any specific Sophos code here to remove the driver.

I assume Googling for "difx" "UninstallDriverPackages" would return many examples of failure reason as it's quite a generic error for a common routine.

The error 2 is ERROR_FILE_NOT_FOUND. The 76F354A6-97D5-4872-9781-2F2642A4F18A component, according to the MSI log in the SNTP.sys driver, so this is the driver that is failing to uninstall.

I guess once approach is to run Process Monitor when perform an update, cross reference the new uninstall log for this custom action running and the same error code by DIFX and see the registry key (I think it's a reg key rather than a file given the name) that is not found. Maybe under: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DIFx\?

The other option might be be simply to run SophosZap - https://support.sophos.com/support/s/article/KB-000038989?language=en_US - on the computer, reboot as requested and then re-install. Does the same issue persist?

I suppose, if I had the issue on may computers, I might want to get to the bottom of it to apply a more surgical fix but if it's a one off, SophosZap as the first port of call would be my first choice.

Hope it helps.
Cancel
Up +1 Down

Reply

Reject Answer

Cancel
0 CapMReynolds 14 days ago in reply to Sophos User930

Thank you for the reply, I ended up using SophosZap remove the client and reinstall it.

As to the issue, it was due to how our SCCM task sequence was created and most likely didn't get the correct permissions at the time it was installing Sophos and some how it was still not working even when I made sure the groups/etc was completed.
Cancel
Up 0 Down

Reply

Verify Answer

Cancel

Reply

0 CapMReynolds 14 days ago in reply to Sophos User930

Thank you for the reply, I ended up using SophosZap remove the client and reinstall it.

As to the issue, it was due to how our SCCM task sequence was created and most likely didn't get the correct permissions at the time it was installing Sophos and some how it was still not working even when I made sure the groups/etc was completed.
Cancel
Up 0 Down

Reply

Verify Answer

Cancel

Children

No Data