Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 14 subscribers
  • Views 3773 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos auto update uninstalling heartbeat

CityLee's Summit

I have found several computers where sophos auto update has uninstalled sophos heartbeat. In investgating, I found this in c:\programdata\Sophos\AutoUpdate\SophosUpdate.log:

Before Uninstall:

2017-01-13T00:03:34.246Z [ 4732] INFO  WinMain =========================

2017-01-13T00:03:34.246Z [ 4732] INFO  WinMain SophosUpdate is starting.

2017-01-13T00:03:34.246Z [ 4732] INFO  WinMain AutoUpdate version      : 5.5.0.26

2017-01-13T00:03:34.246Z [ 4732] INFO  WinMain SophosUpdate version    : 5.5.0.141

2017-01-13T00:03:34.246Z [ 4732] INFO  WinMain Build                   : 203431

2017-01-13T00:03:34.246Z [ 4732] INFO  WinMain =========================

2017-01-13T00:03:34.246Z [ 4732] INFO  Environment::Print Platform ID: WIN_7_X64

2017-01-13T00:03:34.246Z [ 4732] INFO  Environment::Print Platform upgraded: 0

2017-01-13T00:03:34.246Z [ 4732] INFO  Environment::Print Subscription: WindowsCloudNextGen RECOMMENDED 11

2017-01-13T00:03:34.246Z [ 4732] INFO  Environment::Print Subscription: WindowsCloudHitmanProAlert RECOMMENDED 1

2017-01-13T00:03:34.246Z [ 4732] INFO  Environment::Print Subscriptions changed: 0

2017-01-13T00:03:34.246Z [ 4732] INFO  Environment::Print Features: APPCNTRL AV CORE DLP DVCCNTRL HBT NTP SAV SDU WEBCNTRL

2017-01-13T00:03:34.246Z [ 4732] INFO  Environment::Print Features changed: 0

Change that prompts uninstall:

2017-01-13T00:30:03.574Z [  816] INFO  WinMain =========================

2017-01-13T00:30:03.574Z [  816] INFO  WinMain SophosUpdate is starting.

2017-01-13T00:30:03.574Z [  816] INFO  WinMain AutoUpdate version      : 5.5.0.26

2017-01-13T00:30:03.574Z [  816] INFO  WinMain SophosUpdate version    : 5.5.0.141

2017-01-13T00:30:03.574Z [  816] INFO  WinMain Build                   : 203431

2017-01-13T00:30:03.574Z [  816] INFO  WinMain =========================

2017-01-13T00:30:03.574Z [  816] INFO  Environment::Print Platform ID: WIN_7_X64

2017-01-13T00:30:03.574Z [  816] INFO  Environment::Print Platform upgraded: 0

2017-01-13T00:30:03.574Z [  816] INFO  Environment::Print Subscription: WindowsCloudNextGen RECOMMENDED 11

2017-01-13T00:30:03.574Z [  816] INFO  Environment::Print Subscription: WindowsCloudHitmanProAlert RECOMMENDED 1

2017-01-13T00:30:03.574Z [  816] INFO  Environment::Print Subscriptions changed: 0

2017-01-13T00:30:03.574Z [  816] INFO  Environment::Print Features: APPCNTRL AV CORE DLP DVCCNTRL SAV SDU WEBCNTRL

2017-01-13T00:30:03.574Z [  816] INFO  Environment::Print Features changed: 1

2017-01-13T00:30:04.339Z [  816] INFO  UpdateLogic::SyncAndInstall::<lambda_67afd400510729eb7249e1b2d6e29fde>::operator() Removing orphan products.

2017-01-13T00:30:04.339Z [  816] INFO  internal::IdentifyComponentsToRemove Orphan product found: 8E360AC3-A63E-48C8-AAC0-B02090ED484C

2017-01-13T00:30:04.339Z [  816] INFO  ProductInstaller::UninstallSetupDlls Beginning uninstallation of products.

2017-01-13T00:30:04.339Z [  816] INFO  ProductInstaller::UninstallSetupDlls Uninstalling component {8E360AC3-A63E-48C8-AAC0-B02090ED484C}.

2017-01-13T00:30:04.339Z [  816] INFO  ProductInstaller::MakeSetupDLLPath Setup DLL path C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\hbt\Setup.dll.

2017-01-13T00:30:04.339Z [  816] INFO  ProductInstaller::UninstallSetupDlls Setup path C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\hbt\Setup.dll.

2017-01-13T00:30:04.339Z [  816] INFO  check_manifest Checking manifest:C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\hbt\manifest.dat

2017-01-13T00:30:04.713Z [  816] INFO  SetupDLLManager::OpenDll Trying to load setup.dll of product 8E360AC3-A63E-48C8-AAC0-B02090ED484C.

2017-01-13T00:30:04.729Z [  816] INFO  SetupDLLManager::OpenDll Setup DLL loaded C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\hbt\Setup.dll.

2017-01-13T00:30:04.729Z [  816] INFO  SetupDLLManager::Uninstall Trying interface IProductRemoval of product 8E360AC3-A63E-48C8-AAC0-B02090ED484C.

2017-01-13T00:30:04.729Z [  816] INFO  SetupDLLManager::Uninstall Successfully established interface IProductRemoval.

2017-01-13T00:30:25.949Z [  816] INFO  SetupDLLManager::Uninstall Reboot state: 0

2017-01-13T00:30:25.949Z [  816] INFO  SetupDLLManager::Uninstall Successfully uninstalled product 8E360AC3-A63E-48C8-AAC0-B02090ED484C.

2017-01-13T00:30:25.949Z [  816] INFO  StatePersister::Save Overwriting state file C:\ProgramData\Sophos\AutoUpdate\data\status\SophosUpdateStatus.xml

2017-01-13T00:30:25.949Z [  816] INFO  SDDSDownloader::SyncInternal Policy features have changed: forcing full decode.

2017-01-13T00:30:25.949Z [  816] INFO  SDDSDownloader::SyncInternal Beginning decode

2017-01-13T00:30:26.230Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/manifest.dat

2017-01-13T00:30:26.230Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/setup.dll

2017-01-13T00:30:26.230Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/Sophos Heartbeat.msi

2017-01-13T00:30:26.230Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/Sophos/Heartbeat/BPAIF.dll

2017-01-13T00:30:26.230Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/Sophos/Heartbeat/HbtAdapter.dll

2017-01-13T00:30:26.230Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/Sophos/Heartbeat/HealthApi.dll

2017-01-13T00:30:26.230Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/Sophos/Heartbeat/Heartbeat.exe

2017-01-13T00:30:26.230Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/Sophos/Heartbeat/integrity.dat

2017-01-13T00:30:26.230Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/Sophos/Heartbeat/NOTICE.txt

2017-01-13T00:30:26.230Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/Sophos/Heartbeat/scf.dat

2017-01-13T00:30:26.230Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/Sophos/Heartbeat/sof.dat

2017-01-13T00:30:26.230Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/Sophos/Heartbeat/Config/Heartbeat.xml

2017-01-13T00:30:26.230Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/Sophos/Heartbeat/Config

2017-01-13T00:30:26.277Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/Sophos/Heartbeat

2017-01-13T00:30:26.277Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt/Sophos

2017-01-13T00:30:26.277Z [  816] INFO  SUL-Log [I39856] Purging file C:\ProgramData\Sophos\AutoUpdate\Cache\decoded/hbt



This thread was automatically locked due to age.
Parents
  • 0

    From looking at the feature list you have lost NTP and HBT:

    2017-01-13T00:03:34.246Z [ 4732] INFO  Environment::Print Features: APPCNTRL AV CORE DLP DVCCNTRL HBT NTP SAV SDU WEBCNTRL

    ...Update...

    2017-01-13T00:30:03.574Z [  816] INFO  Environment::Print Features: APPCNTRL AV CORE DLP DVCCNTRL SAV SDU WEBCNTRL

    2017-01-13T00:30:03.574Z [  816] INFO  Environment::Print Features changed: 1

    In the same log there is a line:
    INFO  SDDSDownloader::SyncInternal Username:

    I assume the username hasn't changed between these updates? Has the license changed? Has a licence expired if you look in Central?

    Did the NTP component also get removed as the feature tag was dropped?  

    Note: NTP would have the service "Sophos Network Threat Protection" associated with it. The Heartbeat component has the service"Sophos Heartbeat". 

    I had heard that the HBT component was going to be incorporated into one of the other components.  So that might be happening but then why did the NTP feature get dropped as well?

    Might be one for Support.

    Regards,
    Jak


Reply
  • 0

    From looking at the feature list you have lost NTP and HBT:

    2017-01-13T00:03:34.246Z [ 4732] INFO  Environment::Print Features: APPCNTRL AV CORE DLP DVCCNTRL HBT NTP SAV SDU WEBCNTRL

    ...Update...

    2017-01-13T00:30:03.574Z [  816] INFO  Environment::Print Features: APPCNTRL AV CORE DLP DVCCNTRL SAV SDU WEBCNTRL

    2017-01-13T00:30:03.574Z [  816] INFO  Environment::Print Features changed: 1

    In the same log there is a line:
    INFO  SDDSDownloader::SyncInternal Username:

    I assume the username hasn't changed between these updates? Has the license changed? Has a licence expired if you look in Central?

    Did the NTP component also get removed as the feature tag was dropped?  

    Note: NTP would have the service "Sophos Network Threat Protection" associated with it. The Heartbeat component has the service"Sophos Heartbeat". 

    I had heard that the HBT component was going to be incorporated into one of the other components.  So that might be happening but then why did the NTP feature get dropped as well?

    Might be one for Support.

    Regards,
    Jak


Children
No Data
Unfiltered HTML