"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
After protecting an endpoint computer from the console the following is shown in the 'Install errors' column on the 'Alert and Error Details' tab of the console:
Third-party security software removal cancelled. [0x00000049]
In the computer details windows, the following is shown:
00000049 Cancelled Sophos installation and removal of third-party security software. The software being removed may include a firewall or other component that is not being replaced. Make sure the package you are installing provides equivalent protection to the package being removed.
When you run setup.exe manually on the endpoint computer you see:
Cancelled removal of third-party security software and installation of Sophos software. The software being removed may include a firewall or other component that is not being replaced. Make sure the package you are installing provides equivalent protection to the package being removed. If you do not click 'OK', this message box will close automatically after 60 seconds.
At the bottom of the AVRemove.log the following is shown:
[DATE] [TIME] Failure: There were products detected, but some were not selected to be removed ... ... There was a problem running the Competitor Removal tool There were products detected, but some were not selected to be removed
First seen in Enterprise Console 4.5.0Sophos Enterprise Manager 4.7.0Sophos Control Center 4.0.0
As the error suggests: you attempted to protect an endpoint computer with Sophos Anti-Virus but the Sophos Competitor Removal Tool (CRT) detected third-party security software other than just Anti-Virus.
The most common reason for this error is when you protect an endpoint computer with just Sophos Anti-Virus but the endpoint is currently installed with Anti-Virus and a software firewall from a third-party vendor.
Hence the installation was cancelled to avoid reducing the level of protection that the endpoint currently has.
You have two options:
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.