This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

sav and ntp cannot be updated on win 10

Hi Support, 

I have update to sophos 10.8.9.292
on some windows 10 pc, sav and ntp cannot be updated.
what is the cause of failed updates?



This thread was automatically locked due to age.
Parents
  • Hello fadli nurdin,

    the respective Sophos component Install Logs in %windir%\Temp\ should have a detailed description of the failure.

    Christian

  • Hi christian,

    Bellow the log from Sophos AutoUpdate 5.16.37 install log 20200901.txt

    === Verbose logging started: 9/1/2020 12:23:22 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:34) [12:23:22:161]: Cloaking enabled.
    MSI (c) (18:34) [12:23:22:161]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:34) [12:23:22:161]: End dialog not enabled
    MSI (c) (18:34) [12:23:22:161]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
    MSI (c) (18:34) [12:23:22:161]: Package we're running from ==> C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall Flags override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall VersionNT override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall ServicePackLevel override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: looking for appcompat database entry with ProductCode '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (18:34) [12:23:22:165]: MSCOREE not loaded loading copy from system32
    MSI (c) (18:34) [12:23:22:167]: APPCOMPAT: looking for appcompat database entry with ProductCode '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'.
    MSI (c) (18:34) [12:23:22:167]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (18:34) [12:23:22:167]: Transforms are not secure.
    MSI (c) (18:34) [12:23:22:169]: Note: 1: 2205 2: 3: Control
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\Sophos AutoUpdate 5.16.37 install log 20200901 122322.txt'.
    MSI (c) (18:34) [12:23:22:169]: No Command Line.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{6564AB80-4D87-4CD3-B65F-2994DFB4C1D0}'.
    MSI (c) (18:34) [12:23:22:169]: Product Code passed to Engine.Initialize: '(none)'
    MSI (c) (18:34) [12:23:22:169]: Product Code from property table before transforms: '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'
    MSI (c) (18:34) [12:23:22:169]: Product Code from property table after transforms: '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'
    MSI (c) (18:34) [12:23:22:169]: Product not registered: beginning first-time install
    MSI (c) (18:34) [12:23:22:169]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
    MSI (c) (18:34) [12:23:22:169]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2
    MSI (c) (18:34) [12:23:22:169]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (c) (18:34) [12:23:22:169]: User policy value 'SearchOrder' is 'nmu'
    MSI (c) (18:34) [12:23:22:169]: Adding new sources is allowed.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:169]: Package name extracted from package path: 'Sophos AutoUpdate.msi'
    MSI (c) (18:34) [12:23:22:169]: Package to be registered: 'Sophos AutoUpdate.msi'
    MSI (c) (18:34) [12:23:22:170]: Note: 1: 2262 2: AdminProperties 3: -2147287038
    MSI (c) (18:34) [12:23:22:170]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:170]: TRANSFORMS property is now:
    MSI (c) (18:34) [12:23:22:170]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
    MSI (c) (18:34) [12:23:22:170]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
    MSI (c) (18:34) [12:23:22:172]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation
    MSI (c) (18:34) [12:23:22:172]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
    MSI (c) (18:34) [12:23:22:172]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:172]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:174]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'user'.
    MSI (c) (18:34) [12:23:22:174]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi'.
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi'.
    MSI (c) (18:34) [12:23:22:174]: Machine policy value 'MsiDisableEmbeddedUI' is 0
    MSI (c) (18:34) [12:23:22:174]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI
    MSI (c) (18:34) [12:23:22:174]: EEUI - Disabling MsiEmbeddedUI in quiet mode
    === Logging started: 9/1/2020 12:23:22 ===
    MSI (c) (18:34) [12:23:22:174]: Machine policy value 'DisableRollback' is 0
    MSI (c) (18:34) [12:23:22:174]: User policy value 'DisableRollback' is 0
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
    MSI (c) (18:34) [12:23:22:176]: Note: 1: 2265 2: 3: -2147287035
    MSI (c) (18:34) [12:23:22:176]: Checking in-progress install: install for different product.
    MSI (c) (18:34) [12:23:22:176]: Checking in-progress install: install for an uninstall.
    MSI (c) (18:34) [12:23:22:176]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
    MSI (c) (18:34) [12:23:22:178]: Creating MSIHANDLE (6) of type 790537 for thread 7988
    MSI (c) (18:34) [12:23:22:178]: MsiOpenPackageEx is returning 0
    MSI (c) (18:34) [12:23:22:180]: Closing MSIHANDLE (6) of type 790537 for thread 7988
    === Verbose logging stopped: 9/1/2020 12:23:22 ===

  • Hello fadli nurdin,

    this log is from the (attempted) AutoUpdate install and neither from SAV (Sophos Anti-Virus Install...) nor ntp (Sophos Network Threat Protection Install ...). Anyway, the -2147287035 (or 0x8003005) suggests some issue. Is this the complete log - normally it's much bigger?
    As said, the other components' logs would be needed.

    Christian.

  • === Verbose logging started: 9/1/2020  12:23:22  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:34) [12:23:22:161]: Cloaking enabled.
    MSI (c) (18:34) [12:23:22:161]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:34) [12:23:22:161]: End dialog not enabled
    MSI (c) (18:34) [12:23:22:161]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
    MSI (c) (18:34) [12:23:22:161]: Package we're running from ==> C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall Flags override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall VersionNT override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall ServicePackLevel override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: looking for appcompat database entry with ProductCode '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (18:34) [12:23:22:165]: MSCOREE not loaded loading copy from system32
    MSI (c) (18:34) [12:23:22:167]: APPCOMPAT: looking for appcompat database entry with ProductCode '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'.
    MSI (c) (18:34) [12:23:22:167]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (18:34) [12:23:22:167]: Transforms are not secure.
    MSI (c) (18:34) [12:23:22:169]: Note: 1: 2205 2:  3: Control 
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\Sophos AutoUpdate 5.16.37 install log 20200901 122322.txt'.
    MSI (c) (18:34) [12:23:22:169]: No Command Line.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{6564AB80-4D87-4CD3-B65F-2994DFB4C1D0}'.
    MSI (c) (18:34) [12:23:22:169]: Product Code passed to Engine.Initialize:           '(none)'
    MSI (c) (18:34) [12:23:22:169]: Product Code from property table before transforms: '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'
    MSI (c) (18:34) [12:23:22:169]: Product Code from property table after transforms:  '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'
    MSI (c) (18:34) [12:23:22:169]: Product not registered: beginning first-time install
    MSI (c) (18:34) [12:23:22:169]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
    MSI (c) (18:34) [12:23:22:169]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 
    MSI (c) (18:34) [12:23:22:169]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (c) (18:34) [12:23:22:169]: User policy value 'SearchOrder' is 'nmu'
    MSI (c) (18:34) [12:23:22:169]: Adding new sources is allowed.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:169]: Package name extracted from package path: 'Sophos AutoUpdate.msi'
    MSI (c) (18:34) [12:23:22:169]: Package to be registered: 'Sophos AutoUpdate.msi'
    MSI (c) (18:34) [12:23:22:170]: Note: 1: 2262 2: AdminProperties 3: -2147287038 
    MSI (c) (18:34) [12:23:22:170]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:170]: TRANSFORMS property is now: 
    MSI (c) (18:34) [12:23:22:170]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
    MSI (c) (18:34) [12:23:22:170]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16 
    MSI (c) (18:34) [12:23:22:172]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation
    MSI (c) (18:34) [12:23:22:172]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
    MSI (c) (18:34) [12:23:22:172]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:172]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:174]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'user'.
    MSI (c) (18:34) [12:23:22:174]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi'.
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi'.
    MSI (c) (18:34) [12:23:22:174]: Machine policy value 'MsiDisableEmbeddedUI' is 0
    MSI (c) (18:34) [12:23:22:174]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI
    MSI (c) (18:34) [12:23:22:174]: EEUI - Disabling MsiEmbeddedUI in quiet mode
    === Logging started: 9/1/2020  12:23:22 ===
    MSI (c) (18:34) [12:23:22:174]: Machine policy value 'DisableRollback' is 0
    MSI (c) (18:34) [12:23:22:174]: User policy value 'DisableRollback' is 0
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
    MSI (c) (18:34) [12:23:22:176]: Note: 1: 2265 2:  3: -2147287035 
    MSI (c) (18:34) [12:23:22:176]: Checking in-progress install: install for different product.
    MSI (c) (18:34) [12:23:22:176]: Checking in-progress install: install for an uninstall.
    MSI (c) (18:34) [12:23:22:176]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
    MSI (c) (18:34) [12:23:22:178]: Creating MSIHANDLE (6) of type 790537 for thread 7988
    MSI (c) (18:34) [12:23:22:178]: MsiOpenPackageEx is returning 0
    MSI (c) (18:34) [12:23:22:180]: Closing MSIHANDLE (6) of type 790537 for thread 7988
    === Verbose logging stopped: 9/1/2020  12:23:22 ===
    
    === Verbose logging started: 9/1/2020  12:23:22  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:E0) [12:23:22:192]: Resetting cached policy values
    MSI (c) (18:E0) [12:23:22:192]: Machine policy value 'Debug' is 0
    MSI (c) (18:E0) [12:23:22:192]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:E0) [12:23:22:192]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:E0) [12:23:25:193]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:E0) [12:23:25:195]: Cloaking enabled.
    MSI (c) (18:E0) [12:23:25:195]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:E0) [12:23:25:195]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:E0) [12:23:25:197]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:E0) [12:23:25:197]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:25 ===
    
    === Verbose logging started: 9/1/2020  12:23:30  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:88) [12:23:30:205]: Resetting cached policy values
    MSI (c) (18:88) [12:23:30:205]: Machine policy value 'Debug' is 0
    MSI (c) (18:88) [12:23:30:205]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:88) [12:23:30:205]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:88) [12:23:33:206]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:88) [12:23:33:207]: Cloaking enabled.
    MSI (c) (18:88) [12:23:33:207]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:88) [12:23:33:207]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:88) [12:23:33:209]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:88) [12:23:33:209]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:33 ===
    
    === Verbose logging started: 9/1/2020  12:23:38  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:E0) [12:23:38:219]: Resetting cached policy values
    MSI (c) (18:E0) [12:23:38:219]: Machine policy value 'Debug' is 0
    MSI (c) (18:E0) [12:23:38:219]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:E0) [12:23:38:219]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:E0) [12:23:41:219]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:E0) [12:23:41:227]: Cloaking enabled.
    MSI (c) (18:E0) [12:23:41:227]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:E0) [12:23:41:227]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:E0) [12:23:41:229]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:E0) [12:23:41:229]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:41 ===
    
    === Verbose logging started: 9/1/2020  12:23:46  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:6C) [12:23:46:237]: Resetting cached policy values
    MSI (c) (18:6C) [12:23:46:237]: Machine policy value 'Debug' is 0
    MSI (c) (18:6C) [12:23:46:237]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:6C) [12:23:46:237]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:6C) [12:23:49:237]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:6C) [12:23:49:237]: Cloaking enabled.
    MSI (c) (18:6C) [12:23:49:237]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:6C) [12:23:49:239]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:6C) [12:23:49:239]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:6C) [12:23:49:239]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:49 ===
    
    === Verbose logging started: 9/1/2020  12:23:54  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:7C) [12:23:54:245]: Resetting cached policy values
    MSI (c) (18:7C) [12:23:54:245]: Machine policy value 'Debug' is 0
    MSI (c) (18:7C) [12:23:54:245]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:7C) [12:23:54:245]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:7C) [12:23:57:246]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:7C) [12:23:57:248]: Cloaking enabled.
    MSI (c) (18:7C) [12:23:57:248]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:7C) [12:23:57:248]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:7C) [12:23:57:250]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:7C) [12:23:57:250]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:57 ===
    
    
    01-09-2020 12:23:22 Successfully requested Sophos Endpoint Defense disable tamper protection of SAU.
    01-09-2020 12:23:22 In MsiLib::GetPackageProductInfo().
    01-09-2020 12:23:22 In MsiLib::GetPackageProperty().
    01-09-2020 12:23:22 Leaving MsiLib::GetPackageProperty() with ERROR_SUCCESS.
    01-09-2020 12:23:22 In MsiLib::GetPackageProperty().
    01-09-2020 12:23:22 Leaving MsiLib::GetPackageProperty() with ERROR_SUCCESS.
    01-09-2020 12:23:22 In MsiLib::GetPackageProperty().
    01-09-2020 12:23:22 Leaving MsiLib::GetPackageProperty() with ERROR_SUCCESS.
    01-09-2020 12:23:22 Leaving MsiLib::GetPackageProductInfo().
    01-09-2020 12:23:22 In MsiLib::IsProductInstalled().
    01-09-2020 12:23:22 Leaving MsiLib::IsProductInstalled() with true.
    01-09-2020 12:23:22 In FixIniFiles().
    01-09-2020 12:23:22 Processing: C:\ProgramData\Sophos\AutoUpdate\Config\iconn.cfg
    01-09-2020 12:23:22 Processing: C:\ProgramData\Sophos\AutoUpdate\Config\idata.cfg
    01-09-2020 12:23:22 Processing: C:\ProgramData\Sophos\AutoUpdate\Config\ilog.cfg
    01-09-2020 12:23:22 Processing: C:\ProgramData\Sophos\AutoUpdate\Config\imon.cfg
    01-09-2020 12:23:22 Processing: C:\ProgramData\Sophos\AutoUpdate\Config\isched.cfg
    01-09-2020 12:23:22 Processing: C:\ProgramData\Sophos\AutoUpdate\Config\iupd.cfg
    01-09-2020 12:23:22 Pre-existing version: 5.15.166; Installing version: 5.16.37.
    01-09-2020 12:23:22 In KB2918614Workaround().
    01-09-2020 12:23:22 Leaving KB2918614Workaround().
    01-09-2020 12:23:22 Installation type: Minor upgrade.
    01-09-2020 12:23:22 MSI installation attempt: 1
    01-09-2020 12:23:25 Installation of Sophos AutoUpdate failed with return code : 1618.
    01-09-2020 12:23:30 MSI installation attempt: 2
    01-09-2020 12:23:33 Installation of Sophos AutoUpdate failed with return code : 1618.
    01-09-2020 12:23:38 MSI installation attempt: 3
    01-09-2020 12:23:41 Installation of Sophos AutoUpdate failed with return code : 1618.
    01-09-2020 12:23:46 MSI installation attempt: 4
    01-09-2020 12:23:49 Installation of Sophos AutoUpdate failed with return code : 1618.
    01-09-2020 12:23:54 MSI installation attempt: 5
    01-09-2020 12:23:57 Installation of Sophos AutoUpdate failed with return code : 1618.
    01-09-2020 12:24:02 Failed to successfully install MSI within 5 attempts
    01-09-2020 12:24:02 Successfully registered for tamper protection with Sophos Endpoint Defense.
    01-09-2020 12:24:02 Error: Install of MSI failed with error 1618
    
    === Verbose logging started: 9/1/2020  12:23:22  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:34) [12:23:22:161]: Cloaking enabled.
    MSI (c) (18:34) [12:23:22:161]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:34) [12:23:22:161]: End dialog not enabled
    MSI (c) (18:34) [12:23:22:161]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
    MSI (c) (18:34) [12:23:22:161]: Package we're running from ==> C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall Flags override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall VersionNT override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall ServicePackLevel override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: looking for appcompat database entry with ProductCode '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (18:34) [12:23:22:165]: MSCOREE not loaded loading copy from system32
    MSI (c) (18:34) [12:23:22:167]: APPCOMPAT: looking for appcompat database entry with ProductCode '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'.
    MSI (c) (18:34) [12:23:22:167]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (18:34) [12:23:22:167]: Transforms are not secure.
    MSI (c) (18:34) [12:23:22:169]: Note: 1: 2205 2:  3: Control 
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\Sophos AutoUpdate 5.16.37 install log 20200901 122322.txt'.
    MSI (c) (18:34) [12:23:22:169]: No Command Line.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{6564AB80-4D87-4CD3-B65F-2994DFB4C1D0}'.
    MSI (c) (18:34) [12:23:22:169]: Product Code passed to Engine.Initialize:           '(none)'
    MSI (c) (18:34) [12:23:22:169]: Product Code from property table before transforms: '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'
    MSI (c) (18:34) [12:23:22:169]: Product Code from property table after transforms:  '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'
    MSI (c) (18:34) [12:23:22:169]: Product not registered: beginning first-time install
    MSI (c) (18:34) [12:23:22:169]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
    MSI (c) (18:34) [12:23:22:169]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 
    MSI (c) (18:34) [12:23:22:169]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (c) (18:34) [12:23:22:169]: User policy value 'SearchOrder' is 'nmu'
    MSI (c) (18:34) [12:23:22:169]: Adding new sources is allowed.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:169]: Package name extracted from package path: 'Sophos AutoUpdate.msi'
    MSI (c) (18:34) [12:23:22:169]: Package to be registered: 'Sophos AutoUpdate.msi'
    MSI (c) (18:34) [12:23:22:170]: Note: 1: 2262 2: AdminProperties 3: -2147287038 
    MSI (c) (18:34) [12:23:22:170]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:170]: TRANSFORMS property is now: 
    MSI (c) (18:34) [12:23:22:170]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
    MSI (c) (18:34) [12:23:22:170]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16 
    MSI (c) (18:34) [12:23:22:172]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation
    MSI (c) (18:34) [12:23:22:172]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
    MSI (c) (18:34) [12:23:22:172]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:172]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:174]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'user'.
    MSI (c) (18:34) [12:23:22:174]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi'.
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi'.
    MSI (c) (18:34) [12:23:22:174]: Machine policy value 'MsiDisableEmbeddedUI' is 0
    MSI (c) (18:34) [12:23:22:174]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI
    MSI (c) (18:34) [12:23:22:174]: EEUI - Disabling MsiEmbeddedUI in quiet mode
    === Logging started: 9/1/2020  12:23:22 ===
    MSI (c) (18:34) [12:23:22:174]: Machine policy value 'DisableRollback' is 0
    MSI (c) (18:34) [12:23:22:174]: User policy value 'DisableRollback' is 0
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
    MSI (c) (18:34) [12:23:22:176]: Note: 1: 2265 2:  3: -2147287035 
    MSI (c) (18:34) [12:23:22:176]: Checking in-progress install: install for different product.
    MSI (c) (18:34) [12:23:22:176]: Checking in-progress install: install for an uninstall.
    MSI (c) (18:34) [12:23:22:176]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
    MSI (c) (18:34) [12:23:22:178]: Creating MSIHANDLE (6) of type 790537 for thread 7988
    MSI (c) (18:34) [12:23:22:178]: MsiOpenPackageEx is returning 0
    MSI (c) (18:34) [12:23:22:180]: Closing MSIHANDLE (6) of type 790537 for thread 7988
    === Verbose logging stopped: 9/1/2020  12:23:22 ===
    
    === Verbose logging started: 9/1/2020  12:23:22  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:E0) [12:23:22:192]: Resetting cached policy values
    MSI (c) (18:E0) [12:23:22:192]: Machine policy value 'Debug' is 0
    MSI (c) (18:E0) [12:23:22:192]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:E0) [12:23:22:192]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:E0) [12:23:25:193]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:E0) [12:23:25:195]: Cloaking enabled.
    MSI (c) (18:E0) [12:23:25:195]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:E0) [12:23:25:195]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:E0) [12:23:25:197]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:E0) [12:23:25:197]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:25 ===
    
    === Verbose logging started: 9/1/2020  12:23:30  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:88) [12:23:30:205]: Resetting cached policy values
    MSI (c) (18:88) [12:23:30:205]: Machine policy value 'Debug' is 0
    MSI (c) (18:88) [12:23:30:205]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:88) [12:23:30:205]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:88) [12:23:33:206]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:88) [12:23:33:207]: Cloaking enabled.
    MSI (c) (18:88) [12:23:33:207]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:88) [12:23:33:207]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:88) [12:23:33:209]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:88) [12:23:33:209]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:33 ===
    
    === Verbose logging started: 9/1/2020  12:23:38  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:E0) [12:23:38:219]: Resetting cached policy values
    MSI (c) (18:E0) [12:23:38:219]: Machine policy value 'Debug' is 0
    MSI (c) (18:E0) [12:23:38:219]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:E0) [12:23:38:219]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:E0) [12:23:41:219]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:E0) [12:23:41:227]: Cloaking enabled.
    MSI (c) (18:E0) [12:23:41:227]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:E0) [12:23:41:227]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:E0) [12:23:41:229]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:E0) [12:23:41:229]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:41 ===
    
    === Verbose logging started: 9/1/2020  12:23:46  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:6C) [12:23:46:237]: Resetting cached policy values
    MSI (c) (18:6C) [12:23:46:237]: Machine policy value 'Debug' is 0
    MSI (c) (18:6C) [12:23:46:237]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:6C) [12:23:46:237]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:6C) [12:23:49:237]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:6C) [12:23:49:237]: Cloaking enabled.
    MSI (c) (18:6C) [12:23:49:237]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:6C) [12:23:49:239]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:6C) [12:23:49:239]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:6C) [12:23:49:239]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:49 ===
    
    === Verbose logging started: 9/1/2020  12:23:54  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:7C) [12:23:54:245]: Resetting cached policy values
    MSI (c) (18:7C) [12:23:54:245]: Machine policy value 'Debug' is 0
    MSI (c) (18:7C) [12:23:54:245]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:7C) [12:23:54:245]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:7C) [12:23:57:246]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:7C) [12:23:57:248]: Cloaking enabled.
    MSI (c) (18:7C) [12:23:57:248]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:7C) [12:23:57:248]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:7C) [12:23:57:250]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:7C) [12:23:57:250]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:57 ===
    
    
    Sophos Anti-Virus Uninstall Log_200827_050210.txtSophos Network Threat Protection Install Log 20200901 121821.txt
    2020-09-01 12:17:56 Info: Detected version of SAV has major version number: 10
    
    2020-09-01 12:17:56 Info: Using Sophos updating modes (MSI: N, VDL: 2, IDE: 2)
    
    2020-09-01 12:17:56 GetProperty() - Unable to get product-type
    
    2020-09-01 12:17:56 Info: productType: 0
    
    2020-09-01 12:17:56 PROCESSOR_ARCHITECTURE environment variable is: AMD64
    
    2020-09-01 12:17:56 Info: Logging started: installing/upgrading Sophos Anti-Virus
    
    2020-09-01 12:17:56 Info: InstallFromPath is: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\
    
    2020-09-01 12:17:56 Info: InstallToPath is: 
    
    2020-09-01 12:17:56 Info: Detected version of SAV has major version number: 10
    
    2020-09-01 12:17:56 Info: Detected version of SAV has minor version number: 8
    
    2020-09-01 12:17:56 Info: registryInstallTo [overriding InstallToPath] is: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\
    
    2020-09-01 12:17:56 Checking for problem versions of SAVI - Install path:C:\Program Files (x86)\Sophos\Sophos Anti-Virus\
    
    2020-09-01 12:17:56 Veex.dll version '3.77.1.2461'
    
    2020-09-01 12:17:56 INFO: Checking the validity of the VDL manifest file.
    
    2020-09-01 12:17:57 INFO: The manifest file has been successfully validated.
    
    2020-09-01 12:17:57 INFO: Checking the validity of the AppFeed manifest file.
    
    2020-09-01 12:17:57 INFO: The manifest file has been successfully validated.
    
    2020-09-01 12:17:57 PROCESSOR_ARCHITECTURE environment variable is: AMD64
    
    2020-09-01 12:17:57 savonaccess.sys changed - must update on access drivers
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_MajorUpdate = 1
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_DataOnlyUpdate = 0
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_OnAccessDriverUpdate = 1
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_BootDriverUpdate = 0
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_ClassFilterUpdate = 0
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_KMSDriverUpdate = 0
    
    2020-09-01 12:17:57 Info: Managed install (from SAU)
    
    2020-09-01 12:17:57 Info: MSXML6 is installed
    
    2020-09-01 12:17:57 Check for UI changes
    
    2020-09-01 12:17:57 UIType in registry: full
    
    2020-09-01 12:17:57 ProductType in registry: 0
    
    2020-09-01 12:17:57 Checking the integrity of the extant SAV installation (noUI is 0)
    
    2020-09-01 12:17:57 The is a complete SAV installation. Skipping recovery.
    
    2020-09-01 12:17:57 Info: Performing major update of Sophos Anti-Virus using msi.
    
    2020-09-01 12:17:57 Info: Update is signalled.
    
    2020-09-01 12:17:57 In KB2918614Workaround().
    
    2020-09-01 12:17:57 Leaving KB2918614Workaround().
    
    2020-09-01 12:17:57 Product code of SAV currently installed: {01423865-551B-4C59-B44A-CC604BC21AF3}
    
    2020-09-01 12:17:57 Product code of SAV to be installed:     {3386C552-13D3-4B65-912E-8856E03E8E8B}
    
    2020-09-01 12:17:57 ProductCode change detected
    
    2020-09-01 12:17:57 Info: Added SAVService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAVAdminService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added Sophos Device Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SophosBootDriver to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_filter to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_callout to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_update to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_update_64 to ServicesList.
    
    2020-09-01 12:17:57 Info: Added Sophos Web Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAVOnAccess to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAV to ComponentList.
    
    2020-09-01 12:17:57 Info: component SDC is not registered - skipping.
    
    2020-09-01 12:17:57 Info: component SCS is not registered - skipping.
    
    2020-09-01 12:17:57 Info: Added SWI to ComponentList.
    
    2020-09-01 12:17:57 Info: Added SWC to ComponentList.
    
    2020-09-01 12:17:57 Info: Detected an older version of SAV, version 10.8. Doing a major update.
    
    2020-09-01 12:17:57 Info: Set Update Begin
    
    2020-09-01 12:17:57 Info: Added SAVService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAVAdminService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added Sophos Device Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SophosBootDriver to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_filter to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_callout to ServicesList.
    
    2020-09-01 12:17:57 Info: swi_update was found to not be installed - skipping.
    
    2020-09-01 12:17:57 Info: swi_update_64 was found to not be installed - skipping.
    
    2020-09-01 12:17:57 Info: Added Sophos Web Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: All services reported they accept stop controls.
    
    2020-09-01 12:17:57 Info: Stop SAVService
    
    2020-09-01 12:17:57 ForceStopService: Stopping SAVService
    
    2020-09-01 12:17:58 ForceStopService: Checking if service is still running
    
    2020-09-01 12:17:58 WaitForSAVService: Walking system processes...
    
    2020-09-01 12:17:58 WaitForSAVService: Found process named SAVService.exe, waiting...
    
    2020-09-01 12:18:01 WaitForSAVService: Finished walking system processes.
    
    2020-09-01 12:18:01 Info: Stop SAVAdminService
    
    2020-09-01 12:18:01 ForceStopService: Stopping SAVAdminService
    
    2020-09-01 12:18:01 ForceStopService: Checking if service is still running
    
    2020-09-01 12:18:01 Unregistering from SecurityCenter
    
    2020-09-01 12:18:04 Info: unloading SAVOnAccess driver
    
    2020-09-01 12:18:04 UnloadFilterDriver: Driver not loaded, count = 1
    
    2020-09-01 12:18:04 Info: Convert boot tasks
    
    2020-09-01 12:18:04 Info: CopyFilesToTemp
    
    2020-09-01 12:18:04 ERROR: MoveFolder - failed to move sav logs directory, hr = 0x5
    
    2020-09-01 12:18:04 Info: Reverting to copying logs instead of moving them
    
    2020-09-01 12:18:04 Info: Backup threat lifetime data
    
    2020-09-01 12:18:04 Info: useAMPPL is set - skipping backup of WSCClient
    
    2020-09-01 12:18:04 UnregisterAppInitDLL: installDir: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\, module: sophos_detoured.dll, is64bit: N
    
    2020-09-01 12:18:04 UnregisterAppInitDLL: could not get short path to DLL. It will not be unregistered.
    
    2020-09-01 12:18:04 Info: Reading overrides from registry
    
    2020-09-01 12:18:04 Info: Getting registered UI plugins from registry
    
    2020-09-01 12:18:04 Info: Loading the BypassLoopbackPort value form regsitry
    
    2020-09-01 12:18:04 Info: Uninstall SAV
    
    2020-09-01 12:18:04 Unable to delete registry key: SOFTWARE\Sophos\Telemetry\Plugins!
    
    2020-09-01 12:18:04 Info: Running Uninstall of previous version using command line: msiexec.exe /x {01423865-551B-4C59-B44A-CC604BC21AF3} REBOOT=ReallySuppress /qn  UNINSTALLDRIVERS=1 UNINSTALLCLASSFILTER=0 UNINSTALLBOOTDRIVERS=1 UNINSTALLKMSDRIVERS=1 CHECKFORSCF=0 INSTALLINGVERSION="10.8.9.292" /Lvp "C:\WINDOWS\TEMP\Sophos Anti-Virus Uninstall Log_200901_051804.txt"
    
    2020-09-01 12:18:07 Info: Finished waiting for Uninstallation of previous version. Status returned was 0l.
    
    2020-09-01 12:18:07 WARNING: SAV uninstall failed with error 1618
    
    2020-09-01 12:18:07 Info: Detected version of SAV has major version number: 10
    
    2020-09-01 12:18:07 Info: Detected version of SAV has minor version number: 8
    
    2020-09-01 12:18:07 ERROR: Uninstall of SAV, version = 10.8.4, succeeded but IsSAVInstalled is true (10.8.4).
    
    2020-09-01 12:18:07 Info: Added SAV to ComponentList.
    
    2020-09-01 12:18:07 Info: Added SWI to ComponentList.
    
    2020-09-01 12:18:07 Info: Added SWC to ComponentList.
    
    2020-09-01 12:18:07 Info: Set Update Failed
    
    
    2020-09-01 12:17:56 Info: Detected version of SAV has major version number: 10
    
    2020-09-01 12:17:56 Info: Using Sophos updating modes (MSI: N, VDL: 2, IDE: 2)
    
    2020-09-01 12:17:56 GetProperty() - Unable to get product-type
    
    2020-09-01 12:17:56 Info: productType: 0
    
    2020-09-01 12:17:56 PROCESSOR_ARCHITECTURE environment variable is: AMD64
    
    2020-09-01 12:17:56 Info: Logging started: installing/upgrading Sophos Anti-Virus
    
    2020-09-01 12:17:56 Info: InstallFromPath is: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\
    
    2020-09-01 12:17:56 Info: InstallToPath is: 
    
    2020-09-01 12:17:56 Info: Detected version of SAV has major version number: 10
    
    2020-09-01 12:17:56 Info: Detected version of SAV has minor version number: 8
    
    2020-09-01 12:17:56 Info: registryInstallTo [overriding InstallToPath] is: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\
    
    2020-09-01 12:17:56 Checking for problem versions of SAVI - Install path:C:\Program Files (x86)\Sophos\Sophos Anti-Virus\
    
    2020-09-01 12:17:56 Veex.dll version '3.77.1.2461'
    
    2020-09-01 12:17:56 INFO: Checking the validity of the VDL manifest file.
    
    2020-09-01 12:17:57 INFO: The manifest file has been successfully validated.
    
    2020-09-01 12:17:57 INFO: Checking the validity of the AppFeed manifest file.
    
    2020-09-01 12:17:57 INFO: The manifest file has been successfully validated.
    
    2020-09-01 12:17:57 PROCESSOR_ARCHITECTURE environment variable is: AMD64
    
    2020-09-01 12:17:57 savonaccess.sys changed - must update on access drivers
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_MajorUpdate = 1
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_DataOnlyUpdate = 0
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_OnAccessDriverUpdate = 1
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_BootDriverUpdate = 0
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_ClassFilterUpdate = 0
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_KMSDriverUpdate = 0
    
    2020-09-01 12:17:57 Info: Managed install (from SAU)
    
    2020-09-01 12:17:57 Info: MSXML6 is installed
    
    2020-09-01 12:17:57 Check for UI changes
    
    2020-09-01 12:17:57 UIType in registry: full
    
    2020-09-01 12:17:57 ProductType in registry: 0
    
    2020-09-01 12:17:57 Checking the integrity of the extant SAV installation (noUI is 0)
    
    2020-09-01 12:17:57 The is a complete SAV installation. Skipping recovery.
    
    2020-09-01 12:17:57 Info: Performing major update of Sophos Anti-Virus using msi.
    
    2020-09-01 12:17:57 Info: Update is signalled.
    
    2020-09-01 12:17:57 In KB2918614Workaround().
    
    2020-09-01 12:17:57 Leaving KB2918614Workaround().
    
    2020-09-01 12:17:57 Product code of SAV currently installed: {01423865-551B-4C59-B44A-CC604BC21AF3}
    
    2020-09-01 12:17:57 Product code of SAV to be installed:     {3386C552-13D3-4B65-912E-8856E03E8E8B}
    
    2020-09-01 12:17:57 ProductCode change detected
    
    2020-09-01 12:17:57 Info: Added SAVService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAVAdminService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added Sophos Device Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SophosBootDriver to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_filter to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_callout to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_update to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_update_64 to ServicesList.
    
    2020-09-01 12:17:57 Info: Added Sophos Web Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAVOnAccess to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAV to ComponentList.
    
    2020-09-01 12:17:57 Info: component SDC is not registered - skipping.
    
    2020-09-01 12:17:57 Info: component SCS is not registered - skipping.
    
    2020-09-01 12:17:57 Info: Added SWI to ComponentList.
    
    2020-09-01 12:17:57 Info: Added SWC to ComponentList.
    
    2020-09-01 12:17:57 Info: Detected an older version of SAV, version 10.8. Doing a major update.
    
    2020-09-01 12:17:57 Info: Set Update Begin
    
    2020-09-01 12:17:57 Info: Added SAVService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAVAdminService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added Sophos Device Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SophosBootDriver to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_filter to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_callout to ServicesList.
    
    2020-09-01 12:17:57 Info: swi_update was found to not be installed - skipping.
    
    2020-09-01 12:17:57 Info: swi_update_64 was found to not be installed - skipping.
    
    2020-09-01 12:17:57 Info: Added Sophos Web Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: All services reported they accept stop controls.
    
    2020-09-01 12:17:57 Info: Stop SAVService
    
    2020-09-01 12:17:57 ForceStopService: Stopping SAVService
    
    2020-09-01 12:17:58 ForceStopService: Checking if service is still running
    
    2020-09-01 12:17:58 WaitForSAVService: Walking system processes...
    
    2020-09-01 12:17:58 WaitForSAVService: Found process named SAVService.exe, waiting...
    
    2020-09-01 12:18:01 WaitForSAVService: Finished walking system processes.
    
    2020-09-01 12:18:01 Info: Stop SAVAdminService
    
    2020-09-01 12:18:01 ForceStopService: Stopping SAVAdminService
    
    2020-09-01 12:18:01 ForceStopService: Checking if service is still running
    
    2020-09-01 12:18:01 Unregistering from SecurityCenter
    
    2020-09-01 12:18:04 Info: unloading SAVOnAccess driver
    
    2020-09-01 12:18:04 UnloadFilterDriver: Driver not loaded, count = 1
    
    2020-09-01 12:18:04 Info: Convert boot tasks
    
    2020-09-01 12:18:04 Info: CopyFilesToTemp
    
    2020-09-01 12:18:04 ERROR: MoveFolder - failed to move sav logs directory, hr = 0x5
    
    2020-09-01 12:18:04 Info: Reverting to copying logs instead of moving them
    
    2020-09-01 12:18:04 Info: Backup threat lifetime data
    
    2020-09-01 12:18:04 Info: useAMPPL is set - skipping backup of WSCClient
    
    2020-09-01 12:18:04 UnregisterAppInitDLL: installDir: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\, module: sophos_detoured.dll, is64bit: N
    
    2020-09-01 12:18:04 UnregisterAppInitDLL: could not get short path to DLL. It will not be unregistered.
    
    2020-09-01 12:18:04 Info: Reading overrides from registry
    
    2020-09-01 12:18:04 Info: Getting registered UI plugins from registry
    
    2020-09-01 12:18:04 Info: Loading the BypassLoopbackPort value form regsitry
    
    2020-09-01 12:18:04 Info: Uninstall SAV
    
    2020-09-01 12:18:04 Unable to delete registry key: SOFTWARE\Sophos\Telemetry\Plugins!
    
    2020-09-01 12:18:04 Info: Running Uninstall of previous version using command line: msiexec.exe /x {01423865-551B-4C59-B44A-CC604BC21AF3} REBOOT=ReallySuppress /qn  UNINSTALLDRIVERS=1 UNINSTALLCLASSFILTER=0 UNINSTALLBOOTDRIVERS=1 UNINSTALLKMSDRIVERS=1 CHECKFORSCF=0 INSTALLINGVERSION="10.8.9.292" /Lvp "C:\WINDOWS\TEMP\Sophos Anti-Virus Uninstall Log_200901_051804.txt"
    
    2020-09-01 12:18:07 Info: Finished waiting for Uninstallation of previous version. Status returned was 0l.
    
    2020-09-01 12:18:07 WARNING: SAV uninstall failed with error 1618
    
    2020-09-01 12:18:07 Info: Detected version of SAV has major version number: 10
    
    2020-09-01 12:18:07 Info: Detected version of SAV has minor version number: 8
    
    2020-09-01 12:18:07 ERROR: Uninstall of SAV, version = 10.8.4, succeeded but IsSAVInstalled is true (10.8.4).
    
    2020-09-01 12:18:07 Info: Added SAV to ComponentList.
    
    2020-09-01 12:18:07 Info: Added SWI to ComponentList.
    
    2020-09-01 12:18:07 Info: Added SWC to ComponentList.
    
    2020-09-01 12:18:07 Info: Set Update Failed
    
    
    === Verbose logging started: 9/1/2020  12:18:04  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\WINDOWS\SysWOW64\msiexec.exe ===
    MSI (c) (24:04) [12:18:04:729]: Resetting cached policy values
    MSI (c) (24:04) [12:18:04:729]: Machine policy value 'Debug' is 0
    MSI (c) (24:04) [12:18:04:729]: ******* RunEngine:
               ******* Product: {01423865-551B-4C59-B44A-CC604BC21AF3}
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (24:04) [12:18:04:730]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (24:04) [12:18:07:731]: Failed to grab execution mutex. System error 258.
    MSI (c) (24:04) [12:18:07:750]: Cloaking enabled.
    MSI (c) (24:04) [12:18:07:750]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (24:04) [12:18:07:752]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (24:04) [12:18:07:754]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (24:04) [12:18:07:754]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:18:07 ===
    
    

    Hi Christian,

    this is latest log file, i hope you can check from it.

    Thank you

Reply
  • === Verbose logging started: 9/1/2020  12:23:22  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:34) [12:23:22:161]: Cloaking enabled.
    MSI (c) (18:34) [12:23:22:161]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:34) [12:23:22:161]: End dialog not enabled
    MSI (c) (18:34) [12:23:22:161]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
    MSI (c) (18:34) [12:23:22:161]: Package we're running from ==> C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall Flags override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall VersionNT override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall ServicePackLevel override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: looking for appcompat database entry with ProductCode '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (18:34) [12:23:22:165]: MSCOREE not loaded loading copy from system32
    MSI (c) (18:34) [12:23:22:167]: APPCOMPAT: looking for appcompat database entry with ProductCode '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'.
    MSI (c) (18:34) [12:23:22:167]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (18:34) [12:23:22:167]: Transforms are not secure.
    MSI (c) (18:34) [12:23:22:169]: Note: 1: 2205 2:  3: Control 
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\Sophos AutoUpdate 5.16.37 install log 20200901 122322.txt'.
    MSI (c) (18:34) [12:23:22:169]: No Command Line.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{6564AB80-4D87-4CD3-B65F-2994DFB4C1D0}'.
    MSI (c) (18:34) [12:23:22:169]: Product Code passed to Engine.Initialize:           '(none)'
    MSI (c) (18:34) [12:23:22:169]: Product Code from property table before transforms: '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'
    MSI (c) (18:34) [12:23:22:169]: Product Code from property table after transforms:  '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'
    MSI (c) (18:34) [12:23:22:169]: Product not registered: beginning first-time install
    MSI (c) (18:34) [12:23:22:169]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
    MSI (c) (18:34) [12:23:22:169]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 
    MSI (c) (18:34) [12:23:22:169]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (c) (18:34) [12:23:22:169]: User policy value 'SearchOrder' is 'nmu'
    MSI (c) (18:34) [12:23:22:169]: Adding new sources is allowed.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:169]: Package name extracted from package path: 'Sophos AutoUpdate.msi'
    MSI (c) (18:34) [12:23:22:169]: Package to be registered: 'Sophos AutoUpdate.msi'
    MSI (c) (18:34) [12:23:22:170]: Note: 1: 2262 2: AdminProperties 3: -2147287038 
    MSI (c) (18:34) [12:23:22:170]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:170]: TRANSFORMS property is now: 
    MSI (c) (18:34) [12:23:22:170]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
    MSI (c) (18:34) [12:23:22:170]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16 
    MSI (c) (18:34) [12:23:22:172]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation
    MSI (c) (18:34) [12:23:22:172]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
    MSI (c) (18:34) [12:23:22:172]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:172]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:174]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'user'.
    MSI (c) (18:34) [12:23:22:174]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi'.
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi'.
    MSI (c) (18:34) [12:23:22:174]: Machine policy value 'MsiDisableEmbeddedUI' is 0
    MSI (c) (18:34) [12:23:22:174]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI
    MSI (c) (18:34) [12:23:22:174]: EEUI - Disabling MsiEmbeddedUI in quiet mode
    === Logging started: 9/1/2020  12:23:22 ===
    MSI (c) (18:34) [12:23:22:174]: Machine policy value 'DisableRollback' is 0
    MSI (c) (18:34) [12:23:22:174]: User policy value 'DisableRollback' is 0
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
    MSI (c) (18:34) [12:23:22:176]: Note: 1: 2265 2:  3: -2147287035 
    MSI (c) (18:34) [12:23:22:176]: Checking in-progress install: install for different product.
    MSI (c) (18:34) [12:23:22:176]: Checking in-progress install: install for an uninstall.
    MSI (c) (18:34) [12:23:22:176]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
    MSI (c) (18:34) [12:23:22:178]: Creating MSIHANDLE (6) of type 790537 for thread 7988
    MSI (c) (18:34) [12:23:22:178]: MsiOpenPackageEx is returning 0
    MSI (c) (18:34) [12:23:22:180]: Closing MSIHANDLE (6) of type 790537 for thread 7988
    === Verbose logging stopped: 9/1/2020  12:23:22 ===
    
    === Verbose logging started: 9/1/2020  12:23:22  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:E0) [12:23:22:192]: Resetting cached policy values
    MSI (c) (18:E0) [12:23:22:192]: Machine policy value 'Debug' is 0
    MSI (c) (18:E0) [12:23:22:192]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:E0) [12:23:22:192]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:E0) [12:23:25:193]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:E0) [12:23:25:195]: Cloaking enabled.
    MSI (c) (18:E0) [12:23:25:195]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:E0) [12:23:25:195]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:E0) [12:23:25:197]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:E0) [12:23:25:197]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:25 ===
    
    === Verbose logging started: 9/1/2020  12:23:30  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:88) [12:23:30:205]: Resetting cached policy values
    MSI (c) (18:88) [12:23:30:205]: Machine policy value 'Debug' is 0
    MSI (c) (18:88) [12:23:30:205]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:88) [12:23:30:205]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:88) [12:23:33:206]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:88) [12:23:33:207]: Cloaking enabled.
    MSI (c) (18:88) [12:23:33:207]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:88) [12:23:33:207]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:88) [12:23:33:209]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:88) [12:23:33:209]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:33 ===
    
    === Verbose logging started: 9/1/2020  12:23:38  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:E0) [12:23:38:219]: Resetting cached policy values
    MSI (c) (18:E0) [12:23:38:219]: Machine policy value 'Debug' is 0
    MSI (c) (18:E0) [12:23:38:219]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:E0) [12:23:38:219]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:E0) [12:23:41:219]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:E0) [12:23:41:227]: Cloaking enabled.
    MSI (c) (18:E0) [12:23:41:227]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:E0) [12:23:41:227]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:E0) [12:23:41:229]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:E0) [12:23:41:229]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:41 ===
    
    === Verbose logging started: 9/1/2020  12:23:46  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:6C) [12:23:46:237]: Resetting cached policy values
    MSI (c) (18:6C) [12:23:46:237]: Machine policy value 'Debug' is 0
    MSI (c) (18:6C) [12:23:46:237]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:6C) [12:23:46:237]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:6C) [12:23:49:237]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:6C) [12:23:49:237]: Cloaking enabled.
    MSI (c) (18:6C) [12:23:49:237]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:6C) [12:23:49:239]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:6C) [12:23:49:239]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:6C) [12:23:49:239]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:49 ===
    
    === Verbose logging started: 9/1/2020  12:23:54  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:7C) [12:23:54:245]: Resetting cached policy values
    MSI (c) (18:7C) [12:23:54:245]: Machine policy value 'Debug' is 0
    MSI (c) (18:7C) [12:23:54:245]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:7C) [12:23:54:245]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:7C) [12:23:57:246]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:7C) [12:23:57:248]: Cloaking enabled.
    MSI (c) (18:7C) [12:23:57:248]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:7C) [12:23:57:248]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:7C) [12:23:57:250]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:7C) [12:23:57:250]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:57 ===
    
    
    01-09-2020 12:23:22 Successfully requested Sophos Endpoint Defense disable tamper protection of SAU.
    01-09-2020 12:23:22 In MsiLib::GetPackageProductInfo().
    01-09-2020 12:23:22 In MsiLib::GetPackageProperty().
    01-09-2020 12:23:22 Leaving MsiLib::GetPackageProperty() with ERROR_SUCCESS.
    01-09-2020 12:23:22 In MsiLib::GetPackageProperty().
    01-09-2020 12:23:22 Leaving MsiLib::GetPackageProperty() with ERROR_SUCCESS.
    01-09-2020 12:23:22 In MsiLib::GetPackageProperty().
    01-09-2020 12:23:22 Leaving MsiLib::GetPackageProperty() with ERROR_SUCCESS.
    01-09-2020 12:23:22 Leaving MsiLib::GetPackageProductInfo().
    01-09-2020 12:23:22 In MsiLib::IsProductInstalled().
    01-09-2020 12:23:22 Leaving MsiLib::IsProductInstalled() with true.
    01-09-2020 12:23:22 In FixIniFiles().
    01-09-2020 12:23:22 Processing: C:\ProgramData\Sophos\AutoUpdate\Config\iconn.cfg
    01-09-2020 12:23:22 Processing: C:\ProgramData\Sophos\AutoUpdate\Config\idata.cfg
    01-09-2020 12:23:22 Processing: C:\ProgramData\Sophos\AutoUpdate\Config\ilog.cfg
    01-09-2020 12:23:22 Processing: C:\ProgramData\Sophos\AutoUpdate\Config\imon.cfg
    01-09-2020 12:23:22 Processing: C:\ProgramData\Sophos\AutoUpdate\Config\isched.cfg
    01-09-2020 12:23:22 Processing: C:\ProgramData\Sophos\AutoUpdate\Config\iupd.cfg
    01-09-2020 12:23:22 Pre-existing version: 5.15.166; Installing version: 5.16.37.
    01-09-2020 12:23:22 In KB2918614Workaround().
    01-09-2020 12:23:22 Leaving KB2918614Workaround().
    01-09-2020 12:23:22 Installation type: Minor upgrade.
    01-09-2020 12:23:22 MSI installation attempt: 1
    01-09-2020 12:23:25 Installation of Sophos AutoUpdate failed with return code : 1618.
    01-09-2020 12:23:30 MSI installation attempt: 2
    01-09-2020 12:23:33 Installation of Sophos AutoUpdate failed with return code : 1618.
    01-09-2020 12:23:38 MSI installation attempt: 3
    01-09-2020 12:23:41 Installation of Sophos AutoUpdate failed with return code : 1618.
    01-09-2020 12:23:46 MSI installation attempt: 4
    01-09-2020 12:23:49 Installation of Sophos AutoUpdate failed with return code : 1618.
    01-09-2020 12:23:54 MSI installation attempt: 5
    01-09-2020 12:23:57 Installation of Sophos AutoUpdate failed with return code : 1618.
    01-09-2020 12:24:02 Failed to successfully install MSI within 5 attempts
    01-09-2020 12:24:02 Successfully registered for tamper protection with Sophos Endpoint Defense.
    01-09-2020 12:24:02 Error: Install of MSI failed with error 1618
    
    === Verbose logging started: 9/1/2020  12:23:22  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:34) [12:23:22:161]: Cloaking enabled.
    MSI (c) (18:34) [12:23:22:161]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:34) [12:23:22:161]: End dialog not enabled
    MSI (c) (18:34) [12:23:22:161]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
    MSI (c) (18:34) [12:23:22:161]: Package we're running from ==> C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall Flags override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall VersionNT override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: Uninstall ServicePackLevel override found.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: looking for appcompat database entry with ProductCode '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'.
    MSI (c) (18:34) [12:23:22:163]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (18:34) [12:23:22:165]: MSCOREE not loaded loading copy from system32
    MSI (c) (18:34) [12:23:22:167]: APPCOMPAT: looking for appcompat database entry with ProductCode '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'.
    MSI (c) (18:34) [12:23:22:167]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (18:34) [12:23:22:167]: Transforms are not secure.
    MSI (c) (18:34) [12:23:22:169]: Note: 1: 2205 2:  3: Control 
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\Sophos AutoUpdate 5.16.37 install log 20200901 122322.txt'.
    MSI (c) (18:34) [12:23:22:169]: No Command Line.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{6564AB80-4D87-4CD3-B65F-2994DFB4C1D0}'.
    MSI (c) (18:34) [12:23:22:169]: Product Code passed to Engine.Initialize:           '(none)'
    MSI (c) (18:34) [12:23:22:169]: Product Code from property table before transforms: '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'
    MSI (c) (18:34) [12:23:22:169]: Product Code from property table after transforms:  '{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}'
    MSI (c) (18:34) [12:23:22:169]: Product not registered: beginning first-time install
    MSI (c) (18:34) [12:23:22:169]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
    MSI (c) (18:34) [12:23:22:169]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 
    MSI (c) (18:34) [12:23:22:169]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (c) (18:34) [12:23:22:169]: User policy value 'SearchOrder' is 'nmu'
    MSI (c) (18:34) [12:23:22:169]: Adding new sources is allowed.
    MSI (c) (18:34) [12:23:22:169]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:169]: Package name extracted from package path: 'Sophos AutoUpdate.msi'
    MSI (c) (18:34) [12:23:22:169]: Package to be registered: 'Sophos AutoUpdate.msi'
    MSI (c) (18:34) [12:23:22:170]: Note: 1: 2262 2: AdminProperties 3: -2147287038 
    MSI (c) (18:34) [12:23:22:170]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:170]: TRANSFORMS property is now: 
    MSI (c) (18:34) [12:23:22:170]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
    MSI (c) (18:34) [12:23:22:170]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
    MSI (c) (18:34) [12:23:22:170]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16 
    MSI (c) (18:34) [12:23:22:172]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation
    MSI (c) (18:34) [12:23:22:172]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
    MSI (c) (18:34) [12:23:22:172]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:172]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
    MSI (c) (18:34) [12:23:22:174]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'user'.
    MSI (c) (18:34) [12:23:22:174]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi'.
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi'.
    MSI (c) (18:34) [12:23:22:174]: Machine policy value 'MsiDisableEmbeddedUI' is 0
    MSI (c) (18:34) [12:23:22:174]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI
    MSI (c) (18:34) [12:23:22:174]: EEUI - Disabling MsiEmbeddedUI in quiet mode
    === Logging started: 9/1/2020  12:23:22 ===
    MSI (c) (18:34) [12:23:22:174]: Machine policy value 'DisableRollback' is 0
    MSI (c) (18:34) [12:23:22:174]: User policy value 'DisableRollback' is 0
    MSI (c) (18:34) [12:23:22:174]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
    MSI (c) (18:34) [12:23:22:176]: Note: 1: 2265 2:  3: -2147287035 
    MSI (c) (18:34) [12:23:22:176]: Checking in-progress install: install for different product.
    MSI (c) (18:34) [12:23:22:176]: Checking in-progress install: install for an uninstall.
    MSI (c) (18:34) [12:23:22:176]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
    MSI (c) (18:34) [12:23:22:178]: Creating MSIHANDLE (6) of type 790537 for thread 7988
    MSI (c) (18:34) [12:23:22:178]: MsiOpenPackageEx is returning 0
    MSI (c) (18:34) [12:23:22:180]: Closing MSIHANDLE (6) of type 790537 for thread 7988
    === Verbose logging stopped: 9/1/2020  12:23:22 ===
    
    === Verbose logging started: 9/1/2020  12:23:22  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:E0) [12:23:22:192]: Resetting cached policy values
    MSI (c) (18:E0) [12:23:22:192]: Machine policy value 'Debug' is 0
    MSI (c) (18:E0) [12:23:22:192]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:E0) [12:23:22:192]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:E0) [12:23:25:193]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:E0) [12:23:25:195]: Cloaking enabled.
    MSI (c) (18:E0) [12:23:25:195]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:E0) [12:23:25:195]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:E0) [12:23:25:197]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:E0) [12:23:25:197]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:25 ===
    
    === Verbose logging started: 9/1/2020  12:23:30  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:88) [12:23:30:205]: Resetting cached policy values
    MSI (c) (18:88) [12:23:30:205]: Machine policy value 'Debug' is 0
    MSI (c) (18:88) [12:23:30:205]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:88) [12:23:30:205]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:88) [12:23:33:206]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:88) [12:23:33:207]: Cloaking enabled.
    MSI (c) (18:88) [12:23:33:207]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:88) [12:23:33:207]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:88) [12:23:33:209]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:88) [12:23:33:209]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:33 ===
    
    === Verbose logging started: 9/1/2020  12:23:38  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:E0) [12:23:38:219]: Resetting cached policy values
    MSI (c) (18:E0) [12:23:38:219]: Machine policy value 'Debug' is 0
    MSI (c) (18:E0) [12:23:38:219]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:E0) [12:23:38:219]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:E0) [12:23:41:219]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:E0) [12:23:41:227]: Cloaking enabled.
    MSI (c) (18:E0) [12:23:41:227]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:E0) [12:23:41:227]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:E0) [12:23:41:229]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:E0) [12:23:41:229]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:41 ===
    
    === Verbose logging started: 9/1/2020  12:23:46  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:6C) [12:23:46:237]: Resetting cached policy values
    MSI (c) (18:6C) [12:23:46:237]: Machine policy value 'Debug' is 0
    MSI (c) (18:6C) [12:23:46:237]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:6C) [12:23:46:237]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:6C) [12:23:49:237]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:6C) [12:23:49:237]: Cloaking enabled.
    MSI (c) (18:6C) [12:23:49:237]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:6C) [12:23:49:239]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:6C) [12:23:49:239]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:6C) [12:23:49:239]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:49 ===
    
    === Verbose logging started: 9/1/2020  12:23:54  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (18:7C) [12:23:54:245]: Resetting cached policy values
    MSI (c) (18:7C) [12:23:54:245]: Machine policy value 'Debug' is 0
    MSI (c) (18:7C) [12:23:54:245]: ******* RunEngine:
               ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (18:7C) [12:23:54:245]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (18:7C) [12:23:57:246]: Failed to grab execution mutex. System error 258.
    MSI (c) (18:7C) [12:23:57:248]: Cloaking enabled.
    MSI (c) (18:7C) [12:23:57:248]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (18:7C) [12:23:57:248]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (18:7C) [12:23:57:250]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (18:7C) [12:23:57:250]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:23:57 ===
    
    
    Sophos Anti-Virus Uninstall Log_200827_050210.txtSophos Network Threat Protection Install Log 20200901 121821.txt
    2020-09-01 12:17:56 Info: Detected version of SAV has major version number: 10
    
    2020-09-01 12:17:56 Info: Using Sophos updating modes (MSI: N, VDL: 2, IDE: 2)
    
    2020-09-01 12:17:56 GetProperty() - Unable to get product-type
    
    2020-09-01 12:17:56 Info: productType: 0
    
    2020-09-01 12:17:56 PROCESSOR_ARCHITECTURE environment variable is: AMD64
    
    2020-09-01 12:17:56 Info: Logging started: installing/upgrading Sophos Anti-Virus
    
    2020-09-01 12:17:56 Info: InstallFromPath is: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\
    
    2020-09-01 12:17:56 Info: InstallToPath is: 
    
    2020-09-01 12:17:56 Info: Detected version of SAV has major version number: 10
    
    2020-09-01 12:17:56 Info: Detected version of SAV has minor version number: 8
    
    2020-09-01 12:17:56 Info: registryInstallTo [overriding InstallToPath] is: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\
    
    2020-09-01 12:17:56 Checking for problem versions of SAVI - Install path:C:\Program Files (x86)\Sophos\Sophos Anti-Virus\
    
    2020-09-01 12:17:56 Veex.dll version '3.77.1.2461'
    
    2020-09-01 12:17:56 INFO: Checking the validity of the VDL manifest file.
    
    2020-09-01 12:17:57 INFO: The manifest file has been successfully validated.
    
    2020-09-01 12:17:57 INFO: Checking the validity of the AppFeed manifest file.
    
    2020-09-01 12:17:57 INFO: The manifest file has been successfully validated.
    
    2020-09-01 12:17:57 PROCESSOR_ARCHITECTURE environment variable is: AMD64
    
    2020-09-01 12:17:57 savonaccess.sys changed - must update on access drivers
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_MajorUpdate = 1
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_DataOnlyUpdate = 0
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_OnAccessDriverUpdate = 1
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_BootDriverUpdate = 0
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_ClassFilterUpdate = 0
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_KMSDriverUpdate = 0
    
    2020-09-01 12:17:57 Info: Managed install (from SAU)
    
    2020-09-01 12:17:57 Info: MSXML6 is installed
    
    2020-09-01 12:17:57 Check for UI changes
    
    2020-09-01 12:17:57 UIType in registry: full
    
    2020-09-01 12:17:57 ProductType in registry: 0
    
    2020-09-01 12:17:57 Checking the integrity of the extant SAV installation (noUI is 0)
    
    2020-09-01 12:17:57 The is a complete SAV installation. Skipping recovery.
    
    2020-09-01 12:17:57 Info: Performing major update of Sophos Anti-Virus using msi.
    
    2020-09-01 12:17:57 Info: Update is signalled.
    
    2020-09-01 12:17:57 In KB2918614Workaround().
    
    2020-09-01 12:17:57 Leaving KB2918614Workaround().
    
    2020-09-01 12:17:57 Product code of SAV currently installed: {01423865-551B-4C59-B44A-CC604BC21AF3}
    
    2020-09-01 12:17:57 Product code of SAV to be installed:     {3386C552-13D3-4B65-912E-8856E03E8E8B}
    
    2020-09-01 12:17:57 ProductCode change detected
    
    2020-09-01 12:17:57 Info: Added SAVService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAVAdminService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added Sophos Device Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SophosBootDriver to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_filter to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_callout to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_update to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_update_64 to ServicesList.
    
    2020-09-01 12:17:57 Info: Added Sophos Web Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAVOnAccess to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAV to ComponentList.
    
    2020-09-01 12:17:57 Info: component SDC is not registered - skipping.
    
    2020-09-01 12:17:57 Info: component SCS is not registered - skipping.
    
    2020-09-01 12:17:57 Info: Added SWI to ComponentList.
    
    2020-09-01 12:17:57 Info: Added SWC to ComponentList.
    
    2020-09-01 12:17:57 Info: Detected an older version of SAV, version 10.8. Doing a major update.
    
    2020-09-01 12:17:57 Info: Set Update Begin
    
    2020-09-01 12:17:57 Info: Added SAVService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAVAdminService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added Sophos Device Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SophosBootDriver to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_filter to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_callout to ServicesList.
    
    2020-09-01 12:17:57 Info: swi_update was found to not be installed - skipping.
    
    2020-09-01 12:17:57 Info: swi_update_64 was found to not be installed - skipping.
    
    2020-09-01 12:17:57 Info: Added Sophos Web Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: All services reported they accept stop controls.
    
    2020-09-01 12:17:57 Info: Stop SAVService
    
    2020-09-01 12:17:57 ForceStopService: Stopping SAVService
    
    2020-09-01 12:17:58 ForceStopService: Checking if service is still running
    
    2020-09-01 12:17:58 WaitForSAVService: Walking system processes...
    
    2020-09-01 12:17:58 WaitForSAVService: Found process named SAVService.exe, waiting...
    
    2020-09-01 12:18:01 WaitForSAVService: Finished walking system processes.
    
    2020-09-01 12:18:01 Info: Stop SAVAdminService
    
    2020-09-01 12:18:01 ForceStopService: Stopping SAVAdminService
    
    2020-09-01 12:18:01 ForceStopService: Checking if service is still running
    
    2020-09-01 12:18:01 Unregistering from SecurityCenter
    
    2020-09-01 12:18:04 Info: unloading SAVOnAccess driver
    
    2020-09-01 12:18:04 UnloadFilterDriver: Driver not loaded, count = 1
    
    2020-09-01 12:18:04 Info: Convert boot tasks
    
    2020-09-01 12:18:04 Info: CopyFilesToTemp
    
    2020-09-01 12:18:04 ERROR: MoveFolder - failed to move sav logs directory, hr = 0x5
    
    2020-09-01 12:18:04 Info: Reverting to copying logs instead of moving them
    
    2020-09-01 12:18:04 Info: Backup threat lifetime data
    
    2020-09-01 12:18:04 Info: useAMPPL is set - skipping backup of WSCClient
    
    2020-09-01 12:18:04 UnregisterAppInitDLL: installDir: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\, module: sophos_detoured.dll, is64bit: N
    
    2020-09-01 12:18:04 UnregisterAppInitDLL: could not get short path to DLL. It will not be unregistered.
    
    2020-09-01 12:18:04 Info: Reading overrides from registry
    
    2020-09-01 12:18:04 Info: Getting registered UI plugins from registry
    
    2020-09-01 12:18:04 Info: Loading the BypassLoopbackPort value form regsitry
    
    2020-09-01 12:18:04 Info: Uninstall SAV
    
    2020-09-01 12:18:04 Unable to delete registry key: SOFTWARE\Sophos\Telemetry\Plugins!
    
    2020-09-01 12:18:04 Info: Running Uninstall of previous version using command line: msiexec.exe /x {01423865-551B-4C59-B44A-CC604BC21AF3} REBOOT=ReallySuppress /qn  UNINSTALLDRIVERS=1 UNINSTALLCLASSFILTER=0 UNINSTALLBOOTDRIVERS=1 UNINSTALLKMSDRIVERS=1 CHECKFORSCF=0 INSTALLINGVERSION="10.8.9.292" /Lvp "C:\WINDOWS\TEMP\Sophos Anti-Virus Uninstall Log_200901_051804.txt"
    
    2020-09-01 12:18:07 Info: Finished waiting for Uninstallation of previous version. Status returned was 0l.
    
    2020-09-01 12:18:07 WARNING: SAV uninstall failed with error 1618
    
    2020-09-01 12:18:07 Info: Detected version of SAV has major version number: 10
    
    2020-09-01 12:18:07 Info: Detected version of SAV has minor version number: 8
    
    2020-09-01 12:18:07 ERROR: Uninstall of SAV, version = 10.8.4, succeeded but IsSAVInstalled is true (10.8.4).
    
    2020-09-01 12:18:07 Info: Added SAV to ComponentList.
    
    2020-09-01 12:18:07 Info: Added SWI to ComponentList.
    
    2020-09-01 12:18:07 Info: Added SWC to ComponentList.
    
    2020-09-01 12:18:07 Info: Set Update Failed
    
    
    2020-09-01 12:17:56 Info: Detected version of SAV has major version number: 10
    
    2020-09-01 12:17:56 Info: Using Sophos updating modes (MSI: N, VDL: 2, IDE: 2)
    
    2020-09-01 12:17:56 GetProperty() - Unable to get product-type
    
    2020-09-01 12:17:56 Info: productType: 0
    
    2020-09-01 12:17:56 PROCESSOR_ARCHITECTURE environment variable is: AMD64
    
    2020-09-01 12:17:56 Info: Logging started: installing/upgrading Sophos Anti-Virus
    
    2020-09-01 12:17:56 Info: InstallFromPath is: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\
    
    2020-09-01 12:17:56 Info: InstallToPath is: 
    
    2020-09-01 12:17:56 Info: Detected version of SAV has major version number: 10
    
    2020-09-01 12:17:56 Info: Detected version of SAV has minor version number: 8
    
    2020-09-01 12:17:56 Info: registryInstallTo [overriding InstallToPath] is: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\
    
    2020-09-01 12:17:56 Checking for problem versions of SAVI - Install path:C:\Program Files (x86)\Sophos\Sophos Anti-Virus\
    
    2020-09-01 12:17:56 Veex.dll version '3.77.1.2461'
    
    2020-09-01 12:17:56 INFO: Checking the validity of the VDL manifest file.
    
    2020-09-01 12:17:57 INFO: The manifest file has been successfully validated.
    
    2020-09-01 12:17:57 INFO: Checking the validity of the AppFeed manifest file.
    
    2020-09-01 12:17:57 INFO: The manifest file has been successfully validated.
    
    2020-09-01 12:17:57 PROCESSOR_ARCHITECTURE environment variable is: AMD64
    
    2020-09-01 12:17:57 savonaccess.sys changed - must update on access drivers
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_MajorUpdate = 1
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_DataOnlyUpdate = 0
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_OnAccessDriverUpdate = 1
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_BootDriverUpdate = 0
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_ClassFilterUpdate = 0
    
    2020-09-01 12:17:57 Info: SetupPlugin: updateProps.m_KMSDriverUpdate = 0
    
    2020-09-01 12:17:57 Info: Managed install (from SAU)
    
    2020-09-01 12:17:57 Info: MSXML6 is installed
    
    2020-09-01 12:17:57 Check for UI changes
    
    2020-09-01 12:17:57 UIType in registry: full
    
    2020-09-01 12:17:57 ProductType in registry: 0
    
    2020-09-01 12:17:57 Checking the integrity of the extant SAV installation (noUI is 0)
    
    2020-09-01 12:17:57 The is a complete SAV installation. Skipping recovery.
    
    2020-09-01 12:17:57 Info: Performing major update of Sophos Anti-Virus using msi.
    
    2020-09-01 12:17:57 Info: Update is signalled.
    
    2020-09-01 12:17:57 In KB2918614Workaround().
    
    2020-09-01 12:17:57 Leaving KB2918614Workaround().
    
    2020-09-01 12:17:57 Product code of SAV currently installed: {01423865-551B-4C59-B44A-CC604BC21AF3}
    
    2020-09-01 12:17:57 Product code of SAV to be installed:     {3386C552-13D3-4B65-912E-8856E03E8E8B}
    
    2020-09-01 12:17:57 ProductCode change detected
    
    2020-09-01 12:17:57 Info: Added SAVService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAVAdminService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added Sophos Device Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SophosBootDriver to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_filter to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_callout to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_update to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_update_64 to ServicesList.
    
    2020-09-01 12:17:57 Info: Added Sophos Web Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAVOnAccess to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAV to ComponentList.
    
    2020-09-01 12:17:57 Info: component SDC is not registered - skipping.
    
    2020-09-01 12:17:57 Info: component SCS is not registered - skipping.
    
    2020-09-01 12:17:57 Info: Added SWI to ComponentList.
    
    2020-09-01 12:17:57 Info: Added SWC to ComponentList.
    
    2020-09-01 12:17:57 Info: Detected an older version of SAV, version 10.8. Doing a major update.
    
    2020-09-01 12:17:57 Info: Set Update Begin
    
    2020-09-01 12:17:57 Info: Added SAVService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SAVAdminService to ServicesList.
    
    2020-09-01 12:17:57 Info: Added Sophos Device Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added SophosBootDriver to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_service to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_filter to ServicesList.
    
    2020-09-01 12:17:57 Info: Added swi_callout to ServicesList.
    
    2020-09-01 12:17:57 Info: swi_update was found to not be installed - skipping.
    
    2020-09-01 12:17:57 Info: swi_update_64 was found to not be installed - skipping.
    
    2020-09-01 12:17:57 Info: Added Sophos Web Control Service to ServicesList.
    
    2020-09-01 12:17:57 Info: All services reported they accept stop controls.
    
    2020-09-01 12:17:57 Info: Stop SAVService
    
    2020-09-01 12:17:57 ForceStopService: Stopping SAVService
    
    2020-09-01 12:17:58 ForceStopService: Checking if service is still running
    
    2020-09-01 12:17:58 WaitForSAVService: Walking system processes...
    
    2020-09-01 12:17:58 WaitForSAVService: Found process named SAVService.exe, waiting...
    
    2020-09-01 12:18:01 WaitForSAVService: Finished walking system processes.
    
    2020-09-01 12:18:01 Info: Stop SAVAdminService
    
    2020-09-01 12:18:01 ForceStopService: Stopping SAVAdminService
    
    2020-09-01 12:18:01 ForceStopService: Checking if service is still running
    
    2020-09-01 12:18:01 Unregistering from SecurityCenter
    
    2020-09-01 12:18:04 Info: unloading SAVOnAccess driver
    
    2020-09-01 12:18:04 UnloadFilterDriver: Driver not loaded, count = 1
    
    2020-09-01 12:18:04 Info: Convert boot tasks
    
    2020-09-01 12:18:04 Info: CopyFilesToTemp
    
    2020-09-01 12:18:04 ERROR: MoveFolder - failed to move sav logs directory, hr = 0x5
    
    2020-09-01 12:18:04 Info: Reverting to copying logs instead of moving them
    
    2020-09-01 12:18:04 Info: Backup threat lifetime data
    
    2020-09-01 12:18:04 Info: useAMPPL is set - skipping backup of WSCClient
    
    2020-09-01 12:18:04 UnregisterAppInitDLL: installDir: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\, module: sophos_detoured.dll, is64bit: N
    
    2020-09-01 12:18:04 UnregisterAppInitDLL: could not get short path to DLL. It will not be unregistered.
    
    2020-09-01 12:18:04 Info: Reading overrides from registry
    
    2020-09-01 12:18:04 Info: Getting registered UI plugins from registry
    
    2020-09-01 12:18:04 Info: Loading the BypassLoopbackPort value form regsitry
    
    2020-09-01 12:18:04 Info: Uninstall SAV
    
    2020-09-01 12:18:04 Unable to delete registry key: SOFTWARE\Sophos\Telemetry\Plugins!
    
    2020-09-01 12:18:04 Info: Running Uninstall of previous version using command line: msiexec.exe /x {01423865-551B-4C59-B44A-CC604BC21AF3} REBOOT=ReallySuppress /qn  UNINSTALLDRIVERS=1 UNINSTALLCLASSFILTER=0 UNINSTALLBOOTDRIVERS=1 UNINSTALLKMSDRIVERS=1 CHECKFORSCF=0 INSTALLINGVERSION="10.8.9.292" /Lvp "C:\WINDOWS\TEMP\Sophos Anti-Virus Uninstall Log_200901_051804.txt"
    
    2020-09-01 12:18:07 Info: Finished waiting for Uninstallation of previous version. Status returned was 0l.
    
    2020-09-01 12:18:07 WARNING: SAV uninstall failed with error 1618
    
    2020-09-01 12:18:07 Info: Detected version of SAV has major version number: 10
    
    2020-09-01 12:18:07 Info: Detected version of SAV has minor version number: 8
    
    2020-09-01 12:18:07 ERROR: Uninstall of SAV, version = 10.8.4, succeeded but IsSAVInstalled is true (10.8.4).
    
    2020-09-01 12:18:07 Info: Added SAV to ComponentList.
    
    2020-09-01 12:18:07 Info: Added SWI to ComponentList.
    
    2020-09-01 12:18:07 Info: Added SWC to ComponentList.
    
    2020-09-01 12:18:07 Info: Set Update Failed
    
    
    === Verbose logging started: 9/1/2020  12:18:04  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\WINDOWS\SysWOW64\msiexec.exe ===
    MSI (c) (24:04) [12:18:04:729]: Resetting cached policy values
    MSI (c) (24:04) [12:18:04:729]: Machine policy value 'Debug' is 0
    MSI (c) (24:04) [12:18:04:729]: ******* RunEngine:
               ******* Product: {01423865-551B-4C59-B44A-CC604BC21AF3}
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (24:04) [12:18:04:730]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (24:04) [12:18:07:731]: Failed to grab execution mutex. System error 258.
    MSI (c) (24:04) [12:18:07:750]: Cloaking enabled.
    MSI (c) (24:04) [12:18:07:750]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (24:04) [12:18:07:752]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (24:04) [12:18:07:754]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (24:04) [12:18:07:754]: MainEngineThread is returning 1618
    === Verbose logging stopped: 9/1/2020  12:18:07 ===
    
    

    Hi Christian,

    this is latest log file, i hope you can check from it.

    Thank you

Children
  • Hello fadli nurdin,

    thanks, this helps. Already thought as much: SAV uninstall failed with error 1618 - another install/uninstall is in progress. Could be almost anything. There's more than one msiexec.exe process and they are stuck. One would try  to determine what hangs (and perhaps why) but normally killing these processes does no harm and permits the Sophos Update to succeed..
    If the issue recurs you have to find out what fails to (un-)install.

    Christian