Problem on reinstalling antivirus on computer

RE: Problem on reinstalling antivirus on computer

daunay olivier — Wed, 21 Apr 2021 15:12:54 GMT

I continued on the certificate trail and found a difference in local security policies

OK by modifying local security strategies

Computer configuration / Windows settings / Security settings / public key policy

in the "Store" tab: modification of "Main certificate stores"
check the box next to "Third-party and enterprise root certification authorities (recommended)

and it works !!

the misconfiguration was "only enterprise root certification authorities"

thanks a lot for your help

RE: Problem on reinstalling antivirus on computer

QC — Wed, 21 Apr 2021 14:49:01 GMT

Hello Olivier,

I think it's this one:

            Issued to: VeriSign Class 3 Public Primary Certification Authority - G5
            Issued by: Class 3 Public Primary Certification Authority
            Expires:   Mon Nov 08 01:59:59 2021
            SHA1 hash: 32F30882622B87CF8856C63DB873DF0853B4DD27

whereas the good one is:

    Issued to: VeriSign Class 3 Public Primary Certification Authority - G5
    Issued by: VeriSign Class 3 Public Primary Certification Authority - G5
    Expires:   Thu Jul 17 01:59:59 2036
    SHA1 hash: 4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5

The (newer) Verisign Class 3 Public Primary should be under Trusted Root in certmgr.msc

Christian

RE: Problem on reinstalling antivirus on computer

daunay olivier — Wed, 21 Apr 2021 14:19:46 GMT

indeed,

there is an error that I cannot find on a functional installation
do you have an idea ?

Verifying: swi_callout.cat

Signature Index: 0 (Primary Signature)
Hash of file (sha1): 603B1674E37B3E0B23F71C32D5CFDF32E2195DE9

Signing Certificate Chain:
    Issued to: Microsoft Code Verification Root
    Issued by: Microsoft Code Verification Root
    Expires:   Sat Nov 01 15:54:03 2025
    SHA1 hash: 8FBE4D070EF8AB1BCCAF2A9D5CCAE7282A2C66B3

        Issued to: Class 3 Public Primary Certification Authority
        Issued by: Microsoft Code Verification Root
        Expires:   Mon May 23 19:11:29 2016
        SHA1 hash: 58455389CF1D0CD6A08E3CE216F65ADFF7A86408

            Issued to: VeriSign Class 3 Public Primary Certification Authority - G5
            Issued by: Class 3 Public Primary Certification Authority
            Expires:   Mon Nov 08 01:59:59 2021
            SHA1 hash: 32F30882622B87CF8856C63DB873DF0853B4DD27

                Issued to: VeriSign Class 3 Code Signing 2010 CA
                Issued by: VeriSign Class 3 Public Primary Certification Authority - G5
                Expires:   Sat Feb 08 01:59:59 2020
                SHA1 hash: 495847A93187CFB8C71F840CB7B41497AD95C64F

                    Issued to: Sophos Limited
                    Issued by: VeriSign Class 3 Code Signing 2010 CA
                    Expires:   Fri Dec 23 01:59:59 2016
                    SHA1 hash: EC510F6AEFCC5EC44CFD4C7D4A1079BA71CC45E4

The signature is timestamped: Fri May 20 11:18:30 2016
Timestamp Verified by:
    Issued to: Thawte Timestamping CA
    Issued by: Thawte Timestamping CA
    Expires:   Fri Jan 01 01:59:59 2021
    SHA1 hash: BE36A4562FB2EE05DBB3D32323ADF445084ED656

        Issued to: Symantec Time Stamping Services CA - G2
        Issued by: Thawte Timestamping CA
        Expires:   Thu Dec 31 01:59:59 2020
        SHA1 hash: 6C07453FFDDA08B83707C09B82FB3D15F35336B1

            Issued to: Symantec Time Stamping Services Signer - G4
            Issued by: Symantec Time Stamping Services CA - G2
            Expires:   Wed Dec 30 01:59:59 2020
            SHA1 hash: 65439929B67973EB192D6FF243E6767ADF0834E4

SignTool Error: A certificate chain processed, but terminated in a root
certificate which is not trusted by the trust provider.

Number of files successfully Verified: 0
Number of warnings: 0
Number of errors: 5

with a good computer:

Verifying: swi_callout.cat

Signature Index: 0 (Primary Signature)
Hash of file (sha1): 603B1674E37B3E0B23F71C32D5CFDF32E2195DE9

Signing Certificate Chain:
    Issued to: VeriSign Class 3 Public Primary Certification Authority - G5
    Issued by: VeriSign Class 3 Public Primary Certification Authority - G5
    Expires:   Thu Jul 17 01:59:59 2036
    SHA1 hash: 4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5

        Issued to: VeriSign Class 3 Code Signing 2010 CA
        Issued by: VeriSign Class 3 Public Primary Certification Authority - G5
        Expires:   Sat Feb 08 01:59:59 2020
        SHA1 hash: 495847A93187CFB8C71F840CB7B41497AD95C64F

            Issued to: Sophos Limited
            Issued by: VeriSign Class 3 Code Signing 2010 CA
            Expires:   Fri Dec 23 01:59:59 2016
            SHA1 hash: EC510F6AEFCC5EC44CFD4C7D4A1079BA71CC45E4

        Issued to: Symantec Time Stamping Services CA - G2
        Issued by: Thawte Timestamping CA
        Expires:   Thu Dec 31 01:59:59 2020
        SHA1 hash: 6C07453FFDDA08B83707C09B82FB3D15F35336B1

Cross Certificate Chain:
    Issued to: Microsoft Code Verification Root
    Issued by: Microsoft Code Verification Root
    Expires:   Sat Nov 01 15:54:03 2025
    SHA1 hash: 8FBE4D070EF8AB1BCCAF2A9D5CCAE7282A2C66B3

Successfully verified: swi_callout.cat

Number of files successfully Verified: 1
Number of warnings: 0
Number of errors: 0

RE: Problem on reinstalling antivirus on computer

QC — Wed, 21 Apr 2021 11:09:43 GMT

Hello Olivier,

this is somewhat strange considering that it works on all other machines.
I don't think that swi_di.exe (that should install the driver) can spit out more information than it already does, namely saying The driver package is not signed,

The only thing, apart from engaging Support, that comes to my mind is signtool.exe verify /v /kp from the Windows SDK.

Christian

RE: Problem on reinstalling antivirus on computer

daunay olivier — Wed, 21 Apr 2021 09:09:43 GMT

hello Christian

I checked the Digital Signatures of swi_callout.sys and swi_callout.cat in %ProgramData%\Sophos\AutoUpdate\Cache\savxp\program files\Sophos\Sophos Anti-Virus\Web Intelligence\x64

I found no difference between these and the sames on an other computer without the error

Olivier

RE: Problem on reinstalling antivirus on computer

QC — Wed, 21 Apr 2021 08:12:24 GMT

Hello daunay olivier,

not sure this is actually the cause. I also don't know if and where an associated Windows Event is recorded.
Even though the Program folder has been removed by the rollback you can check the Digital Signatures of swi_callout.sys and swi_callout.cat in %ProgramData%\Sophos\AutoUpdate\Cache\savxp\program files\Sophos\Sophos Anti-Virus\Web Intelligence\x64. Note the No signature was present in the subject for the .cat's sha256 signature is expected.

Christian

RE: Problem on reinstalling antivirus on computer

daunay olivier — Tue, 20 Apr 2021 14:20:28 GMT

Thanks

it seems there is no issue with the root certificates

I can acces correctly to the certificate with MMC

how can I verify if there is a certificate error

RE: Problem on reinstalling antivirus on computer

QC — Tue, 20 Apr 2021 13:25:36 GMT

Hello daunay olivier,

thanks.
Installation of Web Intelligence (SwiCalloutInstall) fails with: The driver package is not signed.
Refers to the stuff in %ProgramFiles(x86)%\Sophos\Sophos Anti-Virus\Web Intelligence\. AFAIK the message is issued by swi-di.exe. Is it possible that the server has an issue with the root certificates?

Christian

RE: Problem on reinstalling antivirus on computer

daunay olivier — Tue, 20 Apr 2021 13:04:31 GMT

I found 2 occurrences of "Valeur renvoyée 3"

MSI (s) (18:D0) [14:21:15:079]: Executing op: ActionStart(Name=StartDriverServices,,)
AddSIPSManagementUser Exit (283)
MSI (s) (18:D0) [14:21:15:079]: Executing op: CustomActionSchedule(Action=StartDriverServices,ActionType=1025,Source=BinaryData,Target=StartDriverServices,CustomActionData=WIN7_AMD64)
MSI (s) (18:6C) [14:21:15:079]: Invoking remote custom action. DLL: C:\windows\Installer\MSI2E3D.tmp, Entrypoint: StartDriverServices
MSI (s) (18:D0) [14:21:15:111]: Executing op: ActionStart(Name=SetThreatLifeTimeRegistryKeyPermissions,,)
MSI (s) (18:D0) [14:21:15:111]: Executing op: CustomActionSchedule(Action=SetThreatLifeTimeRegistryKeyPermissions,ActionType=1025,Source=BinaryData,Target=SetThreatLifeTimeRegistryKeyPermissions,)
MSI (s) (18:BC) [14:21:15:111]: Invoking remote custom action. DLL: C:\windows\Installer\MSI2E5D.tmp, Entrypoint: SetThreatLifeTimeRegistryKeyPermissions
MSI (s) (18:D0) [14:21:15:126]: Executing op: ActionStart(Name=SetupSspUserAccountRollback,,)
MSI (s) (18:D0) [14:21:15:126]: Executing op: CustomActionSchedule(Action=SetupSspUserAccountRollback,ActionType=1345,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\SAVService)
MSI (s) (18:D0) [14:21:15:126]: Executing op: ActionStart(Name=SetupSspUserAccount,,)
MSI (s) (18:D0) [14:21:15:126]: Executing op: CustomActionSchedule(Action=SetupSspUserAccount,ActionType=1089,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\SAVService)
MSI (s) (18:60) [14:21:15:126]: Invoking remote custom action. DLL: C:\windows\Installer\MSI2E6E.tmp, Entrypoint: SetupSspUserAccount
SetupSspUserAccount: Initialized.
SetupSspUserAccount: LoadAccount(SophosSSPUser) failed (error 1332)
SetupSspUserAccount: Granting permissions to user "NT SERVICE\SAVService"
MSI (s) (18:D0) [14:21:15:486]: Executing op: ActionStart(Name=SetServiceSecurity,,)
SetupSspUserAccount: Service is not installed.
MSI (s) (18:D0) [14:21:15:486]: Executing op: CustomActionSchedule(Action=SetServiceSecurity,ActionType=1025,Source=BinaryData,Target=SetServiceSecurity,)
MSI (s) (18:40) [14:21:15:486]: Invoking remote custom action. DLL: C:\windows\Installer\MSI2FD6.tmp, Entrypoint: SetServiceSecurity
MSI (s) (18:D0) [14:21:15:501]: Executing op: ActionStart(Name=SetServiceRecoveryActions,,)
MSI (s) (18:D0) [14:21:15:501]: Executing op: CustomActionSchedule(Action=SetServiceRecoveryActions,ActionType=1025,Source=BinaryData,Target=SetServiceRecoveryActions,)
MSI (s) (18:60) [14:21:15:501]: Invoking remote custom action. DLL: C:\windows\Installer\MSI2FE7.tmp, Entrypoint: SetServiceRecoveryActions
MSI (s) (18:D0) [14:21:15:517]: Executing op: ActionStart(Name=RollbackInstallDeviceControl,,)
MSI (s) (18:D0) [14:21:15:517]: Executing op: CustomActionSchedule(Action=RollbackInstallDeviceControl,ActionType=1281,Source=BinaryData,Target=RollbackInstallDeviceControl,)
MSI (s) (18:D0) [14:21:15:532]: Executing op: ActionStart(Name=InstallDeviceControl,,)
MSI (s) (18:D0) [14:21:15:532]: Executing op: CustomActionSchedule(Action=InstallDeviceControl,ActionType=1025,Source=BinaryData,Target=InstallDeviceControl,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\""C:\ProgramData\Sophos\AutoUpdate\cache\savxp\")
MSI (s) (18:24) [14:21:15:532]: Invoking remote custom action. DLL: C:\windows\Installer\MSI3007.tmp, Entrypoint: InstallDeviceControl
MSI (s) (18:D0) [14:21:15:548]: Executing op: ActionStart(Name=SetAdminGroupDescription,,)
MSI (s) (18:D0) [14:21:15:548]: Executing op: CustomActionSchedule(Action=SetAdminGroupDescription,ActionType=1025,Source=BinaryData,Target=SetAdminGroupDescription,CustomActionData=Les SophosAdministrators peuvent exécuter Sophos Anti-Virus avec un accès total)
MSI (s) (18:C8) [14:21:15:564]: Invoking remote custom action. DLL: C:\windows\Installer\MSI3018.tmp, Entrypoint: SetAdminGroupDescription
MSI (s) (18:D0) [14:21:15:579]: Executing op: ActionStart(Name=SetPowerGroupDescription,,)
MSI (s) (18:D0) [14:21:15:579]: Executing op: CustomActionSchedule(Action=SetPowerGroupDescription,ActionType=1025,Source=BinaryData,Target=SetPowerGroupDescription,CustomActionData=Les SophosPowerUsers peuvent exécuter Sophos Anti-Virus avec le même accès que les SophosUsers mais avec un accès supérieur au nettoyage)
MSI (s) (18:E0) [14:21:15:579]: Invoking remote custom action. DLL: C:\windows\Installer\MSI3038.tmp, Entrypoint: SetPowerGroupDescription
MSI (s) (18:D0) [14:21:15:595]: Executing op: ActionStart(Name=SetUserGroupDescription,,)
MSI (s) (18:D0) [14:21:15:595]: Executing op: CustomActionSchedule(Action=SetUserGroupDescription,ActionType=1025,Source=BinaryData,Target=SetUserGroupDescription,CustomActionData=Les SophosUsers peuvent exécuter Sophos Anti-Virus avec un accès limité à la configuration du contrôle et au nettoyage)
MSI (s) (18:6C) [14:21:15:595]: Invoking remote custom action. DLL: C:\windows\Installer\MSI3049.tmp, Entrypoint: SetUserGroupDescription
MSI (s) (18:D0) [14:21:15:611]: Executing op: ActionStart(Name=MsiConfigureServices,,)
MSI (s) (18:D0) [14:21:15:611]: Executing op: ProgressTotal(Total=2,Type=1,ByteEquivalent=1300000)
MSI (s) (18:D0) [14:21:15:611]: Executing op: ServiceConfigure(,Name=SAVService,Event=5,ConfigType=5,Argument=1)
MSI (s) (18:D0) [14:21:15:611]: Changing configuration of service SAVService.
MSI (s) (18:D0) [14:21:15:611]: Changed configuration of service SAVService with ConfigType SERVICE_CONFIG_SERVICE_SID_INFO
MSI (s) (18:D0) [14:21:15:611]: Done changing configuration of service SAVService
MSI (s) (18:D0) [14:21:15:611]: Executing op: ServiceConfigure(,Name=SAVAdminService,Event=5,ConfigType=5,Argument=1)
MSI (s) (18:D0) [14:21:15:611]: Changing configuration of service SAVAdminService.
MSI (s) (18:D0) [14:21:15:611]: Changed configuration of service SAVAdminService with ConfigType SERVICE_CONFIG_SERVICE_SID_INFO
MSI (s) (18:D0) [14:21:15:611]: Done changing configuration of service SAVAdminService
MSI (s) (18:D0) [14:21:15:611]: Executing op: ActionStart(Name=SetOnAccessGroupDescription,,)
MSI (s) (18:D0) [14:21:15:626]: Executing op: CustomActionSchedule(Action=SetOnAccessGroupDescription,ActionType=1025,Source=BinaryData,Target=SetOnAccessGroupDescription,CustomActionData=Contient des comptes utilisés par Sophos Anti-Virus lorsqu'il effectue les opérations de contrôle des menaces et de nettoyage)
MSI (s) (18:70) [14:21:15:626]: Invoking remote custom action. DLL: C:\windows\Installer\MSI3069.tmp, Entrypoint: SetOnAccessGroupDescription
MSI (s) (18:D0) [14:21:15:642]: Executing op: ActionStart(Name=DisablePUADetection,,)
MSI (s) (18:D0) [14:21:15:642]: Executing op: CustomActionSchedule(Action=DisablePUADetection,ActionType=1025,Source=BinaryData,Target=DisablePUADetection,CustomActionData=C:\ProgramData\Sophos\Sophos Anti-Virus\Config)
MSI (s) (18:5C) [14:21:15:642]: Invoking remote custom action. DLL: C:\windows\Installer\MSI3079.tmp, Entrypoint: DisablePUADetection
MSI (s) (18:D0) [14:21:15:658]: Executing op: ActionStart(Name=DeleteExpiredCaches,,)
MSI (s) (18:D0) [14:21:15:658]: Executing op: CustomActionSchedule(Action=DeleteExpiredCaches,ActionType=1025,Source=BinaryData,Target=DeleteExpiredCaches,)
MSI (s) (18:A4) [14:21:15:658]: Invoking remote custom action. DLL: C:\windows\Installer\MSI308A.tmp, Entrypoint: DeleteExpiredCaches
MSI (s) (18:D0) [14:21:15:673]: Executing op: ActionStart(Name=EnableJournals,,)
MSI (s) (18:D0) [14:21:15:673]: Executing op: CustomActionSchedule(Action=EnableJournals,ActionType=1025,Source=BinaryData,Target=EnableJournals,)
MSI (s) (18:E8) [14:21:15:673]: Invoking remote custom action. DLL: C:\windows\Installer\MSI309B.tmp, Entrypoint: EnableJournals
MSI (s) (18:D0) [14:21:15:689]: Executing op: ActionStart(Name=DisableWebProtection,,)
MSI (s) (18:D0) [14:21:15:689]: Executing op: CustomActionSchedule(Action=DisableWebProtection,ActionType=1025,Source=BinaryData,Target=DisableWebProtection,CustomActionData=C:\ProgramData\Sophos\Sophos Anti-Virus\Config)
MSI (s) (18:48) [14:21:15:689]: Invoking remote custom action. DLL: C:\windows\Installer\MSI30AB.tmp, Entrypoint: DisableWebProtection
MSI (s) (18:D0) [14:21:15:704]: Executing op: ActionStart(Name=DisableSxlLookups,,)
MSI (s) (18:D0) [14:21:15:704]: Executing op: CustomActionSchedule(Action=DisableSxlLookups,ActionType=1025,Source=BinaryData,Target=DisableSxlLookups,CustomActionData=C:\ProgramData\Sophos\Sophos Anti-Virus\Config)
MSI (s) (18:A4) [14:21:15:720]: Invoking remote custom action. DLL: C:\windows\Installer\MSI30BC.tmp, Entrypoint: DisableSxlLookups
MSI (s) (18:D0) [14:21:15:720]: Executing op: ActionStart(Name=CheckSNMPDLLPresence,,)
MSI (s) (18:D0) [14:21:15:736]: Executing op: CustomActionSchedule(Action=CheckSNMPDLLPresence,ActionType=1025,Source=BinaryData,Target=CheckSNMPDLLPresence,CustomActionData=C:\ProgramData\Sophos\Sophos Anti-Virus\Config)
MSI (s) (18:F4) [14:21:15:736]: Invoking remote custom action. DLL: C:\windows\Installer\MSI30DC.tmp, Entrypoint: CheckSNMPDLLPresence
MSI (s) (18:D0) [14:21:15:751]: Executing op: ActionStart(Name=UpdateSXLServerList,,)
MSI (s) (18:D0) [14:21:15:751]: Executing op: CustomActionSchedule(Action=UpdateSXLServerList,ActionType=1025,Source=BinaryData,Target=UpdateSXLServerList,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\""C:\ProgramData\Sophos\Sophos Anti-Virus\Config")
MSI (s) (18:20) [14:21:15:751]: Invoking remote custom action. DLL: C:\windows\Installer\MSI30ED.tmp, Entrypoint: UpdateSXLServerList
MSI (s) (18:D0) [14:21:15:782]: Executing op: ActionStart(Name=ApplySAVControlFile,,)
MSI (s) (18:D0) [14:21:15:782]: Executing op: CustomActionSchedule(Action=ApplySAVControlFile,ActionType=1025,Source=BinaryData,Target=ApplySAVControlFile,CustomActionData="C:\ProgramData\Sophos\AutoUpdate\cache\savxp\""C:\ProgramData\Sophos\Sophos Anti-Virus\Config")
MSI (s) (18:9C) [14:21:15:798]: Invoking remote custom action. DLL: C:\windows\Installer\MSI310D.tmp, Entrypoint: ApplySAVControlFile
MSI (s) (18:D0) [14:21:15:814]: Executing op: ActionStart(Name=GenerateSavMachineId,,)
MSI (s) (18:D0) [14:21:15:814]: Executing op: CustomActionSchedule(Action=GenerateSavMachineId,ActionType=1025,Source=BinaryData,Target=GenerateSavMachineId,)
MSI (s) (18:58) [14:21:15:814]: Invoking remote custom action. DLL: C:\windows\Installer\MSI312D.tmp, Entrypoint: GenerateSavMachineId
MSI (s) (18:D0) [14:21:15:829]: Executing op: ActionStart(Name=RegisterProduct,Description=Inscription en cours du produit,Template=[1])
MSI (s) (18:D0) [14:21:15:829]: Executing op: ChangeMedia(MediaVolumeLabel=DISK1,MediaPrompt=Veuillez insérer le disque : 1,,BytesPerTick=0,CopierType=0,,,,,,IsFirstPhysicalMedia=1)
MSI (s) (18:D0) [14:21:15:829]: Executing op: DatabaseCopy(DatabasePath=C:\windows\Installer\9dc78a.msi,ProductCode={31616A98-3852-49E9-BDD6-77A1AB85571A},,,)
MSI (s) (18:D0) [14:21:15:829]: Note: 1: 1402 2: UNKNOWN\Products\89A6161325839E94DB6D771ABA5875A1\InstallProperties 3: 2
MSI (s) (18:D0) [14:21:15:829]: Note: 1: 2318 2: C:\windows\Installer\9dc78e.msi
MSI (s) (18:D0) [14:21:15:829]: File will have security applied from OpCode.
MSI (s) (18:D0) [14:21:15:829]: Executing op: ProductRegister(UpgradeCode={597B239E-3032-491A-A322-817737925E8A},VersionString=10.8.10.810,HelpLink=www.sophos.fr/support,HelpTelephone= ,InstallLocation=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\,InstallSource=C:\ProgramData\Sophos\AutoUpdate\cache\savxp\,Publisher=Sophos Limited,URLInfoAbout=www.sophos.fr,URLUpdateInfo=http:/.../updates,,NoModify=1,NoRepair=1,,Comments=Protège votre ordinateur et votre réseau contre les menaces ,Contact=Support technique Sophos,,,,EstimatedSize=58259,,,,)
MSI (s) (18:D0) [14:21:15:829]: Executing op: ProductCPDisplayInfoRegister()
MSI (s) (18:D0) [14:21:15:829]: Executing op: ActionStart(Name=PublishFeatures,Description=Publication des fonctions du produit,Template=Fonction : [1])
MSI (s) (18:D0) [14:21:15:829]: Executing op: FeaturePublish(Feature=SAVService,,Absent=2,Component=Vg@q[]0GO?nmG^LCD4kt2y1ew`QzF9TS&39+j5vrAFB8?=f[z8nmu`RXU$4SaNyflE0OU?cWtkY2sAg*CJv{jz)vo=.&s7Mw}i@@*4tG&LM6_=rZL8sao&W+L}RJ_nt0v=b&X9K@)_4CmDhxkHF`F?_BRZ7dn2pUY~GizzPss89K7$F=-b!1e0]64Kvq$@L-_er4aQk!)

MSI (s) (18:D0) [14:21:15:845]: Executing op: FeaturePublish(Feature=MainComponents,,Absent=2,Component=sprrGUM,$=-[&ltw@0PwS8t,d=~Bl9Fx7YP,u$!X[l'1cG)mZ9]S4!kCb{$IuVIhIE`XT9{hbt=DY3el!u'`3%hL'9TN*q9fia6pkA-3_~J9{8b$sHYm,bPO%5~xceiij94Rl(R5pfNMHu=b?x[T=?&(TgtXr(ePa51?rAl)p?9r`WW.X!oX,nM~fFRY(=0)(^yUawLfIg4)*$6]?A*cZjw=iOw]r_+~b3xUW9^OEK$,mX3l?`F[h.Ao!=51B3@Gk2]!Owe)[k}X,=T~aALA_N=_[ziyG.*7m@0YWkq*u5KmK^*jLJ.H`=j_S*QxCz4u9?9)2k3hi?QTI)griQ0=[_K,qqU-'A.F2oSSV*E6!74S*H6)+=e{gOXz0{PE-Y+q]$R(J9'{&'-Q7RWDrZ071RO5w8eQM8B6g[Ar2tKQZzrNe=e0XoLr^TT5njbNC9aEZ=x`[}V?Mso^X]TF@BT25??u7=dxHrNhM'a+c-A@{9+R'~g*HXdm-3}-^=I[U=^Re^!fg^eqeAKBxLonMArnQchEI]z_%p!JNLs&I9OSwWA.V5xT?D.L.W=Wo?rr$(Q`6ruqi-.Req^wl9'V]Mbj3*fXH4ae7oue2=PMw%wY~RkBbO-^6@b!'94G3'UC$q~JWqX$hUrJk=d*Bs5+WN{JS)7jPz^Og@jsO(bn!(dDVnWISNc$I@6$d5A'(PvkniW1sZCsY@ZHrL_y+BuIWwYuotW3{8gIL]KAx^qU.&snxj(gt9uepMv~]subZJL@z{Y-.?D^6')v'~9v9RZc(jFgL9R-R[.X`Jw3t+`0tdNmC9xSmcpZk-V(zUav*5'`YAc]34O(wZr`2fonKb6Co@8p)6O4OT3W1eHFT1F(8=9Sz(.0g8wR3{7nvCI'+@y6-W^D@g&5F'6awnl-a@t)Mfu2`)61Uhw!21{rk8%JJbBjqW-LQ=-MB[klXA*AIw8je{CjS`,Y!pof.@FbG2PW5zxY=x+TBXgS,@rmm-6
MSI (s) (18:D0) [14:21:15:845]: Executing op: FeaturePublish(Feature=HomeEdition,,Absent=2,Component=vj+?00,@p95P54q'~A4U)
MSI (s) (18:D0) [14:21:15:845]: Executing op: FeaturePublish(Feature=ConfigFiles,,Absent=2,Component=4Q3DKM`l9A^xRd=eqM,.LIz+m4,=2=2?zF=(m^gksjInj%8FeAn!zWF}kRS@A)FtjR108A*(6`pbXBO!%zt'$rt(_8i9+@Q5xX.&DIo{]xCw0AjQL2FV)9'QR7DXeKGX5?R-8DYuEH=PrdxWg3r((9F~v'{[&aAkfz'*@uFg,=P&HPAg@f&rs6z_KG$7Z@Sm_2qnJf=FmP^U*n,r*AemwXRtQkiz)
MSI (s) (18:D0) [14:21:15:845]: Executing op: FeaturePublish(Feature=Resources,,Absent=2,Component=?$?&&WFt`8a&B`.f~7`u_]K_ZW!6z80Rb{`RtQmA0+I,2M+*^A!Oq7j8fv8[[8{xvmn[n?.$('%+n--*-sHCP?+VPAT[pV7l2WvBA}i^0rrH]A}6D?S^U0!+AoHV?%BO+Ax]wSB,NiBp894@j@v_X9Lho`OH@bm-ZC2`yuZ(!9[(i}FzduNl_75Lwf^?_8F?@W!i)M`''iRkI*ZWY@ft]q_=8`d`)
MSI (s) (18:D0) [14:21:15:845]: Executing op: FeaturePublish(Feature=EngineFiles,,Absent=2,Component=B'H[7pbT+9RjCb&klv}8)
MSI (s) (18:D0) [14:21:15:845]: Executing op: FeaturePublish(Feature=ServiceComponents,,Absent=2,Component=$F{Ui&C@BA*({-6m[ch8p?)^w@e]UAE]BB3c*I*d}ofI&wxEB=CKG)%vix@QuWPR-@hf%?q$,A8TZ{V5u6ilKVh6,9!Y-}v+egguUq]plY8My@!(.Q9g]C_dyahe_Zx!K?'y}5Ig!$BNy,+MB3~Y*?G~Ah8_5C}MBd@$xK(o09zh6`MQ(R{l,aP=7z70[AT9MABI({,J=WuylnAOV?34xJHfz?(+u-wad?0e&9%E!Luxt8XRTob_fH,I{8(Z=_&^1utaAby.bX73p8rbSi$X0e..p[V+2@fOV@F-nf0ls)yhmsZ]`L$A$?Qk2anN=CKd@My_H289H9mW{@KX%g5vJu7y]L1CP?T$id028`0I6H,PUK7f3@kH!TUL9s[t[C3,h`]lT?EJF$PimCc63j6qDn0?}8K'2@LrMX]QT(wJNxo}r=Aa1+{q^7]s%@'hq^'O4A-}$ldrqg8pLwL(Z*c*[?'8ZTpRVOFBy[K&H=HsY?D$Rz-=k%gS)uR}y6KQr8}{TV'JOMVMMkOqQ&~UM@v[@@StB[?a&,PX,iFM*?3D},350cKc~d4ZO,bq79rbveSUbkN4u'7?W&A3!=}IPYO,^%9R0)H5gnJbt?&aP^pI?z+.,0!}]4a3^97NiX,q))gOag+{VP_w*9G3Q?fJV.@PGS8o$t3oo97FwL*$$e~8VYV.u1uG]=c{r}UlZn~W+Bg_d@0909ta40fBxJwN-KC{C2*vdAOVt1eKP'Y947r*a5ZbO=$HMH,7*d.XnzL)u,Hdc?]a)EPrh`jb.[5%X5&s+?PS22)2-+.h6_6?FQmY'@qdd*i!qk'PrA]SLe.da=vV3%?$]&7'3P2drzji3AH[@ClJU7.u!BlV0Lfv~9(NetU}4xgcY[.'Z?5fe=p$$Yb2nRZWT5eA[fE5dAMbCr]yATI'Xv.ur?~hE=P!VBN-CjLjsh26&fuCD?lEVp^5krd1hNpir]'l-?*5?AZf&felFR!Ev$6=-?D1
MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=PublishProduct,Description=Publication en cours des informations sur le produit,)
MSI (s) (18:D0) [14:21:15:845]: Executing op: CleanupConfigData()
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\89A6161325839E94DB6D771ABA5875A1\Patches 3: 2
MSI (s) (18:D0) [14:21:15:845]: Executing op: RegisterPatchOrder(Continue=0,SequenceType=1,Remove=0)
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Products\89A6161325839E94DB6D771ABA5875A1\Patches 3: 2
MSI (s) (18:D0) [14:21:15:845]: Executing op: ProductPublish(PackageKey={DA891FEE-A03E-4AE7-98FD-7F1E6F27DD3B})
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
MSI (s) (18:D0) [14:21:15:845]: Executing op: UpgradeCodePublish(UpgradeCode={597B239E-3032-491A-A322-817737925E8A})
MSI (s) (18:D0) [14:21:15:845]: Executing op: SourceListPublish(,,DiskPromptTemplate=[1],,NumberOfDisks=1)
MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1\SourceList 3: 2
MSI (s) (18:D0) [14:21:15:845]: Executing op: ProductPublishClient(,,)
MSI (s) (18:D0) [14:21:15:845]: Executing op: SourceListRegisterLastUsed(SourceProduct={31616A98-3852-49E9-BDD6-77A1AB85571A},LastUsedSource=C:\ProgramData\Sophos\AutoUpdate\cache\savxp\)
MSI (s) (18:D0) [14:21:15:845]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (s) (18:D0) [14:21:15:845]: Specifed source is already in a list.
MSI (s) (18:D0) [14:21:15:845]: User policy value 'SearchOrder' is 'nmu'
MSI (s) (18:D0) [14:21:15:845]: Adding new sources is allowed.
MSI (s) (18:D0) [14:21:15:845]: Set LastUsedSource to: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\.
MSI (s) (18:D0) [14:21:15:845]: Set LastUsedType to: n.
MSI (s) (18:D0) [14:21:15:845]: Set LastUsedIndex to: 1.
MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RollbackRegisterTamperProtectionControlX64,,)
MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RollbackRegisterTamperProtectionControlX64,ActionType=1378,Source=C:\windows\SysWOW64\,Target="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\NATIVE.EXE" 37 REGSVR32.EXE /u /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\TamperProtectionControlX64.dll",)
MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RollbackRegisterSavShellExtX64,,)
MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RollbackRegisterSavShellExtX64,ActionType=1378,Source=C:\windows\SysWOW64\,Target="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\NATIVE.EXE" 37 REGSVR32.EXE /u /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\SavShellExtX64.dll",)
MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RollbackRegisterSophosOfficeAV,,)
MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RollbackRegisterSophosOfficeAV,ActionType=1378,Source=C:\windows\SysWOW64\,Target=REGSVR32.EXE /u /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\SophosOfficeAV.dll",)
MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RollbackRegisterSophosOfficeAVX64,,)
MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RollbackRegisterSophosOfficeAVX64,ActionType=1378,Source=C:\windows\SysWOW64\,Target="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\NATIVE.EXE" 37 REGSVR32.EXE /u /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\SophosOfficeAVx64.dll",)
MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RegisterTamperProtectionControlX64,,)
MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RegisterTamperProtectionControlX64,ActionType=1570,Source=C:\windows\SysWOW64\,Target="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\NATIVE.EXE" 37 REGSVR32.EXE /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\TamperProtectionControlX64.dll",)
MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RegisterSavShellExtX64,,)
MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RegisterSavShellExtX64,ActionType=1570,Source=C:\windows\SysWOW64\,Target="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\NATIVE.EXE" 37 REGSVR32.EXE /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\SavShellExtX64.dll",)
MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RegisterSophosOfficeAV,,)
MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RegisterSophosOfficeAV,ActionType=1570,Source=C:\windows\SysWOW64\,Target=REGSVR32.EXE /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\SophosOfficeAV.dll",)
MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RegisterSophosOfficeAVX64,,)
MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RegisterSophosOfficeAVX64,ActionType=1570,Source=C:\windows\SysWOW64\,Target="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\NATIVE.EXE" 37 REGSVR32.EXE /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\SophosOfficeAVx64.dll",)
MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RollbackInstallSecurityCenter,,)
MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RollbackInstallSecurityCenter,ActionType=1281,Source=BinaryData,Target=UninstallSecurityCenter,CustomActionData=10.8.10.810;)
MSI (s) (18:D0) [14:21:15:861]: Executing op: ActionStart(Name=RunPreLaunchScript,,)
MSI (s) (18:D0) [14:21:15:861]: Executing op: CustomActionSchedule(Action=RunPreLaunchScript,ActionType=1025,Source=BinaryData,Target=RunPreLaunchScripts,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\""C:\ProgramData\Sophos\AutoUpdate\cache\savxp\""10.8.10.810")
MSI (s) (18:04) [14:21:15:876]: Invoking remote custom action. DLL: C:\windows\Installer\MSI315D.tmp, Entrypoint: RunPreLaunchScripts
MSI (s) (18:D0) [14:21:15:876]: Executing op: ActionStart(Name=RegisterDCIfEnabled,,)
MSI (s) (18:D0) [14:21:15:892]: Executing op: CustomActionSchedule(Action=RegisterDCIfEnabled,ActionType=1537,Source=BinaryData,Target=RegisterDCIfEnabled,)
MSI (s) (18:D0) [14:21:15:892]: Executing op: ActionStart(Name=StartSAVServices,,)
MSI (s) (18:D0) [14:21:15:907]: Executing op: CustomActionSchedule(Action=StartSAVServices,ActionType=1537,Source=BinaryData,Target=StartSAVServices,)
MSI (s) (18:D0) [14:21:15:923]: Executing op: ActionStart(Name=CopySwiFcRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
MSI (s) (18:D0) [14:21:15:923]: Executing op: CustomActionSchedule(Action=CopySwiFcRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3073,Source=BinaryData,Target=RenameAndMarkForDelete,CustomActionData=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_fc.exe)
MSI (s) (18:64) [14:21:15:923]: Invoking remote custom action. DLL: C:\windows\Installer\MSI319D.tmp, Entrypoint: RenameAndMarkForDelete
MSI (s) (18:D0) [14:21:15:923]: Executing op: ActionStart(Name=CopySwiFcToProgramData.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
MSI (s) (18:D0) [14:21:15:923]: Executing op: CustomActionSchedule(Action=CopySwiFcToProgramData.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3073,Source=BinaryData,Target=CopyToShadowDir,CustomActionData=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_fc.exe)
MSI (s) (18:10) [14:21:15:923]: Invoking remote custom action. DLL: C:\windows\Installer\MSI319E.tmp, Entrypoint: CopyToShadowDir
MSI (s) (18:D0) [14:21:15:939]: Executing op: ActionStart(Name=CopyScfDotDatToProgramData.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
CopyToShadowDir: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_fc.exe has been copied to C:\Program Files (x86)\Common Files\Sophos\Web Intelligence\swi_fc.exe
MSI (s) (18:D0) [14:21:15:939]: Executing op: CustomActionSchedule(Action=CopyScfDotDatToProgramData.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3073,Source=BinaryData,Target=CopyToShadowDir,CustomActionData=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\scf.dat)
MSI (s) (18:E0) [14:21:15:939]: Invoking remote custom action. DLL: C:\windows\Installer\MSI31AE.tmp, Entrypoint: CopyToShadowDir
MSI (s) (18:D0) [14:21:15:939]: Executing op: ActionStart(Name=SwiServiceRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
CopyToShadowDir: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\scf.dat has been copied to C:\Program Files (x86)\Common Files\Sophos\Web Intelligence\scf.dat
MSI (s) (18:D0) [14:21:15:954]: Executing op: CustomActionSchedule(Action=SwiServiceRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3393,Source=BinaryData,Target=UninstallService,CustomActionData=swi_service)
MSI (s) (18:D0) [14:21:15:954]: Executing op: ActionStart(Name=SwiServiceRegister.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
MSI (s) (18:D0) [14:21:15:954]: Executing op: CustomActionSchedule(Action=SwiServiceRegister.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3585,Source=BinaryData,Target=CAQuietExec,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe" /registerService)
MSI (s) (18:D0) [14:21:15:954]: Executing op: ActionStart(Name=SwiCalloutRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
MSI (s) (18:D0) [14:21:15:954]: Executing op: CustomActionSchedule(Action=SwiCalloutRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3393,Source=BinaryData,Target=CAQuietExec,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_di.exe" -r "C:\windows\TEMP\SwiRebootRequired.txt" /u "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_callout.inf")
MSI (s) (18:D0) [14:21:15:954]: Executing op: ActionStart(Name=SwiCalloutInstall.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
MSI (s) (18:D0) [14:21:15:954]: Executing op: CustomActionSchedule(Action=SwiCalloutInstall.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3073,Source=BinaryData,Target=CAQuietExec,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_di.exe" -r "C:\windows\TEMP\SwiRebootRequired.txt" "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_callout.inf")
MSI (s) (18:44) [14:21:15:954]: Invoking remote custom action. DLL: C:\windows\Installer\MSI31BF.tmp, Entrypoint: CAQuietExec
CAQuietExec: driverInstaller
CAQuietExec:
CAQuietExec: Installation error: The driver package is not signed.
CAQuietExec: error:1
CAQuietExec: Error 0x80070001: Command line returned an error.
CAQuietExec: Error 0x80070001: CAQuietExec Failed
CustomAction SwiCalloutInstall.11DACB83_28A7_4FA6_AF5B_C006E340C101 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (18:D0) [14:21:16:048]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (18:D0) [14:21:16:048]: User policy value 'DisableRollback' is 0
MSI (s) (18:D0) [14:21:16:048]: Machine policy value 'DisableRollback' is 0
Fin de l'action 14:21:16 : InstallFinalize. Valeur renvoyée 3.

MSI (s) (18:D0) [14:21:22:170]: Executing op: ActionStart(Name=RunErrorScript,,)
MSI (s) (18:D0) [14:21:22:170]: Executing op: CustomActionRollback(Action=RunErrorScript,ActionType=1345,Source=BinaryData,Target=RunErrorScripts,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\""C:\ProgramData\Sophos\AutoUpdate\cache\savxp\""10.8.10.810")
MSI (s) (18:04) [14:21:22:186]: Invoking remote custom action. DLL: C:\windows\Installer\MSI4A0D.tmp, Entrypoint: RunErrorScripts
MSI (s) (18:D0) [14:21:22:202]: Executing op: ActionStart(Name=CheckRegForNullDACLs,,)
MSI (s) (18:D0) [14:21:22:202]: Executing op: ActionStart(Name=RestoreMovedFiles,,)
MSI (s) (18:D0) [14:21:22:202]: Executing op: CustomActionRollback(Action=RestoreMovedFiles,ActionType=1281,Source=BinaryData,Target=RestoreMovedFiles,CustomActionData=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\)
MSI (s) (18:64) [14:21:22:202]: Invoking remote custom action. DLL: C:\windows\Installer\MSI4A2D.tmp, Entrypoint: RestoreMovedFiles
MSI (s) (18:D0) [14:21:22:217]: Executing op: ActionStart(Name=SetUpdateFailed,,)
MSI (s) (18:D0) [14:21:22:217]: Executing op: CustomActionRollback(Action=SetUpdateFailed,ActionType=1281,Source=BinaryData,Target=SetUpdateFailed,)
MSI (s) (18:10) [14:21:22:217]: Invoking remote custom action. DLL: C:\windows\Installer\MSI4A3E.tmp, Entrypoint: SetUpdateFailed
MSI (s) (18:D0) [14:21:22:233]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (18:D0) [14:21:22:233]: Error in rollback skipped. Return: 5
MSI (s) (18:D0) [14:21:22:233]: Note: 1: 2318 2:
MSI (s) (18:D0) [14:21:22:249]: Note: 1: 2318 2:
MSI (s) (18:D0) [14:21:22:249]: No System Restore sequence number for this installation.
MSI (s) (18:D0) [14:21:22:249]: Unlocking Server
MSI (s) (18:D0) [14:21:22:249]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Fin de l'action 14:21:22 : INSTALL. Valeur renvoyée 3.

RE: Problem on reinstalling antivirus on computer

QC — Tue, 20 Apr 2021 12:40:22 GMT

Hello ,

the log with the error was Sophos Anti-Virus Major Install Log
I see, thanks. Whatever caused the install to fail should be in this log. Please search for the French equivalent of Return value 3 (there might be more than one occurrence). Normally the preceding lines have at least some information about the error.

Christian

RE: Problem on reinstalling antivirus on computer

daunay olivier — Tue, 20 Apr 2021 12:36:50 GMT

MSI (s) (24:04) [14:15:20:940]: Invoking remote custom action. DLL: C:\windows\Installer\MSIC73A.tmp, Entrypoint: CAQuietExec
CAQuietExec: driverInstaller
CAQuietExec:
CAQuietExec: Installation error: The driver package is not signed.
CAQuietExec: error:1
CAQuietExec: Error 0x80070001: Command line returned an error.
CAQuietExec: Error 0x80070001: CAQuietExec Failed
CustomAction SwiCalloutInstall.11DACB83_28A7_4FA6_AF5B_C006E340C101 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (24:C0) [14:15:21:018]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (24:C0) [14:15:21:018]: User policy value 'DisableRollback' is 0
MSI (s) (24:C0) [14:15:21:018]: Machine policy value 'DisableRollback' is 0
Fin de l'action 14:15:21 : InstallFinalize. Valeur renvoyée 3.
MSI (s) (24:C0) [14:15:21:018]: Note: 1: 2318 2:
MSI (s) (24:C0) [14:15:21:049]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1385460197,LangId=1036,Platform=0,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
MSI (s) (24:C0) [14:15:21:049]: Executing op: DialogInfo(Type=0,Argument=1036)
MSI (s) (24:C0) [14:15:21:049]: Executing op: DialogInfo(Type=1,Argument=Sophos Anti-Virus)
MSI (s) (24:C0) [14:15:21:049]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Annulation en cours de l'action :,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Suppression en cours des fichiers de sauvegarde,CleanupTemplate=Fichier : [1])
MSI (s) (24:C0) [14:15:21:049]: Executing op: ActionStart(Name=SwiCalloutInstall.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
MSI (s) (24:C0) [14:15:21:049]: Executing op: ProductInfo(ProductKey={31616A98-3852-49E9-BDD6-77A1AB85571A},ProductName=Sophos Anti-Virus,PackageName=Sophos Anti-Virus.msi,Language=1036,Version=168296458,Assignment=1,ObsoleteArg=0,ProductIcon=ARPPRODUCTICON.exe,,PackageCode={DA891FEE-A03E-4AE7-98FD-7F1E6F27DD3B},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3)
MSI (s) (24:C0) [14:15:21:049]: Executing op: ActionStart(Name=SwiCalloutRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
MSI (s) (24:C0) [14:15:21:049]: Executing op: CustomActionRollback(Action=SwiCalloutRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3393,Source=BinaryData,Target=CAQuietExec,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_di.exe" -r "C:\windows\TEMP\SwiRebootRequired.txt" /u "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_callout.inf")
MSI (s) (24:10) [14:15:21:049]: Invoking remote custom action. DLL: C:\windows\Installer\MSIC7A8.tmp, Entrypoint: CAQuietExec
CAQuietExec: driverInstaller
CAQuietExec:
CAQuietExec: Uninstallation error: Unknown error code: 0xe0000302
CAQuietExec: error:1
CAQuietExec: Error 0x80070001: Command line returned an error.
CAQuietExec: Error 0x80070001: CAQuietExec Failed
CustomAction SwiCalloutRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101 returned actual error code 1603 but will be translated to success due to continue marking
MSI (s) (24:C0) [14:15:21:080]: Executing op: ActionStart(Name=SwiServiceRegister.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
MSI (s) (24:C0) [14:15:21:080]: Executing op: ActionStart(Name=SwiServiceRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
MSI (s) (24:C0) [14:15:21:080]: Executing op: CustomActionRollback(Action=SwiServiceRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3393,Source=BinaryData,Target=UninstallService,CustomActionData=swi_service)
MSI (s) (24:70) [14:15:21:080]: Invoking remote custom action. DLL: C:\windows\Installer\MSIC7C9.tmp, Entrypoint: UninstallService
UninstallService: Unable to open service to delete it. Error 1060
CustomAction SwiServiceRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101 returned actual error code 1603 but will be translated to success due to continue marking

RE: Problem on reinstalling antivirus on computer

daunay olivier — Tue, 20 Apr 2021 12:18:13 GMT

the SOPHOS installer creates the groups correctly but they are deleted during the rollback of the installation apparently

RE: Problem on reinstalling antivirus on computer

daunay olivier — Tue, 20 Apr 2021 11:48:38 GMT

Thank you for your response

the log with the error was Sophos Anti-Virus Major Install Log

I control the log Sophos Anti-Virus Major CustomActions Log and found this error :

2021-04-20 11:47:01 CreateUserGroups: Action started
2021-04-20 11:47:01 CreateUserGroups: CreateSophosUserGroup: Group SophosUser has been created successfully.
2021-04-20 11:47:01 CreateUserGroups: CreateSophosUserGroup: Group SophosPowerUser has been created successfully.
2021-04-20 11:47:01 CreateUserGroups: CreateSophosUserGroup: Group SophosAdministrator has been created successfully.
2021-04-20 11:47:01 CreateUserGroups: CreateSophosUserGroup: Group SophosOnAccess has been created successfully.
2021-04-20 11:47:01 CreateUserGroups: PROCESSOR_ARCHITECTURE environment variable is: AMD64
2021-04-20 11:47:01 CreateUserGroups: Local name of well-known group Administrators is Administrateurs
2021-04-20 11:47:01 CreateUserGroups: Local name of well-known group PowerUsers is Utilisateurs avec pouvoir
2021-04-20 11:47:01 CreateUserGroups: Local name of well-known group Users is Utilisateurs
2021-04-20 11:47:01 CreateUserGroups: Failed to add the members of group PowerUsers to SophosPowerUser group. HRESULT: 0x80070057
2021-04-20 11:47:01 CreateUserGroups: Adding LOCAL SYSTEM to the SophosAdministrator role in the machine file
2021-04-20 11:47:01 CreateUserGroups: Action succeeded

I don't find these usergroups localy like on the other computer ?

RE: Problem on reinstalling antivirus on computer

QC — Tue, 20 Apr 2021 11:15:19 GMT

Hello daunay olivier,

this is from the ALUpdate log, isn't it?
You say that everything installed except SAVXP (and it does not appear in Programs and Features)? The actual final error is the rather vague ERROR: Installation failed. The rest is just consequential. Guess there is nothing meaningful prior to this message.

Please check the Sophos Anti-Virus Major Install and Sophos Anti-Virus Major CustomActions logs in %windir%\Temp.

Christian