Hello Guys,
I know receive the error on several machines : Failed to install SAVXP: A previous version could not be uninstalled.
This has impact on the AV engine, becauce i see also an older AV version on the machines.
Regards
Roel
Hello Roel,
there should be a (i.e. more or a lot) Sophos Anti-Virus Uninstall Log_2112dd_hhmmss.txt in %windir%\Temp\. These are MSI logs, please see this article if you're not familiar with them. Often it's simple to solve the problem once the reason is determined
Christian
=== Verbose logging started: 14-12-2021 16:05:42 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\WINDOWS\SysWOW64\msiexec.exe ===
MSI (c) (D0:28) [16:05:42:094]: Resetting cached policy values
MSI (c) (D0:28) [16:05:42:094]: Machine policy value 'Debug' is 0
MSI (c) (D0:28) [16:05:42:094]: ******* RunEngine:
******* Product: {31616A98-3852-49E9-BDD6-77A1AB85571A}
******* Action:
******* CommandLine: **********
MSI (c) (D0:28) [16:05:42:094]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (D0:28) [16:05:42:094]: Grabbed execution mutex.
MSI (c) (D0:28) [16:05:42:148]: Cloaking enabled.
MSI (c) (D0:28) [16:05:42:148]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (D0:28) [16:05:42:151]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (08:E0) [16:05:42:160]: Running installation inside multi-package transaction {31616A98-3852-49E9-BDD6-77A1AB85571A}
MSI (s) (08:E0) [16:05:42:160]: Grabbed execution mutex.
MSI (s) (08:30) [16:05:42:162]: Resetting cached policy values
MSI (s) (08:30) [16:05:42:162]: Machine policy value 'Debug' is 0
MSI (s) (08:30) [16:05:42:162]: ******* RunEngine:
******* Product: {31616A98-3852-49E9-BDD6-77A1AB85571A}
******* Action:
******* CommandLine: **********
MSI (s) (08:30) [16:05:42:162]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (08:30) [16:05:42:163]: Warning: Local cached package 'C:\windows\Installer\23548025.msi' is missing.
MSI (s) (08:30) [16:05:42:163]: User policy value 'SearchOrder' is 'nmu'
MSI (s) (08:30) [16:05:42:163]: User policy value 'DisableMedia' is 0
MSI (s) (08:30) [16:05:42:163]: Machine policy value 'AllowLockdownMedia' is 0
MSI (s) (08:30) [16:05:42:163]: SOURCEMGMT: Media enabled only if package is safe.
MSI (s) (08:30) [16:05:42:163]: SOURCEMGMT: Looking for sourcelist for product {31616A98-3852-49E9-BDD6-77A1AB85571A}
MSI (s) (08:30) [16:05:42:163]: SOURCEMGMT: Adding {31616A98-3852-49E9-BDD6-77A1AB85571A}; to potential sourcelist list (pcode;disk;relpath).
MSI (s) (08:30) [16:05:42:163]: SOURCEMGMT: Now checking product {31616A98-3852-49E9-BDD6-77A1AB85571A}
MSI (s) (08:30) [16:05:42:163]: SOURCEMGMT: Media is enabled for product.
MSI (s) (08:30) [16:05:42:163]: SOURCEMGMT: Attempting to use LastUsedSource from source list.
MSI (s) (08:30) [16:05:42:163]: SOURCEMGMT: Trying source C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\decode\savxp\.
MSI (s) (08:30) [16:05:42:164]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2
MSI (s) (08:30) [16:05:42:173]: SOURCEMGMT: Source is invalid due to invalid package code (product code doesn't match).
MSI (s) (08:30) [16:05:42:173]: Note: 1: 1706 2: -2147483646 3: Sophos Anti-Virus.msi
MSI (s) (08:30) [16:05:42:173]: SOURCEMGMT: Processing net source list.
MSI (s) (08:30) [16:05:42:173]: Note: 1: 1706 2: -2147483647 3: Sophos Anti-Virus.msi
MSI (s) (08:30) [16:05:42:173]: SOURCEMGMT: Processing media source list.
MSI (s) (08:30) [16:05:42:173]: Note: 1: 2203 2: 3: -2147287037
MSI (s) (08:30) [16:05:42:173]: SOURCEMGMT: Source is invalid due to missing/inaccessible package.
MSI (s) (08:30) [16:05:42:173]: Note: 1: 1706 2: -2147483647 3: Sophos Anti-Virus.msi
MSI (s) (08:30) [16:05:42:174]: SOURCEMGMT: Processing URL source list.
MSI (s) (08:30) [16:05:42:174]: Note: 1: 1402 2: UNKNOWN\URL 3: 2
MSI (s) (08:30) [16:05:42:174]: Note: 1: 1706 2: -2147483647 3: Sophos Anti-Virus.msi
MSI (s) (08:30) [16:05:42:174]: Note: 1: 1706 2: 3: Sophos Anti-Virus.msi
MSI (s) (08:30) [16:05:42:174]: SOURCEMGMT: Failed to resolve source
MSI (s) (08:30) [16:05:42:174]: MainEngineThread is returning 1612
MSI (s) (08:E0) [16:05:42:175]: User policy value 'DisableRollback' is 0
MSI (s) (08:E0) [16:05:42:175]: Machine policy value 'DisableRollback' is 0
MSI (s) (08:E0) [16:05:42:175]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (08:E0) [16:05:42:175]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (08:E0) [16:05:42:175]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (08:E0) [16:05:42:176]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (D0:28) [16:05:42:177]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (D0:28) [16:05:42:177]: MainEngineThread is returning 1612
=== Verbose logging stopped: 14-12-2021 16:05:42 ===
Hello Roel,
MSI (s) (08:30) [16:05:42:163]: Warning: Local cached package 'C:\windows\Installer\23548025.msi' is missing.
causes the error. When SAVXP is installed/updated the Windows Installer caches the MSI (giving it a random name). During product updates the old version is uninstalled and when this succeeds the new version is installed. For the uninstall the corresponding MSI (i.e. the old one) is needed. For some reason it (23548025.msi) is no longer in the cache. In this case the Installer tries the package the LastUsedSource points to - but as this is already the one that contains the update it can't be used.
The solution is to take the Sophos Anti-Virus.msi that corresponds to the installed version and copy it to the Installer cache with the name given in the warning message. If necessary add the necessary subscription in SEC.
Christian
Hello Roel,
MSI (s) (08:30) [16:05:42:163]: Warning: Local cached package 'C:\windows\Installer\23548025.msi' is missing.
causes the error. When SAVXP is installed/updated the Windows Installer caches the MSI (giving it a random name). During product updates the old version is uninstalled and when this succeeds the new version is installed. For the uninstall the corresponding MSI (i.e. the old one) is needed. For some reason it (23548025.msi) is no longer in the cache. In this case the Installer tries the package the LastUsedSource points to - but as this is already the one that contains the update it can't be used.
The solution is to take the Sophos Anti-Virus.msi that corresponds to the installed version and copy it to the Installer cache with the name given in the warning message. If necessary add the necessary subscription in SEC.
Christian
Thanks, See the log below, where can i find the correct package with the version that is installed on the machine?
MSI (s) (E8:0C) [11:09:50:547]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (E8:0C) [11:09:50:547]: Warning: The package code in the cached package 'C:\windows\Installer\1145ae1.msi' does not match the registered package code. Cached package will be ignored.
MSI (s) (E8:0C) [11:09:50:547]: User policy value 'SearchOrder' is 'nmu'
Hello Roel,
Recommended version is 10.8.12. If I'm not mistaken the product code in the log ({31616A98-3852-49E9-BDD6-77A1AB85571A}) belongs to10.8.10. As far as I can see 10.8.10 had a very short lifespan, less than four days, April 23rd-27th. 10.8.10 didn't have a very long lifespan, for whatever reason we delayed the update from 10.8.9 and coincidentally 10.8.100 came out a few days later. Anyway it's not available as one of the Fixed Extended packages.
Not very likely you have an MSI from this time around. Can you confirm that the endpoints are running 10.8.10 (and haven't updated since April)?
Christian
Hello Roel ,
strange, as the ProductCode is definitely from 10.8.10 and 10.8.11 has a different one. The log snippet with the 1145ae1.msi is from the second endpoint? Does it mention the same ProductCode? What SAV version do the two show under Programs and Features?
Christian
