This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos EpS&C fails to update / install properly

I have a client machine here that was brought in because sophos started to fail on updating.  According to the student who brought it in, sophos was running happily for quite some time, and then simply started getting a failed update notification.   About three different work-study techs looked at this before it landed on my desk.  Some of the things they checked were to run several virus/malware/rootkit scanning utilities to ensure the system was virus-free, Checked that no other AV programs remained, ran system file checker to ensure that windows files were all intact, and did a complete uninstall of Sophos including post-uninstall scrubbing of the registry of all Sophos entries, deleting any remaining sophos files from windows/temp, program files\sophoos, and all users\application data\sophos\ . 

As it stands now, it appears that when sophos installs, it only installs the auto-updater, and then fails.   When it gets to the screen that says "Installing Sophos antivirus for windows --Installing package 1 of 2", that takes a bit, and then immediately following the "package 1 of 2" step, the window closes out and the icon shows "Updating - Failed" with a red X on the shield. 

When right-clicking the notifier in the system tray, the option to open sophos endpoint security and control is greyed out, and subsequently choosing update sophos results in a repeat of the above.  

After the failed intall, the following services have been started according to the windows services utilty:

Sophos Agent

Sophos AutoUpdate Service

Sophos Message Router

LOG:

From the program installation directory, autoupdate/logs, is the update log, which i loaded into pastebin:  http://pastebin.com/pP4jFQ9Z

The system is running Windows XP Home Edition sp3

I hope i've given enough information to get this started.  I've turned on email notifications for this thread so I'll be right on top of things to add more information, etc, throughout the day. 

Thanks in advance,

:11203


This thread was automatically locked due to age.
  • Hi,
    Well SAU attempts to install SAV and fails it seems:
    Trace(2011-Mar-29 10:46:01): ALUpdate(Install.Failure): SAVXP
    Trace(2011-Mar-29 10:46:01): SetupAction::Execute: Thread to install SAVXP returns 0
    We really need the MSI log and the custom actions log of the install, they are a pair and will be in:
    \windows\temp\
    Look for the latest 2 with the same timestamp in the filename,
    Regards,
    Jak
    :11209
  • Here's all the log files from the windows/temp directory related to sophos.  Figured you can pick the ones you want to look at, in case any of the other ones shed light on it for you.  A couple were too large for the 512k pastebin max, so I uploaded the txt files to another host:

    Sophos Anti-Virus CustomActions Log_110329_063435: http://ifile.it/nao5mqw

    Sophos Anti-Virus Install Log_110329_063435: http://pastebin.com/RHZuQfHr

    *edit*Sophos AutoUpdate install log: http://ifile.it/ba0ywpn

    Sophos Client Firewall install log: http://pastebin.com/eGk96zX0

    Sophos RMS install log:  http://pastebin.com/epApLe37

    Sophos RMS Install Log_20110329_133417: http://pastebin.com/hMisRfqT

    :11213
  • HI,

    Looking in the SAV msi log it looks like the custom action:
    RegisterBufferOverflowProtection
    is failing.  
    In the corresponding CA log we see:
    2011-03-29 13:35:04 Error opening Windows key
    2011-03-29 13:35:04 GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\detoured.dll does not exist, no further action.
    2011-03-29 13:35:04 Failed to open the AppInit_DLLs key
    so I suspect it is worth checking:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    Sophos is trying to add an entry to the value: AppInit_DLLs to ensure that detours is loaded into each user process.  I suspect the permissions on the above key might be not quite as expected. Maybe compare them with another machine that is ok.
    If that all fails running Process Monitor (http://technet.microsoft.com/en-us/sysinternals/bb896645) with a class filter of registry with a path of:
    "Windows NT\CurrentVersion\Windows"
    Would be interesing if not obvious when SAV next attempts an install (Just kicking on update now should cause AutoUpdate to try again).
    Regards,
    Jak
    :11217
  • I suspect you've hit the nail on the head.  the windows folder on the registry returns a "Cannot open Windows.  Error while opening key." when I navigate to the path you mentioned above.   I should be able to take it from here, thanks!

    :11219