Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 1929 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cannot Install 9.5 " The MSI has failed"

Ron83

Hello Everyone,

I am struggling with getting sophos 9.5 to install on one of my clients.  It is a windows XPS SP3 machine. It had Sophos installed but quit updating all at once.  Looking at the log is says " Failed to install SAVXP: The MSI has failed".  I have tried removing all the sophos software and manually deleting every sophos folder I can find. I have tried pushing the install from the console, and installing manually.  I have also re-registered the windows installer service.  Does anyone have any ideas?  Thanks for any assistance you can give!!

I would post the install log, but its beyond the 20,000 character limit. However I read on the forum that the pertinent information is usually near the "value 3" lines so I have posted them below.

(Action=RollbackForceDeleteFiles,ActionType=1281,Source=BinaryData,Target=ForceDeleteFiles,CustomActionData=C:\Program Files\Sophos\Sophos Anti-Virus\)
MSI (s) (3C:D8) [14:22:46:640]: Executing op: ActionStart(Name=RollbackOtherFiles,,)
MSI (s) (3C:D8) [14:22:46:640]: Executing op: CustomActionSchedule(Action=RollbackOtherFiles,ActionType=1281,Source=BinaryData,Target=DeleteOtherFiles,CustomActionData=C:\Program Files\Sophos\Sophos Anti-Virus\)
MSI (s) (3C:D8) [14:22:46:656]: Executing op: ActionStart(Name=RollbackUpdateSavAdapterDll,,)
MSI (s) (3C:D8) [14:22:46:656]: Executing op: CustomActionSchedule(Action=RollbackUpdateSavAdapterDll,ActionType=1281,Source=BinaryData,Target=RollbackUpdateSavAdapterDll,CustomActionData=C:\Program Files\Sophos\Sophos Anti-Virus\)
MSI (s) (3C:D8) [14:22:46:656]: Executing op: ActionStart(Name=UpdateSavAdapterDll,,)
MSI (s) (3C:D8) [14:22:46:671]: Executing op: CustomActionSchedule(Action=UpdateSavAdapterDll,ActionType=1025,Source=BinaryData,Target=UpdateSavAdapterDll,)
MSI (s) (3C:20) [14:22:46:671]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI114.tmp, Entrypoint: UpdateSavAdapterDll
MSI (s) (3C:D8) [14:22:57:000]: Executing op: ActionStart(Name=CopyOtherFiles,,)
MSI (s) (3C:D8) [14:22:57:000]: Executing op: CustomActionSchedule(Action=CopyOtherFiles,ActionType=1025,Source=BinaryData,Target=CopyOtherFiles,CustomActionData="C:\Program Files\Sophos\Sophos Anti-Virus\""C:\Program Files\Sophos\AutoUpdate\cache\savxp\""XP")
MSI (s) (3C:BC) [14:22:57:015]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI115.tmp, Entrypoint: CopyOtherFiles
MSI (s) (3C:D8) [14:22:57:140]: Executing op: ActionStart(Name=RegisterBufferOverflowProtection,,)
MSI (s) (3C:D8) [14:22:57:140]: Executing op: CustomActionSchedule(Action=RegisterBufferOverflowProtection,ActionType=1025,Source=BinaryData,Target=RegisterBufferOverflowProtection,CustomActionData=C:\Program Files\Sophos\Sophos Anti-Virus\)
MSI (s) (3C:14) [14:22:57:156]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI116.tmp, Entrypoint: RegisterBufferOverflowProtection
MSI (s) (3C:D8) [14:22:57:218]: User policy value 'DisableRollback' is 0
MSI (s) (3C:D8) [14:22:57:218]: Machine policy value 'DisableRollback' is 0
Action ended 14:22:57: InstallFinalize. Return value 3.
MSI (s) (3C:D8) [14:22:57:234]: Executing op: Header(Signature=1397708873,Version=301,Timestamp=1045066452,LangId=1033,Platform=0,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)

MSI (s) (3C:D8) [14:22:58:703]: Executing op: ComponentUnregister(ComponentId={FE613E3D-0469-40F8-9A0F-635D16097928},ProductKey={9ACB414D-9347-40B6-A453-5EFB2DB59DFA},BinaryType=0,)
MSI (s) (3C:D8) [14:22:58:703]: Executing op: ComponentUnregister(ComponentId={3276B786-D941-4ABD-810D-5AE5E3106F02},ProductKey={9ACB414D-9347-40B6-A453-5EFB2DB59DFA},BinaryType=0,)
MSI (s) (3C:D8) [14:22:58:703]: Executing op: ComponentUnregister(ComponentId={F4E436FD-FE28-4278-86D5-E3412859F5E5},ProductKey={9ACB414D-9347-40B6-A453-5EFB2DB59DFA},BinaryType=0,)
MSI (s) (3C:D8) [14:22:58:703]: Executing op: ComponentUnregister(ComponentId={A153DC07-D119-4900-B5D1-F671EC25C7EB},ProductKey={9ACB414D-9347-40B6-A453-5EFB2DB59DFA},BinaryType=0,)
MSI (s) (3C:D8) [14:22:58:703]: Executing op: ComponentUnregister(ComponentId={D0457C5C-2602-48AF-9F0D-F73C1A499E8E},ProductKey={9ACB414D-9347-40B6-A453-5EFB2DB59DFA},BinaryType=0,)
MSI (s) (3C:D8) [14:22:58:703]: Executing op: ActionStart(Name=RunErrorScript,,)
MSI (s) (3C:D8) [14:22:58:703]: Executing op: CustomActionRollback(Action=RunErrorScript,ActionType=1345,Source=BinaryData,Target=RunErrorScripts,CustomActionData="C:\Program Files\Sophos\Sophos Anti-Virus\""C:\Program Files\Sophos\AutoUpdate\cache\savxp\""9.5.5")
MSI (s) (3C:10) [14:22:58:703]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI11A.tmp, Entrypoint: RunErrorScripts
MSI (s) (3C:D8) [14:22:58:750]: Executing op: ActionStart(Name=CheckRegForNullDACLs,,)
MSI (s) (3C:D8) [14:22:58:750]: Executing op: ActionStart(Name=RestoreMovedFiles,,)
MSI (s) (3C:D8) [14:22:58:750]: Executing op: CustomActionRollback(Action=RestoreMovedFiles,ActionType=1281,Source=BinaryData,Target=RestoreMovedFiles,CustomActionData=C:\Program Files\Sophos\Sophos Anti-Virus\)
MSI (s) (3C:30) [14:22:58:750]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI11B.tmp, Entrypoint: RestoreMovedFiles
MSI (s) (3C:D8) [14:22:58:781]: Executing op: ActionStart(Name=SetUpdateFailed,,)
MSI (s) (3C:D8) [14:22:58:781]: Executing op: CustomActionRollback(Action=SetUpdateFailed,ActionType=1281,Source=BinaryData,Target=SetUpdateFailed,)
MSI (s) (3C:74) [14:22:58:781]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI11C.tmp, Entrypoint: SetUpdateFailed
MSI (s) (3C:D8) [14:22:58:828]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (3C:D8) [14:22:58:828]: Error in rollback skipped.    Return: 5
MSI (s) (3C:D8) [14:22:58:828]: No System Restore sequence number for this installation.
MSI (s) (3C:D8) [14:22:58:828]: Unlocking Server
MSI (s) (3C:D8) [14:22:58:828]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 14:22:58: INSTALL. Return value 3.

:9005


This thread was automatically locked due to age.
  • 0

    Hi,

    Are you able to post the corresponding custom actions log file?  It's in the same directory as the msi with the same time stamp in the file name.

    Regards,

    Jak

    :9009
  • 0

    Absolutely,

    Here it is.

    2011-02-10 14:22:28 Starting competitor detection...
    2011-02-10 14:22:32 Boot driver: not installed.
    2011-02-10 14:22:36 Setting class filter present property to: 0
    2011-02-10 14:22:36 PROCESSOR_ARCHITECTURE environment variable is: x86
    2011-02-10 14:22:42 WaitForSAVService: Walking system processes...
    2011-02-10 14:22:42 WaitForSAVService: Finished walking system processes.
    2011-02-10 14:22:44 IsServiceInstalled: Unable to get a handle to requested service SAVOnAccess control. Returning false.
    2011-02-10 14:22:44 IsServiceInstalled: Unable to get a handle to requested service SAVOnAccess filter. Returning false.
    2011-02-10 14:22:57 CopyOtherFiles custom action - Copying other driver files
    2011-02-10 14:22:57 Copying class filter source: C:\Program Files\Sophos\AutoUpdate\cache\savxp\classfilterdrivers\i386\SDCFILTER.INF, target: C:\Program Files\Sophos\Sophos Anti-Virus\
    2011-02-10 14:22:57 GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\sophos_detoured.dll does not exist, no further action.
    2011-02-10 14:22:57 PROCESSOR_ARCHITECTURE environment variable is: x86
    2011-02-10 14:22:57 Error opening Windows key
    2011-02-10 14:22:57 GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\detoured.dll does not exist, no further action.
    2011-02-10 14:22:57 Failed to open the AppInit_DLLs key
    2011-02-10 14:22:57 GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\sophos_detoured.dll detoured exists, proceeding to rename it & mark for delete.
    2011-02-10 14:22:57 PROCESSOR_ARCHITECTURE environment variable is: x86
    2011-02-10 14:22:57 GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\detoured.dll does not exist, no further action.
    2011-02-10 14:22:57 Deleting config file folder
    2011-02-10 14:22:57 Failed to delete config folder, 2
    2011-02-10 14:22:58 Error deleting DesktopMessaging registry key. Returned error was: The system cannot find the file specified.

    2011-02-10 14:22:58 RestoreMovedFiles(): Unexpected error 0x00000003 when looking for temporary files
    2011-02-10 14:22:58 Unable to create an instance of ComponentManager - SystemInformation cannot be informed of end of update

    :9011
  • 0

    Hi,

    I wonder if:

    "2011-02-10 14:22:57 Error opening Windows key" and "2011-02-10 14:22:57 Failed to open the AppInit_DLLs key"

    are the problem.  In the MSI log you have:

    MSI (s) (3C:14) [14:22:57:156]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI116.tmp, Entrypoint: RegisterBufferOverflowProtection
    MSI (s) (3C 8) [14:22:57:218]: User policy value 'DisableRollback' is 0
    MSI (s) (3C 8) [14:22:57:218]: Machine policy value 'DisableRollback' is 0
    Action ended 14:22:57: InstallFinalize. Return value 3.

    So there is an "Return value 3" shortly following the custom action RegisterBufferOverflowProtection.  I can only assume this custom action is responsible for adding the AppInit registry key (This key is BOPS related (http://www.sophos.com/support/knowledgebase/article/112099.html)), namely:

    "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs"

    C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL

    I would suggest first of all checking the above key.  possibly the permissions on it, maybe clear out the key of previous entries that maybe Sophos related.  You could check the effective permissions on it for the system account.  I would assume that as AutoUpdate is installing SAV and this is being carried out by alupdate.exe running as system, system would be writing the key.

    If there is nothing obvious. I would suggest letting the install run through again but run Process Monitor (http://technet.microsoft.com/en-us/sysinternals/bb896645) at the same time to log all that the installer is doing.  In there you might see some errors such as "access denied", etc.

    Hope that helps.  

    Thanks,

    Jak

    :9013
Unfiltered HTML