Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 10 replies
  • Subscribers 1 subscriber
  • Views 26315 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SAV Installation Error

MiDo

Hi all,

we unfortunately encounter the following situtaion on several of our PCs:

in the Enterprise Console we see several PCs with Update-Error saying that SAVXP could not have been installed, the MSI could not have been executed (translated from the original German error-meesage).

The Anti Virus Major Install Log displays the following:

MSI (s) (30:88) [08:37:59:478]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIFD91.tmp, Entrypoint: UpdateSAVI
MSI (s) (30:18) [08:37:59:944]: Executing op: ActionStart(Name=SetFolderPermissions,,)
MSI (s) (30:18) [08:37:59:945]: Executing op: CustomActionSchedule(Action=SetFolderPermissions,ActionType=1025,Source=BinaryData,Target=SetFolderPermissions,CustomActionData=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\)
MSI (s) (30:6C) [08:37:59:946]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIFF66.tmp, Entrypoint: SetFolderPermissions
CustomAction SetFolderPermissions returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (30:18) [08:37:59:957]: User policy value 'DisableRollback' is 0
MSI (s) (30:18) [08:37:59:957]: Machine policy value 'DisableRollback' is 0
Action ended 8:37:59: InstallFinalize. Return value 3.

The Custom Actions Log displays:

2014-03-10 08:37:59 SetFolderPermissions: Action started
2014-03-10 08:37:59 SetFolderPermissions: AddSpecifiedPermissionsToKey Unable to open registry key Software\Sophos\SAVService\PP (00000002)
2014-03-10 08:37:59 SetFolderPermissions: Add permissions to SavService\PP failed (0x80070002)
2014-03-10 08:37:59 SetFolderPermissions: Action failed

I've searched the internet a long time but couldn't find any hints.

Any help is apreciated.

BR,

Michael

:47960


This thread was automatically locked due to age.
Parents
  • 0

    Hello Michael,

    according to the log Sophos Anti-Virus is not installed and thus uninstall (of SAVXP) is not an option. That SAVXP isn't installed suggests that it has been uninstalled at some point - did you manually uninstall it? And if, how did you attempt to reinstall? Running the main setup.exe or by requesting an update? If the log is from an update performed by AutoUpdate there should be previous but recent Major Install logs - in which case I assume that the oldest is significantly different from the following.

    The mentioned key should be written to the registry by the Installer shortly before SetFolderPermissions is executed. That the SAVService key is not there is correct if the product is not installed.

    Should I delete the whole Sophos-Path in the registry

    Generally one shouldn't do such a thing unless recommended by the vendor (especially for products installed with Microsoft Installer). And if I'm not mistaken AutoUpdate and RMS are still installed, aren't they? 

    You could check the permissions on the \Software\Wow6432Node\Sophos key, they are likely correct. As you seem to be in a domain environment - have recently changes been made to the group policies? Personally I'd use Sysinternal's Process Monitor to see what happens to and with the \SAVService\PP key. If you haven't uninstalled the other components please do and then try a full install.

    Usually you should run the diagnostic utility (SDU) before any other actions but you say that several PCs are affected so evidence should be there.

    Christian

    :48126
Reply
  • 0

    Hello Michael,

    according to the log Sophos Anti-Virus is not installed and thus uninstall (of SAVXP) is not an option. That SAVXP isn't installed suggests that it has been uninstalled at some point - did you manually uninstall it? And if, how did you attempt to reinstall? Running the main setup.exe or by requesting an update? If the log is from an update performed by AutoUpdate there should be previous but recent Major Install logs - in which case I assume that the oldest is significantly different from the following.

    The mentioned key should be written to the registry by the Installer shortly before SetFolderPermissions is executed. That the SAVService key is not there is correct if the product is not installed.

    Should I delete the whole Sophos-Path in the registry

    Generally one shouldn't do such a thing unless recommended by the vendor (especially for products installed with Microsoft Installer). And if I'm not mistaken AutoUpdate and RMS are still installed, aren't they? 

    You could check the permissions on the \Software\Wow6432Node\Sophos key, they are likely correct. As you seem to be in a domain environment - have recently changes been made to the group policies? Personally I'd use Sysinternal's Process Monitor to see what happens to and with the \SAVService\PP key. If you haven't uninstalled the other components please do and then try a full install.

    Usually you should run the diagnostic utility (SDU) before any other actions but you say that several PCs are affected so evidence should be there.

    Christian

    :48126
Children
No Data
Unfiltered HTML