Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 5 subscribers
  • Views 27034 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Auto-update 4.3.10.27 cant uninstall due to missing .msi file

TechTester

A number of my servers in the last few days are having issues updating to the latest version of Auto-update. We were getting this error in the event logs:

LogName=Application

SourceName=MsiInstaller

EventCode=11714

EventType=2 Type=Error

Message=Product: Sophos AutoUpdate -- Error 1714.The older version of Sophos AutoUpdate cannot be removed. Contact your technical support group. System Error 1612.


I checked one of the systems and it shows the rest of the Sophos systems have been updated because their install times in programs and features shows 4/14/16 but Auto-Update last update was 7/28/15 version 4.3.10.27. I tried to manually remove it and it prompted me for an .msi file, I also did some looking int the temp folder and found uninstall logs showing it trying to uninstall about every half hour and the logs also reflect failure due to the missing .msi file.

community.sophos.com/.../1910

I found here an interesting way to possibly resolve the issue by installing the older copy of the Auto-update and then manually upgrading it and looking into the upgrade logs for the location of the .msi file used to uninstall it and then copying it over to the system that was missing it. Problem is I have no idea where to get a copy of the Auto-update 4.3.10.27. Does anyone know how to get this or have a better way to resolve this issue?



This thread was automatically locked due to age.
  • 0

    Hi,

    Typically the cached MSI file under C:\windows\installer\ is used for the uninstall.  This also gives the new install the chance to modify the cached MSI file if needed.

    If you navigate to:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\

    You can usually search for the product, e.g. Sophos AutoUpdate.

    For example it might find:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\93035FCBCF7A97C43A3E34A72EF89D81\InstallProperties

    The value of interest is the localpackage, it is usually a file under C:\windows\installer, e.g. C:\Windows\Installer\ad9e902.msi

    Is this reference broken on your computer? I.e. Does the key exist and the file is missing? Is the registry key missing? Was the installer directory purged for some reason which could account for the missing cached MSI file?

    As a tip, when looking at the installer directory you can add the "Authors" column to see if it's a Sophos, Microsoft, etc., file.

    You could take the MSI of the installed version and "fix up" this reference.  The problem is, AutoUpdate on the computer has already downloaded to its local cache the next version of the MSI file so you would need to obtain the MSI for the currently installed package from another source/computer.  For example, you could subscribe to the previous software in SEC and harvest the missing MSI file from the generated CID.

    Hope it helps,

    Regards,

    Jak

  • 0 in reply to jak

    When we upgraded from 10.6 to 10.7 I found a number of PC that wont take the update.  I can uninstall all of the AV installed packages but the Sophos AV due to missing files.

    Other than re-imaging the PC is there a quick and easy to get the PC to take the update.

    In other AV products I have used you could delete a few folders and registry file to get it done.

    Does Sophos have anything like this?

  • 0 in reply to Navar Holmes

    Hello Navar Holmes,

    this might be a slightly different issue even if files are missing, so if it's not the AV .msi it'd perhaps be a good idea to start a new thread.

    delete a few folders and registry
    not advisable. Dunno about the other AV products but as AV with real-time protection has to integrate with the system to intercept file access installation is more than just dropping a few files and adding some registry values. And if a "simple" method would do exactly the same as a regular uninstall - why isn't it the preferred way?
    Sophos is installed using the Windows Installer and the Installer should be used to uninstall in order to get a clean system afterwards. Microsoft has a Fix-It tool in case the Installer database is corrupted - it has nevertheless to be applied with care and correctly. Otherwise the actual reason should be determined and dealt with.

    Having said this, if you encounter uninstall and/or upgrade problems you should ask first, not only after wielding the chainsaw [:)]. So, what files are missing?

    Christian

Unfiltered HTML