Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 11 replies
  • Subscribers 6 subscribers
  • Views 56116 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Failed to install savxp 80041f19

MarcoTeixeira

Hi

Sophos antivirus endpoint solution was installed successfully in dozens of machines, except in two.

On those machines, the log  firstly complained about third party software,  the previous antivirus was Microsoft Windows antivirus.

All malware tools were removed. The Windows antivirus was even turned-off manually. 

Nevertheless, the installation error remains (see image in attachment). The installation now comes to an end but there is some sort of malfunction in the software. 

 

Thank you for your help. 

 

 

 



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Mike Baum

    Hello Mike Baum,

    are you using Central or SESC? AFAIK you don't have many options for the former as opposed to the on-premise version. Apparently TraceLogging was not enabled, it might have told why it thinks removal failed.
    It did run the command in UninstallString (the line with Creating new process) but this returned in less than a second so unlikely that actual removal was attempted by this command. Not clear if AgentUninstallPassword.exe writes a log, if then I assume it'd be in \Windows\Temp. 

    that AV is currently not installed
    you mean it's not in Programs and Features, or no trace of it on the disk? CRT does detect it and as far as I can see from the CRT data it's found in HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall (you should find it by searching for AgentUninstallPassword.exe). If you run the UninstallString command in an elevated cmd window it might tell why it refuses to uninstall.

    Christian   

  • 0 in reply to QC

    I am using Central for all my deployments. Oddly enough, I could not find AgentUninstallPassword.exe in regedit. There are a lot of instances of Vipre, but the program is removed in Add/Remove programs and I do not see any services running.

  • 0 in reply to Mike Baum

    Hello Mike Baum,

    according to Sophos Central: Endpoint installer and the detection of other security software under A third party product is detected that has already been removed the log should be verbose. The one you've posted is not.
    If the \crt folder containing the AVRemove.exe isn't left behind as the article suggests you should be able to extract it from a full installer. Extract and modify CRT.cfg to enable TraceLogging - this should tell you what caused the Vipre detection.

    It's also possible to tell the installer to ignore third-party products but this option should be used with caution.

    Christian

  • 0 in reply to QC

    Got it figured out, turns out someone also installed Webroot on the machine. Thank you!

Unfiltered HTML