Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 11 replies
  • Subscribers 6 subscribers
  • Views 40499 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Update failing with Failed to install savxp: uninstalling an older product failed.

David Coombe

We have an endpoint that is failing on an update. In the past we've had our share of failed to install due to a previous version could not be installed, but this is the first time we've had this error message. I've had no luck in googling it.

 

If I try to uninstall the Sophos Endpoint Agent via the control panel, I get an error message saying that the I need to reboot the computer first. When I reboot and try again, I get the same error message. 

I've noticed in the Sophos anti-virus uninstall log, that there's a variable called  RebootYesNo set to yes. Are we able to set that to no? 

 

Would setting that to no, allow us to uninstall? 

 



This thread was automatically locked due to age.
Parents
  • +1

    David Coombe,

    doesn't look like the RebootYesNo property is actually used.
    Normally the log contains at least a hint why the .msi thinks a reboot is required. Please search for the string Return value 3 (might be more than one occurrence), the significant messages are in the lines above.

    Christian

  • 0 in reply to QC

    Hi Christian, 

    Thanks for the quick reply. I found two instances of Return value 3. The first instance is related to the Web Intelligence service,which makes sense, as this PC is having issues with that service. I've tried following the instructions found here https://community.sophos.com/kb/en-us/121905, but haven't had any luck restarting or manually  re-registering the service. I'm not sure what my next steps should be.   

     

    MSI (s) (C8:84) [13:14:16:496]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI157B.tmp, Entrypoint: UninstallService
    MSI (s) (C8:74) [13:14:16:512]: Executing op: ActionStart(Name=SwiCalloutUninstall.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
    CustomAction SwiFilterUninstall.11DACB83_28A7_4FA6_AF5B_C006E340C101 returned actual error code 1603 but will be translated to success due to continue marking
    MSI (s) (C8:74) [13:14:16:512]: Executing op: CustomActionSchedule(Action=SwiCalloutUninstall.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3137,Source=BinaryData,Target=CAQuietExec,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_di.exe" -r "C:\WINDOWS\TEMP\SwiRebootRequired.txt" /u "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_callout.inf")
    MSI (s) (C8:AC) [13:14:16:512]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI158C.tmp, Entrypoint: CAQuietExec
    CAQuietExec: driverInstaller
    CAQuietExec:
    CAQuietExec: Uninstallation error: Unknown error code: 0xe0000302
    CAQuietExec: error:1
    CAQuietExec: Error 0x80070001: Command line returned an error.
    CAQuietExec: Error 0x80070001: CAQuietExec Failed
    MSI (s) (C8:74) [13:14:16:918]: Executing op: ActionStart(Name=ForceStopSAVService,,)
    CustomAction SwiCalloutUninstall.11DACB83_28A7_4FA6_AF5B_C006E340C101 returned actual error code 1603 but will be translated to success due to continue marking
    MSI (s) (C8:74) [13:14:16:934]: Executing op: CustomActionSchedule(Action=ForceStopSAVService,ActionType=1025,Source=BinaryData,Target=ForceStopSAVService,)
    MSI (s) (C8:E8) [13:14:16:934]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI1732.tmp, Entrypoint: ForceStopSAVService
    MSI (s) (C8:74) [13:14:17:012]: Executing op: ActionStart(Name=WaitForSAVService,,)
    MSI (s) (C8:74) [13:14:17:012]: Executing op: CustomActionSchedule(Action=WaitForSAVService,ActionType=1025,Source=BinaryData,Target=WaitForSAVService,)
    MSI (s) (C8:24) [13:14:17:012]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI1782.tmp, Entrypoint: WaitForSAVService
    MSI (s) (C8:74) [13:14:17:059]: Executing op: ActionStart(Name=CleanUpSsspUserAccountRollback,,)
    MSI (s) (C8:74) [13:14:17:059]: Executing op: CustomActionSchedule(Action=CleanUpSsspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\SAVService)
    MSI (s) (C8:74) [13:14:17:059]: Executing op: ActionStart(Name=CleanUpSsspUserAccount,,)
    MSI (s) (C8:74) [13:14:17:059]: Executing op: CustomActionSchedule(Action=CleanUpSsspUserAccount,ActionType=1025,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\SAVService)
    MSI (s) (C8:D4) [13:14:17:059]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI17B1.tmp, Entrypoint: CleanUpSsspUserAccount
    MSI (s) (C8:74) [13:14:17:074]: Executing op: ActionStart(Name=RemoveSIPSSubmitterUserAccount,,)
    CleanUpSsspUserAccount: Initialized.
    MSI (s) (C8:74) [13:14:17:074]: Executing op: CustomActionSchedule(Action=RemoveSIPSSubmitterUserAccount,ActionType=1025,Source=BinaryData,Target=RemoveSIPSManagementUser,CustomActionData=NT SERVICE\SAVService)
    MSI (s) (C8:F4) [13:14:17:090]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI17C2.tmp, Entrypoint: RemoveSIPSManagementUser
    RemoveSIPSManagementUser Enter (290)
    Failed to delete value from the registry (319)
    CustomAction RemoveSIPSSubmitterUserAccount returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
    MSI (s) (C8:74) [13:14:17:121]: Note: 1: 2265 2: 3: -2147287035
    MSI (s) (C8:74) [13:14:17:121]: User policy value 'DisableRollback' is 0
    MSI (s) (C8:74) [13:14:17:121]: Machine policy value 'DisableRollback' is 0
    Action ended 13:14:17: InstallFinalize. Return value 3.

Reply
  • 0 in reply to QC

    Hi Christian, 

    Thanks for the quick reply. I found two instances of Return value 3. The first instance is related to the Web Intelligence service,which makes sense, as this PC is having issues with that service. I've tried following the instructions found here https://community.sophos.com/kb/en-us/121905, but haven't had any luck restarting or manually  re-registering the service. I'm not sure what my next steps should be.   

     

    MSI (s) (C8:84) [13:14:16:496]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI157B.tmp, Entrypoint: UninstallService
    MSI (s) (C8:74) [13:14:16:512]: Executing op: ActionStart(Name=SwiCalloutUninstall.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
    CustomAction SwiFilterUninstall.11DACB83_28A7_4FA6_AF5B_C006E340C101 returned actual error code 1603 but will be translated to success due to continue marking
    MSI (s) (C8:74) [13:14:16:512]: Executing op: CustomActionSchedule(Action=SwiCalloutUninstall.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3137,Source=BinaryData,Target=CAQuietExec,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_di.exe" -r "C:\WINDOWS\TEMP\SwiRebootRequired.txt" /u "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_callout.inf")
    MSI (s) (C8:AC) [13:14:16:512]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI158C.tmp, Entrypoint: CAQuietExec
    CAQuietExec: driverInstaller
    CAQuietExec:
    CAQuietExec: Uninstallation error: Unknown error code: 0xe0000302
    CAQuietExec: error:1
    CAQuietExec: Error 0x80070001: Command line returned an error.
    CAQuietExec: Error 0x80070001: CAQuietExec Failed
    MSI (s) (C8:74) [13:14:16:918]: Executing op: ActionStart(Name=ForceStopSAVService,,)
    CustomAction SwiCalloutUninstall.11DACB83_28A7_4FA6_AF5B_C006E340C101 returned actual error code 1603 but will be translated to success due to continue marking
    MSI (s) (C8:74) [13:14:16:934]: Executing op: CustomActionSchedule(Action=ForceStopSAVService,ActionType=1025,Source=BinaryData,Target=ForceStopSAVService,)
    MSI (s) (C8:E8) [13:14:16:934]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI1732.tmp, Entrypoint: ForceStopSAVService
    MSI (s) (C8:74) [13:14:17:012]: Executing op: ActionStart(Name=WaitForSAVService,,)
    MSI (s) (C8:74) [13:14:17:012]: Executing op: CustomActionSchedule(Action=WaitForSAVService,ActionType=1025,Source=BinaryData,Target=WaitForSAVService,)
    MSI (s) (C8:24) [13:14:17:012]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI1782.tmp, Entrypoint: WaitForSAVService
    MSI (s) (C8:74) [13:14:17:059]: Executing op: ActionStart(Name=CleanUpSsspUserAccountRollback,,)
    MSI (s) (C8:74) [13:14:17:059]: Executing op: CustomActionSchedule(Action=CleanUpSsspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\SAVService)
    MSI (s) (C8:74) [13:14:17:059]: Executing op: ActionStart(Name=CleanUpSsspUserAccount,,)
    MSI (s) (C8:74) [13:14:17:059]: Executing op: CustomActionSchedule(Action=CleanUpSsspUserAccount,ActionType=1025,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\SAVService)
    MSI (s) (C8:D4) [13:14:17:059]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI17B1.tmp, Entrypoint: CleanUpSsspUserAccount
    MSI (s) (C8:74) [13:14:17:074]: Executing op: ActionStart(Name=RemoveSIPSSubmitterUserAccount,,)
    CleanUpSsspUserAccount: Initialized.
    MSI (s) (C8:74) [13:14:17:074]: Executing op: CustomActionSchedule(Action=RemoveSIPSSubmitterUserAccount,ActionType=1025,Source=BinaryData,Target=RemoveSIPSManagementUser,CustomActionData=NT SERVICE\SAVService)
    MSI (s) (C8:F4) [13:14:17:090]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI17C2.tmp, Entrypoint: RemoveSIPSManagementUser
    RemoveSIPSManagementUser Enter (290)
    Failed to delete value from the registry (319)
    CustomAction RemoveSIPSSubmitterUserAccount returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
    MSI (s) (C8:74) [13:14:17:121]: Note: 1: 2265 2: 3: -2147287035
    MSI (s) (C8:74) [13:14:17:121]: User policy value 'DisableRollback' is 0
    MSI (s) (C8:74) [13:14:17:121]: Machine policy value 'DisableRollback' is 0
    Action ended 13:14:17: InstallFinalize. Return value 3.

Children
No Data
Unfiltered HTML