Fails to install SAVXP : The MSI has failed

Question

Hi, 
 I wonder if anybody has had this issue below that was taken from the Sophos Anti-Virus Major Install Log.... 
 CAQuietExec: Entering CAQuietExec in C:\Windows\Installer\MSI6D6D.tmp, version 3.5.2519.0 CAQuietExec: "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_di.exe" -r "C:\Windows\TEMP\SwiRebootRequired.txt" "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_callout.inf" CAQuietExec: driverInstaller CAQuietExec: CAQuietExec: Installation error: The driver package is not signed. CAQuietExec: error:1 CAQuietExec: Error 0x80070001: Command line returned an error. CAQuietExec: Error 0x80070001: CAQuietExec Failed CustomAction SwiCalloutInstall.11DACB83_28A7_4FA6_AF5B_C006E340C101 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox) 
 This has happened on a particular server pushing out the major April update. 
 Everything is managed on Sophos enterprise console(v5.2.1). 
 it appears to be related to the web intelligence driver install with an error of &lsquo;CAQuietExec: Installation error: The driver package is not signed.&rsquo; And then it rolls back. 
 Would appreciate any advice of what maybe causing this. 
 Thanks 
 AP

AndrewPargeter · Accepted Answer

Hi Ritchie, 
 Just in case you are still having issues with AV installing or anybody else who runs into this issue. 
 We have been working with the Sophos Support Development Team and found a solution to what was affecting 6 specific servers in the end. 
 We have to perform the following on each affected machine.... 
 1. Open up the registry 
 2. Navigate to '[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing]' 
 3. Look for the key "State"=dword:" 
 4. Modify the following key to '00023c00' if it isn't set to that already. 
 5. It should then read '0x00023c00 (146432)' 
 6. Reboot the machine. 
 7. Run the script to perform the install once again or simply right click the Sophos client menu and update. 
 
 This worked a treat for us on every server and Sophos claimed it was due to this.... 
 https://support.microsoft.com/en-us/kb/2715304 
 I did point out to the Sophos development team that none of the affected servers had that particular update installed on the servers. 
 The only thing in common that each of these machines have is Oracle software and we think this could have somehow corrupted the key within the registry when it was installed after AV went onto each machine at a clean OS state. 
 We ran into this overall issue when the major April update came out.