Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 8 replies
  • Subscribers 1 subscriber
  • Views 19599 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

MSI error - Sophos Anti-Virus -- Configuration failed.

hal

I am having trouble with a machine, it won't update. I have protected again but makes no difference. For some reason it won't let me manually uninstall SAV as it says I am not a Sophos admin, which is not true.

The log file says at the end (Sophos Anti-Virus Major Install Log_121001_100059)

MSI (s) (D4:28) [23:02:50:522]: Note: 1: 1729 MSI (s) (D4:28) [23:02:50:522]: Product: Sophos Anti-Virus -- Configuration failed.

MSI (s) (D4:28) [23:02:50:537]: Cleaning up uninstalled install packages, if any exist MSI (s) (D4:28) [23:02:50:537]: MainEngineThread is returning 1603 MSI (s) (D4:E4) [23:02:50:646]: Destroying RemoteAPI object. MSI (s) (D4:3C) [23:02:50:646]: Custom Action Manager thread ending. === Logging stopped: 01/10/2012  23:02:50 === MSI (c) (D0:1C) [23:02:50:646]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be

denied.  Counter after decrement: -1 MSI (c) (D0:1C) [23:02:50:646]: MainEngineThread is returning 1603 === Verbose logging stopped: 01/10/2012  23:02:50 ===

2012-10-01 23:02:50 ERROR: Installation failed

I can't post the whole thing as it is large, and contains sensitive info.

Can anyone help with this please?

Thanks

:33439


This thread was automatically locked due to age.
  • 0

    HI,

    I would suggest continuing with the uninstall.

    Is your Windows user account a member of the local "SophosAdministrator" group?  If not add it to that, first and try an uninstall.  Run 

    lusrmgr.msc to add your account the group "SophosAdministrator".

    If it still fails. go into services (services.msc) and stop the Sophos Anti-Virus service, then try an uninstall, does that work?

    Regards,

    Jak

    :33443
  • 0

    Hello hal,

    the end of the log contains just the "final statement" - to locate the error please search for Return value 3, the preceding lines have more information. It might be necessary to inspect the Sophos Anti-Virus CustomActions Log_121001_100059. There shouldn't be sensitive info in the lines before the error(s) in the Major Install and CustomActions logs so it should be possible to post the snippets here.

    Christian

    :33445
  • 0

    This any use? Thanks!

    MSI (s) (D4:28) [23:02:19:773]: Executing op: ComponentRegister(ComponentId={D0457C5C-2602-48AF-9F0D-

    F73C1A499E8E},KeyPath=C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe,State=3,ProductKey=

    {9ACB414D-9347-40B6-A453-5EFB2DB59DFA},,SharedDllRefCount=0,BinaryType=0) MSI (s) (D4:28) [23:02:19:773]: Executing op: ActionStart(Name=CloseSavMainWindow,,) MSI (s) (D4:28) [23:02:19:773]: Executing op: ActionStart(Name=SetUpdateBegin,,) MSI (s) (D4:28) [23:02:19:773]: Executing op: ActionStart(Name=RunErrorScript,,) MSI (s) (D4:28) [23:02:19:773]: Executing op: CustomActionRollback

    (Action=RunErrorScript,ActionType=1345,Source=BinaryData,Target=RunErrorScripts,CustomActionData="C:\Program

    Files\Sophos\Sophos Anti-Virus\""C:\Program Files\Sophos\AutoUpdate\cache\savxp\""10.0.8") MSI (s) (D4:20) [23:02:19:804]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI62.tmp,

    Entrypoint: RunErrorScripts MSI (s) (D4:28) [23:02:19:944]: Executing op: ActionStart(Name=CheckRegForNullDACLs,,) MSI (s) (D4:28) [23:02:19:944]: Executing op: ActionStart(Name=RestoreMovedFiles,,) MSI (s) (D4:28) [23:02:19:944]: Executing op: CustomActionRollback

    (Action=RestoreMovedFiles,ActionType=1281,Source=BinaryData,Target=RestoreMovedFiles,CustomActionData=C:

    \Program Files\Sophos\Sophos Anti-Virus\) MSI (s) (D4:3C) [23:02:19:959]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI63.tmp,

    Entrypoint: RestoreMovedFiles MSI (s) (D4:28) [23:02:20:146]: Executing op: ActionStart(Name=SetUpdateFailed,,) MSI (s) (D4:28) [23:02:20:146]: Executing op: CustomActionRollback

    (Action=SetUpdateFailed,ActionType=1281,Source=BinaryData,Target=SetUpdateFailed,) MSI (s) (D4:4C) [23:02:20:161]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI64.tmp,

    Entrypoint: SetUpdateFailed MSI (s) (D4:28) [23:02:50:180]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0) MSI (s) (D4:28) [23:02:50:180]: Error in rollback skipped. Return: 5 MSI (s) (D4:28) [23:02:50:195]: No System Restore sequence number for this installation. MSI (s) (D4:28) [23:02:50:195]: Unlocking Server MSI (s) (D4:28) [23:02:50:195]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'. Action ended 23:02:50: INSTALL. Return value 3.

    :33451
  • 0

    Hello hal,

    it's a start - could you please post the CustomActions log as well

    Christian

    :33453
  • 0

    Here it is!

    2012-10-03 22:26:27 ExtractClassicConfig: Action started
    2012-10-03 22:26:27 ExtractClassicConfig: Action succeeded
    2012-10-03 22:26:28 PreInstallChecks: Action started
    2012-10-03 22:26:28 PreInstallChecks: Action succeeded
    2012-10-03 22:26:30 SetBootDriverStartupProperty: Action started
    2012-10-03 22:26:30 SetBootDriverStartupProperty: Boot driver: not installed.
    2012-10-03 22:26:30 SetBootDriverStartupProperty: Action succeeded
    2012-10-03 22:26:46 SetClassFilterPresentProperty: Action started
    2012-10-03 22:26:46 SetClassFilterPresentProperty: Setting class filter present property to: 1
    2012-10-03 22:26:46 SetClassFilterPresentProperty: Action succeeded
    2012-10-03 22:26:47 SetDriverProperty: Action started
    2012-10-03 22:26:47 SetDriverProperty: PROCESSOR_ARCHITECTURE environment variable is: x86
    2012-10-03 22:26:47 SetDriverProperty: Action succeeded
    2012-10-03 22:26:48 SetProcessorProperties: Action started
    2012-10-03 22:26:48 SetProcessorProperties: Action succeeded
    2012-10-03 22:26:58 CheckRegForNullDACLs: Action started
    2012-10-03 22:26:58 CheckRegForNullDACLs: Action succeeded
    2012-10-03 22:27:00 SetUpdateBegin: Action started
    2012-10-03 22:27:30 SetUpdateBegin: Unable to create an instance of ComponentManager - SystemInformation will not be informed of the update (0x80080005)
    2012-10-03 22:27:30 SetUpdateBegin: Action succeeded
    2012-10-03 22:27:30 CloseSavMainWindow: Action started
    2012-10-03 22:27:30 CloseSavMainWindow: CloseSavMainWindow: failed to open Software\Sophos\SAVUI 2
    2012-10-03 22:27:30 CloseSavMainWindow: Action succeeded
    2012-10-03 22:27:32 DisableServices: Action started
    2012-10-03 22:27:33 DisableServices: Action succeeded
    2012-10-03 22:27:49 ForceStopSAVService: Action started
    2012-10-03 22:27:49 ForceStopSAVService: ForceStopService: Stopping SAVService
    2012-10-03 22:27:49 ForceStopSAVService: ForceStopService: Checking if service is still running
    2012-10-03 22:27:49 ForceStopSAVService: ForceStopService: Stopping SAVAdminService
    2012-10-03 22:27:49 ForceStopSAVService: ForceStopService: Checking if service is still running
    2012-10-03 22:27:49 ForceStopSAVService: ForceStopSAVService: Services have been stopped
    2012-10-03 22:27:49 ForceStopSAVService: Action succeeded
    2012-10-03 22:27:49 WaitForSAVService: Action started
    2012-10-03 22:27:49 WaitForSAVService: WaitForSAVService: Walking system processes...
    2012-10-03 22:27:49 WaitForSAVService: WaitForSAVService: Finished walking system processes.
    2012-10-03 22:27:49 WaitForSAVService: Action succeeded
    2012-10-03 22:27:50 CheckUninstallDrivers: Action started
    2012-10-03 22:27:50 CheckUninstallDrivers: IsServiceInstalled: Unable to get a handle to requested service SAVOnAccess control. Returning false.
    2012-10-03 22:27:50 CheckUninstallDrivers: IsServiceInstalled: Unable to get a handle to requested service SAVOnAccess filter. Returning false.
    2012-10-03 22:27:50 CheckUninstallDrivers: Action succeeded
    2012-10-03 22:27:50 UninstallBootDriverFromInf: Action started
    2012-10-03 22:27:50 UninstallBootDriverFromInf: Executing RunInfSection with DefaultUninstall and DefaultUninstall.Services
    2012-10-03 22:27:50 UninstallBootDriverFromInf: RunInfSection: Error calling SetupOpenInfFile() 0x80070002. ErrorLine is 0
    2012-10-03 22:27:50 UninstallBootDriverFromInf: Action failed
    2012-10-03 22:27:55 RollbackDisableServices: Action started
    2012-10-03 22:27:57 RollbackDisableServices: Action succeeded
    2012-10-03 22:27:58 RunErrorScripts: Action started
    2012-10-03 22:27:58 RunErrorScripts: Action succeeded
    2012-10-03 22:27:58 RestoreMovedFiles: Action started
    2012-10-03 22:27:58 RestoreMovedFiles: Action succeeded
    2012-10-03 22:27:58 SetUpdateFailed: Action started
    2012-10-03 22:28:28 SetUpdateFailed: Unable to create an instance of ComponentManager - SystemInformation cannot be informed of end of update
    2012-10-03 22:28:28 SetUpdateFailed: Action succeeded

    :33519
  • 0

    Thanks, hal

    Can't say I'm sure what the problem is - as far as I can see the failing action is UninstallBootDriverFromInf and SetupOpenInfFile() 0x80070002 suggests that it couldn't open SophosBootDriver.inf. Looks like some Installer information is messed up.

    To get to the root to the cause it's probably necessary to analyze what's there and what's not and to view all the logs - thus it might be better to give Support a call. Personally I'd give the Microsoft Fix-It tool (Fix problems with programs that can't be installed or uninstalled) a try - the drawback is that it will remove information necessary information needed for analysis (please see Troubleshooting and resolving problematic Sophos endpoint upgrade and uninstall issues). My guess is you will be able to install then - but if you are not confident better call Support first.

    Sorry that I can't give a better advice

    Christian

    :33531
  • 0

    So I found that the PC has no Sophos groups on it,. I guess this might be why I cannot uninstall the old version of Sophos.

    :33795
  • 0

    Hello hal,

    so you did not (yet) try the Fix-It?

    Can't say why the Sophos groups "disappeared" but it might be a consequence of a previous failure. While you could create the groups manually, add the appropriate account to Sophos Administrator and then follow 113207 to update machine.xml (which should then allow the uninstall) I fear this won't resolve the problem with the .inf file - but of course trying it would not make the problem worse.

    Christian

    :33799
Unfiltered HTML