This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Failed to install savxp 80041f19

Sophos antivirus endpoint solution was installed successfully in dozens of machines, except in two.

On those machines, the log firstly complained about third party software, the previous antivirus was Microsoft Windows antivirus.

All malware tools were removed. The Windows antivirus was even turned-off manually.

Nevertheless, the installation error remains (see image in attachment). The installation now comes to an end but there is some sort of malfunction in the software.

Thank you for your help.

This thread was automatically locked due to age.

Parents

0 Mike Baum over 6 years ago

I am receiving the same error. the avremove.txt file is stating it was unable to uninstall Vipre 7.x, however that AV is currently not installed.

Here is the log: https://pastebin.com/WW4WFCHQ
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to Mike Baum

Hello Mike Baum,

are you using Central or SESC? AFAIK you don't have many options for the former as opposed to the on-premise version. Apparently TraceLogging was not enabled, it might have told why it thinks removal failed.
It did run the command in UninstallString (the line with Creating new process) but this returned in less than a second so unlikely that actual removal was attempted by this command. Not clear if AgentUninstallPassword.exe writes a log, if then I assume it'd be in \Windows\Temp.

that AV is currently not installed
you mean it's not in Programs and Features, or no trace of it on the disk? CRT does detect it and as far as I can see from the CRT data it's found in HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall (you should find it by searching for AgentUninstallPassword.exe). If you run the UninstallString command in an elevated cmd window it might tell why it refuses to uninstall.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Mike Baum over 6 years ago in reply to QC

I am using Central for all my deployments. Oddly enough, I could not find AgentUninstallPassword.exe in regedit. There are a lot of instances of Vipre, but the program is removed in Add/Remove programs and I do not see any services running.
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to Mike Baum

Hello Mike Baum,

according to Sophos Central: Endpoint installer and the detection of other security software under A third party product is detected that has already been removed the log should be verbose. The one you've posted is not.
If the \crt folder containing the AVRemove.exe isn't left behind as the article suggests you should be able to extract it from a full installer. Extract and modify CRT.cfg to enable TraceLogging - this should tell you what caused the Vipre detection.

It's also possible to tell the installer to ignore third-party products but this option should be used with caution.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Mike Baum over 6 years ago in reply to QC

Got it figured out, turns out someone also installed Webroot on the machine. Thank you!
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Mike Baum over 6 years ago in reply to QC

Got it figured out, turns out someone also installed Webroot on the machine. Thank you!
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data