Sophos Anti-Virus 10.6.3 - Will not reinstall - Unexpected product state 1 for product

Hello Dietmar Schuhmann,

which previous version do you think you need what is the issue you are trying to resolve by installing a previous version? The thread is three years old, unlikely this issue is with a pre-10 version. You get indeed product state 1? Could you give some details about platform, installed version (if there is one), what kind of install fails?

Christian

Hi Christian, thanks for your quick response.

This thread corresponds to what I am currently experincing. I had sophos antivirus 10.6.3 installed on both win7 and win8.1. But as I wasn't able to update the database (getting a message 'Update process failed') I decided to re-install sophos antivirus 10.6.3 again. But the uninstall process didn't run smoothly. There were some messages popping up during the uninstall. After starting the installer (.exe) the software unpacked to the selected directory. Right after the unpacking a message window popped up saying 'Unexpected product state 1 for product...' and the installation process stopped.

I found this thread here where the user installed version 7 which finally resolved the problem. I didn't realise that the postings are of 2012. Anyway... Meanwhile I found (searching Google) that there are still 4 Sophos services active. Currently I have no antivirus installed. Not Sophos nor any other. Sophos is not possible (see above) and others I don't want.

I would appreciate if you could help me to be able to re-install the Sophos antivirus.

Hello Dietmar Schuhmann,

the updating issues were on both 7 and 8.1? And now the state 1 is also on both? Reinstall isn't a cure-all and IMO it's not the first thing to try. As 10.6.3 was on the machines installing a previous version won't help.

All Sophos services start with Sophos in their name - which ones are still listed and which are running? Which Sophos components are still in Programs and Features? Which installer (.exe) did you use (please give the exact name and the product line - Endpoint, Cloud, Home) and what is the product GUID in the Unexpected message?

Christian

Dear Christian,

I'm running Win7 and Win8.1 on the same computer on different partitions. I had sophos 10.6.3 installed on both partitions. Currently I'm not able to re-install it on any of the partitions. For the installation I used the installer savw_106_sa_sfx.exe. Currently there is no entry in Programs and features that could be used to uninstall the software. As I said I uninstalled Sophos Anti-virus Endpoint because it was no longer possible to update the program (a window popped up telling me that it would download the updates but nothing happened. The window closed without updating anything). Currently there are no services in the msconfig. In the task manager there are the following services listed: SAVService, SAVAdminService, Sophos AutoUpdate Service, sophossps and swi_update_64. None of them is running. When trying ot install the software again the files are unpacked, copied to the destination folder and after unpacking a window pops up saying 'During the installation of Sophos Endpoint Security and Control an unexpectd problem occurred. Details: Unexpected product state 1 for the product with code {09863DA9-7A9B-4430-9561-E04D178D7017}'

Hope that helps.

Thanks for your support.

Hello Dietmar Schuhmann,

the product is Sophos Anti-Virus. Guess there will be corresponding logs (name starts with Sophos Anti-Virus) in \Windows\Temp. Maybe you could attach a "set" of them here.
You say that there are no Sophos services when you open services.msc but the Task Manager shows these Sophos processes (and I assume you have already rebooted the machine)?

Wonder ifthe Microsoft Fix-It toll mentioned in Troubleshooting and resolving problematic Sophos endpoint upgrade and uninstall issues could help here. From your description you'd have to use the product code (the one for AutoUpdate is I think {BCF53039-A7FC-4C79-A3E3-437AE28FD918}.

Christian

Hello Christian,

there are some .log files in the Temp folder of Windows. I wonder which one you are interested in. Interestingly there is no uninstall log for the uninstall some days ago. I'll attach the install.log of 24OCT2016. There is also a Major Install log but from a different date (3 weeks ago). Here is the Sophos Anti-virus Install Log:

2016-10-24 07:50:58 Info: Logging started: installing/upgrading Sophos Anti-Virus
2016-10-24 07:50:58 Info: InstallFromPath is: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\decode\savxp\
2016-10-24 07:50:58 Info: InstallToPath is:
2016-10-24 07:50:58 Info: Detected version of SAV has major version number: 10
2016-10-24 07:50:58 Info: Detected version of SAV has minor version number: 6
2016-10-24 07:50:58 Info: registryInstallTo [overriding InstallToPath] is: D:\Program Files (x86)\Sophos\Sophos Anti-Virus\
2016-10-24 07:50:58 Checking for problem versions of SAVI - Install path:D:\Program Files (x86)\Sophos\Sophos Anti-Virus\
2016-10-24 07:50:58 Veex.dll version '3.64.3.2243'
2016-10-24 07:50:58 INFO: Checking the validity of the VDL manifest file.
2016-10-24 07:51:06 INFO: The manifest file has been successfully validated.
2016-10-24 07:51:06 INFO: Checking the validity of the AppFeed manifest file.
2016-10-24 07:51:06 INFO: The manifest file has been successfully validated.
2016-10-24 07:51:07 PROCESSOR_ARCHITECTURE environment variable is: AMD64
2016-10-24 07:51:07 Info: SetupPlugin: updateProps.m_MajorUpdate = 0
2016-10-24 07:51:07 Info: SetupPlugin: updateProps.m_DataOnlyUpdate = 1
2016-10-24 07:51:07 Info: SetupPlugin: updateProps.m_OnAccessDriverUpdate = 0
2016-10-24 07:51:07 Info: SetupPlugin: updateProps.m_BootDriverUpdate = 0
2016-10-24 07:51:07 Info: SetupPlugin: updateProps.m_ClassFilterUpdate = 0
2016-10-24 07:51:07 Info: SetupPlugin: updateProps.m_KMSDriverUpdate = 0
2016-10-24 07:51:07 Info: Standalone install (from SAU)
2016-10-24 07:51:07 Unable to QI IProductConfig
2016-10-24 07:51:07 Product type in registry: 0
2016-10-24 07:51:07 Checking the integrity of the extant SAV installation
2016-10-24 07:51:07 The is a complete SAV installation. Skipping recovery.
2016-10-24 07:51:07 UpdateVersionInfo(), SAU can't supply version info - using msi version
2016-10-24 07:51:07 Info: Logging started: performing minor update to Sophos Anti-Virus.
2016-10-24 07:51:07 Info: Beginning Shared Custom Actions. Logging will appear in Custom Action log.
2016-10-24 07:51:07 Info: Running Set Update Begin shared custom action.
2016-10-24 07:51:07 Info: Return Value from SetUpdateBegin: 0
2016-10-24 07:51:07 Info: Running DeleteRuleFiles(IDEs) shared custom action.
2016-10-24 07:51:07 Info: Return Value from DeleteRuleFiles(IDEs): 0
2016-10-24 07:51:07 Info: Running DeleteRuleFiles(HIPSConfig) shared custom action.
2016-10-24 07:51:07 Info: Return Value from DeleteRuleFiles(HIPSConfig): 0
2016-10-24 07:51:07 Info: Running DeleteRuleFiles(bdls) shared custom action.
2016-10-24 07:51:07 Info: Return Value from DeleteRuleFiles(bdls): 0
2016-10-24 07:51:07 Info: Running CopyHotUpdateFiles shared custom action.
2016-10-24 07:51:07 Info: Return Value from CopyHotUpdateFiles: 0
2016-10-24 07:51:07 Info: Running UpdateSAVI shared custom action.
2016-10-24 07:51:10 Info: Return Value from UpdateSAVI: 0
2016-10-24 07:51:10 Info: Running SetSavAdminUpdateComplete shared custom action.
2016-10-24 07:51:10 Info: Return Value from SetSavAdminUpdateComplete: 0
2016-10-24 07:51:10 Info: Running ConfigureSAV shared custom action.
2016-10-24 07:51:10 Info: Return Value from ConfigureSAV: 0
2016-10-24 07:51:10 Info: Running CopySAVSyncFile shared custom action.
2016-10-24 07:51:10 Info: Return Value from CopySAVSyncFile: 0
2016-10-24 07:51:10 Info: Running SetUpdateFinished shared custom action.
2016-10-24 07:51:10 Info: Return Value from SetUpdateFinished: 0
2016-10-24 07:51:10 Info: Running RunAfterScripts shared custom action.
2016-10-24 07:51:10 Info: Return Value from RunAfterScripts: 0
2016-10-24 07:51:10 Info: Shared custom actions succeeded.
2016-10-24 07:51:10 Info: Update to Sophos Anti-Virus succeeded.

For my tentatives these days there are no logs in the Temp folder.

Please let me know in case you are interested in some specific log.

Regards,

Dietmar

Hello Dietmar,

this log (is it the latest SAV Install log) is from a successful IDE (threat detection identities) update. For a SA version there are the Sophos Anti-Virus ... and Sophos AutoUpdate ... logs which are of interest (if they are from after it stopped working). From the reinstall attempts there should be logs in your user's %TEMP% directory (again, they have Sophos in their name).

Christian

Hello Christian,.

here is the Standalone Installer text of today's attempt:

28.10.2016,13:38:59,Informationen,------------------ Beginning installation of Sophos Anti-Virus and AutoUpdate ------------------,
28.10.2016,13:38:59,Informationen,Setup-Version 3.4.0.457,
28.10.2016,13:38:59,Informationen,Process security set successfully,
28.10.2016,13:38:59,Informationen,Setup-Programm wurde von C:\savw_106_sa gestartet,
28.10.2016,13:38:59,Informationen,Prüfung des Betriebssystems und Auswahl der zu installierenden Sophos Endpoint Security and Control-Version...,
28.10.2016,13:38:59,Informationen,Überprüfung der Version von Internet Explorer...,
28.10.2016,13:38:59,Informationen,Überprüfung auf vorhandene Installation von Sophos Anti-Virus für XP oder Sophos AutoUpdate...,
28.10.2016,13:38:59,FEHLER,Bei der Installation von Sophos Endpoint Security and Control ist ein unerwartetes Problem aufgetreten. Details: Unexpected product state 1 for product with code {09863DA9-7A9B-4430-9561-E04D178D7017},
28.10.2016,13:53:21,Informationen,------------------ Installation program finishing ------------------,

'FEHLER' means 'ERROR' as you might guess. This is the only log containing information of today's installation attempt. There are other log with a date stamp of today but the content is of 24OCT, prior to the problems.

Do you think I should try the SDU for which you sent me the link earlier today or should I wait?

Regards,

Dietmar

Hello Dietmar,

(Deutsch oder zumindest Österreichisch ist meine Muttersprache. Obwohl - mit dem IT-Deutsch habe ich manchmal Probleme)
SDU collects the Sophos logs, Windows Event data, and machine information. Can get quite large. Anyway, I think giving Using the Microsoft Fix-It Tool a try is your best option (one could try to find a "custom" solution by wading through the Installer data collected by SDU but likely it boils down to the Fix-It).

Christian

Hello Christian,

the Microsoft Fix-It Tool did the job! On both Windows versions. On Win8.1 I had to fix only the Sophos Anti-Virus problem, on Win7 I had to fix the Sophos Auto-Updater, the Sophos System Protection and finally the Sophos Anti-Virus. Finally I was able, after temporarily deactivating the Windows Defender and running the Sophos Anti-Virus installer as admin, to install and update Sophos Anti-Virus!

Great! Thanks again for your support. Perfect start of the week!

Dietmar