The Sophos Community will be offline for scheduled maintenance this Saturday, May 27th, at 13:00 UTC for approximately 1 hour. Apologies for any inconvenience caused.


"Wanna" ransomware outbreak. Please see this Sophos article for advice on how to protect your organization. Immediate action recommended.

Sophos Home cannot be installed until your computer is restarted

I have searched the forum for the answer to this, and nothing has helped. I had Avast installed and decided to switch to Sophos because I also have a Mac. I thought it was running and then found out that it hadn't for months. I see the Sophos application in the list to uninstall, but it cannot find the data in ProgramData\Sophos so the uninstaller fails. I look in the temp folder for the log file and there are no Sophos log files.

Any other ideas?

  • Hello Mike Tuller,

    so the Home installer gives you the message in this post's subject? The installer is supposed to create files in your user's %TEMP% directory.
    but it cannot find the data in ProgramData\Sophos - where does it tell you this? Could you provide a screenshot (normally I'd expect this information in a log but you say there is none)?

    Christian

  • In reply to QC:

    Attached are screenshots. I had deleted the Program Data/Sophos directory because I read that would help it install. There never was a Sophos directory in temp. Sophos did show up in the apps installed, but when I went to uninstall it couldn't find the files. I later used a freeware app to remove the apps from the list. Anything to try to get this installed. 

  • In reply to Mike Tuller:

    Hello Mike Tuller,

    there should be recent sophos logs in your %TEMP% directory, at least one with bootstrap in its name. If their contents don't make sense to you please post them here.

    Christian

  • In reply to QC:

    As you can see in the screenshot, there are no files in the temp directory. So I don't have an program files, any data, or any temp files. I have no idea what the installer is looking at.

  • In reply to Mike Tuller:

    Hello Mike Tuller,

    the screenshot shows an unusual (system) TEMP location - normally it's C:\Windows\Temp. The install doesn't write to the system temp though but the user's. This is where the logs should be (and they might tell what makes the installer think it can't proceed). Just type %temp% in the Search box or the Explorer's address bar.

    Christian 

  • In reply to QC:

    Sorry about that. I was thinking system temp. I looked in the user temp, and there were some Sophos files. I removed them, restarted, and then ran the installer again. Same thing happens. "Sophos Home cannot be installed until your computer is restarted" and then I can see files in the directory. The Endpoint Bootstrap has:

     

    5/19/2017,10:16:40 PM,Information,------------------ Beginning installation of Sophos Anti-Virus and AutoUpdate ------------------,
    5/19/2017,10:16:40 PM,Information,Setup version 3.1.5.29,
    5/19/2017,10:16:40 PM,Information,Command line: c:\users\***\appdata\local\temp\a170d007-a821-41b6-a8e4-b457c28469e9\setup.exe -server dzr-mcs-amzn-us-east-1-h0m3.upe.p.hmr.sophos.com -token ***************** -producttype 1,
    5/19/2017,10:16:40 PM,Information,Process security set successfully,
    5/19/2017,10:16:40 PM,Information,Setup program was run from C:\Users\***\AppData\Local\Temp\a170d007-a821-41b6-a8e4-b457c28469e9,
    5/19/2017,10:16:40 PM,Information,Checking if Sophos Anti-Virus or Sophos AutoUpdate are installed...,
    5/19/2017,10:16:40 PM,Information,Sophos Anti-Virus is already installed on your computer.,
    5/19/2017,10:16:40 PM,Information,Sophos AutoUpdate is already installed on your computer.,
    5/19/2017,10:16:40 PM,Information,Starting wizard to collect information from user...,
    5/19/2017,10:17:05 PM,Information,Starting the install sequence.,
    5/19/2017,10:17:05 PM,Information,Checking for internet connectivity...,
    5/19/2017,10:17:05 PM,Success,Successfully connected to the URL http://dci.sophosupd.com/.,
    5/19/2017,10:17:05 PM,Information,Checking for internet connectivity...,
    5/19/2017,10:17:05 PM,Success,Successfully connected to the URL dzr-mcs-amzn-us-east-1-h0m3.upe.p.hmr.sophos.com/.../ep.,
    5/19/2017,10:17:05 PM,Information,Checking for local third-party software...,
    5/19/2017,10:17:05 PM,Information,Sending data back to Sophos...,
    5/19/2017,10:17:05 PM,Success,Successfully connected to the URL d1.sophosupd.com/.../x.xml.,
    5/19/2017,10:17:05 PM,Information,Done.,
    5/19/2017,10:17:05 PM,Information,Installing MSI...,
    5/19/2017,10:17:05 PM,Information,Checking for update in progress...,
    5/19/2017,10:17:05 PM,Information,Unable to create client update instance,
    5/19/2017,10:17:05 PM,Information,Remove old SAU...,
    5/19/2017,10:17:06 PM,Information,Uninstallation of Sophos AutoUpdate returned exitcode: 1612,
    5/19/2017,10:17:06 PM,ERROR,The uninstallation of Sophos AutoUpdate failed. Installation of Sophos Home has failed.,

  • In reply to Mike Tuller:

    Hi, I think I have the same issue.

    I had Sophos Home installed, I joined the beta and I think something went wrong when Sophos Home Beta tried to uninstall the "stable" installation.

    Now I can't event uninstall Sophos Home from the control Pannell

     

    My bootstrap logs:

     

    17/05/2017,23:15:58,Information,------------------ Beginning installation of Sophos Anti-Virus and AutoUpdate ------------------,
    17/05/2017,23:15:58,Information,Setup version 3.2.5.1,
    17/05/2017,23:15:58,Information,Command line: c:\users\myuser\appdata\local\temp\9ededaf8-7a29-42b9-8aed-176285d2f1da\setup.exe -server dzr-mcs-amzn-us-east-1-h0m3.upe.p.hmr.sophos.com -token ***************** -producttype 1,
    17/05/2017,23:15:58,Information,Process security set successfully,
    17/05/2017,23:15:58,Information,Setup program was run from C:\Users\myuser\AppData\Local\Temp\9ededaf8-7a29-42b9-8aed-176285d2f1da,
    17/05/2017,23:15:58,Information,Checking if Sophos Anti-Virus or Sophos AutoUpdate are installed...,
    17/05/2017,23:15:58,Information,Sophos Anti-Virus is already installed on your computer.,
    17/05/2017,23:15:58,Information,Starting wizard to collect information from user...,
    17/05/2017,23:16:19,Information,Starting the install sequence.,
    17/05/2017,23:16:19,Information,Checking for internet connectivity...,
    17/05/2017,23:16:20,Success,Successfully connected to the URL http://dci.sophosupd.com/.,
    17/05/2017,23:16:20,Information,Checking for internet connectivity...,
    17/05/2017,23:16:20,Success,Successfully connected to the URL dzr-mcs-amzn-us-east-1-h0m3.upe.p.hmr.sophos.com/.../ep.,
    17/05/2017,23:16:20,Information,Checking for local third-party software...,
    17/05/2017,23:16:20,Information,Sending data back to Sophos...,
    17/05/2017,23:16:21,Success,Successfully connected to the URL d1.sophosupd.com/.../x.xml.,
    17/05/2017,23:16:21,Information,Done.,
    17/05/2017,23:16:21,Information,Installing MSI...,
    17/05/2017,23:16:21,Information,Remove old SAV...,
    17/05/2017,23:18:41,Information,Uninstallation of Sophos Anti-Virus returned exitcode: 1603,
    17/05/2017,23:18:41,ERROR,The uninstallation of Sophos Anti-Virus failed. Installation of Sophos Home has failed.,
    17/05/2017,23:25:24,Information,Sending EBS feedback to Sophos...,
    17/05/2017,23:25:24,Information,Sending data back to Sophos...,
    17/05/2017,23:25:24,Success,Successfully connected to the URL d1.sophosupd.com/.../x.xml.,
    17/05/2017,23:25:24,Information,------------------ Installation program finishing with code 145 ------------------,

  • In reply to Mike Tuller:

    Hello Mike Tuller,

    in the same directory there should be a log related to AutoUpdate Uninstall. It will tell us the 1612 - this means that the .msi needed for the uninstall can't be located - but it should also mention the version of AutoUpdate that it is trying to uninstall.
    You might have to resort to the Fix-It mentioned here but make sure to use the correct product code if necessary (if you're unsure please post the Uninstall log).

    Christian

  • In reply to MassimoForni1:

    Hello MassimoForni1,

    so in your case it's Anti-Virus, again the uninstall failed - there should (in the same directory as the bootstrap log) be both an uninstall and a customactions log, normally the latter has the error details.

    Christian

  • In reply to QC:

    Hi Christian, the file "Sophos Anti-Virus Uninstall Log.txt" is almost 7MB, how van I send it to you?

     

    From a fast reading I can see some errors about SAVAdminService.exe and swc_service.exe being in use so they can not be removed

     

    Thanks

  • In reply to MassimoForni1:

    Hello MassimoForni1,

    almost 7MB
    should considerably shrink when zipped
    , then attach the archive here. Please attach also the CustomActions log.

    Christian

  • In reply to QC:

    Hi,

    Attached all the files.

    Temp.zip

     

    Thanks

  • In reply to MassimoForni1:

    Hello MassimoForni1,

    please see this thread - skip the logs, read the instructions. Guess for Windows 10 you have to use the Win8_AMD64 folder instead of WinLH_AMD64.

    Christian

  • In reply to QC:

    Hi!

     

    In C:\ProgramData\Sophos I have only these two folders:

    • Sophos Data Recorder
    • Web Control

    I have searched for savonaccessdriv.inf file on C: but there is no trace of it and I do not have the folder C:\Program Files (x86)\Sophos\Sophos Anti-virus

     

    Thanks

  • In reply to MassimoForni1:

    Hello MassimoForni1,

    the easy part is the C:\Program Files (x86)\Sophos\Sophos Anti-virus folder - simply create it.
    As for the mentioned files, you have to unpack the installer to some location - it's self-extracting but likely on-board tools won't help, 7zip can do it..

    Christian