ProductSetup::ProductSetup: Begin product setup ProductSetup::InstUninstEntry: Begin install ProductSetup::InstUninstEntry: Show gui: false ProductSetup::InstUninstEntry: Existing product code: <none> ProductSetup::InstUninstEntry: Install from: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64 ProductSetup::InstUninstEntry: Install to: <default> === Verbose logging started: 6/17/2016 9:55:14 Build type: SHIP UNICODE 5.00.7601.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe === MSI (c) (24:F8) [09:55:14:878]: Cloaking enabled. MSI (c) (24:F8) [09:55:14:878]: Attempting to enable all disabled privileges before calling Install on Server MSI (c) (24:F8) [09:55:14:878]: End dialog not enabled MSI (c) (24:F8) [09:55:14:878]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi MSI (c) (24:F8) [09:55:14:878]: Package we're running from ==> C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi MSI (c) (24:F8) [09:55:14:878]: Machine policy value 'DisableUserInstalls' is 0 MSI (c) (24:F8) [09:55:14:878]: APPCOMPAT: Compatibility mode property overrides found. MSI (c) (24:F8) [09:55:14:878]: APPCOMPAT: looking for appcompat database entry with ProductCode '{66967E5F-43E8-4402-87A4-04685EE5C2CB}'. MSI (c) (24:F8) [09:55:14:878]: APPCOMPAT: no matching ProductCode found in database. MSI (c) (24:F8) [09:55:14:888]: MSCOREE not loaded loading copy from system32 MSI (c) (24:F8) [09:55:14:888]: APPCOMPAT: looking for appcompat database entry with ProductCode '{66967E5F-43E8-4402-87A4-04685EE5C2CB}'. MSI (c) (24:F8) [09:55:14:888]: APPCOMPAT: no matching ProductCode found in database. MSI (c) (24:F8) [09:55:14:888]: Transforms are not secure. MSI (c) (24:F8) [09:55:14:888]: Note: 1: 2205 2: 3: Control MSI (c) (24:F8) [09:55:14:888]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\Windows\TEMP\Sophos Network Threat Protection Install Log 20160617 095514.txt'. MSI (c) (24:F8) [09:55:14:888]: No Command Line. MSI (c) (24:F8) [09:55:14:888]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{69BE7301-439B-4074-8A16-83658F3FDC2B}'. MSI (c) (24:F8) [09:55:14:888]: Product Code passed to Engine.Initialize: '(none)' MSI (c) (24:F8) [09:55:14:888]: Product Code from property table before transforms: '{66967E5F-43E8-4402-87A4-04685EE5C2CB}' MSI (c) (24:F8) [09:55:14:888]: Product Code from property table after transforms: '{66967E5F-43E8-4402-87A4-04685EE5C2CB}' MSI (c) (24:F8) [09:55:14:888]: Product not registered: beginning first-time install MSI (c) (24:F8) [09:55:14:888]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'. MSI (c) (24:F8) [09:55:14:888]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 MSI (c) (24:F8) [09:55:14:888]: Entering CMsiConfigurationManager::SetLastUsedSource. MSI (c) (24:F8) [09:55:14:888]: User policy value 'SearchOrder' is 'nmu' MSI (c) (24:F8) [09:55:14:888]: Adding new sources is allowed. MSI (c) (24:F8) [09:55:14:888]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'. MSI (c) (24:F8) [09:55:14:888]: Package name extracted from package path: 'Sophos Network Threat Protection.msi' MSI (c) (24:F8) [09:55:14:888]: Package to be registered: 'Sophos Network Threat Protection.msi' MSI (c) (24:F8) [09:55:14:888]: Note: 1: 2262 2: AdminProperties 3: -2147287038 MSI (c) (24:F8) [09:55:14:888]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'. MSI (c) (24:F8) [09:55:14:888]: TRANSFORMS property is now: MSI (c) (24:F8) [09:55:14:888]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'. MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Favorites MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Documents MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\ProgramData MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Local MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Pictures MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Desktop MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates MSI (c) (24:F8) [09:55:14:888]: SHELL32::SHGetFolderPath returned: C:\Windows\Fonts MSI (c) (24:F8) [09:55:14:888]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16 MSI (c) (24:F8) [09:55:14:898]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation MSI (c) (24:F8) [09:55:14:898]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated. MSI (c) (24:F8) [09:55:14:898]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'. MSI (c) (24:F8) [09:55:14:898]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'. MSI (c) (24:F8) [09:55:14:898]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (c) (24:F8) [09:55:14:898]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'IT'. MSI (c) (24:F8) [09:55:14:898]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (c) (24:F8) [09:55:14:898]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi'. MSI (c) (24:F8) [09:55:14:898]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi'. MSI (c) (24:F8) [09:55:14:898]: Machine policy value 'MsiDisableEmbeddedUI' is 0 MSI (c) (24:F8) [09:55:14:898]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI MSI (c) (24:F8) [09:55:14:898]: EEUI - Disabling MsiEmbeddedUI in quiet mode === Logging started: 6/17/2016 9:55:14 === MSI (c) (24:F8) [09:55:14:898]: Machine policy value 'DisableRollback' is 0 MSI (c) (24:F8) [09:55:14:898]: User policy value 'DisableRollback' is 0 MSI (c) (24:F8) [09:55:14:898]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'. MSI (c) (24:F8) [09:55:14:898]: Creating MSIHANDLE (1) of type 790537 for thread 8184 MSI (c) (24:F8) [09:55:14:898]: MsiOpenPackageEx is returning 0 MSI (c) (24:F8) [09:55:14:898]: Closing MSIHANDLE (1) of type 790537 for thread 8184 === Verbose logging stopped: 6/17/2016 9:55:14 === setup::MsiInstaller::install: New version: {66967E5F-43E8-4402-87A4-04685EE5C2CB}, version: 1.2.2.50 setup::MsiInstaller::install: Performing clean install setup::MsiInstaller::cleanInstall: Running clean install setup::MsiInstaller::installOrUpgrade: Executing: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi INSTALLDIR="" REBOOT=ReallySuppress INSTALLINGVERSION="1.2.2.50" === Verbose logging started: 6/17/2016 9:55:14 Build type: SHIP UNICODE 5.00.7601.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe === MSI (c) (24:54) [09:55:14:898]: Resetting cached policy values MSI (c) (24:54) [09:55:14:898]: Machine policy value 'Debug' is 0 MSI (c) (24:54) [09:55:14:898]: ******* RunEngine: ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi ******* Action: ******* CommandLine: ********** MSI (c) (24:54) [09:55:14:898]: Client-side and UI is none or basic: Running entire install on the server. MSI (c) (24:54) [09:55:14:898]: Grabbed execution mutex. MSI (c) (24:54) [09:55:14:898]: Cloaking enabled. MSI (c) (24:54) [09:55:14:898]: Attempting to enable all disabled privileges before calling Install on Server MSI (c) (24:54) [09:55:14:898]: Incrementing counter to disable shutdown. Counter after increment: 0 MSI (s) (D4:4C) [09:55:14:908]: Running installation inside multi-package transaction C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi MSI (s) (D4:4C) [09:55:14:908]: Grabbed execution mutex. MSI (s) (D4:88) [09:55:14:908]: Resetting cached policy values MSI (s) (D4:88) [09:55:14:908]: Machine policy value 'Debug' is 0 MSI (s) (D4:88) [09:55:14:908]: ******* RunEngine: ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi ******* Action: ******* CommandLine: ********** MSI (s) (D4:88) [09:55:14:908]: Machine policy value 'DisableUserInstalls' is 0 MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109210000000000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109210000000000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109511090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109511090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109610090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109610090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109611090400100000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109611090400100000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109810090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109810090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109A10090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109A10090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109A20000000100000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109A20000000100000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109A20090400100000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109A20090400100000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109B10090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109B10090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109C20090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109C20090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109E60090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109E60090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109F10090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109F10090400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109F100A0C00000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109F100A0C00000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 00002109F100C0400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 00002109F100C0400000000000F01FEC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 05D5D9B00351F69418FFBCB1A492F8AC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 05D5D9B00351F69418FFBCB1A492F8AC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 0AB19942EE0FDA44C98CE55CA0CE6F7B MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 0AB19942EE0FDA44C98CE55CA0CE6F7B MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 68AB67CA7DA7067500000A0000000030 MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 68AB67CA7DA7067500000A0000000030 MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 68AB67CA7DA73301B744AA0000000010 MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 68AB67CA7DA73301B744AA0000000010 MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 68AB67CA7DA7744200000A0000000030 MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 68AB67CA7DA7744200000A0000000030 MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 926C08824FC89B646A4BDA4754AF8D7B MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 926C08824FC89B646A4BDA4754AF8D7B MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 93035FCBCF7A97C43A3E34A72EF89D81 MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 93035FCBCF7A97C43A3E34A72EF89D81 MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 96F071321C0420729002000010000000 MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 96F071321C0420729002000010000000 MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: 9AD36890B9A7034459160ED471D80771 MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: 9AD36890B9A7034459160ED471D80771 MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: A089CE062ADB6BC44A720BA745894BAC MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: A089CE062ADB6BC44A720BA745894BAC MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: C1C4F482D08301F4888CF1E983E6EF89 MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: C1C4F482D08301F4888CF1E983E6EF89 MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: D5001DEF8CBC5D542A88FF7CBB031412 MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: D5001DEF8CBC5D542A88FF7CBB031412 MSI (s) (D4:88) [09:55:14:908]: Setting cached product context: machine assigned for product: D75B3901316A3F7409FCF05D5CCDFF6E MSI (s) (D4:88) [09:55:14:908]: Using cached product context: machine assigned for product: D75B3901316A3F7409FCF05D5CCDFF6E MSI (s) (D4:88) [09:55:14:908]: SRSetRestorePoint skipped for this transaction. MSI (s) (D4:88) [09:55:14:908]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 MSI (s) (D4:88) [09:55:14:908]: File will have security applied from OpCode. MSI (s) (D4:88) [09:55:14:908]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi' against software restriction policy MSI (s) (D4:88) [09:55:14:908]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi has a digital signature MSI (s) (D4:88) [09:55:14:908]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi is permitted to run because the user token authorizes execution (system or service token). MSI (s) (D4:88) [09:55:14:908]: End dialog not enabled MSI (s) (D4:88) [09:55:14:908]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi MSI (s) (D4:88) [09:55:14:908]: Package we're running from ==> C:\Windows\Installer\55fea.msi MSI (s) (D4:88) [09:55:14:918]: APPCOMPAT: Compatibility mode property overrides found. MSI (s) (D4:88) [09:55:14:918]: APPCOMPAT: looking for appcompat database entry with ProductCode '{66967E5F-43E8-4402-87A4-04685EE5C2CB}'. MSI (s) (D4:88) [09:55:14:918]: APPCOMPAT: no matching ProductCode found in database. MSI (s) (D4:88) [09:55:14:918]: MSCOREE not loaded loading copy from system32 MSI (s) (D4:88) [09:55:14:918]: Machine policy value 'TransformsSecure' is 0 MSI (s) (D4:88) [09:55:14:918]: User policy value 'TransformsAtSource' is 0 MSI (s) (D4:88) [09:55:14:918]: Machine policy value 'DisablePatch' is 0 MSI (s) (D4:88) [09:55:14:918]: Machine policy value 'AllowLockdownPatch' is 0 MSI (s) (D4:88) [09:55:14:918]: Machine policy value 'DisableLUAPatching' is 0 MSI (s) (D4:88) [09:55:14:918]: Machine policy value 'DisableFlyWeightPatching' is 0 MSI (s) (D4:88) [09:55:14:918]: Enabling baseline caching for this transaction since all active patches are MSI 3.0 style MSPs or at least one MSI 3.0 minor update patch is active MSI (s) (D4:88) [09:55:14:918]: APPCOMPAT: looking for appcompat database entry with ProductCode '{66967E5F-43E8-4402-87A4-04685EE5C2CB}'. MSI (s) (D4:88) [09:55:14:918]: APPCOMPAT: no matching ProductCode found in database. MSI (s) (D4:88) [09:55:14:918]: Transforms are not secure. MSI (s) (D4:88) [09:55:14:918]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\Windows\TEMP\Sophos Network Threat Protection Install Log 20160617 095514.txt'. MSI (s) (D4:88) [09:55:14:918]: Command Line: INSTALLDIR= REBOOT=ReallySuppress INSTALLINGVERSION=1.2.2.50 CURRENTDIRECTORY=C:\Windows\system32 CLIENTUILEVEL=3 MSICLIENTUSESEXTERNALUI=1 CLIENTPROCESSID=7204 MSI (s) (D4:88) [09:55:14:918]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{69BE7301-439B-4074-8A16-83658F3FDC2B}'. MSI (s) (D4:88) [09:55:14:918]: Product Code passed to Engine.Initialize: '' MSI (s) (D4:88) [09:55:14:918]: Product Code from property table before transforms: '{66967E5F-43E8-4402-87A4-04685EE5C2CB}' MSI (s) (D4:88) [09:55:14:918]: Product Code from property table after transforms: '{66967E5F-43E8-4402-87A4-04685EE5C2CB}' MSI (s) (D4:88) [09:55:14:918]: Product not registered: beginning first-time install MSI (s) (D4:88) [09:55:14:918]: Product {66967E5F-43E8-4402-87A4-04685EE5C2CB} is not managed. MSI (s) (D4:88) [09:55:14:918]: MSI_LUA: Credential prompt not required, user is an admin MSI (s) (D4:88) [09:55:14:918]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'. MSI (s) (D4:88) [09:55:14:918]: Entering CMsiConfigurationManager::SetLastUsedSource. MSI (s) (D4:88) [09:55:14:918]: User policy value 'SearchOrder' is 'nmu' MSI (s) (D4:88) [09:55:14:918]: Adding new sources is allowed. MSI (s) (D4:88) [09:55:14:918]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'. MSI (s) (D4:88) [09:55:14:918]: Package name extracted from package path: 'Sophos Network Threat Protection.msi' MSI (s) (D4:88) [09:55:14:918]: Package to be registered: 'Sophos Network Threat Protection.msi' MSI (s) (D4:88) [09:55:14:918]: Note: 1: 2262 2: AdminProperties 3: -2147287038 MSI (s) (D4:88) [09:55:14:918]: Machine policy value 'DisableMsi' is 0 MSI (s) (D4:88) [09:55:14:918]: Machine policy value 'AlwaysInstallElevated' is 0 MSI (s) (D4:88) [09:55:14:918]: User policy value 'AlwaysInstallElevated' is 0 MSI (s) (D4:88) [09:55:14:918]: Product installation will be elevated because user is admin and product is being installed per-machine. MSI (s) (D4:88) [09:55:14:918]: Running product '{66967E5F-43E8-4402-87A4-04685EE5C2CB}' with elevated privileges: Product is assigned. MSI (s) (D4:88) [09:55:14:918]: PROPERTY CHANGE: Adding REBOOT property. Its value is 'ReallySuppress'. MSI (s) (D4:88) [09:55:14:918]: PROPERTY CHANGE: Adding INSTALLINGVERSION property. Its value is '1.2.2.50'. MSI (s) (D4:88) [09:55:14:918]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'C:\Windows\system32'. MSI (s) (D4:88) [09:55:14:918]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'. MSI (s) (D4:88) [09:55:14:918]: PROPERTY CHANGE: Adding MSICLIENTUSESEXTERNALUI property. Its value is '1'. MSI (s) (D4:88) [09:55:14:918]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '7204'. MSI (s) (D4:88) [09:55:14:918]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0 MSI (s) (D4:88) [09:55:14:918]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality. MSI (s) (D4:88) [09:55:14:918]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'. MSI (s) (D4:88) [09:55:14:918]: TRANSFORMS property is now: MSI (s) (D4:88) [09:55:14:918]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'. MSI (s) (D4:88) [09:55:14:918]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming MSI (s) (D4:88) [09:55:14:918]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Favorites MSI (s) (D4:88) [09:55:14:918]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts MSI (s) (D4:88) [09:55:14:918]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Documents MSI (s) (D4:88) [09:55:14:918]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts MSI (s) (D4:88) [09:55:14:918]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent MSI (s) (D4:88) [09:55:14:918]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo MSI (s) (D4:88) [09:55:14:918]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates MSI (s) (D4:88) [09:55:14:918]: SHELL32::SHGetFolderPath returned: C:\ProgramData MSI (s) (D4:88) [09:55:14:918]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Local MSI (s) (D4:88) [09:55:14:918]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Pictures MSI (s) (D4:88) [09:55:14:928]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools MSI (s) (D4:88) [09:55:14:928]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup MSI (s) (D4:88) [09:55:14:928]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs MSI (s) (D4:88) [09:55:14:928]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu MSI (s) (D4:88) [09:55:14:928]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop MSI (s) (D4:88) [09:55:14:928]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools MSI (s) (D4:88) [09:55:14:928]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup MSI (s) (D4:88) [09:55:14:928]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs MSI (s) (D4:88) [09:55:14:928]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu MSI (s) (D4:88) [09:55:14:928]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Desktop MSI (s) (D4:88) [09:55:14:928]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates MSI (s) (D4:88) [09:55:14:928]: SHELL32::SHGetFolderPath returned: C:\Windows\Fonts MSI (s) (D4:88) [09:55:14:928]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16 MSI (s) (D4:88) [09:55:14:928]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated. MSI (s) (D4:88) [09:55:14:928]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'. MSI (s) (D4:88) [09:55:14:928]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'. MSI (s) (D4:88) [09:55:14:928]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (s) (D4:88) [09:55:14:928]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'IT'. MSI (s) (D4:88) [09:55:14:928]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (s) (D4:88) [09:55:14:928]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\Windows\Installer\55fea.msi'. MSI (s) (D4:88) [09:55:14:928]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi'. MSI (s) (D4:88) [09:55:14:928]: Machine policy value 'MsiDisableEmbeddedUI' is 0 MSI (s) (D4:88) [09:55:14:928]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI MSI (s) (D4:88) [09:55:14:928]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install MSI (s) (D4:88) [09:55:14:928]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (D4:88) [09:55:14:928]: Machine policy value 'DisableRollback' is 0 MSI (s) (D4:88) [09:55:14:928]: User policy value 'DisableRollback' is 0 MSI (s) (D4:88) [09:55:14:928]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'. === Logging started: 6/17/2016 9:55:14 === MSI (s) (D4:88) [09:55:14:928]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'. MSI (s) (D4:88) [09:55:14:928]: Doing action: INSTALL MSI (s) (D4:88) [09:55:14:928]: Note: 1: 2205 2: 3: ActionText Action start 9:55:14: INSTALL. MSI (s) (D4:88) [09:55:14:928]: Running ExecuteSequence MSI (s) (D4:88) [09:55:14:928]: Doing action: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C MSI (s) (D4:88) [09:55:14:928]: Note: 1: 2205 2: 3: ActionText MSI (s) (D4:88) [09:55:14:928]: PROPERTY CHANGE: Adding System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C property. Its value is 'C:\Windows\system32\'. Action start 9:55:14: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C. MSI (s) (D4:88) [09:55:14:928]: Doing action: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA MSI (s) (D4:88) [09:55:14:928]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:14: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C. Return value 1. MSI (s) (D4:88) [09:55:14:928]: PROPERTY CHANGE: Adding SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA property. Its value is 'C:\Windows\SysWOW64\'. Action start 9:55:14: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA. MSI (s) (D4:88) [09:55:14:928]: Doing action: FindRelatedProducts MSI (s) (D4:88) [09:55:14:928]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:14: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA. Return value 1. Action start 9:55:14: FindRelatedProducts. MSI (s) (D4:88) [09:55:14:928]: Doing action: LaunchConditions MSI (s) (D4:88) [09:55:14:928]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:14: FindRelatedProducts. Return value 1. Action start 9:55:14: LaunchConditions. MSI (s) (D4:88) [09:55:14:938]: Doing action: ValidateProductID MSI (s) (D4:88) [09:55:14:938]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:14: LaunchConditions. Return value 1. Action start 9:55:14: ValidateProductID. MSI (s) (D4:88) [09:55:14:938]: Skipping action: TamperProtectionCheckRemove (condition is false) MSI (s) (D4:88) [09:55:14:938]: Doing action: CostInitialize MSI (s) (D4:88) [09:55:14:938]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:14: ValidateProductID. Return value 1. MSI (s) (D4:88) [09:55:14:938]: Machine policy value 'MaxPatchCacheSize' is 10 MSI (s) (D4:88) [09:55:14:938]: Baseline: Sorting baselines for {66967E5F-43E8-4402-87A4-04685EE5C2CB}. MSI (s) (D4:88) [09:55:14:938]: Baseline: New baseline 1.2.2 from transaction. MSI (s) (D4:88) [09:55:14:938]: Baseline: Sorted order Native: Order 0. MSI (s) (D4:88) [09:55:14:938]: Baseline Data Table: MSI (s) (D4:88) [09:55:14:938]: ProductCode: {66967E5F-43E8-4402-87A4-04685EE5C2CB} Version: 1.2.2 Attributes: 0 PatchId: Native BaselineId: -2147483648 Order: 0 MSI (s) (D4:88) [09:55:14:938]: Baseline File Table: MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding ROOTDRIVE property. Its value is 'E:\'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding CostingComplete property. Its value is '0'. MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: Patch MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: __MsiPatchFileList MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2228 2: 3: PatchPackage 4: SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId` MSI (s) (D4:88) [09:55:14:948]: Delta compression fallback method for this product transaction is 'MSI 2.0 legacy obsolescence' MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: Patch Action start 9:55:14: CostInitialize. MSI (s) (D4:88) [09:55:14:948]: Doing action: FileCost MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:14: CostInitialize. Return value 1. MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: MsiAssembly MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: Class MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: Extension Action start 9:55:14: FileCost. MSI (s) (D4:88) [09:55:14:948]: Doing action: CostFinalize MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:14: FileCost. Return value 1. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding OutOfDiskSpace property. Its value is '0'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding OutOfNoRbDiskSpace property. Its value is '0'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceAvailable property. Its value is '0'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRequired property. Its value is '0'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRemaining property. Its value is '0'. MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: Patch MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: Condition MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding TARGETDIR property. Its value is 'E:\'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 property. Its value is 'E:\'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding Sophos property. Its value is 'C:\Program Files\Sophos\'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding INSTALLDIR property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding gui property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\gui\'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding bin property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\bin\'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding plugins property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding SophosAppData property. Its value is 'C:\ProgramData\Sophos\'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding ProductData property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding Logs property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding Config property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\'. MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding Status property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\'. MSI (s) (D4:88) [09:55:14:948]: Target path resolution complete. Dumping Directory table... MSI (s) (D4:88) [09:55:14:948]: Note: target paths subject to change (via custom actions or browsing) MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: TARGETDIR , Object: E:\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: WindowsFolder , Object: C:\Windows\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: E:\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: System64Folder , Object: C:\Windows\system32\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C , Object: C:\Windows\system32\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: SystemFolder , Object: C:\Windows\SysWOW64\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA , Object: C:\Windows\SysWOW64\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: ProgramFiles64Folder , Object: C:\Program Files\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: Sophos , Object: C:\Program Files\Sophos\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: INSTALLDIR , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: gui , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\gui\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: bin , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: plugins , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: CommonAppDataFolder , Object: C:\ProgramData\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: SophosAppData , Object: C:\ProgramData\Sophos\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: ProductData , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: Logs , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: Config , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\ MSI (s) (D4:88) [09:55:14:948]: Dir (target): Key: Status , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\ MSI (s) (D4:88) [09:55:14:948]: PROPERTY CHANGE: Adding INSTALLLEVEL property. Its value is '1'. MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: MsiAssembly MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2228 2: 3: MsiAssembly 4: SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ? Action start 9:55:14: CostFinalize. MSI (s) (D4:88) [09:55:14:948]: Doing action: MigrateFeatureStates MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:14: CostFinalize. Return value 1. Action start 9:55:14: MigrateFeatureStates. MSI (s) (D4:88) [09:55:14:948]: Doing action: InstallValidate MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:14: MigrateFeatureStates. Return value 0. MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: Dialog MSI (s) (D4:88) [09:55:14:948]: Feature: AllComponents; Installed: Absent; Request: Local; Action: Local MSI (s) (D4:88) [09:55:14:948]: Component: ProductDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: ConfigDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: StatusFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: LogsDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: Driver; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: navl.dll; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: ip.plg; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: ipv6.plg; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: tcp.plg; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: http.plg; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: udp.plg; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: portmap.plg; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: ProductInformation; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: Service; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: NTPAdapter; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: SspInterface; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: RemoveObsoleteAutoUpdateRegistration; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: C_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: C_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: C_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: C_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: C_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: C_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (D4:88) [09:55:14:948]: Component: __ProductInformation65; Installed: Null; Request: Local; Action: Local; Client State: Null MSI (s) (D4:88) [09:55:14:948]: Component: __Service65; Installed: Null; Request: Local; Action: Local; Client State: Null MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: BindImage MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: ProgId MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: PublishComponent MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: SelfReg MSI (s) (D4:88) [09:55:14:948]: Note: 1: 2205 2: 3: Extension MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: Font MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: Shortcut MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: Class Action start 9:55:14: InstallValidate. MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: _RemoveFilePath MSI (s) (D4:88) [09:55:14:958]: PROPERTY CHANGE: Modifying CostingComplete property. Its current value is '0'. Its new value: '1'. MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: BindImage MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: ProgId MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: PublishComponent MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: SelfReg MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: Extension MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: Font MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: Shortcut MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: Class MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2727 2: MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2727 2: MSI (s) (D4:88) [09:55:14:958]: Doing action: RemoveExistingProducts MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:14: InstallValidate. Return value 1. Action start 9:55:14: RemoveExistingProducts. MSI (s) (D4:88) [09:55:14:958]: Doing action: InstallInitialize MSI (s) (D4:88) [09:55:14:958]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:14: RemoveExistingProducts. Return value 1. MSI (s) (D4:88) [09:55:14:958]: Machine policy value 'AlwaysInstallElevated' is 0 MSI (s) (D4:88) [09:55:14:958]: User policy value 'AlwaysInstallElevated' is 0 MSI (s) (D4:88) [09:55:14:958]: BeginTransaction: Locking Server MSI (s) (D4:88) [09:55:14:958]: SRSetRestorePoint skipped for this transaction. MSI (s) (D4:88) [09:55:14:958]: Server not locked: locking for product {66967E5F-43E8-4402-87A4-04685EE5C2CB} Action start 9:55:14: InstallInitialize. MSI (s) (D4:88) [09:55:15:151]: Doing action: ProcessComponents MSI (s) (D4:88) [09:55:15:151]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: InstallInitialize. Return value 1. MSI (s) (D4:88) [09:55:15:151]: Note: 1: 2205 2: 3: MsiPatchCertificate MSI (s) (D4:88) [09:55:15:151]: LUA patching is disabled: missing MsiPatchCertificate table MSI (s) (D4:88) [09:55:15:151]: Resolving source. MSI (s) (D4:88) [09:55:15:151]: Resolving source to launched-from source. MSI (s) (D4:88) [09:55:15:151]: Setting launched-from source as last-used. MSI (s) (D4:88) [09:55:15:151]: PROPERTY CHANGE: Adding SourceDir property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\'. MSI (s) (D4:88) [09:55:15:151]: PROPERTY CHANGE: Adding SOURCEDIR property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\'. MSI (s) (D4:88) [09:55:15:151]: PROPERTY CHANGE: Adding SourcedirProduct property. Its value is '{66967E5F-43E8-4402-87A4-04685EE5C2CB}'. MSI (s) (D4:88) [09:55:15:151]: SOURCEDIR ==> C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\ MSI (s) (D4:88) [09:55:15:151]: SOURCEDIR product ==> {66967E5F-43E8-4402-87A4-04685EE5C2CB} MSI (s) (D4:88) [09:55:15:151]: SECREPAIR: CryptAcquireContext succeeded MSI (s) (D4:88) [09:55:15:151]: Determining source type MSI (s) (D4:88) [09:55:15:151]: Source type from package 'Sophos Network Threat Protection.msi': 0 MSI (s) (D4:88) [09:55:15:151]: SECREPAIR: Hash Database: C:\Windows\Installer\SourceHash{66967E5F-43E8-4402-87A4-04685EE5C2CB} MSI (s) (D4:88) [09:55:15:161]: Note: 1: 2262 2: SourceHash 3: -2147287038 MSI (s) (D4:88) [09:55:15:181]: SECREPAIR: New Hash Database creation complete. MSI (s) (D4:88) [09:55:15:201]: SECREPAIR: Hash Value for the file:Sophos Network Threat Protection.msi is: ftmm/Dqg+eV3ca3GKvON9VYa5aOG3gz6Ku37mUS/UvQ= MSI (s) (D4:88) [09:55:15:201]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\Sntp.sys is: axIxhRNuGvC2Cys03KB1GEc5OW0K2FShA2NRq1fsKbQ= MSI (s) (D4:88) [09:55:15:201]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\navl.dll is: bwusqVMGWA8oOrMHN91sssT3ZWCeC1LvkGHDKkYCUPg= MSI (s) (D4:88) [09:55:15:201]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\plugins\ip.plg is: s+9YMClHjhGpgLPdZrzd4HGrJYmnA/YXRRW37d7L4Lw= MSI (s) (D4:88) [09:55:15:201]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\plugins\ipv6.plg is: y0Btt1DaW+NPLdEIHh4ZleQ+BZY58TzbK51p4LFjvyw= MSI (s) (D4:88) [09:55:15:211]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\plugins\tcp.plg is: /nW8Sw0ugqhjw87eNGBFH5AItaQ5CvQkBezfoB2W0YA= MSI (s) (D4:88) [09:55:15:211]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\plugins\http.plg is: 9GW6moqMPHSxjZjePJdxR7SdkaEKT77KEmLddxp1knA= MSI (s) (D4:88) [09:55:15:211]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\plugins\udp.plg is: rqKuqQksPYfoCJeKuxFpfSUZKB25qP1yq2X4aqgDJxg= MSI (s) (D4:88) [09:55:15:211]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\plugins\portmap.plg is: e1jc977q8poSIJMbrWY4MoKtRyS534mN/Id57gCAugA= MSI (s) (D4:88) [09:55:15:211]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\SntpService.exe is: DrtiTN2Tn79jTPhdxljGqzjAK6NjKsLo0Lp7SEfsFLg= MSI (s) (D4:88) [09:55:15:211]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\NTPAdapter.dll is: 3Vorqa6nJgKYJf3KqzvheW/uHkJ0gtBRsgN9Bx4HgUQ= MSI (s) (D4:88) [09:55:15:211]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\BPAIF.dll is: ijgGWoPfgCfuulS70Rkr7CVEi9cgcAI1rK4YNc/hyDw= MSI (s) (D4:88) [09:55:15:211]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\Sntp.inf is: Mea3o+Nd1s2g5aM3rSd1XUB3bUnXzO/w5xp5QWejdjw= MSI (s) (D4:88) [09:55:15:211]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\Sntp.cat is: faV6mG2AOeaDwFbJd3+3Vb4HujQdbpxPxgxZQISjHmQ= MSI (s) (D4:88) [09:55:15:211]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\bin\Sntp.man is: TOO+D3ZF4iQ/WFWVeotXZ4YmAe/zKQg0mzSb2t2fcQA= MSI (s) (D4:88) [09:55:15:221]: SECREPAIR: Hash Value for the file:System\msvcr120.dll is: huObWZWvDgQvzaqF/irv18ndx61l5jJ71ecFi8OrYVw= MSI (s) (D4:88) [09:55:15:221]: SECREPAIR: Hash Value for the file:System\msvcp120.dll is: h8QsoVVHPk5xhX0DSXyMvCj6j/fyyNcuih85txB49gA= MSI (s) (D4:88) [09:55:15:221]: SECREPAIR: Hash Value for the file:System\vccorlib120.dll is: nJ1OQhxV9+9ORV51tYpmOUKMzXXHblcX9Eiv5MIcUrA= MSI (s) (D4:88) [09:55:15:231]: SECREPAIR: Hash Value for the file:System64\msvcr120.dll is: rTIkC7HeVcP1/KyHifWDoXBX+dFJFMU4wqelrTRrNBA= MSI (s) (D4:88) [09:55:15:231]: SECREPAIR: Hash Value for the file:System64\msvcp120.dll is: Kr8Kq1o8WulCS2Tp0Z2dbUrrxngU1+kuSSe5eY/vKEA= MSI (s) (D4:88) [09:55:15:231]: SECREPAIR: Hash Value for the file:System64\vccorlib120.dll is: YCrdd8vYB9AjBt4dAXnLcakI7ssRZ3EW/CBqfnFKttg= Action start 9:55:15: ProcessComponents. MSI (s) (D4:88) [09:55:15:261]: Source path resolution complete. Dumping Directory table... MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: TARGETDIR , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\ , LongSubPath: , ShortSubPath: MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: WindowsFolder , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\ , LongSubPath: , ShortSubPath: MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\ , LongSubPath: , ShortSubPath: MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: System64Folder , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\System64\ , LongSubPath: System64\ , ShortSubPath: Sys64\ MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\System64\ , LongSubPath: System64\ , ShortSubPath: Sys64\ MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: SystemFolder , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\System\ , LongSubPath: System\ , ShortSubPath: Sys\ MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\System\ , LongSubPath: System\ , ShortSubPath: Sys\ MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: ProgramFiles64Folder , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\ , LongSubPath: , ShortSubPath: MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: Sophos , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\ , LongSubPath: Sophos\ , ShortSubPath: MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: INSTALLDIR , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\ , LongSubPath: Sophos\Sophos Network Threat Protection\ , ShortSubPath: Sophos\_tph7qnj\ MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: gui , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\gui\ , LongSubPath: Sophos\Sophos Network Threat Protection\gui\ , ShortSubPath: Sophos\_tph7qnj\gui\ MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: bin , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\ , LongSubPath: Sophos\Sophos Network Threat Protection\bin\ , ShortSubPath: Sophos\_tph7qnj\bin\ MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: plugins , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\plugins\ , LongSubPath: Sophos\Sophos Network Threat Protection\bin\plugins\ , ShortSubPath: Sophos\_tph7qnj\bin\plugins\ MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: CommonAppDataFolder , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\ , LongSubPath: , ShortSubPath: MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: SophosAppData , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\ , LongSubPath: Sophos\ , ShortSubPath: MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: ProductData , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\ , LongSubPath: Sophos\Sophos Network Threat Protection\ , ShortSubPath: Sophos\hv6uh-kp\ MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: Logs , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\Logs\ , LongSubPath: Sophos\Sophos Network Threat Protection\Logs\ , ShortSubPath: Sophos\hv6uh-kp\Logs\ MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: Config , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\Config\ , LongSubPath: Sophos\Sophos Network Threat Protection\Config\ , ShortSubPath: Sophos\hv6uh-kp\Config\ MSI (s) (D4:88) [09:55:15:261]: Dir (source): Key: Status , Object: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\Config\Status\ , LongSubPath: Sophos\Sophos Network Threat Protection\Config\Status\ , ShortSubPath: Sophos\hv6uh-kp\Config\Status\ MSI (s) (D4:88) [09:55:15:261]: Note: 1: 2205 2: 3: ActionText MSI (s) (D4:88) [09:55:15:261]: Note: 1: 2205 2: 3: ActionText MSI (s) (D4:88) [09:55:15:261]: Note: 1: 2205 2: 3: ActionText MSI (s) (D4:88) [09:55:15:271]: Doing action: UnpublishFeatures MSI (s) (D4:88) [09:55:15:271]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: ProcessComponents. Return value 1. Action start 9:55:15: UnpublishFeatures. MSI (s) (D4:88) [09:55:15:271]: Doing action: SchedSecureObjectsRollback_x64 MSI (s) (D4:88) [09:55:15:271]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: UnpublishFeatures. Return value 1. MSI (s) (D4:88) [09:55:15:271]: Creating MSIHANDLE (46801) of type 790542 for thread 6792 MSI (s) (D4:0C) [09:55:15:281]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIC9E7.tmp, Entrypoint: SchedSecureObjectsRollback MSI (s) (D4:A4) [09:55:15:281]: Generating random cookie. MSI (s) (D4:A4) [09:55:15:281]: Created Custom Action Server with PID 5300 (0x14B4). MSI (s) (D4:24) [09:55:15:351]: Running as a service. MSI (s) (D4:FC) [09:55:15:351]: Hello, I'm your 64bit Elevated Non-remapped custom action server. MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46802) of type 790541 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46803) of type 790540 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46804) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46805) of type 790531 for thread 3672 Action start 9:55:15: SchedSecureObjectsRollback_x64. MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46805) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46804) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46806) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46807) of type 790531 for thread 3672 SchedSecureObjectsRollback: Failed to store ACL rollback information with error 0x80070002 - continuing MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46807) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46806) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46808) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46809) of type 790531 for thread 3672 SchedSecureObjectsRollback: Failed to store ACL rollback information with error 0x80070003 - continuing MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46809) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46808) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46810) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46811) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46811) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46812) of type 790540 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46813) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46814) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46815) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46815) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46813) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46814) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46812) of type 790540 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46816) of type 790531 for thread 3672 SchedSecureObjectsRollback: Failed to store ACL rollback information with error 0x80070003 - continuing MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46816) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46810) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46817) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46818) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46818) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46819) of type 790540 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46820) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46821) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46822) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46822) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46820) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46821) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46819) of type 790540 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Creating MSIHANDLE (46823) of type 790531 for thread 3672 SchedSecureObjectsRollback: Failed to store ACL rollback information with error 0x80070424 - continuing MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46823) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46817) of type 790531 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46802) of type 790541 for thread 3672 MSI (s) (D4!58) [09:55:15:351]: Closing MSIHANDLE (46803) of type 790540 for thread 3672 MSI (s) (D4:0C) [09:55:15:351]: Closing MSIHANDLE (46801) of type 790542 for thread 6792 SchedSecureObjectsRollback: Failed to store ACL rollback information with error 0x80070424 - continuing MSI (s) (D4:88) [09:55:15:361]: Doing action: SetUnregisterManagementAdapterRollback MSI (s) (D4:88) [09:55:15:361]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: SchedSecureObjectsRollback_x64. Return value 1. MSI (s) (D4:88) [09:55:15:361]: PROPERTY CHANGE: Adding UnregisterManagementAdapterRollback property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\bin\NTPAdapter.dll'. Action start 9:55:15: SetUnregisterManagementAdapterRollback. MSI (s) (D4:88) [09:55:15:361]: Skipping action: UnregisterManagementAdapterRollback (condition is false) MSI (s) (D4:88) [09:55:15:361]: Skipping action: UnregisterManagementAdapter (condition is false) MSI (s) (D4:88) [09:55:15:361]: Doing action: StopServices MSI (s) (D4:88) [09:55:15:361]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: SetUnregisterManagementAdapterRollback. Return value 1. Action start 9:55:15: StopServices. MSI (s) (D4:88) [09:55:15:361]: Skipping action: CleanUpSsspUserAccount.SetProperty (condition is false) MSI (s) (D4:88) [09:55:15:361]: Skipping action: CleanUpSsspUserAccountRollback.SetProperty (condition is false) MSI (s) (D4:88) [09:55:15:361]: Skipping action: CleanUpSsspUserAccountRollback (condition is false) MSI (s) (D4:88) [09:55:15:361]: Skipping action: CleanUpSsspUserAccount (condition is false) MSI (s) (D4:88) [09:55:15:361]: Skipping action: RemoveSIPSSubmitterUserAccount.SetProperty (condition is false) MSI (s) (D4:88) [09:55:15:361]: Skipping action: RemoveSIPSSubmitterUserAccountRollback.SetProperty (condition is false) MSI (s) (D4:88) [09:55:15:361]: Skipping action: RemoveSIPSSubmitterUserAccountRollback (condition is false) MSI (s) (D4:88) [09:55:15:361]: Skipping action: RemoveSIPSSubmitterUserAccount (condition is false) MSI (s) (D4:88) [09:55:15:361]: Doing action: DeleteServices MSI (s) (D4:88) [09:55:15:361]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: StopServices. Return value 1. Action start 9:55:15: DeleteServices. MSI (s) (D4:88) [09:55:15:361]: Doing action: UnregisterTypeLibraries MSI (s) (D4:88) [09:55:15:361]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: DeleteServices. Return value 1. Action start 9:55:15: UnregisterTypeLibraries. MSI (s) (D4:88) [09:55:15:361]: Doing action: RemoveRegistryValues MSI (s) (D4:88) [09:55:15:361]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: UnregisterTypeLibraries. Return value 1. Action start 9:55:15: RemoveRegistryValues. MSI (s) (D4:88) [09:55:15:361]: Doing action: ConfigureEventManifestUnregister MSI (s) (D4:88) [09:55:15:361]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: RemoveRegistryValues. Return value 1. MSI (s) (D4:88) [09:55:15:361]: Creating MSIHANDLE (46824) of type 790542 for thread 6792 MSI (s) (D4:28) [09:55:15:371]: Invoking remote custom action. DLL: C:\Windows\Installer\MSICA36.tmp, Entrypoint: ConfigureEventManifestUnregister MSI (s) (D4:A4) [09:55:15:371]: Generating random cookie. MSI (s) (D4:A4) [09:55:15:371]: Created Custom Action Server with PID 5724 (0x165C). MSI (s) (D4:FC) [09:55:15:401]: Running as a service. MSI (s) (D4:FC) [09:55:15:401]: Hello, I'm your 32bit Elevated Non-remapped custom action server. MSI (s) (D4!20) [09:55:15:401]: Creating MSIHANDLE (46825) of type 790541 for thread 7200 MSI (s) (D4!20) [09:55:15:401]: Creating MSIHANDLE (46826) of type 790531 for thread 7200 MSI (s) (D4!20) [09:55:15:401]: Closing MSIHANDLE (46826) of type 790531 for thread 7200 MSI (s) (D4!20) [09:55:15:401]: Creating MSIHANDLE (46827) of type 790540 for thread 7200 MSI (s) (D4!20) [09:55:15:401]: Creating MSIHANDLE (46828) of type 790531 for thread 7200 MSI (s) (D4!20) [09:55:15:401]: Closing MSIHANDLE (46828) of type 790531 for thread 7200 MSI (s) (D4!20) [09:55:15:401]: Closing MSIHANDLE (46825) of type 790541 for thread 7200 MSI (s) (D4!20) [09:55:15:401]: Closing MSIHANDLE (46827) of type 790540 for thread 7200 MSI (s) (D4:28) [09:55:15:401]: Closing MSIHANDLE (46824) of type 790542 for thread 6792 Action start 9:55:15: ConfigureEventManifestUnregister. MSI (s) (D4:88) [09:55:15:401]: Skipping action: RemoveLogFiles.Property (condition is false) MSI (s) (D4:88) [09:55:15:401]: Skipping action: RemoveLogFiles (condition is false) MSI (s) (D4:88) [09:55:15:401]: Skipping action: RemovePolicyFile.Property (condition is false) MSI (s) (D4:88) [09:55:15:401]: Skipping action: RemovePolicyFile (condition is false) MSI (s) (D4:88) [09:55:15:401]: Skipping action: RemoveStatusFile.Property (condition is false) MSI (s) (D4:88) [09:55:15:401]: Skipping action: RemoveStatusFile (condition is false) MSI (s) (D4:88) [09:55:15:401]: Doing action: RemoveFiles MSI (s) (D4:88) [09:55:15:401]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: ConfigureEventManifestUnregister. Return value 1. MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: RemoveFile MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: RemoveFile Action start 9:55:15: RemoveFiles. MSI (s) (D4:88) [09:55:15:411]: Doing action: RemoveFolders MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: RemoveFiles. Return value 0. Action start 9:55:15: RemoveFolders. MSI (s) (D4:88) [09:55:15:411]: Doing action: CreateFolders MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: RemoveFolders. Return value 1. MSI (s) (D4:88) [09:55:15:411]: Using well known SID for Administrators MSI (s) (D4:88) [09:55:15:411]: Finished allocating new user SID MSI (s) (D4:88) [09:55:15:411]: Using well known SID for System MSI (s) (D4:88) [09:55:15:411]: Finished allocating new user SID Action start 9:55:15: CreateFolders. MSI (s) (D4:88) [09:55:15:411]: Doing action: InstallFiles MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: CreateFolders. Return value 1. MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'Sntp.sys' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'navl.dll' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'ip.plg' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'ipv6.plg' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'tcp.plg' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'http.plg' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'udp.plg' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'portmap.plg' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'SntpService.exe' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'NTPAdapter.dll' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'BPAIF.dll' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'Sntp.inf' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'Sntp.cat' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'Sntp.man' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C' has no eligible binary patches MSI (s) (D4:88) [09:55:15:411]: The file represented by File table key 'F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C' has no eligible binary patches Action start 9:55:15: InstallFiles. MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: Patch MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence` MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: MsiSFCBypass MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2228 2: 3: MsiSFCBypass 4: SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ? MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2228 2: 3: MsiPatchHeaders 4: SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ? MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: Patch MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence` MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: Patch MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence` MSI (s) (D4:88) [09:55:15:411]: Using cached product context: machine assigned for product: 0AB19942EE0FDA44C98CE55CA0CE6F7B MSI (s) (D4:88) [09:55:15:411]: Using cached product context: machine assigned for product: 0AB19942EE0FDA44C98CE55CA0CE6F7B MSI (s) (D4:88) [09:55:15:411]: Using cached product context: machine assigned for product: 0AB19942EE0FDA44C98CE55CA0CE6F7B MSI (s) (D4:88) [09:55:15:411]: Using cached product context: machine assigned for product: 0AB19942EE0FDA44C98CE55CA0CE6F7B MSI (s) (D4:88) [09:55:15:411]: Using cached product context: machine assigned for product: 0AB19942EE0FDA44C98CE55CA0CE6F7B MSI (s) (D4:88) [09:55:15:411]: Using cached product context: machine assigned for product: 0AB19942EE0FDA44C98CE55CA0CE6F7B MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: Patch MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence` MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: Patch MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence` MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: Patch MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence` MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2205 2: 3: Patch MSI (s) (D4:88) [09:55:15:411]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence` MSI (s) (D4:88) [09:55:15:421]: Skipping action: FixupDIFxAppRegistry (condition is false) MSI (s) (D4:88) [09:55:15:421]: Doing action: MsiProcessDrivers MSI (s) (D4:88) [09:55:15:421]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: InstallFiles. Return value 1. MSI (s) (D4:88) [09:55:15:421]: Creating MSIHANDLE (46829) of type 790542 for thread 6792 MSI (s) (D4:7C) [09:55:15:431]: Invoking remote custom action. DLL: C:\Windows\Installer\MSICA75.tmp, Entrypoint: ProcessDriverPackages MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46830) of type 790531 for thread 3900 Action start 9:55:15: MsiProcessDrivers. MSI (s) (D4!3C) [09:55:15:431]: Closing MSIHANDLE (46830) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46831) of type 790541 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46832) of type 790540 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46833) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46834) of type 790531 for thread 3900 DIFXAPP: ENTER: ProcessDriverPackages() MSI (s) (D4!3C) [09:55:15:431]: Closing MSIHANDLE (46834) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46835) of type 790531 for thread 3900 DIFXAPP: INFO: 'Component' is 'Driver' MSI (s) (D4!3C) [09:55:15:431]: Closing MSIHANDLE (46835) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46836) of type 790541 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46837) of type 790540 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46838) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Closing MSIHANDLE (46838) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Closing MSIHANDLE (46837) of type 790540 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Closing MSIHANDLE (46836) of type 790541 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46839) of type 790531 for thread 3900 DIFXAPP: INFO: Component state 0x2 -> 0x3 MSI (s) (D4!3C) [09:55:15:431]: Closing MSIHANDLE (46839) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46840) of type 790531 for thread 3900 DIFXAPP: INFO: 'ComponentId' is {76F354A6-97D5-4872-9781-2F2642A4F18A} MSI (s) (D4!3C) [09:55:15:431]: Closing MSIHANDLE (46840) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46841) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46842) of type 790531 for thread 3900 DIFXAPP: INFO: 'Flags' is 21 MSI (s) (D4!3C) [09:55:15:431]: Closing MSIHANDLE (46842) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46843) of type 790531 for thread 3900 DIFXAPP: INFO: component path is C:\Program Files\Sophos\Sophos Network Threat Protection\bin\ MSI (s) (D4!3C) [09:55:15:431]: Closing MSIHANDLE (46843) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: Creating MSIHANDLE (46844) of type 790531 for thread 3900 DIFXAPP: INFO: user SID of user performing the install is 'S-1-5-18'. MSI (s) (D4!3C) [09:55:15:431]: Closing MSIHANDLE (46844) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:431]: PROPERTY CHANGE: Adding MsiRollbackInstall property. Its value is '2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}212Sophos Network Threat ProtectionSophos Limited'. MSI (s) (D4!3C) [09:55:15:431]: Doing action: MsiRollbackInstall MSI (s) (D4!3C) [09:55:15:431]: Note: 1: 2205 2: 3: ActionText DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{76F354A6-97D5-4872-9781-2F2642A4F18A} (User's SID: 'S-1-5-18') ... Action start 9:55:15: MsiRollbackInstall. MSI (s) (D4!3C) [09:55:15:431]: PROPERTY CHANGE: Adding MsiInstallDrivers property. Its value is '2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}C:\Program Files\Sophos\Sophos Network Threat Protection\bin\212Sophos Network Threat ProtectionSophos Limited'. MSI (s) (D4!3C) [09:55:15:431]: Doing action: MsiInstallDrivers MSI (s) (D4!3C) [09:55:15:431]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: MsiRollbackInstall. Return value 1. Action start 9:55:15: MsiInstallDrivers. MSI (s) (D4!3C) [09:55:15:441]: Closing MSIHANDLE (46841) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:441]: Closing MSIHANDLE (46833) of type 790531 for thread 3900 MSI (s) (D4!3C) [09:55:15:441]: Closing MSIHANDLE (46832) of type 790540 for thread 3900 MSI (s) (D4!3C) [09:55:15:441]: Closing MSIHANDLE (46831) of type 790541 for thread 3900 MSI (s) (D4!3C) [09:55:15:441]: Creating MSIHANDLE (46845) of type 790531 for thread 3900 Action ended 9:55:15: MsiInstallDrivers. Return value 1. MSI (s) (D4!3C) [09:55:15:441]: Closing MSIHANDLE (46845) of type 790531 for thread 3900 MSI (s) (D4:7C) [09:55:15:441]: Closing MSIHANDLE (46829) of type 790542 for thread 6792 DIFXAPP: RETURN: ProcessDriverPackages() 0 (0x0) MSI (s) (D4:88) [09:55:15:441]: Doing action: DuplicateFiles MSI (s) (D4:88) [09:55:15:441]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: MsiProcessDrivers. Return value 1. Action start 9:55:15: DuplicateFiles. MSI (s) (D4:88) [09:55:15:441]: Doing action: SchedXmlFile MSI (s) (D4:88) [09:55:15:441]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: DuplicateFiles. Return value 1. MSI (s) (D4:88) [09:55:15:441]: Creating MSIHANDLE (46846) of type 790542 for thread 6792 MSI (s) (D4:70) [09:55:15:451]: Invoking remote custom action. DLL: C:\Windows\Installer\MSICA86.tmp, Entrypoint: SchedXmlFile MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46847) of type 790541 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46848) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46848) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46849) of type 790540 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46850) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46851) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46851) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46852) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46852) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46853) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46853) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46854) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46854) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46850) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46855) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46856) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46856) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46857) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46857) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46858) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46858) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46859) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46859) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46855) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46849) of type 790540 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: PROPERTY CHANGE: Adding ExecXmlFile property. Its value is '2€0€C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man€7€1€/*/*/*/*[@messageFileName]€messageFileName€C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.sys€2€0€C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man€7€1€/*/*/*/*[@resourceFileName]€resourceFileName€C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.sys'. MSI (s) (D4!30) [09:55:15:461]: Creating MSIHANDLE (46860) of type 790531 for thread 5424 Action start 9:55:15: SchedXmlFile. MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46860) of type 790531 for thread 5424 MSI (s) (D4!30) [09:55:15:461]: Doing action: ExecXmlFile MSI (s) (D4!30) [09:55:15:461]: Note: 1: 2205 2: 3: ActionText Action start 9:55:15: ExecXmlFile. MSI (s) (D4!30) [09:55:15:461]: Closing MSIHANDLE (46847) of type 790541 for thread 5424 MSI (s) (D4:70) [09:55:15:461]: Closing MSIHANDLE (46846) of type 790542 for thread 6792 Action ended 9:55:15: ExecXmlFile. Return value 1. MSI (s) (D4:88) [09:55:15:461]: Doing action: ConfigureEventManifestRegister MSI (s) (D4:88) [09:55:15:461]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: SchedXmlFile. Return value 1. MSI (s) (D4:88) [09:55:15:461]: Creating MSIHANDLE (46861) of type 790542 for thread 6792 MSI (s) (D4:98) [09:55:15:471]: Invoking remote custom action. DLL: C:\Windows\Installer\MSICAA6.tmp, Entrypoint: ConfigureEventManifestRegister MSI (s) (D4!1C) [09:55:15:481]: Creating MSIHANDLE (46862) of type 790541 for thread 4892 MSI (s) (D4!1C) [09:55:15:481]: Creating MSIHANDLE (46863) of type 790531 for thread 4892 MSI (s) (D4!1C) [09:55:15:481]: Closing MSIHANDLE (46863) of type 790531 for thread 4892 MSI (s) (D4!1C) [09:55:15:481]: Creating MSIHANDLE (46864) of type 790540 for thread 4892 MSI (s) (D4!1C) [09:55:15:481]: Creating MSIHANDLE (46865) of type 790531 for thread 4892 MSI (s) (D4!1C) [09:55:15:481]: Creating MSIHANDLE (46866) of type 790531 for thread 4892 MSI (s) (D4!1C) [09:55:15:481]: Closing MSIHANDLE (46866) of type 790531 for thread 4892 MSI (s) (D4!1C) [09:55:15:481]: PROPERTY CHANGE: Adding RollbackRegisterEventManifest property. Its value is '"wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man"'. MSI (s) (D4!1C) [09:55:15:481]: Creating MSIHANDLE (46867) of type 790531 for thread 4892 Action start 9:55:15: ConfigureEventManifestRegister. MSI (s) (D4!1C) [09:55:15:481]: Closing MSIHANDLE (46867) of type 790531 for thread 4892 MSI (s) (D4!1C) [09:55:15:481]: Doing action: RollbackRegisterEventManifest MSI (s) (D4!1C) [09:55:15:481]: Note: 1: 2205 2: 3: ActionText Action start 9:55:15: RollbackRegisterEventManifest. MSI (s) (D4!1C) [09:55:15:481]: PROPERTY CHANGE: Adding RegisterEventManifest property. Its value is '"wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man"'. MSI (s) (D4!1C) [09:55:15:481]: Creating MSIHANDLE (46868) of type 790531 for thread 4892 Action ended 9:55:15: RollbackRegisterEventManifest. Return value 1. MSI (s) (D4!1C) [09:55:15:481]: Closing MSIHANDLE (46868) of type 790531 for thread 4892 MSI (s) (D4!1C) [09:55:15:481]: Doing action: RegisterEventManifest MSI (s) (D4!1C) [09:55:15:481]: Note: 1: 2205 2: 3: ActionText Action start 9:55:15: RegisterEventManifest. MSI (s) (D4!1C) [09:55:15:481]: Closing MSIHANDLE (46865) of type 790531 for thread 4892 MSI (s) (D4!1C) [09:55:15:481]: Closing MSIHANDLE (46862) of type 790541 for thread 4892 MSI (s) (D4!1C) [09:55:15:481]: Closing MSIHANDLE (46864) of type 790540 for thread 4892 MSI (s) (D4:98) [09:55:15:481]: Closing MSIHANDLE (46861) of type 790542 for thread 6792 Action ended 9:55:15: RegisterEventManifest. Return value 1. MSI (s) (D4:88) [09:55:15:481]: Doing action: WriteRegistryValues MSI (s) (D4:88) [09:55:15:481]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: ConfigureEventManifestRegister. Return value 1. Action start 9:55:15: WriteRegistryValues. MSI (s) (D4:88) [09:55:15:481]: Doing action: RegisterTypeLibraries MSI (s) (D4:88) [09:55:15:481]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: WriteRegistryValues. Return value 1. Action start 9:55:15: RegisterTypeLibraries. MSI (s) (D4:88) [09:55:15:481]: Doing action: InstallServices MSI (s) (D4:88) [09:55:15:481]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: RegisterTypeLibraries. Return value 1. Action start 9:55:15: InstallServices. MSI (s) (D4:88) [09:55:15:491]: Doing action: AddSIPSSubmitterUserAccount.SetProperty MSI (s) (D4:88) [09:55:15:491]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: InstallServices. Return value 1. MSI (s) (D4:88) [09:55:15:491]: PROPERTY CHANGE: Adding AddSIPSSubmitterUserAccount property. Its value is 'NT SERVICE\SntpService'. Action start 9:55:15: AddSIPSSubmitterUserAccount.SetProperty. MSI (s) (D4:88) [09:55:15:491]: Doing action: AddSIPSSubmitterUserAccountRollback.SetProperty MSI (s) (D4:88) [09:55:15:491]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: AddSIPSSubmitterUserAccount.SetProperty. Return value 1. MSI (s) (D4:88) [09:55:15:491]: PROPERTY CHANGE: Adding AddSIPSSubmitterUserAccountRollback property. Its value is 'NT SERVICE\SntpService'. Action start 9:55:15: AddSIPSSubmitterUserAccountRollback.SetProperty. MSI (s) (D4:88) [09:55:15:491]: Doing action: AddSIPSSubmitterUserAccountRollback MSI (s) (D4:88) [09:55:15:491]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: AddSIPSSubmitterUserAccountRollback.SetProperty. Return value 1. Action start 9:55:15: AddSIPSSubmitterUserAccountRollback. MSI (s) (D4:88) [09:55:15:491]: Doing action: AddSIPSSubmitterUserAccount MSI (s) (D4:88) [09:55:15:491]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: AddSIPSSubmitterUserAccountRollback. Return value 1. Action start 9:55:15: AddSIPSSubmitterUserAccount. MSI (s) (D4:88) [09:55:15:491]: Doing action: SchedSecureObjects_x64 MSI (s) (D4:88) [09:55:15:491]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: AddSIPSSubmitterUserAccount. Return value 1. MSI (s) (D4:88) [09:55:15:491]: Creating MSIHANDLE (46869) of type 790542 for thread 6792 MSI (s) (D4:20) [09:55:15:491]: Invoking remote custom action. DLL: C:\Windows\Installer\MSICAC6.tmp, Entrypoint: SchedSecureObjects MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46870) of type 790541 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46871) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46871) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46872) of type 790540 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46873) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46874) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46874) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46873) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46875) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46876) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46876) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46875) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46877) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46878) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46878) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46877) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46879) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46880) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46880) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46881) of type 790540 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46882) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46883) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46884) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46884) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46882) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46883) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46881) of type 790540 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46885) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46885) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46879) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46886) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46887) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46887) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46888) of type 790540 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46889) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46890) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46891) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46891) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46889) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46890) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46888) of type 790540 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46892) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46892) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46886) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: PROPERTY CHANGE: Adding ExecSecureObjects_64 property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\€CreateFolder€€NT SERVICE\sntpservice€-2147483647€C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\€CreateFolder€€NT SERVICE\sntpservice€278€C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\€CreateFolder€€NT SERVICE\sntpservice€278€SntpService€ServiceInstall€€Administrators€983551€SntpService€ServiceInstall€€Everyone€-2147483632'. MSI (s) (D4!70) [09:55:15:501]: Creating MSIHANDLE (46893) of type 790531 for thread 3696 Action start 9:55:15: SchedSecureObjects_x64. MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46893) of type 790531 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Doing action: ExecSecureObjects_64 MSI (s) (D4!70) [09:55:15:501]: Note: 1: 2205 2: 3: ActionText Action start 9:55:15: ExecSecureObjects_64. MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46870) of type 790541 for thread 3696 MSI (s) (D4!70) [09:55:15:501]: Closing MSIHANDLE (46872) of type 790540 for thread 3696 MSI (s) (D4:20) [09:55:15:501]: Closing MSIHANDLE (46869) of type 790542 for thread 6792 Action ended 9:55:15: ExecSecureObjects_64. Return value 1. MSI (s) (D4:88) [09:55:15:501]: Doing action: SchedServiceConfig MSI (s) (D4:88) [09:55:15:501]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: SchedSecureObjects_x64. Return value 1. MSI (s) (D4:88) [09:55:15:501]: Creating MSIHANDLE (46894) of type 790542 for thread 6792 MSI (s) (D4:10) [09:55:15:511]: Invoking remote custom action. DLL: C:\Windows\Installer\MSICAC7.tmp, Entrypoint: SchedServiceConfig MSI (s) (D4!88) [09:55:15:521]: Creating MSIHANDLE (46895) of type 790541 for thread 1928 MSI (s) (D4!88) [09:55:15:521]: Creating MSIHANDLE (46896) of type 790540 for thread 1928 MSI (s) (D4!88) [09:55:15:521]: Creating MSIHANDLE (46897) of type 790531 for thread 1928 MSI (s) (D4!88) [09:55:15:521]: Creating MSIHANDLE (46898) of type 790531 for thread 1928 MSI (s) (D4!88) [09:55:15:521]: Closing MSIHANDLE (46898) of type 790531 for thread 1928 MSI (s) (D4!88) [09:55:15:521]: Closing MSIHANDLE (46897) of type 790531 for thread 1928 MSI (s) (D4!88) [09:55:15:521]: PROPERTY CHANGE: Adding RollbackServiceConfig property. Its value is 'SchedServiceConfig'. MSI (s) (D4!88) [09:55:15:521]: Creating MSIHANDLE (46899) of type 790531 for thread 1928 Action start 9:55:15: SchedServiceConfig. MSI (s) (D4!88) [09:55:15:521]: Closing MSIHANDLE (46899) of type 790531 for thread 1928 MSI (s) (D4!88) [09:55:15:521]: Doing action: RollbackServiceConfig MSI (s) (D4!88) [09:55:15:521]: Note: 1: 2205 2: 3: ActionText Action start 9:55:15: RollbackServiceConfig. MSI (s) (D4!88) [09:55:15:521]: PROPERTY CHANGE: Adding ExecServiceConfig property. Its value is 'SchedServiceConfig€SntpService€0€restart€restart€none€1€120€€'. MSI (s) (D4!88) [09:55:15:521]: Creating MSIHANDLE (46900) of type 790531 for thread 1928 Action ended 9:55:15: RollbackServiceConfig. Return value 1. MSI (s) (D4!88) [09:55:15:521]: Closing MSIHANDLE (46900) of type 790531 for thread 1928 MSI (s) (D4!88) [09:55:15:521]: Doing action: ExecServiceConfig MSI (s) (D4!88) [09:55:15:521]: Note: 1: 2205 2: 3: ActionText Action start 9:55:15: ExecServiceConfig. MSI (s) (D4!88) [09:55:15:521]: Closing MSIHANDLE (46895) of type 790541 for thread 1928 MSI (s) (D4!88) [09:55:15:521]: Closing MSIHANDLE (46896) of type 790540 for thread 1928 MSI (s) (D4:10) [09:55:15:521]: Closing MSIHANDLE (46894) of type 790542 for thread 6792 Action ended 9:55:15: ExecServiceConfig. Return value 1. MSI (s) (D4:88) [09:55:15:521]: Doing action: SetupSspUserAccount.SetProperty MSI (s) (D4:88) [09:55:15:521]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: SchedServiceConfig. Return value 1. MSI (s) (D4:88) [09:55:15:521]: PROPERTY CHANGE: Adding SetupSspUserAccount property. Its value is 'NT SERVICE\sntpservice'. Action start 9:55:15: SetupSspUserAccount.SetProperty. MSI (s) (D4:88) [09:55:15:521]: Doing action: SetupSspUserAccountRollback.SetProperty MSI (s) (D4:88) [09:55:15:521]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: SetupSspUserAccount.SetProperty. Return value 1. MSI (s) (D4:88) [09:55:15:521]: PROPERTY CHANGE: Adding SetupSspUserAccountRollback property. Its value is 'NT SERVICE\sntpservice'. Action start 9:55:15: SetupSspUserAccountRollback.SetProperty. MSI (s) (D4:88) [09:55:15:521]: Doing action: SetupSspUserAccountRollback MSI (s) (D4:88) [09:55:15:521]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: SetupSspUserAccountRollback.SetProperty. Return value 1. Action start 9:55:15: SetupSspUserAccountRollback. MSI (s) (D4:88) [09:55:15:521]: Doing action: SetupSspUserAccount MSI (s) (D4:88) [09:55:15:521]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: SetupSspUserAccountRollback. Return value 1. Action start 9:55:15: SetupSspUserAccount. MSI (s) (D4:88) [09:55:15:521]: Doing action: MsiConfigureServices MSI (s) (D4:88) [09:55:15:521]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: SetupSspUserAccount. Return value 1. Action start 9:55:15: MsiConfigureServices. MSI (s) (D4:88) [09:55:15:521]: Note: 1: 2205 2: 3: MsiServiceConfigFailureActions MSI (s) (D4:88) [09:55:15:521]: Note: 1: 2228 2: 3: MsiServiceConfigFailureActions 4: SELECT `Name`, `Event`, `ResetPeriod`, `RebootMessage`,`Command`, `Actions`, `DelayActions`, `Action` FROM `MsiServiceConfigFailureActions`, `Component` WHERE `Component_` = `Component` AND (`Action` = 0 OR `Action` = 1 OR `Action` = 3) MSI (s) (D4:88) [09:55:15:521]: Doing action: StartServices MSI (s) (D4:88) [09:55:15:521]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: MsiConfigureServices. Return value 1. Action start 9:55:15: StartServices. MSI (s) (D4:88) [09:55:15:521]: Doing action: RegisterManagementAdapterRollback MSI (s) (D4:88) [09:55:15:521]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: StartServices. Return value 1. Action start 9:55:15: RegisterManagementAdapterRollback. MSI (s) (D4:88) [09:55:15:521]: Doing action: SetRegisterManagementAdapter MSI (s) (D4:88) [09:55:15:521]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: RegisterManagementAdapterRollback. Return value 1. MSI (s) (D4:88) [09:55:15:531]: PROPERTY CHANGE: Adding RegisterManagementAdapter property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\bin\NTPAdapter.dll'. Action start 9:55:15: SetRegisterManagementAdapter. MSI (s) (D4:88) [09:55:15:531]: Doing action: RegisterManagementAdapter MSI (s) (D4:88) [09:55:15:531]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: SetRegisterManagementAdapter. Return value 1. Action start 9:55:15: RegisterManagementAdapter. MSI (s) (D4:88) [09:55:15:531]: Doing action: RegisterUser MSI (s) (D4:88) [09:55:15:531]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: RegisterManagementAdapter. Return value 1. Action start 9:55:15: RegisterUser. MSI (s) (D4:88) [09:55:15:531]: Doing action: RegisterProduct MSI (s) (D4:88) [09:55:15:531]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: RegisterUser. Return value 1. Action start 9:55:15: RegisterProduct. MSI (s) (D4:88) [09:55:15:531]: PROPERTY CHANGE: Adding ProductToBeRegistered property. Its value is '1'. MSI (s) (D4:88) [09:55:15:531]: Doing action: PublishFeatures MSI (s) (D4:88) [09:55:15:531]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: RegisterProduct. Return value 1. Action start 9:55:15: PublishFeatures. MSI (s) (D4:88) [09:55:15:531]: Doing action: PublishProduct MSI (s) (D4:88) [09:55:15:531]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: PublishFeatures. Return value 1. Action start 9:55:15: PublishProduct. MSI (s) (D4:88) [09:55:15:531]: Skipping action: WixFailWhenDeferred (condition is false) MSI (s) (D4:88) [09:55:15:531]: Doing action: InstallFinalize MSI (s) (D4:88) [09:55:15:531]: Note: 1: 2205 2: 3: ActionText Action ended 9:55:15: PublishProduct. Return value 1. MSI (s) (D4:88) [09:55:15:531]: Running Script: C:\Windows\Installer\MSIC9D6.tmp MSI (s) (D4:88) [09:55:15:531]: PROPERTY CHANGE: Adding UpdateStarted property. Its value is '1'. MSI (s) (D4:88) [09:55:15:531]: Machine policy value 'DisableRollback' is 0 MSI (s) (D4:88) [09:55:15:541]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (D4:88) [09:55:15:541]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1221676776,LangId=1033,Platform=589824,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1) Action start 9:55:15: InstallFinalize. MSI (s) (D4:88) [09:55:15:541]: Executing op: ProductInfo(ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},ProductName=Sophos Network Threat Protection,PackageName=Sophos Network Threat Protection.msi,Language=1033,Version=16908290,Assignment=1,ObsoleteArg=0,ProductIcon=shield.ico,,PackageCode={69BE7301-439B-4074-8A16-83658F3FDC2B},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3) MSI (s) (D4:88) [09:55:15:541]: Executing op: DialogInfo(Type=0,Argument=1033) MSI (s) (D4:88) [09:55:15:541]: Executing op: DialogInfo(Type=1,Argument=Sophos Network Threat Protection) MSI (s) (D4:88) [09:55:15:541]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1]) MSI (s) (D4:88) [09:55:15:541]: Executing op: SetBaseline(Baseline=0,) MSI (s) (D4:88) [09:55:15:541]: Executing op: SetBaseline(Baseline=1,) MSI (s) (D4:88) [09:55:15:541]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,) MSI (s) (D4:88) [09:55:15:541]: Executing op: ProgressTotal(Total=23,Type=1,ByteEquivalent=24000) MSI (s) (D4:88) [09:55:15:541]: Executing op: ComponentRegister(ComponentId={E1E87C49-DD4A-4C77-8D42-3ACD20DBC536},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (D4:88) [09:55:15:541]: Executing op: ComponentRegister(ComponentId={4D81D62C-8373-45B8-ABF2-0C0D6ED2DE34},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (D4:88) [09:55:15:541]: Executing op: ComponentRegister(ComponentId={74F91047-4C42-457F-B531-A83EF6EC85E2},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (D4:88) [09:55:15:541]: Executing op: ComponentRegister(ComponentId={F1B8B8D7-46D7-4CA9-B109-35931536EA8A},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (D4:88) [09:55:15:541]: Executing op: ComponentRegister(ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.sys,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (D4:88) [09:55:15:541]: Executing op: ComponentRegister(ComponentId={355DC0F9-A6B5-4FCA-8121-00847E59A436},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\navl.dll,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=1) MSI (s) (D4:88) [09:55:15:541]: Executing op: ComponentRegister(ComponentId={9B222529-2B29-4547-AAEA-9C8A0423595B},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\ip.plg,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=1) MSI (s) (D4:88) [09:55:15:541]: Executing op: ComponentRegister(ComponentId={1A0CA7AD-4F12-4887-809E-96D79A66CC7F},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\ipv6.plg,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=1) MSI (s) (D4:88) [09:55:15:541]: Executing op: ComponentRegister(ComponentId={F27D2FBB-5E0B-4351-82CE-E72D4F1EDE71},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\tcp.plg,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=1) MSI (s) (D4:88) [09:55:15:541]: Executing op: ComponentRegister(ComponentId={D45EF81E-13E2-45D6-9DA9-09FD21266A06},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\http.plg,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=1) MSI (s) (D4:88) [09:55:15:551]: Executing op: ComponentRegister(ComponentId={710F5A00-8ECC-402C-910E-6096F350A923},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\udp.plg,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=1) MSI (s) (D4:88) [09:55:15:551]: Executing op: ComponentRegister(ComponentId={411E659C-FCB0-4BA0-9E87-A88C4E28174F},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\portmap.plg,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=1) MSI (s) (D4:88) [09:55:15:551]: Executing op: ComponentRegister(ComponentId={38879DEA-36FA-41BE-ACF3-B084CB40689B},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (D4:88) [09:55:15:551]: Executing op: ComponentRegister(ComponentId={DF927ABB-6A5F-44F2-A430-137AAC79AA71},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (D4:88) [09:55:15:551]: Executing op: ComponentRegister(ComponentId={4E691ABE-115D-4721-9F9A-3547D17077C5},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\NTPAdapter.dll,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (D4:88) [09:55:15:551]: Executing op: ComponentRegister(ComponentId={B9C8E32A-5EB9-4B7F-91AF-9FD883FB729C},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\BPAIF.dll,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=1) MSI (s) (D4:88) [09:55:15:551]: Executing op: ComponentRegister(ComponentId={1B63A9FF-509B-4CD9-BA54-256A7D62B724},KeyPath=E:\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0) MSI (s) (D4:88) [09:55:15:551]: Executing op: ComponentRegister(ComponentId={0835C947-D6D2-4E52-AF14-0231D04E88EA},KeyPath=C:\Windows\SysWOW64\msvcr120.dll,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=0) MSI (s) (D4:88) [09:55:15:551]: WIN64DUALFOLDERS: 'C:\Windows\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcr120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (D4:88) [09:55:15:551]: WIN64DUALFOLDERS: 'C:\Windows\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcr120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (D4:88) [09:55:15:551]: Executing op: ComponentRegister(ComponentId={74260D9F-D644-423B-B2D4-0291EA4BA8BE},KeyPath=C:\Windows\SysWOW64\msvcp120.dll,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=0) MSI (s) (D4:88) [09:55:15:551]: WIN64DUALFOLDERS: 'C:\Windows\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcp120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (D4:88) [09:55:15:551]: WIN64DUALFOLDERS: 'C:\Windows\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcp120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (D4:88) [09:55:15:551]: Executing op: ComponentRegister(ComponentId={63B83B20-1AB9-4F49-B0B2-4489724CA96C},KeyPath=C:\Windows\SysWOW64\vccorlib120.dll,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=0) MSI (s) (D4:88) [09:55:15:551]: WIN64DUALFOLDERS: 'C:\Windows\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\vccorlib120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (D4:88) [09:55:15:551]: WIN64DUALFOLDERS: 'C:\Windows\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\vccorlib120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (D4:88) [09:55:15:551]: Executing op: ComponentRegister(ComponentId={E5B92048-5859-4AF1-AEAD-B97EBF00B087},KeyPath=C:\Windows\system32\msvcr120.dll,State=3,,Disk=1,SharedDllRefCount=3,BinaryType=1) MSI (s) (D4:88) [09:55:15:551]: Executing op: ComponentRegister(ComponentId={570C624B-D57C-4CD1-9013-1B80C800093B},KeyPath=C:\Windows\system32\msvcp120.dll,State=3,,Disk=1,SharedDllRefCount=3,BinaryType=1) MSI (s) (D4:88) [09:55:15:561]: Executing op: ComponentRegister(ComponentId={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},KeyPath=C:\Windows\system32\vccorlib120.dll,State=3,,Disk=1,SharedDllRefCount=3,BinaryType=1) MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200) MSI (s) (D4:88) [09:55:15:561]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0,,) MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTick() MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200) MSI (s) (D4:88) [09:55:15:561]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0,,) MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTick() MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200) MSI (s) (D4:88) [09:55:15:561]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0,,) MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTick() MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200) MSI (s) (D4:88) [09:55:15:561]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=1,,) MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTick() MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200) MSI (s) (D4:88) [09:55:15:561]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=1,,) MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTick() MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200) MSI (s) (D4:88) [09:55:15:561]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=1,,) MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTick() MSI (s) (D4:88) [09:55:15:561]: Executing op: ActionStart(Name=StopServices,Description=Stopping services,Template=Service: [1]) MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000) MSI (s) (D4:88) [09:55:15:561]: Executing op: ServiceControl(,Name=SntpService,Action=2,Wait=1,) MSI (s) (D4:88) [09:55:15:561]: Executing op: ActionStart(Name=RemoveRegistryValues,Description=Removing system registry values,Template=Key: [1], Name: [2]) MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200) MSI (s) (D4:88) [09:55:15:561]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\AutoUpdate\Products\NTP64,,BinaryType=0,,) MSI (s) (D4:88) [09:55:15:561]: Executing op: RegRemoveKey() MSI (s) (D4:88) [09:55:15:561]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\Software\Sophos\AutoUpdate\Products\NTP64 3: 2 MSI (s) (D4:88) [09:55:15:561]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1]) MSI (s) (D4:88) [09:55:15:561]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\,Foreign=0,SecurityDescriptor=BinaryData,) MSI (s) (D4:88) [09:55:15:561]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\,Foreign=0,,) MSI (s) (D4:88) [09:55:15:561]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\,Foreign=0,,) MSI (s) (D4:88) [09:55:15:561]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\,Foreign=0,,) MSI (s) (D4:88) [09:55:15:561]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\,Foreign=0,,) MSI (s) (D4:88) [09:55:15:561]: Executing op: FolderCreate(Folder=E:\,Foreign=0,,) MSI (s) (D4:88) [09:55:15:561]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6]) MSI (s) (D4:88) [09:55:15:561]: Executing op: ProgressTotal(Total=6598613,Type=0,ByteEquivalent=1) MSI (s) (D4:88) [09:55:15:561]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\) MSI (s) (D4:88) [09:55:15:561]: Executing op: SetSourceFolder(Folder=1\Sophos\_tph7qnj\bin\|Sophos\Sophos Network Threat Protection\bin\) MSI (s) (D4:88) [09:55:15:561]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,,BytesPerTick=65536,CopierType=0,,,,,,IsFirstPhysicalMedia=1) MSI (s) (D4:88) [09:55:15:561]: Executing op: FileCopy(SourceName=BPAIF.dll,SourceCabKey=BPAIF.dll,DestName=BPAIF.dll,Attributes=512,FileSize=263944,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.2.1.3,Language=2057,InstallMode=58982400,,,,,,,) MSI (s) (D4:88) [09:55:15:561]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\BPAIF.dll; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:561]: Source for file 'BPAIF.dll' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\'. MSI (s) (D4:88) [09:55:15:561]: Executing op: SetTargetFolder(Folder=C:\Windows\system32\) MSI (s) (D4:88) [09:55:15:561]: Executing op: SetSourceFolder(Folder=1\Sys64\|System64\) MSI (s) (D4:88) [09:55:15:561]: Executing op: RegisterSharedComponentProvider(,,File=F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,Component={570C624B-D57C-4CD1-9013-1B80C800093B},ComponentVersion=12.0.21005.1,ProductCode={66967E5F-43E8-4402-87A4-04685EE5C2CB},ProductVersion=1.2.2,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0) MSI (s) (D4:88) [09:55:15:571]: Executing op: FileCopy(SourceName=msvcp120.dll,SourceCabKey=F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,DestName=msvcp120.dll,Attributes=512,FileSize=660128,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=12.0.21005.1,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (D4:88) [09:55:15:571]: File: C:\Windows\system32\msvcp120.dll; Won't Overwrite; Won't patch; Existing file is of an equal version MSI (s) (D4:88) [09:55:15:571]: Executing op: SetTargetFolder(Folder=C:\Windows\SysWOW64\) MSI (s) (D4:88) [09:55:15:571]: Executing op: SetSourceFolder(Folder=1\Sys\|System\) MSI (s) (D4:88) [09:55:15:571]: Executing op: RegisterSharedComponentProvider(,,File=F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,Component={74260D9F-D644-423B-B2D4-0291EA4BA8BE},ComponentVersion=12.0.21005.1,ProductCode={66967E5F-43E8-4402-87A4-04685EE5C2CB},ProductVersion=1.2.2,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0) MSI (s) (D4:88) [09:55:15:571]: Executing op: FileCopy(SourceName=msvcp120.dll,SourceCabKey=F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,DestName=msvcp120.dll,Attributes=512,FileSize=455328,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=12.0.21005.1,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (D4:88) [09:55:15:571]: File: C:\Windows\SysWOW64\msvcp120.dll; Won't Overwrite; Won't patch; Existing file is of an equal version MSI (s) (D4:88) [09:55:15:571]: Executing op: SetTargetFolder(Folder=C:\Windows\system32\) MSI (s) (D4:88) [09:55:15:571]: Executing op: SetSourceFolder(Folder=1\Sys64\|System64\) MSI (s) (D4:88) [09:55:15:571]: Executing op: RegisterSharedComponentProvider(,,File=F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,Component={E5B92048-5859-4AF1-AEAD-B97EBF00B087},ComponentVersion=12.0.21005.1,ProductCode={66967E5F-43E8-4402-87A4-04685EE5C2CB},ProductVersion=1.2.2,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0) MSI (s) (D4:88) [09:55:15:581]: Executing op: FileCopy(SourceName=msvcr120.dll,SourceCabKey=F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,DestName=msvcr120.dll,Attributes=512,FileSize=963232,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=12.0.21005.1,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (D4:88) [09:55:15:581]: File: C:\Windows\system32\msvcr120.dll; Won't Overwrite; Won't patch; Existing file is of an equal version MSI (s) (D4:88) [09:55:15:581]: Executing op: SetTargetFolder(Folder=C:\Windows\SysWOW64\) MSI (s) (D4:88) [09:55:15:581]: Executing op: SetSourceFolder(Folder=1\Sys\|System\) MSI (s) (D4:88) [09:55:15:581]: Executing op: RegisterSharedComponentProvider(,,File=F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,Component={0835C947-D6D2-4E52-AF14-0231D04E88EA},ComponentVersion=12.0.21005.1,ProductCode={66967E5F-43E8-4402-87A4-04685EE5C2CB},ProductVersion=1.2.2,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0) MSI (s) (D4:88) [09:55:15:581]: Executing op: FileCopy(SourceName=msvcr120.dll,SourceCabKey=F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,DestName=msvcr120.dll,Attributes=512,FileSize=970912,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=12.0.21005.1,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (D4:88) [09:55:15:581]: File: C:\Windows\SysWOW64\msvcr120.dll; Won't Overwrite; Won't patch; Existing file is of an equal version MSI (s) (D4:88) [09:55:15:581]: Executing op: SetTargetFolder(Folder=C:\Windows\system32\) MSI (s) (D4:88) [09:55:15:581]: Executing op: SetSourceFolder(Folder=1\Sys64\|System64\) MSI (s) (D4:88) [09:55:15:581]: Executing op: RegisterSharedComponentProvider(,,File=F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,Component={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},ComponentVersion=12.0.21005.1,ProductCode={66967E5F-43E8-4402-87A4-04685EE5C2CB},ProductVersion=1.2.2,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0) MSI (s) (D4:88) [09:55:15:591]: Executing op: FileCopy(SourceName=him3inkw.dll|vccorlib120.dll,SourceCabKey=F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,DestName=vccorlib120.dll,Attributes=512,FileSize=356528,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=12.0.21005.1,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (D4:88) [09:55:15:591]: File: C:\Windows\system32\vccorlib120.dll; Won't Overwrite; Won't patch; Existing file is of an equal version MSI (s) (D4:88) [09:55:15:591]: Executing op: SetTargetFolder(Folder=C:\Windows\SysWOW64\) MSI (s) (D4:88) [09:55:15:591]: Executing op: SetSourceFolder(Folder=1\Sys\|System\) MSI (s) (D4:88) [09:55:15:591]: Executing op: RegisterSharedComponentProvider(,,File=F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,Component={63B83B20-1AB9-4F49-B0B2-4489724CA96C},ComponentVersion=12.0.21005.1,ProductCode={66967E5F-43E8-4402-87A4-04685EE5C2CB},ProductVersion=1.2.2,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0) MSI (s) (D4:88) [09:55:15:591]: Executing op: FileCopy(SourceName=bxxe4aoo.dll|vccorlib120.dll,SourceCabKey=F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,DestName=vccorlib120.dll,Attributes=512,FileSize=247984,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=12.0.21005.1,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (D4:88) [09:55:15:591]: File: C:\Windows\SysWOW64\vccorlib120.dll; Won't Overwrite; Won't patch; Existing file is of an equal version MSI (s) (D4:88) [09:55:15:591]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\) MSI (s) (D4:88) [09:55:15:591]: Executing op: SetSourceFolder(Folder=1\Sophos\_tph7qnj\bin\plugins\|Sophos\Sophos Network Threat Protection\bin\plugins\) MSI (s) (D4:88) [09:55:15:591]: Executing op: FileCopy(SourceName=http.plg,SourceCabKey=http.plg,DestName=http.plg,Attributes=512,FileSize=233608,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-1003090990,HashPart2=637438897,HashPart3=1497796465,HashPart4=997938917,,) MSI (s) (D4:88) [09:55:15:591]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\http.plg; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:591]: Source for file 'http.plg' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\plugins\'. MSI (s) (D4:88) [09:55:15:591]: Executing op: FileCopy(SourceName=ip.plg,SourceCabKey=ip.plg,DestName=ip.plg,Attributes=512,FileSize=140696,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-936529958,HashPart2=1188448779,HashPart3=212944153,HashPart4=1446538244,,) MSI (s) (D4:88) [09:55:15:591]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\ip.plg; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:591]: Source for file 'ip.plg' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\plugins\'. MSI (s) (D4:88) [09:55:15:591]: Executing op: FileCopy(SourceName=ipv6.plg,SourceCabKey=ipv6.plg,DestName=ipv6.plg,Attributes=512,FileSize=119344,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-1846526672,HashPart2=1124447724,HashPart3=406511845,HashPart4=-1945955065,,) MSI (s) (D4:88) [09:55:15:591]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\ipv6.plg; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:591]: Source for file 'ipv6.plg' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\plugins\'. MSI (s) (D4:88) [09:55:15:591]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\) MSI (s) (D4:88) [09:55:15:591]: Executing op: SetSourceFolder(Folder=1\Sophos\_tph7qnj\bin\|Sophos\Sophos Network Threat Protection\bin\) MSI (s) (D4:88) [09:55:15:591]: Executing op: FileCopy(SourceName=navl.dll,SourceCabKey=navl.dll,DestName=navl.dll,Attributes=512,FileSize=609240,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=4.2.0.26,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (D4:88) [09:55:15:591]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\navl.dll; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:591]: Source for file 'navl.dll' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\'. MSI (s) (D4:88) [09:55:15:601]: Executing op: FileCopy(SourceName=4tttawjz.dll|NTPAdapter.dll,SourceCabKey=NTPAdapter.dll,DestName=NTPAdapter.dll,Attributes=512,FileSize=132264,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.2.2.50,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (D4:88) [09:55:15:601]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\NTPAdapter.dll; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:601]: Source for file 'NTPAdapter.dll' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\'. MSI (s) (D4:88) [09:55:15:601]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\) MSI (s) (D4:88) [09:55:15:601]: Executing op: SetSourceFolder(Folder=1\Sophos\_tph7qnj\bin\plugins\|Sophos\Sophos Network Threat Protection\bin\plugins\) MSI (s) (D4:88) [09:55:15:601]: Executing op: FileCopy(SourceName=portmap.plg,SourceCabKey=portmap.plg,DestName=portmap.plg,Attributes=512,FileSize=76704,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-1543113808,HashPart2=1031817023,HashPart3=82558230,HashPart4=517997495,,) MSI (s) (D4:88) [09:55:15:601]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\portmap.plg; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:601]: Source for file 'portmap.plg' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\plugins\'. MSI (s) (D4:88) [09:55:15:601]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\) MSI (s) (D4:88) [09:55:15:601]: Executing op: SetSourceFolder(Folder=1\Sophos\_tph7qnj\bin\|Sophos\Sophos Network Threat Protection\bin\) MSI (s) (D4:88) [09:55:15:601]: Executing op: FileCopy(SourceName=Sntp.cat,SourceCabKey=Sntp.cat,DestName=Sntp.cat,Attributes=512,FileSize=19822,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-1263684000,HashPart2=-1229433199,HashPart3=-506491320,HashPart4=772320935,,) MSI (s) (D4:88) [09:55:15:601]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.cat; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:601]: Source for file 'Sntp.cat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\'. MSI (s) (D4:88) [09:55:15:601]: Executing op: FileCopy(SourceName=Sntp.inf,SourceCabKey=Sntp.inf,DestName=Sntp.inf,Attributes=512,FileSize=1669,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=540190727,HashPart2=-1778745258,HashPart3=1573664978,HashPart4=372036710,,) MSI (s) (D4:88) [09:55:15:601]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.inf; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:601]: Source for file 'Sntp.inf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\'. MSI (s) (D4:88) [09:55:15:621]: Executing op: FileCopy(SourceName=Sntp.man,SourceCabKey=Sntp.man,DestName=Sntp.man,Attributes=512,FileSize=16378,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=1118515140,HashPart2=-545138584,HashPart3=-520713038,HashPart4=1289866927,,) MSI (s) (D4:88) [09:55:15:621]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:621]: Source for file 'Sntp.man' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\'. MSI (s) (D4:88) [09:55:15:621]: Executing op: FileCopy(SourceName=Sntp.sys,SourceCabKey=Sntp.sys,DestName=Sntp.sys,Attributes=512,FileSize=116144,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.2.2.50,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (D4:88) [09:55:15:621]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.sys; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:621]: Source for file 'Sntp.sys' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\'. MSI (s) (D4:88) [09:55:15:621]: Executing op: FileCopy(SourceName=yfmdjijj.exe|SntpService.exe,SourceCabKey=SntpService.exe,DestName=SntpService.exe,Attributes=512,FileSize=901248,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.2.2.50,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (D4:88) [09:55:15:621]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:621]: Source for file 'SntpService.exe' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\'. MSI (s) (D4:88) [09:55:15:621]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\) MSI (s) (D4:88) [09:55:15:621]: Executing op: SetSourceFolder(Folder=1\Sophos\_tph7qnj\bin\plugins\|Sophos\Sophos Network Threat Protection\bin\plugins\) MSI (s) (D4:88) [09:55:15:621]: Executing op: FileCopy(SourceName=tcp.plg,SourceCabKey=tcp.plg,DestName=tcp.plg,Attributes=512,FileSize=165000,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=1257080860,HashPart2=-1219977601,HashPart3=-2029541999,HashPart4=889595478,,) MSI (s) (D4:88) [09:55:15:621]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\tcp.plg; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:621]: Source for file 'tcp.plg' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\plugins\'. MSI (s) (D4:88) [09:55:15:621]: Executing op: FileCopy(SourceName=udp.plg,SourceCabKey=udp.plg,DestName=udp.plg,Attributes=512,FileSize=148440,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=857749978,HashPart2=-1200827959,HashPart3=1680134307,HashPart4=918499589,,) MSI (s) (D4:88) [09:55:15:621]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\udp.plg; To be installed; Won't patch; No existing file MSI (s) (D4:88) [09:55:15:621]: Source for file 'udp.plg' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos\Sophos Network Threat Protection\bin\plugins\'. MSI (s) (D4:88) [09:55:15:631]: Executing op: CacheSizeFlush(,) MSI (s) (D4:88) [09:55:15:631]: Executing op: ActionStart(Name=MsiRollbackInstall,,) MSI (s) (D4:88) [09:55:15:631]: Executing op: CustomActionSchedule(Action=MsiRollbackInstall,ActionType=3329,Source=BinaryData,Target=RollbackInstall,CustomActionData=2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}212Sophos Network Threat ProtectionSophos Limited) MSI (s) (D4:88) [09:55:15:631]: Executing op: ActionStart(Name=MsiInstallDrivers,,) MSI (s) (D4:88) [09:55:15:631]: Executing op: CustomActionSchedule(Action=MsiInstallDrivers,ActionType=3073,Source=BinaryData,Target=InstallDriverPackages,CustomActionData=2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}C:\Program Files\Sophos\Sophos Network Threat Protection\bin\212Sophos Network Threat ProtectionSophos Limited) MSI (s) (D4:88) [09:55:15:631]: Creating MSIHANDLE (46901) of type 790536 for thread 6792 MSI (s) (D4:D0) [09:55:15:641]: Invoking remote custom action. DLL: C:\Windows\Installer\MSICB56.tmp, Entrypoint: InstallDriverPackages MSI (s) (D4!A4) [09:55:15:661]: Creating MSIHANDLE (46902) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:661]: Closing MSIHANDLE (46902) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:661]: Creating MSIHANDLE (46903) of type 790531 for thread 7844 DIFXAPP: ENTER: InstallDriverPackages() MSI (s) (D4!A4) [09:55:15:661]: Closing MSIHANDLE (46903) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:661]: Creating MSIHANDLE (46904) of type 790531 for thread 7844 DIFXAPP: INFO: 'CustomActionData' property 'DIFxApp Version' is '2.1'. MSI (s) (D4!A4) [09:55:15:661]: Closing MSIHANDLE (46904) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:661]: Creating MSIHANDLE (46905) of type 790531 for thread 7844 DIFXAPP: INFO: 'CustomActionData' property 'UI Level' is '2'. MSI (s) (D4!A4) [09:55:15:661]: Closing MSIHANDLE (46905) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:661]: Creating MSIHANDLE (46906) of type 790531 for thread 7844 DIFXAPP: INFO: 'CustomActionData' property 'componentId' is '{76F354A6-97D5-4872-9781-2F2642A4F18A}'. MSI (s) (D4!A4) [09:55:15:661]: Closing MSIHANDLE (46906) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:661]: Creating MSIHANDLE (46907) of type 790531 for thread 7844 DIFXAPP: INFO: 'CustomActionData' property 'componentPath' is 'C:\Program Files\Sophos\Sophos Network Threat Protection\bin\'. MSI (s) (D4!A4) [09:55:15:661]: Closing MSIHANDLE (46907) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:661]: Creating MSIHANDLE (46908) of type 790531 for thread 7844 DIFXAPP: INFO: 'CustomActionData' property 'flags' is 0x15. MSI (s) (D4!A4) [09:55:15:661]: Closing MSIHANDLE (46908) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:661]: Creating MSIHANDLE (46909) of type 790531 for thread 7844 DIFXAPP: INFO: 'CustomActionData' property 'installState' is '2'. MSI (s) (D4!A4) [09:55:15:661]: Closing MSIHANDLE (46909) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:661]: Creating MSIHANDLE (46910) of type 790531 for thread 7844 DIFXAPP: INFO: 'CustomActionData' property 'ProductName' is 'Sophos Network Threat Protection'. MSI (s) (D4!A4) [09:55:15:661]: Closing MSIHANDLE (46910) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:661]: Creating MSIHANDLE (46911) of type 790531 for thread 7844 DIFXAPP: INFO: 'CustomActionData' property 'ManufacturerName' is 'Sophos Limited'. MSI (s) (D4!A4) [09:55:15:661]: Closing MSIHANDLE (46911) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:661]: Creating MSIHANDLE (46912) of type 790531 for thread 7844 DIFXAPP: INFO: user SID of user performing the install is 'S-1-5-18'. MSI (s) (D4!A4) [09:55:15:661]: Closing MSIHANDLE (46912) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:671]: Creating MSIHANDLE (46913) of type 790531 for thread 7844 DIFXAPP: INFO: opening HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{76F354A6-97D5-4872-9781-2F2642A4F18A} (User's SID: 'S-1-5-18') ... MSI (s) (D4!A4) [09:55:15:671]: Closing MSIHANDLE (46913) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:671]: Creating MSIHANDLE (46914) of type 790531 for thread 7844 DIFXAPP: INFO: ENTER: DriverPackageInstallW MSI (s) (D4!A4) [09:55:15:671]: Closing MSIHANDLE (46914) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:701]: Creating MSIHANDLE (46915) of type 790531 for thread 7844 DIFXAPP: INFO: Sntp.inf: checking signature with catalog 'C:\Program Files\Sophos\Sophos Network Threat Protection\bin\sntp.cat' ... MSI (s) (D4!A4) [09:55:15:701]: Closing MSIHANDLE (46915) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:731]: Creating MSIHANDLE (46916) of type 790531 for thread 7844 DIFXAPP: INFO: Driver package 'Sntp.inf' is Authenticode signed. MSI (s) (D4!A4) [09:55:15:731]: Closing MSIHANDLE (46916) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:731]: Creating MSIHANDLE (46917) of type 790531 for thread 7844 DIFXAPP: INFO: Copied 'Sntp.inf' to driver store... MSI (s) (D4!A4) [09:55:15:731]: Closing MSIHANDLE (46917) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:741]: Creating MSIHANDLE (46918) of type 790531 for thread 7844 DIFXAPP: INFO: Copied 'sntp.cat' to driver store... MSI (s) (D4!A4) [09:55:15:741]: Closing MSIHANDLE (46918) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:741]: Creating MSIHANDLE (46919) of type 790531 for thread 7844 DIFXAPP: INFO: Commiting queue... MSI (s) (D4!A4) [09:55:15:741]: Closing MSIHANDLE (46919) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:751]: Creating MSIHANDLE (46920) of type 790531 for thread 7844 DIFXAPP: INFO: Copied file: 'C:\Program Files\Sophos\Sophos Network Threat Protection\bin\sntp.sys' -> 'C:\Windows\system32\DRVSTORE\Sntp_65825BCE18B284A77B7004ABEDBF369AB894EB1F\sntp.sys'. MSI (s) (D4!A4) [09:55:15:751]: Closing MSIHANDLE (46920) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:15:751]: Creating MSIHANDLE (46921) of type 790531 for thread 7844 DIFXAPP: INFO: Installing INF file "C:\Windows\system32\DRVSTORE\Sntp_65825BCE18B284A77B7004ABEDBF369AB894EB1F\Sntp.inf" of Type 1. MSI (s) (D4!A4) [09:55:15:751]: Closing MSIHANDLE (46921) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:16:561]: Creating MSIHANDLE (46922) of type 790531 for thread 7844 DIFXAPP: INFO: Installing legacy driver 'C:\Windows\system32\DRVSTORE\Sntp_65825BCE18B284A77B7004ABEDBF369AB894EB1F\Sntp.inf' MSI (s) (D4!A4) [09:55:16:561]: Closing MSIHANDLE (46922) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:16:561]: Creating MSIHANDLE (46923) of type 790531 for thread 7844 DIFXAPP: INFO: Service 'sntp' was started MSI (s) (D4!A4) [09:55:16:571]: Closing MSIHANDLE (46923) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:16:571]: Creating MSIHANDLE (46924) of type 790531 for thread 7844 DIFXAPP: SUCCESS:Installation completed with code 0x0. MSI (s) (D4!A4) [09:55:16:571]: Closing MSIHANDLE (46924) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:16:571]: Creating MSIHANDLE (46925) of type 790531 for thread 7844 DIFXAPP: INFO: RETURN: DriverPackageInstallW (0x0) MSI (s) (D4!A4) [09:55:16:571]: Closing MSIHANDLE (46925) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:16:571]: Creating MSIHANDLE (46926) of type 790531 for thread 7844 DIFXAPP: INFO: ENTER: DriverPackageGetPathW MSI (s) (D4!A4) [09:55:16:571]: Closing MSIHANDLE (46926) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:16:571]: Creating MSIHANDLE (46927) of type 790531 for thread 7844 DIFXAPP: SUCCESS:Found driver store entry. MSI (s) (D4!A4) [09:55:16:571]: Closing MSIHANDLE (46927) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:16:571]: Creating MSIHANDLE (46928) of type 790531 for thread 7844 DIFXAPP: INFO: RETURN: DriverPackageGetPathW (0x7A) MSI (s) (D4!A4) [09:55:16:571]: Closing MSIHANDLE (46928) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:16:571]: Creating MSIHANDLE (46929) of type 790531 for thread 7844 DIFXAPP: INFO: ENTER: DriverPackageGetPathW MSI (s) (D4!A4) [09:55:16:571]: Closing MSIHANDLE (46929) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:16:571]: Creating MSIHANDLE (46930) of type 790531 for thread 7844 DIFXAPP: SUCCESS:Found driver store entry. MSI (s) (D4!A4) [09:55:16:571]: Closing MSIHANDLE (46930) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:16:571]: Creating MSIHANDLE (46931) of type 790531 for thread 7844 DIFXAPP: INFO: RETURN: DriverPackageGetPathW (0x0) MSI (s) (D4!A4) [09:55:16:571]: Closing MSIHANDLE (46931) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:16:571]: Creating MSIHANDLE (46932) of type 790531 for thread 7844 DIFXAPP: INFO: driver store entry for 'C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.inf' is 'C:\Windows\system32\DRVSTORE\Sntp_65825BCE18B284A77B7004ABEDBF369AB894EB1F\Sntp.inf'. MSI (s) (D4!A4) [09:55:16:571]: Closing MSIHANDLE (46932) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:16:571]: Creating MSIHANDLE (46933) of type 790531 for thread 7844 DIFXAPP: INFO: The component Id '{76F354A6-97D5-4872-9781-2F2642A4F18A}' is now set to point to driver store: 'C:\Windows\system32\DRVSTORE\Sntp_65825BCE18B284A77B7004ABEDBF369AB894EB1F\Sntp.inf' MSI (s) (D4!A4) [09:55:16:571]: Closing MSIHANDLE (46933) of type 790531 for thread 7844 MSI (s) (D4!A4) [09:55:16:571]: Creating MSIHANDLE (46934) of type 790531 for thread 7844 DIFXAPP: INFO: A reboot is not needed to install the component '{76F354A6-97D5-4872-9781-2F2642A4F18A}'. MSI (s) (D4!A4) [09:55:16:571]: Closing MSIHANDLE (46934) of type 790531 for thread 7844 MSI (s) (D4:D0) [09:55:16:571]: Closing MSIHANDLE (46901) of type 790536 for thread 6792 MSI (s) (D4:88) [09:55:16:571]: Executing op: ActionStart(Name=ExecXmlFile,,) DIFXAPP: RETURN: InstallDriverPackages() 0 (0x0) MSI (s) (D4:88) [09:55:16:571]: Executing op: CustomActionSchedule(Action=ExecXmlFile,ActionType=3073,Source=BinaryData,Target=ExecXmlFile,CustomActionData=2€0€C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man€7€1€/*/*/*/*[@messageFileName]€messageFileName€C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.sys€2€0€C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man€7€1€/*/*/*/*[@resourceFileName]€resourceFileName€C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.sys) MSI (s) (D4:88) [09:55:16:581]: Creating MSIHANDLE (46935) of type 790536 for thread 6792 MSI (s) (D4:70) [09:55:16:591]: Invoking remote custom action. DLL: C:\Windows\Installer\MSICEFF.tmp, Entrypoint: ExecXmlFile MSI (s) (D4:70) [09:55:16:851]: Closing MSIHANDLE (46935) of type 790536 for thread 6792 MSI (s) (D4:88) [09:55:16:851]: Executing op: ActionStart(Name=RollbackRegisterEventManifest,,) MSI (s) (D4:88) [09:55:16:851]: Executing op: CustomActionSchedule(Action=RollbackRegisterEventManifest,ActionType=3393,Source=BinaryData,Target=CAQuietExec,CustomActionData="wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man") MSI (s) (D4:88) [09:55:16:851]: Executing op: ActionStart(Name=RegisterEventManifest,,) MSI (s) (D4:88) [09:55:16:851]: Executing op: CustomActionSchedule(Action=RegisterEventManifest,ActionType=3073,Source=BinaryData,Target=CAQuietExec,CustomActionData="wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man") MSI (s) (D4:88) [09:55:16:851]: Creating MSIHANDLE (46936) of type 790536 for thread 6792 MSI (s) (D4:70) [09:55:16:871]: Invoking remote custom action. DLL: C:\Windows\Installer\MSID019.tmp, Entrypoint: CAQuietExec MSI (s) (D4:70) [09:55:17:191]: Closing MSIHANDLE (46936) of type 790536 for thread 6792 MSI (s) (D4:88) [09:55:17:191]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3]) MSI (s) (D4:88) [09:55:17:191]: Executing op: ProgressTotal(Total=5,Type=1,ByteEquivalent=13200) MSI (s) (D4:88) [09:55:17:191]: Executing op: RegOpenKey(,Key=AppID\{C092D533-8791-42F8-8EBE-DB116F79B4B7},,BinaryType=1,,) MSI (s) (D4:88) [09:55:17:191]: Executing op: RegAddValue(Name=LocalService,Value=SntpService,) MSI (s) (D4:88) [09:55:17:191]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Application,,BinaryType=1,,) MSI (s) (D4:88) [09:55:17:191]: Executing op: RegAddValue(Name=ProductCode,Value={66967E5F-43E8-4402-87A4-04685EE5C2CB},) MSI (s) (D4:88) [09:55:17:201]: Executing op: RegAddValue(Name=ProductVersion,Value=1.2.2.50,) MSI (s) (D4:88) [09:55:17:201]: Executing op: RegAddValue(Name=Path,Value=C:\Program Files\Sophos\Sophos Network Threat Protection\,) MSI (s) (D4:88) [09:55:17:201]: Executing op: RegOpenKey(Root=-2147483646,Key=SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService,,BinaryType=1,,) MSI (s) (D4:88) [09:55:17:201]: Executing op: RegAddValue(,Value=service,) MSI (s) (D4:88) [09:55:17:201]: Executing op: ActionStart(Name=RegisterTypeLibraries,Description=Registering type libraries,Template=LibID: [1]) MSI (s) (D4:88) [09:55:17:201]: Executing op: TypeLibraryRegister(,,FilePath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe,LibID={6886D7DB-850A-4C92-A2F7-CBD741F825E5},Version=256,,Language=0,HelpPath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\,BinaryType=1,IgnoreRegistrationFailure=0,) MSI (s) (D4:88) [09:55:17:201]: QueryPathOfRegTypeLib returned 0 in local context. Path is 'C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe' MSI (s) (D4:88) [09:55:17:201]: Note: 1: 1402 2: UNKNOWN\TypeLib\{6886D7DB-850A-4C92-A2F7-CBD741F825E5}\100.0\0\win32 3: 2 MSI (s) (D4:88) [09:55:17:201]: CMsiServices::ProcessTypeLibrary runs in local context, not impersonated. MSI (s) (D4:88) [09:55:17:211]: ProcessTypeLibraryCore returns: -2147319780. (0 means OK) MSI (s) (D4:88) [09:55:17:211]: Note: 1: 2107 2: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe 3: -2147319780 MSI (s) (D4:88) [09:55:17:211]: CMsiServices::ProcessTypeLibrary runs in local context, not impersonated. MSI (s) (D4:88) [09:55:17:211]: ProcessTypeLibraryCore returns: 0. (0 means OK) MSI (s) (D4:88) [09:55:17:211]: Executing op: ActionStart(Name=InstallServices,Description=Installing new services,Template=Service: [2]) Info 1912.Could not unregister type library for file C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe. Contact your support personnel. MSI (s) (D4:88) [09:55:17:211]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000) MSI (s) (D4:88) [09:55:17:211]: Executing op: ServiceInstall(Name=SntpService,DisplayName=Sophos Network Threat Protection,ImagePath="C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe",ServiceType=16,StartType=2,ErrorControl=32769,,Dependencies=rpcss[~][~][~],,StartName=LocalSystem,Password=**********,Description=Detects network-based threats.,,) MSI (s) (D4:88) [09:55:17:441]: Executing op: ActionStart(Name=AddSIPSSubmitterUserAccountRollback,,) MSI (s) (D4:88) [09:55:17:441]: Executing op: CustomActionSchedule(Action=AddSIPSSubmitterUserAccountRollback,ActionType=1281,Source=BinaryData,Target=RemoveSIPSManagementUser,CustomActionData=NT SERVICE\SntpService) MSI (s) (D4:88) [09:55:17:441]: Executing op: ActionStart(Name=AddSIPSSubmitterUserAccount,,) MSI (s) (D4:88) [09:55:17:441]: Executing op: CustomActionSchedule(Action=AddSIPSSubmitterUserAccount,ActionType=1025,Source=BinaryData,Target=AddSIPSManagementUser,CustomActionData=NT SERVICE\SntpService) MSI (s) (D4:88) [09:55:17:441]: Creating MSIHANDLE (46937) of type 790536 for thread 6792 MSI (s) (D4:A4) [09:55:17:451]: Invoking remote custom action. DLL: C:\Windows\Installer\MSID26A.tmp, Entrypoint: AddSIPSManagementUser MSI (s) (D4!F0) [09:55:17:451]: Creating MSIHANDLE (46938) of type 790531 for thread 7920 MSI (s) (D4!F0) [09:55:17:451]: Closing MSIHANDLE (46938) of type 790531 for thread 7920 MSI (s) (D4!F0) [09:55:17:451]: Creating MSIHANDLE (46939) of type 790531 for thread 7920 AddSIPSManagementUser Enter (234) MSI (s) (D4!F0) [09:55:17:451]: Closing MSIHANDLE (46939) of type 790531 for thread 7920 MSI (s) (D4:A4) [09:55:17:451]: Closing MSIHANDLE (46937) of type 790536 for thread 6792 MSI (s) (D4:88) [09:55:17:451]: Executing op: ActionStart(Name=ExecSecureObjects_64,,) AddSIPSManagementUser Exit (283) MSI (s) (D4:88) [09:55:17:451]: Executing op: CustomActionSchedule(Action=ExecSecureObjects_64,ActionType=3073,Source=BinaryData,Target=ExecSecureObjects,CustomActionData=C:\ProgramData\Sophos\Sophos Network Threat Protection\€CreateFolder€€NT SERVICE\sntpservice€-2147483647€C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\€CreateFolder€€NT SERVICE\sntpservice€278€C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\€CreateFolder€€NT SERVICE\sntpservice€278€SntpService€ServiceInstall€€Administrators€983551€SntpService€ServiceInstall€€Everyone€-2147483632) MSI (s) (D4:88) [09:55:17:451]: Creating MSIHANDLE (46940) of type 790536 for thread 6792 MSI (s) (D4:D8) [09:55:17:461]: Invoking remote custom action. DLL: C:\Windows\Installer\MSID26B.tmp, Entrypoint: ExecSecureObjects MSI (s) (D4!4C) [09:55:17:461]: Creating MSIHANDLE (46941) of type 790531 for thread 8012 MSI (s) (D4!4C) [09:55:17:461]: Creating MSIHANDLE (46942) of type 790531 for thread 8012 MSI (s) (D4!4C) [09:55:17:461]: Closing MSIHANDLE (46942) of type 790531 for thread 8012 MSI (s) (D4!4C) [09:55:17:461]: Creating MSIHANDLE (46943) of type 790531 for thread 8012 MSI (s) (D4!4C) [09:55:17:461]: Closing MSIHANDLE (46943) of type 790531 for thread 8012 MSI (s) (D4!4C) [09:55:17:461]: Creating MSIHANDLE (46944) of type 790531 for thread 8012 MSI (s) (D4!4C) [09:55:17:461]: Closing MSIHANDLE (46944) of type 790531 for thread 8012 MSI (s) (D4!4C) [09:55:17:561]: Creating MSIHANDLE (46945) of type 790531 for thread 8012 MSI (s) (D4!4C) [09:55:17:561]: Closing MSIHANDLE (46945) of type 790531 for thread 8012 MSI (s) (D4!4C) [09:55:17:641]: Creating MSIHANDLE (46946) of type 790531 for thread 8012 MSI (s) (D4!4C) [09:55:17:641]: Closing MSIHANDLE (46946) of type 790531 for thread 8012 MSI (s) (D4!4C) [09:55:17:641]: Closing MSIHANDLE (46941) of type 790531 for thread 8012 MSI (s) (D4:D8) [09:55:17:641]: Closing MSIHANDLE (46940) of type 790536 for thread 6792 MSI (s) (D4:88) [09:55:17:641]: Executing op: ActionStart(Name=RollbackServiceConfig,,) MSI (s) (D4:88) [09:55:17:641]: Executing op: CustomActionSchedule(Action=RollbackServiceConfig,ActionType=3329,Source=BinaryData,Target=RollbackServiceConfig,CustomActionData=SchedServiceConfig) MSI (s) (D4:88) [09:55:17:641]: Executing op: ActionStart(Name=ExecServiceConfig,,) MSI (s) (D4:88) [09:55:17:641]: Executing op: CustomActionSchedule(Action=ExecServiceConfig,ActionType=3073,Source=BinaryData,Target=ExecServiceConfig,CustomActionData=SchedServiceConfig€SntpService€0€restart€restart€none€1€120€€) MSI (s) (D4:88) [09:55:17:641]: Creating MSIHANDLE (46947) of type 790536 for thread 6792 MSI (s) (D4:38) [09:55:17:651]: Invoking remote custom action. DLL: C:\Windows\Installer\MSID328.tmp, Entrypoint: ExecServiceConfig MSI (s) (D4!30) [09:55:17:771]: Creating MSIHANDLE (46948) of type 790531 for thread 6192 MSI (s) (D4!30) [09:55:17:781]: Closing MSIHANDLE (46948) of type 790531 for thread 6192 MSI (s) (D4:38) [09:55:17:781]: Closing MSIHANDLE (46947) of type 790536 for thread 6792 MSI (s) (D4:88) [09:55:17:781]: Executing op: ActionStart(Name=SetupSspUserAccountRollback,,) MSI (s) (D4:88) [09:55:17:781]: Executing op: CustomActionSchedule(Action=SetupSspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\sntpservice) MSI (s) (D4:88) [09:55:17:781]: Executing op: ActionStart(Name=SetupSspUserAccount,,) MSI (s) (D4:88) [09:55:17:781]: Executing op: CustomActionSchedule(Action=SetupSspUserAccount,ActionType=1025,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sntpservice) MSI (s) (D4:88) [09:55:17:781]: Creating MSIHANDLE (46949) of type 790536 for thread 6792 MSI (s) (D4:64) [09:55:17:791]: Invoking remote custom action. DLL: C:\Windows\Installer\MSID3B5.tmp, Entrypoint: SetupSspUserAccount MSI (s) (D4!3C) [09:55:17:811]: Creating MSIHANDLE (46950) of type 790531 for thread 7228 MSI (s) (D4!3C) [09:55:17:811]: Closing MSIHANDLE (46950) of type 790531 for thread 7228 MSI (s) (D4!3C) [09:55:17:821]: Creating MSIHANDLE (46951) of type 790531 for thread 7228 SetupSspUserAccount: Initialized. MSI (s) (D4!3C) [09:55:17:821]: Closing MSIHANDLE (46951) of type 790531 for thread 7228 MSI (s) (D4!3C) [09:55:17:821]: Creating MSIHANDLE (46952) of type 790531 for thread 7228 SetupSspUserAccount: LoadAccount(SophosSSPUser) failed (error 1332) MSI (s) (D4!3C) [09:55:17:821]: Closing MSIHANDLE (46952) of type 790531 for thread 7228 MSI (s) (D4!3C) [09:55:18:331]: Creating MSIHANDLE (46953) of type 790531 for thread 7228 SetupSspUserAccount: Granting permissions to user "NT SERVICE\sntpservice" MSI (s) (D4!3C) [09:55:18:331]: Closing MSIHANDLE (46953) of type 790531 for thread 7228 MSI (s) (D4:64) [09:55:18:411]: Closing MSIHANDLE (46949) of type 790536 for thread 6792 MSI (s) (D4:88) [09:55:18:421]: Executing op: ActionStart(Name=MsiConfigureServices,,) SetupSspUserAccount: Service has stopped, now starting. MSI (s) (D4:88) [09:55:18:441]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000) MSI (s) (D4:88) [09:55:18:441]: Executing op: ServiceConfigure(,Name=SntpService,Event=5,ConfigType=5,Argument=1) MSI (s) (D4:88) [09:55:18:441]: Changing configuration of service SntpService. MSI (s) (D4:88) [09:55:18:761]: Changed configuration of service SntpService with ConfigType SERVICE_CONFIG_SERVICE_SID_INFO MSI (s) (D4:88) [09:55:18:761]: Done changing configuration of service SntpService MSI (s) (D4:88) [09:55:18:761]: Executing op: ActionStart(Name=StartServices,Description=Starting services,Template=Service: [1]) MSI (s) (D4:88) [09:55:18:761]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000) MSI (s) (D4:88) [09:55:18:761]: Executing op: ServiceControl(,Name=SntpService,Action=1,Wait=1,) MSI (s) (D4:88) [09:55:49:069]: Product: Sophos Network Threat Protection -- Error 1920. Service 'Sophos Network Threat Protection' (SntpService) failed to start. Verify that you have sufficient privileges to start system services. Error 1920. Service 'Sophos Network Threat Protection' (SntpService) failed to start. Verify that you have sufficient privileges to start system services. MSI (s) (D4:88) [09:55:49:089]: User policy value 'DisableRollback' is 0 MSI (s) (D4:88) [09:55:49:089]: Machine policy value 'DisableRollback' is 0 Action ended 9:55:49: InstallFinalize. Return value 3. MSI (s) (D4:88) [09:55:49:099]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1221676776,LangId=1033,Platform=589824,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1) MSI (s) (D4:88) [09:55:49:099]: Executing op: DialogInfo(Type=0,Argument=1033) MSI (s) (D4:88) [09:55:49:099]: Executing op: DialogInfo(Type=1,Argument=Sophos Network Threat Protection) MSI (s) (D4:88) [09:55:49:099]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1]) MSI (s) (D4:88) [09:55:49:099]: Executing op: ActionStart(Name=StartServices,Description=Starting services,Template=Service: [1]) MSI (s) (D4:88) [09:55:49:099]: Executing op: ProductInfo(ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},ProductName=Sophos Network Threat Protection,PackageName=Sophos Network Threat Protection.msi,Language=1033,Version=16908290,Assignment=1,ObsoleteArg=0,ProductIcon=shield.ico,,PackageCode={69BE7301-439B-4074-8A16-83658F3FDC2B},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3) MSI (s) (D4:88) [09:55:49:099]: Executing op: ActionStart(Name=MsiConfigureServices,,) MSI (s) (D4:88) [09:55:49:099]: Executing op: ServiceConfigure(,Name=SntpService,,ConfigType=5,Argument=0) MSI (s) (D4:88) [09:55:49:099]: Changing configuration of service SntpService. MSI (s) (D4:88) [09:55:49:169]: Changed configuration of service SntpService with ConfigType SERVICE_CONFIG_SERVICE_SID_INFO MSI (s) (D4:88) [09:55:49:169]: Done changing configuration of service SntpService MSI (s) (D4:88) [09:55:49:169]: Executing op: ActionStart(Name=SetupSspUserAccount,,) MSI (s) (D4:88) [09:55:49:169]: Executing op: ActionStart(Name=SetupSspUserAccountRollback,,) MSI (s) (D4:88) [09:55:49:169]: Executing op: CustomActionRollback(Action=SetupSspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\sntpservice) MSI (s) (D4:88) [09:55:49:169]: Creating MSIHANDLE (46954) of type 790536 for thread 6792 MSI (s) (D4:A4) [09:55:49:199]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI4E51.tmp, Entrypoint: CleanUpSsspUserAccount MSI (s) (D4!48) [09:55:49:209]: Creating MSIHANDLE (46955) of type 790531 for thread 3656 MSI (s) (D4!48) [09:55:49:209]: Closing MSIHANDLE (46955) of type 790531 for thread 3656 MSI (s) (D4:A4) [09:55:49:209]: Closing MSIHANDLE (46954) of type 790536 for thread 6792 CleanUpSsspUserAccount: Initialized. MSI (s) (D4:88) [09:55:49:209]: Executing op: ActionStart(Name=ExecServiceConfig,,) MSI (s) (D4:88) [09:55:49:209]: Executing op: ActionStart(Name=RollbackServiceConfig,,) MSI (s) (D4:88) [09:55:49:209]: Executing op: CustomActionRollback(Action=RollbackServiceConfig,ActionType=3329,Source=BinaryData,Target=RollbackServiceConfig,CustomActionData=SchedServiceConfig) MSI (s) (D4:88) [09:55:49:209]: Creating MSIHANDLE (46956) of type 790536 for thread 6792 MSI (s) (D4:CC) [09:55:49:229]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI4E81.tmp, Entrypoint: RollbackServiceConfig MSI (s) (D4!D4) [09:55:49:329]: Creating MSIHANDLE (46957) of type 790531 for thread 3796 MSI (s) (D4!D4) [09:55:49:329]: Closing MSIHANDLE (46957) of type 790531 for thread 3796 MSI (s) (D4:CC) [09:55:49:339]: Closing MSIHANDLE (46956) of type 790536 for thread 6792 MSI (s) (D4:88) [09:55:49:339]: Executing op: ActionStart(Name=ExecSecureObjects_64,,) MSI (s) (D4:88) [09:55:49:339]: Executing op: ActionStart(Name=AddSIPSSubmitterUserAccount,,) MSI (s) (D4:88) [09:55:49:339]: Executing op: ActionStart(Name=AddSIPSSubmitterUserAccountRollback,,) MSI (s) (D4:88) [09:55:49:339]: Executing op: CustomActionRollback(Action=AddSIPSSubmitterUserAccountRollback,ActionType=1281,Source=BinaryData,Target=RemoveSIPSManagementUser,CustomActionData=NT SERVICE\SntpService) MSI (s) (D4:88) [09:55:49:339]: Creating MSIHANDLE (46958) of type 790536 for thread 6792 MSI (s) (D4:7C) [09:55:49:369]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI4EFF.tmp, Entrypoint: RemoveSIPSManagementUser MSI (s) (D4!D8) [09:55:49:369]: Creating MSIHANDLE (46959) of type 790531 for thread 984 MSI (s) (D4!D8) [09:55:49:369]: Closing MSIHANDLE (46959) of type 790531 for thread 984 MSI (s) (D4!D8) [09:55:49:369]: Creating MSIHANDLE (46960) of type 790531 for thread 984 RemoveSIPSManagementUser Enter (290) MSI (s) (D4!D8) [09:55:49:369]: Closing MSIHANDLE (46960) of type 790531 for thread 984 MSI (s) (D4:7C) [09:55:49:369]: Closing MSIHANDLE (46958) of type 790536 for thread 6792 RemoveSIPSManagementUser Exit (331) MSI (s) (D4:88) [09:55:49:379]: Executing op: ActionStart(Name=InstallServices,Description=Installing new services,Template=Service: [2]) MSI (s) (D4:88) [09:55:49:379]: Executing op: ServiceControl(,Name=SntpService,Action=8,,) MSI (s) (D4:88) [09:55:49:379]: Executing op: ActionStart(Name=RegisterTypeLibraries,Description=Registering type libraries,Template=LibID: [1]) MSI (s) (D4:88) [09:55:49:379]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\TypeLib\{6886D7DB-850A-4C92-A2F7-CBD741F825E5}\100.0\0\win32,,BinaryType=1,,) MSI (s) (D4:88) [09:55:49:379]: Executing op: TypeLibraryUnregister(,,FilePath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe,LibID={6886D7DB-850A-4C92-A2F7-CBD741F825E5},Version=256,,Language=0,HelpPath=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\,BinaryType=1,) MSI (s) (D4:88) [09:55:49:379]: Note: 1: 1402 2: UNKNOWN\TypeLib\{6886D7DB-850A-4C92-A2F7-CBD741F825E5}\1.0\0\win32 3: 2 MSI (s) (D4:88) [09:55:49:379]: CMsiServices::ProcessTypeLibrary runs in local context, not impersonated. MSI (s) (D4:88) [09:55:49:379]: ProcessTypeLibraryCore returns: -2147319780. (0 means OK) MSI (s) (D4:88) [09:55:49:379]: Note: 1: 2107 2: C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe 3: -2147319780 Info 1912.Could not unregister type library for file C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe. Contact your support personnel. MSI (s) (D4:88) [09:55:49:379]: Executing op: RegRemoveKey() MSI (s) (D4:88) [09:55:49:379]: Note: 1: 1402 2: UNKNOWN\TypeLib\{6886D7DB-850A-4C92-A2F7-CBD741F825E5}\1.0\0\win32 3: 2 MSI (s) (D4:88) [09:55:49:379]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3]) MSI (s) (D4:88) [09:55:49:379]: Executing op: RegOpenKey(Root=-2147483646,Key=SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService,,BinaryType=1,,) MSI (s) (D4:88) [09:55:49:379]: Executing op: RegRemoveValue(,Value=service,) MSI (s) (D4:88) [09:55:49:379]: Executing op: RegRemoveKey() MSI (s) (D4:88) [09:55:49:379]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService 3: 2 MSI (s) (D4:88) [09:55:49:379]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Application,,BinaryType=1,,) MSI (s) (D4:88) [09:55:49:379]: Executing op: RegRemoveValue(Name=Path,Value=C:\Program Files\Sophos\Sophos Network Threat Protection\,) MSI (s) (D4:88) [09:55:49:379]: Executing op: RegCreateKey() MSI (s) (D4:88) [09:55:49:379]: Executing op: RegRemoveValue(Name=ProductVersion,Value=1.2.2.50,) MSI (s) (D4:88) [09:55:49:379]: Executing op: RegCreateKey() MSI (s) (D4:88) [09:55:49:379]: Executing op: RegRemoveValue(Name=ProductCode,Value={66967E5F-43E8-4402-87A4-04685EE5C2CB},) MSI (s) (D4:88) [09:55:49:379]: Executing op: RegRemoveKey() MSI (s) (D4:88) [09:55:49:379]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Sophos\Sophos Network Threat Protection\Application 3: 2 MSI (s) (D4:88) [09:55:49:379]: Executing op: RegOpenKey(,Key=AppID\{C092D533-8791-42F8-8EBE-DB116F79B4B7},,BinaryType=1,,) MSI (s) (D4:88) [09:55:49:379]: Executing op: RegRemoveValue(Name=LocalService,Value=SntpService,) MSI (s) (D4:88) [09:55:49:379]: Executing op: RegRemoveKey() MSI (s) (D4:88) [09:55:49:379]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Classes\AppID\{C092D533-8791-42F8-8EBE-DB116F79B4B7} 3: 2 MSI (s) (D4:88) [09:55:49:379]: Executing op: ActionStart(Name=RegisterEventManifest,,) MSI (s) (D4:88) [09:55:49:379]: Executing op: ActionStart(Name=RollbackRegisterEventManifest,,) MSI (s) (D4:88) [09:55:49:379]: Executing op: CustomActionRollback(Action=RollbackRegisterEventManifest,ActionType=3393,Source=BinaryData,Target=CAQuietExec,CustomActionData="wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man") MSI (s) (D4:88) [09:55:49:379]: Creating MSIHANDLE (46961) of type 790536 for thread 6792 MSI (s) (D4:44) [09:55:49:399]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI4F2F.tmp, Entrypoint: CAQuietExec MSI (s) (D4:44) [09:55:49:439]: Closing MSIHANDLE (46961) of type 790536 for thread 6792 MSI (s) (D4:88) [09:55:49:439]: Executing op: ActionStart(Name=ExecXmlFile,,) MSI (s) (D4:88) [09:55:49:449]: Executing op: ActionStart(Name=MsiInstallDrivers,,) MSI (s) (D4:88) [09:55:49:449]: Executing op: ActionStart(Name=MsiRollbackInstall,,) MSI (s) (D4:88) [09:55:49:449]: Executing op: CustomActionRollback(Action=MsiRollbackInstall,ActionType=3329,Source=BinaryData,Target=RollbackInstall,CustomActionData=2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}212Sophos Network Threat ProtectionSophos Limited) MSI (s) (D4:88) [09:55:49:449]: Creating MSIHANDLE (46962) of type 790536 for thread 6792 MSI (s) (D4:1C) [09:55:49:449]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI4F6E.tmp, Entrypoint: RollbackInstall MSI (s) (D4!2C) [09:55:49:459]: Creating MSIHANDLE (46963) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:459]: Closing MSIHANDLE (46963) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:459]: Creating MSIHANDLE (46964) of type 790531 for thread 1836 DIFXAPP: ENTER: RollbackInstall() MSI (s) (D4!2C) [09:55:49:459]: Closing MSIHANDLE (46964) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:459]: Creating MSIHANDLE (46965) of type 790531 for thread 1836 DIFXAPP: INFO: 'CustomActionData' property 'DIFxApp Version' is '2.1'. MSI (s) (D4!2C) [09:55:49:459]: Closing MSIHANDLE (46965) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:459]: Creating MSIHANDLE (46966) of type 790531 for thread 1836 DIFXAPP: INFO: 'CustomActionData' property 'componentId' is '{76F354A6-97D5-4872-9781-2F2642A4F18A}'. MSI (s) (D4!2C) [09:55:49:459]: Closing MSIHANDLE (46966) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:459]: Creating MSIHANDLE (46967) of type 790531 for thread 1836 DIFXAPP: INFO: 'CustomActionData' property 'flags' is 0x15. MSI (s) (D4!2C) [09:55:49:459]: Closing MSIHANDLE (46967) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:459]: Creating MSIHANDLE (46968) of type 790531 for thread 1836 DIFXAPP: INFO: 'CustomActionData' property 'installState' is '2'. MSI (s) (D4!2C) [09:55:49:459]: Closing MSIHANDLE (46968) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:459]: Creating MSIHANDLE (46969) of type 790531 for thread 1836 DIFXAPP: INFO: 'CustomActionData' property 'ProductName' is 'Sophos Network Threat Protection'. MSI (s) (D4!2C) [09:55:49:459]: Closing MSIHANDLE (46969) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:459]: Creating MSIHANDLE (46970) of type 790531 for thread 1836 DIFXAPP: INFO: 'CustomActionData' property 'ManufacturerName' is 'Sophos Limited'. MSI (s) (D4!2C) [09:55:49:459]: Closing MSIHANDLE (46970) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:459]: Creating MSIHANDLE (46971) of type 790531 for thread 1836 DIFXAPP: INFO: user SID of user performing the install is 'S-1-5-18'. MSI (s) (D4!2C) [09:55:49:459]: Closing MSIHANDLE (46971) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:459]: Creating MSIHANDLE (46972) of type 790531 for thread 1836 DIFXAPP: INFO: ENTER: DriverPackageUninstallW MSI (s) (D4!2C) [09:55:49:459]: Closing MSIHANDLE (46972) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:459]: Creating MSIHANDLE (46973) of type 790531 for thread 1836 DIFXAPP: INFO: Uninstalling driver package C:\Windows\system32\DRVSTORE\Sntp_65825BCE18B284A77B7004ABEDBF369AB894EB1F\Sntp.inf... MSI (s) (D4!2C) [09:55:49:459]: Closing MSIHANDLE (46973) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:459]: Creating MSIHANDLE (46974) of type 790531 for thread 1836 DIFXAPP: ERROR: Unable to revert to a previous driver store for service 'sntp'. MSI (s) (D4!2C) [09:55:49:459]: Closing MSIHANDLE (46974) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:469]: Creating MSIHANDLE (46975) of type 790531 for thread 1836 DIFXAPP: ERROR: Will attempt to uninstall the driver. MSI (s) (D4!2C) [09:55:49:469]: Closing MSIHANDLE (46975) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:469]: Creating MSIHANDLE (46976) of type 790531 for thread 1836 DIFXAPP: INFO: service 'sntp' was deleted. MSI (s) (D4!2C) [09:55:49:469]: Closing MSIHANDLE (46976) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:469]: Creating MSIHANDLE (46977) of type 790531 for thread 1836 DIFXAPP: INFO: Driver store entry 'C:\Windows\system32\DRVSTORE\Sntp_65825BCE18B284A77B7004ABEDBF369AB894EB1F\Sntp.inf' removed. MSI (s) (D4!2C) [09:55:49:469]: Closing MSIHANDLE (46977) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:469]: Creating MSIHANDLE (46978) of type 790531 for thread 1836 DIFXAPP: SUCCESS:Uninstall completed. MSI (s) (D4!2C) [09:55:49:469]: Closing MSIHANDLE (46978) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:469]: Creating MSIHANDLE (46979) of type 790531 for thread 1836 DIFXAPP: INFO: RETURN: DriverPackageUninstallW (0x0) MSI (s) (D4!2C) [09:55:49:469]: Closing MSIHANDLE (46979) of type 790531 for thread 1836 MSI (s) (D4!2C) [09:55:49:469]: Creating MSIHANDLE (46980) of type 790531 for thread 1836 DIFXAPP: ERROR: Rollback failed with error 0x2 MSI (s) (D4!2C) [09:55:49:469]: Closing MSIHANDLE (46980) of type 790531 for thread 1836 DIFXAPP: RETURN: RollbackInstall() 2 (0x2) MSI (s) (D4:1C) [09:55:49:469]: Closing MSIHANDLE (46962) of type 790536 for thread 6792 CustomAction MsiRollbackInstall returned actual error code 1603 but will be translated to success due to continue marking MSI (s) (D4:88) [09:55:49:469]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6]) MSI (s) (D4:88) [09:55:49:469]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\) MSI (s) (D4:88) [09:55:49:469]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\udp.plg,,) MSI (s) (D4:88) [09:55:49:469]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:469]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\tcp.plg,,) MSI (s) (D4:88) [09:55:49:469]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:469]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\) MSI (s) (D4:88) [09:55:49:469]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe,,) MSI (s) (D4:88) [09:55:49:469]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:469]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.sys,,) MSI (s) (D4:88) [09:55:49:469]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:469]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man,,) MSI (s) (D4:88) [09:55:49:469]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:469]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.inf,,) MSI (s) (D4:88) [09:55:49:469]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:469]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.cat,,) MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\) MSI (s) (D4:88) [09:55:49:479]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\portmap.plg,,) MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\) MSI (s) (D4:88) [09:55:49:479]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\NTPAdapter.dll,,) MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\navl.dll,,) MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\) MSI (s) (D4:88) [09:55:49:479]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\ipv6.plg,,) MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\ip.plg,,) MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\http.plg,,) MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Executing op: SetTargetFolder(Folder=C:\Windows\SysWOW64\) MSI (s) (D4:88) [09:55:49:479]: Executing op: UnregisterSharedComponentProvider(Component={63B83B20-1AB9-4F49-B0B2-4489724CA96C},ProductCode={66967E5F-43E8-4402-87A4-04685EE5C2CB}) MSI (s) (D4:88) [09:55:49:479]: Executing op: SetTargetFolder(Folder=C:\Windows\system32\) MSI (s) (D4:88) [09:55:49:479]: Executing op: UnregisterSharedComponentProvider(Component={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},ProductCode={66967E5F-43E8-4402-87A4-04685EE5C2CB}) MSI (s) (D4:88) [09:55:49:479]: Executing op: SetTargetFolder(Folder=C:\Windows\SysWOW64\) MSI (s) (D4:88) [09:55:49:479]: Executing op: UnregisterSharedComponentProvider(Component={0835C947-D6D2-4E52-AF14-0231D04E88EA},ProductCode={66967E5F-43E8-4402-87A4-04685EE5C2CB}) MSI (s) (D4:88) [09:55:49:479]: Executing op: SetTargetFolder(Folder=C:\Windows\system32\) MSI (s) (D4:88) [09:55:49:479]: Executing op: UnregisterSharedComponentProvider(Component={E5B92048-5859-4AF1-AEAD-B97EBF00B087},ProductCode={66967E5F-43E8-4402-87A4-04685EE5C2CB}) MSI (s) (D4:88) [09:55:49:479]: Executing op: SetTargetFolder(Folder=C:\Windows\SysWOW64\) MSI (s) (D4:88) [09:55:49:479]: Executing op: UnregisterSharedComponentProvider(Component={74260D9F-D644-423B-B2D4-0291EA4BA8BE},ProductCode={66967E5F-43E8-4402-87A4-04685EE5C2CB}) MSI (s) (D4:88) [09:55:49:479]: Executing op: SetTargetFolder(Folder=C:\Windows\system32\) MSI (s) (D4:88) [09:55:49:479]: Executing op: UnregisterSharedComponentProvider(Component={570C624B-D57C-4CD1-9013-1B80C800093B},ProductCode={66967E5F-43E8-4402-87A4-04685EE5C2CB}) MSI (s) (D4:88) [09:55:49:479]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\) MSI (s) (D4:88) [09:55:49:479]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\bin\BPAIF.dll,,) MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1]) MSI (s) (D4:88) [09:55:49:479]: Executing op: FolderCreate(Folder=E:\,Foreign=0,SecurityDescriptor=BinaryData,) MSI (s) (D4:88) [09:55:49:479]: Executing op: FolderRemove(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\,Foreign=0) MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\,Foreign=0) MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\,Foreign=0) MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:479]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\,Foreign=0) MSI (s) (D4:88) [09:55:49:479]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\,Foreign=0) MSI (s) (D4:88) [09:55:49:479]: Executing op: ActionStart(Name=RemoveRegistryValues,Description=Removing system registry values,Template=Key: [1], Name: [2]) MSI (s) (D4:88) [09:55:49:479]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\AutoUpdate\Products\NTP64,,BinaryType=0,,) MSI (s) (D4:88) [09:55:49:479]: Executing op: RegRemoveKey() MSI (s) (D4:88) [09:55:49:479]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\Software\Sophos\AutoUpdate\Products\NTP64 3: 2 MSI (s) (D4:88) [09:55:49:479]: Executing op: ActionStart(Name=StopServices,Description=Stopping services,Template=Service: [1]) MSI (s) (D4:88) [09:55:49:479]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,) MSI (s) (D4:88) [09:55:49:479]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (D4:88) [09:55:49:479]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (D4:88) [09:55:49:479]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (D4:88) [09:55:49:479]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=0,,) MSI (s) (D4:88) [09:55:49:479]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=0,,) MSI (s) (D4:88) [09:55:49:479]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=0,,) MSI (s) (D4:88) [09:55:49:479]: Executing op: ComponentUnregister(ComponentId={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:479]: Executing op: ComponentUnregister(ComponentId={570C624B-D57C-4CD1-9013-1B80C800093B},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:479]: Executing op: ComponentUnregister(ComponentId={E5B92048-5859-4AF1-AEAD-B97EBF00B087},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={63B83B20-1AB9-4F49-B0B2-4489724CA96C},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=0,) MSI (s) (D4:88) [09:55:49:489]: WIN64DUALFOLDERS: 'C:\Windows\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\vccorlib120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={74260D9F-D644-423B-B2D4-0291EA4BA8BE},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=0,) MSI (s) (D4:88) [09:55:49:489]: WIN64DUALFOLDERS: 'C:\Windows\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcp120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={0835C947-D6D2-4E52-AF14-0231D04E88EA},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=0,) MSI (s) (D4:88) [09:55:49:489]: WIN64DUALFOLDERS: 'C:\Windows\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcr120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={1B63A9FF-509B-4CD9-BA54-256A7D62B724},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=0,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={B9C8E32A-5EB9-4B7F-91AF-9FD883FB729C},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={4E691ABE-115D-4721-9F9A-3547D17077C5},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={DF927ABB-6A5F-44F2-A430-137AAC79AA71},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={38879DEA-36FA-41BE-ACF3-B084CB40689B},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={411E659C-FCB0-4BA0-9E87-A88C4E28174F},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={710F5A00-8ECC-402C-910E-6096F350A923},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={D45EF81E-13E2-45D6-9DA9-09FD21266A06},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={F27D2FBB-5E0B-4351-82CE-E72D4F1EDE71},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={1A0CA7AD-4F12-4887-809E-96D79A66CC7F},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={9B222529-2B29-4547-AAEA-9C8A0423595B},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={355DC0F9-A6B5-4FCA-8121-00847E59A436},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={F1B8B8D7-46D7-4CA9-B109-35931536EA8A},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={74F91047-4C42-457F-B531-A83EF6EC85E2},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={4D81D62C-8373-45B8-ABF2-0C0D6ED2DE34},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: ComponentUnregister(ComponentId={E1E87C49-DD4A-4C77-8D42-3ACD20DBC536},ProductKey={66967E5F-43E8-4402-87A4-04685EE5C2CB},BinaryType=1,) MSI (s) (D4:88) [09:55:49:489]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0) MSI (s) (D4:88) [09:55:49:489]: Error in rollback skipped. Return: 5 MSI (s) (D4:88) [09:55:49:489]: Note: 1: 2318 2: MSI (s) (D4:88) [09:55:49:489]: No System Restore sequence number for this installation. MSI (s) (D4:88) [09:55:49:489]: Unlocking Server MSI (s) (D4:88) [09:55:49:539]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'. Action ended 9:55:49: INSTALL. Return value 3. Property(S): UpgradeCode = {A6CF693D-C171-4DF5-AE49-223B66F65A1A} Property(S): ProductData = C:\ProgramData\Sophos\Sophos Network Threat Protection\ Property(S): Config = C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\ Property(S): Status = C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\ Property(S): Logs = C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\ Property(S): bin = C:\Program Files\Sophos\Sophos Network Threat Protection\bin\ Property(S): plugins = C:\Program Files\Sophos\Sophos Network Threat Protection\bin\plugins\ Property(S): INSTALLDIR = C:\Program Files\Sophos\Sophos Network Threat Protection\ Property(S): TARGETDIR = E:\ Property(S): ExecSecureObjects_64 = C:\ProgramData\Sophos\Sophos Network Threat Protection\€CreateFolder€€NT SERVICE\sntpservice€-2147483647€C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\€CreateFolder€€NT SERVICE\sntpservice€278€C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\€CreateFolder€€NT SERVICE\sntpservice€278€SntpService€ServiceInstall€€Administrators€983551€SntpService€ServiceInstall€€Everyone€-2147483632 Property(S): RegisterEventManifest = "wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man" Property(S): RollbackRegisterEventManifest = "wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man" Property(S): ExecXmlFile = 2€0€C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man€7€1€/*/*/*/*[@messageFileName]€messageFileName€C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.sys€2€0€C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man€7€1€/*/*/*/*[@resourceFileName]€resourceFileName€C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.sys Property(S): MsiInstallDrivers = 2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}C:\Program Files\Sophos\Sophos Network Threat Protection\bin\212Sophos Network Threat ProtectionSophos Limited Property(S): MsiRollbackInstall = 2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}212Sophos Network Threat ProtectionSophos Limited Property(S): ExecServiceConfig = SchedServiceConfig€SntpService€0€restart€restart€none€1€120€€ Property(S): RollbackServiceConfig = SchedServiceConfig Property(S): UnregisterManagementAdapterRollback = C:\Program Files\Sophos\Sophos Network Threat Protection\bin\NTPAdapter.dll Property(S): RegisterManagementAdapter = C:\Program Files\Sophos\Sophos Network Threat Protection\bin\NTPAdapter.dll Property(S): SetupSspUserAccount = NT SERVICE\sntpservice Property(S): SetupSspUserAccountRollback = NT SERVICE\sntpservice Property(S): AddSIPSSubmitterUserAccount = NT SERVICE\SntpService Property(S): AddSIPSSubmitterUserAccountRollback = NT SERVICE\SntpService Property(S): gui = C:\Program Files\Sophos\Sophos Network Threat Protection\gui\ Property(S): Sophos = C:\Program Files\Sophos\ Property(S): ProgramFiles64Folder = C:\Program Files\ Property(S): SophosAppData = C:\ProgramData\Sophos\ Property(S): CommonAppDataFolder = C:\ProgramData\ Property(S): SourceDir = C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\ Property(S): VersionNT = 601 Property(S): VersionNT64 = 601 Property(S): ALLUSERS = 1 Property(S): ARPCOMMENTS = Network-aware threat detection Property(S): ARPCONTACT = Sophos Technical Support Property(S): ARPHELPLINK = http://www.sophos.com/support Property(S): ARPNOMODIFY = 1 Property(S): ARPNOREPAIR = 1 Property(S): ARPPRODUCTICON = shield.ico Property(S): ARPURLINFOABOUT = http://www.sophos.com Property(S): ARPURLUPDATEINFO = http://www.sophos.com/support/updates Property(S): Manufacturer = Sophos Limited Property(S): ProductCode = {66967E5F-43E8-4402-87A4-04685EE5C2CB} Property(S): ProductLanguage = 1033 Property(S): ProductName = Sophos Network Threat Protection Property(S): ProductVersion = 1.2.2.50 Property(S): MSIRESTARTMANAGERCONTROL = Disable Property(S): RegisterWithAutoUpdate = {8087796B-2289-4897-98A5-58FF23DAAFD0};ntp64 Property(S): SecureCustomProperties = WIX_DOWNGRADE_DETECTED;WIX_UPGRADE_DETECTED Property(S): SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA = C:\Windows\SysWOW64\ Property(S): SystemFolder = C:\Windows\SysWOW64\ Property(S): DirectoryTable100_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA = DirectoryTable Property(S): System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C = C:\Windows\system32\ Property(S): System64Folder = C:\Windows\system32\ Property(S): DirectoryTable100_amd64.05F0B5F5_44A8_3793_976B_A4F17AECF92C = DirectoryTable Property(S): INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 = E:\ Property(S): MsiLogFileLocation = C:\Windows\TEMP\Sophos Network Threat Protection Install Log 20160617 095514.txt Property(S): PackageCode = {69BE7301-439B-4074-8A16-83658F3FDC2B} Property(S): ProductState = -1 Property(S): PackagecodeChanging = 1 Property(S): REBOOT = ReallySuppress Property(S): INSTALLINGVERSION = 1.2.2.50 Property(S): CURRENTDIRECTORY = C:\Windows\system32 Property(S): CLIENTUILEVEL = 3 Property(S): MSICLIENTUSESEXTERNALUI = 1 Property(S): CLIENTPROCESSID = 7204 Property(S): MsiSystemRebootPending = 1 Property(S): VersionDatabase = 405 Property(S): VersionMsi = 5.00 Property(S): WindowsBuild = 7601 Property(S): ServicePackLevel = 1 Property(S): ServicePackLevelMinor = 0 Property(S): MsiNTProductType = 1 Property(S): WindowsFolder = C:\Windows\ Property(S): WindowsVolume = C:\ Property(S): RemoteAdminTS = 1 Property(S): TempFolder = C:\Windows\TEMP\ Property(S): ProgramFilesFolder = C:\Program Files (x86)\ Property(S): CommonFilesFolder = C:\Program Files (x86)\Common Files\ Property(S): CommonFiles64Folder = C:\Program Files\Common Files\ Property(S): AppDataFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\ Property(S): FavoritesFolder = C:\Windows\system32\config\systemprofile\Favorites\ Property(S): NetHoodFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\ Property(S): PersonalFolder = C:\Windows\system32\config\systemprofile\Documents\ Property(S): PrintHoodFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\ Property(S): RecentFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\ Property(S): SendToFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\ Property(S): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\ Property(S): LocalAppDataFolder = C:\Windows\system32\config\systemprofile\AppData\Local\ Property(S): MyPicturesFolder = C:\Windows\system32\config\systemprofile\Pictures\ Property(S): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Property(S): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Property(S): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\ Property(S): DesktopFolder = C:\Users\Public\Desktop\ Property(S): FontsFolder = C:\Windows\Fonts\ Property(S): GPTSupport = 1 Property(S): OLEAdvtSupport = 1 Property(S): ShellAdvtSupport = 1 Property(S): MsiAMD64 = 6 Property(S): Msix64 = 6 Property(S): Intel = 6 Property(S): PhysicalMemory = 4020 Property(S): VirtualMemory = 5729 Property(S): AdminUser = 1 Property(S): MsiTrueAdminUser = 1 Property(S): LogonUser = SYSTEM Property(S): UserSID = S-1-5-18 Property(S): UserLanguageID = 1033 Property(S): ComputerName = VN-HR03 Property(S): SystemLanguageID = 1033 Property(S): ScreenX = 1024 Property(S): ScreenY = 768 Property(S): CaptionHeight = 22 Property(S): BorderTop = 1 Property(S): BorderSide = 1 Property(S): TextHeight = 16 Property(S): TextInternalLeading = 3 Property(S): ColorBits = 32 Property(S): TTCSupport = 1 Property(S): Time = 9:55:49 Property(S): Date = 6/17/2016 Property(S): MsiNetAssemblySupport = 2.0.50727.5483 Property(S): MsiWin32AssemblySupport = 6.1.7601.17514 Property(S): RedirectedDllSupport = 2 Property(S): MsiRunningElevated = 1 Property(S): Privileged = 1 Property(S): USERNAME = IT Property(S): DATABASE = C:\Windows\Installer\55fea.msi Property(S): OriginalDatabase = C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\Sophos Network Threat Protection.msi Property(S): UILevel = 2 Property(S): ACTION = INSTALL Property(S): ROOTDRIVE = E:\ Property(S): CostingComplete = 1 Property(S): OutOfDiskSpace = 0 Property(S): OutOfNoRbDiskSpace = 0 Property(S): PrimaryVolumeSpaceAvailable = 0 Property(S): PrimaryVolumeSpaceRequired = 0 Property(S): PrimaryVolumeSpaceRemaining = 0 Property(S): INSTALLLEVEL = 1 Property(S): SOURCEDIR = C:\ProgramData\Sophos\AutoUpdate\cache\ntp64\ Property(S): SourcedirProduct = {66967E5F-43E8-4402-87A4-04685EE5C2CB} Property(S): ProductToBeRegistered = 1 MSI (s) (D4:88) [09:55:49:579]: Note: 1: 1708 MSI (s) (D4:88) [09:55:49:579]: Product: Sophos Network Threat Protection -- Installation failed. MSI (s) (D4:88) [09:55:49:579]: Windows Installer installed the product. Product Name: Sophos Network Threat Protection. Product Version: 1.2.2.50. Product Language: 1033. Manufacturer: Sophos Limited. Installation success or error status: 1603. MSI (s) (D4:88) [09:55:49:589]: Deferring clean up of packages/files, if any exist MSI (s) (D4:88) [09:55:49:589]: MainEngineThread is returning 1603 MSI (s) (D4:4C) [09:55:49:589]: No System Restore sequence number for this installation. === Logging stopped: 6/17/2016 9:55:49 === MSI (s) (D4:4C) [09:55:49:589]: User policy value 'DisableRollback' is 0 MSI (s) (D4:4C) [09:55:49:589]: Machine policy value 'DisableRollback' is 0 MSI (s) (D4:4C) [09:55:49:589]: Incrementing counter to disable shutdown. Counter after increment: 0 MSI (s) (D4:4C) [09:55:49:589]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (D4:4C) [09:55:49:589]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (D4:4C) [09:55:49:589]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (s) (D4:4C) [09:55:49:589]: Restoring environment variables MSI (s) (D4:4C) [09:55:49:599]: Destroying RemoteAPI object. MSI (s) (D4:A4) [09:55:49:599]: Custom Action Manager thread ending. MSI (c) (24:54) [09:55:49:599]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (c) (24:54) [09:55:49:599]: MainEngineThread is returning 1603 === Verbose logging stopped: 6/17/2016 9:55:49 === setup::MsiInstaller::installOrUpgrade: Install/upgrade returned 1603 `anonymous-namespace'::setResult: installation failed ProductSetup::~ProductSetup: End product setup