Cloud Status - 'Some Sophos services not running' or 'missing'

Same problem on new customers deployed today.
No problemes with older ones

Enable support access under:
cloud.sophos.com/.../support
Then take a look at the Status tab for a device and it will give you the actual list.

Regards,
Jak

Jak,

Maybe I missed something - what do I need to do to fix this?

Hi,

The option was not intended as a fix, just as a way of getting more information about which services were missing on each client to see if there was a common theme.

If 'Sophos System Protection Service' is in a stopping state, can the ssp.exe process be killed to "stop" the service?  Does the next update go through?

It is just that service that is flagged as problematic?

Regards,

Jak

Here is an example of what I see:

Hi,

I must have some slightly different config.  That said, If you open up the Developer Tools (Hit F12 in Chrome for Example).

Switch to the "Network" tab.

Click on Preserve log and clock XHR to reduce noise.

In the filter type: health

This will filter all the API queries down to those that contain the word health.  Then as you visit the devices status page you can look at the "Preview" tab on the right.

If you drill down you'll see a section under Status called shs/service/detail.  For each service 0 is running 1 is not.

This will at least give you the information.

Regards,

Jak

I choose a computer that is currently powered on and found this:

I have the same problem on 2 computers so far.

The service in question is SSP (Sophos System Protection). Its installation always fail.

I have tried un-install and re-install, remove update cache then update.

Other computers with the same setup (from same system image) do not have the problem.

I am waiting for Sophos' 2nd line support engineer reply.

Hi,

Can you make available the MSI log file for SSP?  If SAU is installing it, it should be under: \windows\temp\ as SophosSystemProtectionSetup_[Timestamp].log.

Regards,

Jak

Here is the most recent log:

2016-02-22 16:21:01 Info: SSP is already installed. Version: 1.2.0
2016-02-22 16:21:01 Info: Upgrading from version: 1.2.0 to version: 1.3.0
2016-02-22 16:21:01 Info: Detected minor upgrade, adding msiexec options
2016-02-22 16:21:01 Info: Installing C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi with command: INSTALLDIR="" REINSTALL=ALL REINSTALLMODE=VOMUS INSTALLINGVERSION=1.3.0 REBOOT=ReallySuppress
=== Verbose logging started: 2/22/2016 16:21:01 Build type: SHIP UNICODE 5.00.7601.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\SophosUpdate.exe ===
MSI (c) (FC:44) [16:21:01:265]: Resetting cached policy values
MSI (c) (FC:44) [16:21:01:265]: Machine policy value 'Debug' is 0
MSI (c) (FC:44) [16:21:01:265]: ******* RunEngine:
******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi
******* Action:
******* CommandLine: **********
MSI (c) (FC:44) [16:21:01:266]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (FC:44) [16:21:01:266]: Grabbed execution mutex.
MSI (c) (FC:44) [16:21:01:267]: Cloaking enabled.
MSI (c) (FC:44) [16:21:01:267]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (FC:44) [16:21:01:267]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (24:DC) [16:21:01:276]: Running installation inside multi-package transaction C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi
MSI (s) (24:DC) [16:21:01:276]: Grabbed execution mutex.
MSI (s) (24:B8) [16:21:01:279]: Resetting cached policy values
MSI (s) (24:B8) [16:21:01:279]: Machine policy value 'Debug' is 0
MSI (s) (24:B8) [16:21:01:279]: ******* RunEngine:
******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi
******* Action:
******* CommandLine: **********
MSI (s) (24:B8) [16:21:01:279]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (24:B8) [16:21:01:298]: SRSetRestorePoint skipped for this transaction.
MSI (s) (24:B8) [16:21:01:299]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2
MSI (s) (24:B8) [16:21:01:301]: File will have security applied from OpCode.
MSI (s) (24:B8) [16:21:01:307]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi' against software restriction policy
MSI (s) (24:B8) [16:21:01:307]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi has a digital signature
MSI (s) (24:B8) [16:21:01:308]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi is permitted to run because the user token authorizes execution (system or service token).
MSI (s) (24:B8) [16:21:01:308]: End dialog not enabled
MSI (s) (24:B8) [16:21:01:308]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi
MSI (s) (24:B8) [16:21:01:308]: Package we're running from ==> C:\Windows\Installer\2144f81.msi
MSI (s) (24:B8) [16:21:01:308]: APPCOMPAT: Uninstall Flags override found.
MSI (s) (24:B8) [16:21:01:308]: APPCOMPAT: Uninstall VersionNT override found.
MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: Uninstall ServicePackLevel override found.
MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'.
MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (24:B8) [16:21:01:314]: MSCOREE not loaded loading copy from system32
MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisablePatch' is 0
MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'AllowLockdownPatch' is 0
MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisableLUAPatching' is 0
MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisableFlyWeightPatching' is 0
MSI (s) (24:B8) [16:21:01:319]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'.
MSI (s) (24:B8) [16:21:01:319]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (24:B8) [16:21:01:319]: Transforms are not secure.
MSI (s) (24:B8) [16:21:01:319]: Note: 1: 2205 2: 3: Control
MSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\Windows\TEMP\SophosSystemProtectionSetup_160222_102101.log'.
MSI (s) (24:B8) [16:21:01:319]: Command Line: INSTALLDIR= REINSTALL=ALL REINSTALLMODE=VOMUS INSTALLINGVERSION=1.3.0 REBOOT=ReallySuppress CURRENTDIRECTORY=C:\Windows\system32 CLIENTUILEVEL=3 CLIENTPROCESSID=8444
MSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{8A3EE444-F60F-44F2-B42C-14907395E0A6}'.
MSI (s) (24:B8) [16:21:01:319]: Product Code passed to Engine.Initialize: ''
MSI (s) (24:B8) [16:21:01:319]: Product Code from property table before transforms: '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'
MSI (s) (24:B8) [16:21:01:319]: Product Code from property table after transforms: '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'
MSI (s) (24:B8) [16:21:01:319]: Product registered: entering maintenance mode
MSI (s) (24:B8) [16:21:01:319]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
MSI (s) (24:B8) [16:21:01:319]: Product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} is admin assigned: LocalSystem owns the publish key.
MSI (s) (24:B8) [16:21:01:319]: Product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} is managed.
MSI (s) (24:B8) [16:21:01:319]: MSI_LUA: Credential prompt not required, user is an admin
MSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding ProductState property. Its value is '5'.
MSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding ProductToBeRegistered property. Its value is '1'.
MSI (s) (24:B8) [16:21:01:319]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (s) (24:B8) [16:21:01:319]: Specifed source is already in a list.
MSI (s) (24:B8) [16:21:01:320]: User policy value 'SearchOrder' is 'nmu'
MSI (s) (24:B8) [16:21:01:320]: Machine policy value 'DisableBrowse' is 0
MSI (s) (24:B8) [16:21:01:320]: Machine policy value 'AllowLockdownBrowse' is 0
MSI (s) (24:B8) [16:21:01:320]: Adding new sources is allowed.
MSI (s) (24:B8) [16:21:01:320]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
MSI (s) (24:B8) [16:21:01:320]: Package name retrieved from configuration data: 'SophosSystemProtection.msi'
MSI (s) (24:B8) [16:21:01:322]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (s) (24:B8) [16:21:01:322]: Machine policy value 'DisableMsi' is 0
MSI (s) (24:B8) [16:21:01:322]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (24:B8) [16:21:01:322]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (24:B8) [16:21:01:322]: Product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} is admin assigned: LocalSystem owns the publish key.
MSI (s) (24:B8) [16:21:01:322]: Product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} is managed.
MSI (s) (24:B8) [16:21:01:322]: Running product '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}' with elevated privileges: Product is assigned.
MSI (s) (24:B8) [16:21:01:322]: PROPERTY CHANGE: Adding REINSTALL property. Its value is 'ALL'.
MSI (s) (24:B8) [16:21:01:323]: PROPERTY CHANGE: Adding REINSTALLMODE property. Its value is 'VOMUS'.
MSI (s) (24:B8) [16:21:01:323]: PROPERTY CHANGE: Adding INSTALLINGVERSION property. Its value is '1.3.0'.
MSI (s) (24:B8) [16:21:01:323]: PROPERTY CHANGE: Adding REBOOT property. Its value is 'ReallySuppress'.
MSI (s) (24:B8) [16:21:01:323]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'C:\Windows\system32'.
MSI (s) (24:B8) [16:21:01:323]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'.
MSI (s) (24:B8) [16:21:01:323]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '8444'.
MSI (s) (24:B8) [16:21:01:323]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0
MSI (s) (24:B8) [16:21:01:326]: PROPERTY CHANGE: Adding MsiRestartManagerSessionKey property. Its value is '5365f1866847d342987fdcfdf5230400'.
MSI (s) (24:B8) [16:21:01:326]: RESTART MANAGER: Session opened.
MSI (s) (24:B8) [16:21:01:326]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
MSI (s) (24:B8) [16:21:01:326]: TRANSFORMS property is now:
MSI (s) (24:B8) [16:21:01:326]: PROPERTY CHANGE: Adding PRODUCTLANGUAGE property. Its value is '1033'.
MSI (s) (24:B8) [16:21:01:326]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
MSI (s) (24:B8) [16:21:01:328]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming
MSI (s) (24:B8) [16:21:01:329]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Favorites
MSI (s) (24:B8) [16:21:01:330]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
MSI (s) (24:B8) [16:21:01:331]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Documents
MSI (s) (24:B8) [16:21:01:332]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
MSI (s) (24:B8) [16:21:01:333]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
MSI (s) (24:B8) [16:21:01:334]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
MSI (s) (24:B8) [16:21:01:335]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
MSI (s) (24:B8) [16:21:01:335]: SHELL32::SHGetFolderPath returned: C:\ProgramData
MSI (s) (24:B8) [16:21:01:336]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Local
MSI (s) (24:B8) [16:21:01:337]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Pictures
MSI (s) (24:B8) [16:21:01:339]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (24:B8) [16:21:01:340]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (24:B8) [16:21:01:341]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
MSI (s) (24:B8) [16:21:01:342]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
MSI (s) (24:B8) [16:21:01:342]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
MSI (s) (24:B8) [16:21:01:344]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (24:B8) [16:21:01:345]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (24:B8) [16:21:01:346]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
MSI (s) (24:B8) [16:21:01:347]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
MSI (s) (24:B8) [16:21:01:348]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Desktop
MSI (s) (24:B8) [16:21:01:350]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
MSI (s) (24:B8) [16:21:01:350]: SHELL32::SHGetFolderPath returned: C:\Windows\Fonts
MSI (s) (24:B8) [16:21:01:350]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
MSI (s) (24:B8) [16:21:01:356]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
MSI (s) (24:B8) [16:21:01:356]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'Admin'.
MSI (s) (24:B8) [16:21:01:356]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding Installed property. Its value is '00:00:00'.
MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\Windows\Installer\2144f81.msi'.
MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi'.
MSI (s) (24:B8) [16:21:01:357]: Machine policy value 'MsiDisableEmbeddedUI' is 0
MSI (s) (24:B8) [16:21:01:357]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install
MSI (s) (24:B8) [16:21:01:357]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (24:B8) [16:21:01:357]: Machine policy value 'DisableRollback' is 0
MSI (s) (24:B8) [16:21:01:357]: User policy value 'DisableRollback' is 0
MSI (s) (24:B8) [16:21:01:357]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
MSI (s) (24:B8) [16:21:01:357]: PROPERTY CHANGE: Adding QFEUpgrade property. Its value is '1'.
=== Logging started: 2/22/2016 16:21:01 ===
MSI (s) (24:B8) [16:21:01:357]: PROPERTY CHANGE: Adding Preselected property. Its value is '1'.
MSI (s) (24:B8) [16:21:01:357]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
MSI (s) (24:B8) [16:21:01:357]: Doing action: INSTALL
MSI (s) (24:B8) [16:21:01:357]: Note: 1: 2205 2: 3: ActionText
Action start 16:21:01: INSTALL.
MSI (s) (24:B8) [16:21:01:358]: Running ExecuteSequence
MSI (s) (24:B8) [16:21:01:358]: Doing action: FindRelatedProducts
MSI (s) (24:B8) [16:21:01:358]: Note: 1: 2205 2: 3: ActionText
MSI (s) (24:B8) [16:21:01:359]: Skipping FindRelatedProducts action: not run in maintenance mode
Action start 16:21:01: FindRelatedProducts.
MSI (s) (24:B8) [16:21:01:360]: Doing action: LaunchConditions
MSI (s) (24:B8) [16:21:01:360]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:01: FindRelatedProducts. Return value 0.
Action start 16:21:01: LaunchConditions.
MSI (s) (24:B8) [16:21:01:361]: Doing action: ValidateProductID
MSI (s) (24:B8) [16:21:01:361]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:01: LaunchConditions. Return value 1.
Action start 16:21:01: ValidateProductID.
MSI (s) (24:B8) [16:21:01:362]: Skipping action: TamperProtectionCheckRemove (condition is false)
MSI (s) (24:B8) [16:21:01:362]: Doing action: CostInitialize
MSI (s) (24:B8) [16:21:01:362]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:01: ValidateProductID. Return value 1.
MSI (s) (24:B8) [16:21:01:363]: Machine policy value 'MaxPatchCacheSize' is 10
MSI (s) (24:B8) [16:21:01:364]: PROPERTY CHANGE: Adding ROOTDRIVE property. Its value is 'C:\'.
MSI (s) (24:B8) [16:21:01:365]: PROPERTY CHANGE: Adding CostingComplete property. Its value is '0'.
MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: Patch
MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: MsiPatchHeaders
MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: __MsiPatchFileList
MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2228 2: 3: PatchPackage 4: SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId`
MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: Patch
Action start 16:21:01: CostInitialize.
MSI (s) (24:B8) [16:21:01:365]: Doing action: FileCost
MSI (s) (24:B8) [16:21:01:366]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:01: CostInitialize. Return value 1.
MSI (s) (24:B8) [16:21:01:366]: Note: 1: 2205 2: 3: MsiAssembly
MSI (s) (24:B8) [16:21:01:367]: Note: 1: 2205 2: 3: Class
MSI (s) (24:B8) [16:21:01:367]: Note: 1: 2205 2: 3: Extension
MSI (s) (24:B8) [16:21:01:367]: Note: 1: 2205 2: 3: TypeLib
Action start 16:21:01: FileCost.
MSI (s) (24:B8) [16:21:01:367]: Doing action: CostFinalize
MSI (s) (24:B8) [16:21:01:367]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:01: FileCost. Return value 1.
MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding OutOfDiskSpace property. Its value is '0'.
MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding OutOfNoRbDiskSpace property. Its value is '0'.
MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceAvailable property. Its value is '0'.
MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRequired property. Its value is '0'.
MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRemaining property. Its value is '0'.
MSI (s) (24:B8) [16:21:01:368]: Note: 1: 2205 2: 3: MsiAssembly
MSI (s) (24:B8) [16:21:01:368]: Note: 1: 2228 2: 3: MsiAssembly 4: SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?
MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding INSTALLDIR property. Its value is 'C:\Program Files\Sophos\Sophos System Protection'.
MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding Config property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Config'.
MSI (s) (24:B8) [16:21:01:369]: PROPERTY CHANGE: Adding Logs property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Logs'.
MSI (s) (24:B8) [16:21:01:369]: PROPERTY CHANGE: Adding Data property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Data'.
MSI (s) (24:B8) [16:21:01:369]: Note: 1: 2205 2: 3: Patch
MSI (s) (24:B8) [16:21:01:369]: Note: 1: 2205 2: 3: Condition
MSI (s) (24:B8) [16:21:01:369]: Machine policy value 'EnforceUpgradeComponentRules' is 0
MSI (s) (24:B8) [16:21:01:370]: SELMGR: New components have been added to feature 'ProductFeature'
MSI (s) (24:B8) [16:21:01:370]: SELMGR: Component 'EPHconf' is a new component added to feature 'ProductFeature'
MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding TARGETDIR property. Its value is 'C:\'.
MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 property. Its value is 'C:\'.
MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding Sophos property. Its value is 'C:\Program Files\Sophos\'.
MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Modifying INSTALLDIR property. Its current value is 'C:\Program Files\Sophos\Sophos System Protection'. Its new value: 'C:\Program Files\Sophos\Sophos System Protection\'.
MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding AppDataSophos property. Its value is 'C:\ProgramData\Sophos\'.
MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding AppDataSsp property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\'.
MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Modifying Logs property. Its current value is 'C:\ProgramData\Sophos\Sophos System Protection\Logs'. Its new value: 'C:\ProgramData\Sophos\Sophos System Protection\Logs\'.
MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Modifying Config property. Its current value is 'C:\ProgramData\Sophos\Sophos System Protection\Config'. Its new value: 'C:\ProgramData\Sophos\Sophos System Protection\Config\'.
MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Modifying Data property. Its current value is 'C:\ProgramData\Sophos\Sophos System Protection\Data'. Its new value: 'C:\ProgramData\Sophos\Sophos System Protection\Data\'.
MSI (s) (24:B8) [16:21:01:370]: Target path resolution complete. Dumping Directory table...
MSI (s) (24:B8) [16:21:01:370]: Note: target paths subject to change (via custom actions or browsing)
MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: TARGETDIR , Object: C:\
MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: WindowsFolder , Object: C:\Windows\
MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\
MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: ProgramFilesFolder , Object: C:\Program Files\
MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: Sophos , Object: C:\Program Files\Sophos\
MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: INSTALLDIR , Object: C:\Program Files\Sophos\Sophos System Protection\
MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: CommonAppDataFolder , Object: C:\ProgramData\
MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: AppDataSophos , Object: C:\ProgramData\Sophos\
MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: AppDataSsp , Object: C:\ProgramData\Sophos\Sophos System Protection\
MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: Logs , Object: C:\ProgramData\Sophos\Sophos System Protection\Logs\
MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: Config , Object: C:\ProgramData\Sophos\Sophos System Protection\Config\
MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: Data , Object: C:\ProgramData\Sophos\Sophos System Protection\Data\
MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding INSTALLLEVEL property. Its value is '1'.
Action start 16:21:01: CostFinalize.
MSI (s) (24:B8) [16:21:01:377]: Doing action: SetRegisterWithAutoUpdate
MSI (s) (24:B8) [16:21:01:377]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:01: CostFinalize. Return value 1.
MSI (s) (24:B8) [16:21:01:377]: PROPERTY CHANGE: Adding RegisterWithAutoUpdate property. Its value is '{F8FFD42E-47AC-4CFF-9E27-EC84ED62128E};ssp;'.
Action start 16:21:01: SetRegisterWithAutoUpdate.
MSI (s) (24:B8) [16:21:01:378]: Doing action: MigrateFeatureStates
MSI (s) (24:B8) [16:21:01:378]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:01: SetRegisterWithAutoUpdate. Return value 1.
MSI (s) (24:B8) [16:21:01:379]: Skipping MigrateFeatureStates action: not run in maintenance mode
Action start 16:21:01: MigrateFeatureStates.
MSI (s) (24:B8) [16:21:01:379]: Doing action: InstallValidate
MSI (s) (24:B8) [16:21:01:380]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:01: MigrateFeatureStates. Return value 0.
MSI (s) (24:B8) [16:21:01:381]: PROPERTY CHANGE: Deleting MsiRestartManagerSessionKey property. Its current value is '5365f1866847d342987fdcfdf5230400'.
MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: Dialog
MSI (s) (24:B8) [16:21:01:381]: Feature: ProductFeature; Installed: Local; Request: Reinstall; Action: Reinstall
MSI (s) (24:B8) [16:21:01:381]: Component: CreateProgramFilesFolder; Installed: Local; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: ServiceComponent; Installed: Local; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: scfdat; Installed: Local; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: RandomRegistry; Installed: Local; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: CreateLoggingRegentry; Installed: Local; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: CreateConfigFolder; Installed: Local; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: SSPconf; Installed: Local; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: FBAconf; Installed: Local; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: PIAconf; Installed: Local; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: SXAconf; Installed: Local; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: EPHconf; Installed: Absent; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: CreateLogsFolder; Installed: Local; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: CreateDataFolder; Installed: Local; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: __RandomRegistry65; Installed: Null; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Component: __CreateLoggingRegentry65; Installed: Null; Request: Local; Action: Local
MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: BindImage
MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: ProgId
MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: PublishComponent
MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: SelfReg
MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: Extension
MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: Font
MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: Shortcut
MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: Class
MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: TypeLib
Action start 16:21:01: InstallValidate.
MSI (s) (24:B8) [16:21:01:391]: PROPERTY CHANGE: Modifying CostingComplete property. Its current value is '0'. Its new value: '1'.
MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: BindImage
MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: ProgId
MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: PublishComponent
MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: SelfReg
MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: Extension
MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: Font
MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: Shortcut
MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: Class
MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: TypeLib
MSI (s) (24:B8) [16:21:01:392]: Note: 1: 2727 2:
MSI (s) (24:B8) [16:21:01:408]: RESTART MANAGER: Will attempt to shut down and restart applications in no UI modes.
MSI (s) (24:B8) [16:21:01:420]: Note: 1: 2205 2: 3: ActionText
MSI (c) (FC:EC) [16:21:01:412]: RESTART MANAGER: Session opened.
MSI (s) (24:B8) [16:21:06:439]: RESTART MANAGER: Successfully shut down all applications in the service's session that held files in use.
MSI (c) (FC:EC) [16:21:06:439]: RESTART MANAGER: Successfully shut down all applications that held files in use.
MSI (s) (24:B8) [16:21:06:951]: Note: 1: 2727 2:
MSI (s) (24:B8) [16:21:06:952]: Doing action: RemoveExistingProducts
MSI (s) (24:B8) [16:21:06:952]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:06: InstallValidate. Return value 1.
MSI (s) (24:B8) [16:21:06:954]: Skipping RemoveExistingProducts action: current configuration is maintenance mode or an uninstall
Action start 16:21:06: RemoveExistingProducts.
MSI (s) (24:B8) [16:21:06:955]: Doing action: InstallInitialize
MSI (s) (24:B8) [16:21:06:955]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:06: RemoveExistingProducts. Return value 0.
MSI (s) (24:B8) [16:21:06:956]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (24:B8) [16:21:06:956]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (24:B8) [16:21:06:956]: BeginTransaction: Locking Server
MSI (s) (24:B8) [16:21:06:957]: SRSetRestorePoint skipped for this transaction.
MSI (s) (24:B8) [16:21:06:957]: Server not locked: locking for product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}
Action start 16:21:06: InstallInitialize.
MSI (s) (24:B8) [16:21:06:984]: Doing action: ProcessComponents
MSI (s) (24:B8) [16:21:06:984]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:06: InstallInitialize. Return value 1.
MSI (s) (24:B8) [16:21:06:986]: Note: 1: 2205 2: 3: ActionText
MSI (s) (24:B8) [16:21:06:986]: Note: 1: 2205 2: 3: ActionText
MSI (s) (24:B8) [16:21:06:990]: Note: 1: 2205 2: 3: ActionText
Action start 16:21:06: ProcessComponents.
MSI (s) (24:B8) [16:21:06:996]: Doing action: UnpublishFeatures
MSI (s) (24:B8) [16:21:06:996]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:06: ProcessComponents. Return value 1.
Action start 16:21:06: UnpublishFeatures.
MSI (s) (24:B8) [16:21:06:997]: Doing action: StopSspServiceRollback.SetProperty
MSI (s) (24:B8) [16:21:06:997]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:06: UnpublishFeatures. Return value 1.
MSI (s) (24:B8) [16:21:06:998]: PROPERTY CHANGE: Adding StopSspServiceRollback property. Its value is 'sophossps'.
Action start 16:21:06: StopSspServiceRollback.SetProperty.
MSI (s) (24:B8) [16:21:06:998]: Doing action: StopSspServiceRollback
MSI (s) (24:B8) [16:21:06:998]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:06: StopSspServiceRollback.SetProperty. Return value 1.
Action start 16:21:06: StopSspServiceRollback.
MSI (s) (24:B8) [16:21:07:003]: Doing action: StopSspService.SetProperty
MSI (s) (24:B8) [16:21:07:003]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: StopSspServiceRollback. Return value 1.
MSI (s) (24:B8) [16:21:07:004]: PROPERTY CHANGE: Adding StopSspService property. Its value is 'sophossps'.
Action start 16:21:07: StopSspService.SetProperty.
MSI (s) (24:B8) [16:21:07:005]: Doing action: StopSspService
MSI (s) (24:B8) [16:21:07:005]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: StopSspService.SetProperty. Return value 1.
Action start 16:21:07: StopSspService.
MSI (s) (24:B8) [16:21:07:010]: Doing action: StopServices
MSI (s) (24:B8) [16:21:07:010]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: StopSspService. Return value 1.
Action start 16:21:07: StopServices.
MSI (s) (24:B8) [16:21:07:013]: Doing action: CleanUpShsUserAccountRollback.SetProperty
MSI (s) (24:B8) [16:21:07:013]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: StopServices. Return value 1.
MSI (s) (24:B8) [16:21:07:014]: PROPERTY CHANGE: Adding CleanUpShsUserAccountRollback property. Its value is 'NT SERVICE\sophossps;GENERIC_READ'.
Action start 16:21:07: CleanUpShsUserAccountRollback.SetProperty.
MSI (s) (24:B8) [16:21:07:014]: Doing action: CleanUpShsUserAccountRollback
MSI (s) (24:B8) [16:21:07:014]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: CleanUpShsUserAccountRollback.SetProperty. Return value 1.
Action start 16:21:07: CleanUpShsUserAccountRollback.
MSI (s) (24:B8) [16:21:07:020]: Skipping action: CleanUpShsUserAccount.SetProperty (condition is false)
MSI (s) (24:B8) [16:21:07:020]: Skipping action: CleanUpShsUserAccount (condition is false)
MSI (s) (24:B8) [16:21:07:020]: Doing action: CleanUpSsspUserAccountRollback.SetPropertyVistaOrLater
MSI (s) (24:B8) [16:21:07:020]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: CleanUpShsUserAccountRollback. Return value 1.
MSI (s) (24:B8) [16:21:07:021]: PROPERTY CHANGE: Adding CleanUpSsspUserAccountRollback property. Its value is 'NT SERVICE\sophossps'.
Action start 16:21:07: CleanUpSsspUserAccountRollback.SetPropertyVistaOrLater.
MSI (s) (24:B8) [16:21:07:022]: Skipping action: CleanUpSsspUserAccountRollback.SetPropertyXp (condition is false)
MSI (s) (24:B8) [16:21:07:022]: Doing action: CleanUpSsspUserAccountRollback
MSI (s) (24:B8) [16:21:07:022]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: CleanUpSsspUserAccountRollback.SetPropertyVistaOrLater. Return value 1.
Action start 16:21:07: CleanUpSsspUserAccountRollback.
MSI (s) (24:B8) [16:21:07:026]: Skipping action: CleanUpSsspUserAccount.SetPropertyVistaOrLater (condition is false)
MSI (s) (24:B8) [16:21:07:026]: Skipping action: CleanUpSsspUserAccount.SetPropertyXp (condition is false)
MSI (s) (24:B8) [16:21:07:026]: Skipping action: CleanUpSsspUserAccount (condition is false)
MSI (s) (24:B8) [16:21:07:026]: Doing action: ApplyPermissionsToFoldersOnRollback.SetProperty
MSI (s) (24:B8) [16:21:07:026]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: CleanUpSsspUserAccountRollback. Return value 1.
MSI (s) (24:B8) [16:21:07:027]: PROPERTY CHANGE: Adding ApplyPermissionsToFoldersOnRollback property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\'.
Action start 16:21:07: ApplyPermissionsToFoldersOnRollback.SetProperty.
MSI (s) (24:B8) [16:21:07:027]: Doing action: ApplyPermissionsToFoldersOnRollback
MSI (s) (24:B8) [16:21:07:027]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: ApplyPermissionsToFoldersOnRollback.SetProperty. Return value 1.
Action start 16:21:07: ApplyPermissionsToFoldersOnRollback.
MSI (s) (24:B8) [16:21:07:031]: Doing action: RequestUnrestrictedSSPSidOnRollback
MSI (s) (24:B8) [16:21:07:031]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: ApplyPermissionsToFoldersOnRollback. Return value 1.
Action start 16:21:07: RequestUnrestrictedSSPSidOnRollback.
MSI (s) (24:B8) [16:21:07:037]: Doing action: DeleteServices
MSI (s) (24:B8) [16:21:07:037]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: RequestUnrestrictedSSPSidOnRollback. Return value 1.
Action start 16:21:07: DeleteServices.
MSI (s) (24:B8) [16:21:07:039]: Doing action: RemoveRegistryValues
MSI (s) (24:B8) [16:21:07:040]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: DeleteServices. Return value 1.
Action start 16:21:07: RemoveRegistryValues.
MSI (s) (24:B8) [16:21:07:044]: Doing action: RemoveFiles
MSI (s) (24:B8) [16:21:07:044]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: RemoveRegistryValues. Return value 1.
Action start 16:21:07: RemoveFiles.
MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupData.SetProperty (condition is false)
MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupData (condition is false)
MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupLogs.SetProperty (condition is false)
MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupLogs (condition is false)
MSI (s) (24:B8) [16:21:07:046]: Doing action: RemoveFolders
MSI (s) (24:B8) [16:21:07:046]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: RemoveFiles. Return value 1.
Action start 16:21:07: RemoveFolders.
MSI (s) (24:B8) [16:21:07:047]: Doing action: CreateFolders
MSI (s) (24:B8) [16:21:07:047]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: RemoveFolders. Return value 1.
MSI (s) (24:B8) [16:21:07:049]: Using well known SID for System
MSI (s) (24:B8) [16:21:07:049]: Finished allocating new user SID
Action start 16:21:07: CreateFolders.
MSI (s) (24:B8) [16:21:07:049]: Using well known SID for Everyone
MSI (s) (24:B8) [16:21:07:049]: Finished allocating new user SID
MSI (s) (24:B8) [16:21:07:049]: Using well known SID for Administrators
MSI (s) (24:B8) [16:21:07:049]: Finished allocating new user SID
MSI (s) (24:B8) [16:21:07:050]: Doing action: InstallFiles
MSI (s) (24:B8) [16:21:07:050]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: CreateFolders. Return value 1.
Action start 16:21:07: InstallFiles.
MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2205 2: 3: Patch
MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence`
MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2205 2: 3: MsiSFCBypass
MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2228 2: 3: MsiSFCBypass 4: SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ?
MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2205 2: 3: MsiPatchHeaders
MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2228 2: 3: MsiPatchHeaders 4: SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ?
MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: MsiPatchHeaders
MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (24:B8) [16:21:07:064]: Note: 1: 2205 2: 3: Patch
MSI (s) (24:B8) [16:21:07:064]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence`
MSI (s) (24:B8) [16:21:07:069]: Doing action: RandomisePipeName
MSI (s) (24:B8) [16:21:07:069]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: InstallFiles. Return value 1.
MSI (s) (24:E8) [16:21:07:107]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI660E.tmp, Entrypoint: GenerateRandString
MSI (s) (24:08) [16:21:07:108]: Generating random cookie.
MSI (s) (24:08) [16:21:07:111]: Created Custom Action Server with PID 6700 (0x1A2C).
MSI (s) (24:04) [16:21:07:149]: Running as a service.
MSI (s) (24:04) [16:21:07:150]: Hello, I'm your 32bit Elevated custom action server.
Action start 16:21:07: RandomisePipeName.
MSI (s) (24!BC) [16:21:07:155]: PROPERTY CHANGE: Adding GeneratedRandString property. Its value is 'phqghumeaylnlfdxfircvscxggbwkfnqduxwfnfozvsrtkjpre'.
GenerateRandString: Initialized.
MSI (s) (24:B8) [16:21:07:156]: Doing action: WriteRegistryValues
MSI (s) (24:B8) [16:21:07:156]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: RandomisePipeName. Return value 1.
Action start 16:21:07: WriteRegistryValues.
MSI (s) (24:B8) [16:21:07:158]: Doing action: InstallServices
MSI (s) (24:B8) [16:21:07:158]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: WriteRegistryValues. Return value 1.
Action start 16:21:07: InstallServices.
MSI (s) (24:B8) [16:21:07:159]: Doing action: RequestUnrestrictedSSPSid
MSI (s) (24:B8) [16:21:07:159]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: InstallServices. Return value 1.
Action start 16:21:07: RequestUnrestrictedSSPSid.
MSI (s) (24:B8) [16:21:07:161]: Doing action: ApplyPermissionsToFolders.SetProperty
MSI (s) (24:B8) [16:21:07:161]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: RequestUnrestrictedSSPSid. Return value 1.
MSI (s) (24:B8) [16:21:07:161]: PROPERTY CHANGE: Adding ApplyPermissionsToFolders property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\'.
Action start 16:21:07: ApplyPermissionsToFolders.SetProperty.
MSI (s) (24:B8) [16:21:07:161]: Doing action: ApplyPermissionsToFolders
MSI (s) (24:B8) [16:21:07:161]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: ApplyPermissionsToFolders.SetProperty. Return value 1.
Action start 16:21:07: ApplyPermissionsToFolders.
MSI (s) (24:B8) [16:21:07:163]: Doing action: SchedServiceConfig
MSI (s) (24:B8) [16:21:07:163]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: ApplyPermissionsToFolders. Return value 1.
MSI (s) (24:7C) [16:21:07:181]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI666C.tmp, Entrypoint: SchedServiceConfig
MSI (s) (24!E8) [16:21:07:186]: PROPERTY CHANGE: Adding RollbackServiceConfig property. Its value is 'SchedServiceConfig'.
Action start 16:21:07: SchedServiceConfig.
MSI (s) (24!E8) [16:21:07:186]: Doing action: RollbackServiceConfig
MSI (s) (24!E8) [16:21:07:186]: Note: 1: 2205 2: 3: ActionText
Action start 16:21:07: RollbackServiceConfig.
MSI (s) (24!E8) [16:21:07:188]: PROPERTY CHANGE: Adding ExecServiceConfig property. Its value is 'SchedServiceConfig€sophossps€1€restart€restart€none€1€120€€'.
Action ended 16:21:07: RollbackServiceConfig. Return value 1.
MSI (s) (24!E8) [16:21:07:188]: Doing action: ExecServiceConfig
MSI (s) (24!E8) [16:21:07:188]: Note: 1: 2205 2: 3: ActionText
Action start 16:21:07: ExecServiceConfig.
Action ended 16:21:07: ExecServiceConfig. Return value 1.
MSI (s) (24:B8) [16:21:07:190]: Doing action: SetupSspUserAccountRollback.SetPropertyVistaOrLater
MSI (s) (24:B8) [16:21:07:190]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: SchedServiceConfig. Return value 1.
MSI (s) (24:B8) [16:21:07:191]: PROPERTY CHANGE: Adding SetupSspUserAccountRollback property. Its value is 'NT SERVICE\sophossps'.
Action start 16:21:07: SetupSspUserAccountRollback.SetPropertyVistaOrLater.
MSI (s) (24:B8) [16:21:07:191]: Skipping action: SetupSspUserAccountRollback.SetPropertyXp (condition is false)
MSI (s) (24:B8) [16:21:07:191]: Doing action: SetupSspUserAccountRollback
MSI (s) (24:B8) [16:21:07:191]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: SetupSspUserAccountRollback.SetPropertyVistaOrLater. Return value 1.
Action start 16:21:07: SetupSspUserAccountRollback.
MSI (s) (24:B8) [16:21:07:192]: Doing action: SetupSspUserAccount.SetPropertyVistaOrLater
MSI (s) (24:B8) [16:21:07:192]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: SetupSspUserAccountRollback. Return value 1.
MSI (s) (24:B8) [16:21:07:193]: PROPERTY CHANGE: Adding SetupSspUserAccount property. Its value is 'NT SERVICE\sophossps'.
Action start 16:21:07: SetupSspUserAccount.SetPropertyVistaOrLater.
MSI (s) (24:B8) [16:21:07:193]: Skipping action: SetupSspUserAccount.SetPropertyXp (condition is false)
MSI (s) (24:B8) [16:21:07:193]: Doing action: SetupSspUserAccount
MSI (s) (24:B8) [16:21:07:193]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: SetupSspUserAccount.SetPropertyVistaOrLater. Return value 1.
Action start 16:21:07: SetupSspUserAccount.
MSI (s) (24:B8) [16:21:07:194]: Doing action: SetupShsUserAccountRollback.SetProperty
MSI (s) (24:B8) [16:21:07:194]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: SetupSspUserAccount. Return value 1.
MSI (s) (24:B8) [16:21:07:195]: PROPERTY CHANGE: Adding SetupShsUserAccountRollback property. Its value is 'NT SERVICE\sophossps'.
Action start 16:21:07: SetupShsUserAccountRollback.SetProperty.
MSI (s) (24:B8) [16:21:07:195]: Doing action: SetupShsUserAccountRollback
MSI (s) (24:B8) [16:21:07:195]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: SetupShsUserAccountRollback.SetProperty. Return value 1.
Action start 16:21:07: SetupShsUserAccountRollback.
MSI (s) (24:B8) [16:21:07:197]: Doing action: SetupShsUserAccount.SetProperty
MSI (s) (24:B8) [16:21:07:197]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: SetupShsUserAccountRollback. Return value 1.
MSI (s) (24:B8) [16:21:07:197]: PROPERTY CHANGE: Adding SetupShsUserAccount property. Its value is 'NT SERVICE\sophossps;GENERIC_READ'.
Action start 16:21:07: SetupShsUserAccount.SetProperty.
MSI (s) (24:B8) [16:21:07:197]: Doing action: SetupShsUserAccount
MSI (s) (24:B8) [16:21:07:197]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: SetupShsUserAccount.SetProperty. Return value 1.
Action start 16:21:07: SetupShsUserAccount.
MSI (s) (24:B8) [16:21:07:199]: Doing action: StartServices
MSI (s) (24:B8) [16:21:07:199]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: SetupShsUserAccount. Return value 1.
Action start 16:21:07: StartServices.
MSI (s) (24:B8) [16:21:07:200]: Doing action: StartSspServiceRollback.SetProperty
MSI (s) (24:B8) [16:21:07:200]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: StartServices. Return value 1.
MSI (s) (24:B8) [16:21:07:200]: PROPERTY CHANGE: Adding StartSspServiceRollback property. Its value is 'sophossps'.
Action start 16:21:07: StartSspServiceRollback.SetProperty.
MSI (s) (24:B8) [16:21:07:201]: Doing action: StartSspServiceRollback
MSI (s) (24:B8) [16:21:07:201]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: StartSspServiceRollback.SetProperty. Return value 1.
Action start 16:21:07: StartSspServiceRollback.
MSI (s) (24:B8) [16:21:07:202]: Doing action: StartSspService.SetProperty
MSI (s) (24:B8) [16:21:07:202]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: StartSspServiceRollback. Return value 1.
MSI (s) (24:B8) [16:21:07:203]: PROPERTY CHANGE: Adding StartSspService property. Its value is 'sophossps'.
Action start 16:21:07: StartSspService.SetProperty.
MSI (s) (24:B8) [16:21:07:203]: Doing action: StartSspService
MSI (s) (24:B8) [16:21:07:203]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: StartSspService.SetProperty. Return value 1.
Action start 16:21:07: StartSspService.
MSI (s) (24:B8) [16:21:07:205]: Doing action: RegisterUser
MSI (s) (24:B8) [16:21:07:205]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: StartSspService. Return value 1.
Action start 16:21:07: RegisterUser.
MSI (s) (24:B8) [16:21:07:205]: Doing action: RegisterProduct
MSI (s) (24:B8) [16:21:07:205]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: RegisterUser. Return value 0.
Action start 16:21:07: RegisterProduct.
MSI (s) (24:B8) [16:21:07:207]: Re-registering product - performing upgrade of existing installation.
MSI (s) (24:B8) [16:21:07:207]: Resolving source.
MSI (s) (24:B8) [16:21:07:207]: Resolving source to launched-from source.
MSI (s) (24:B8) [16:21:07:207]: Setting launched-from source as last-used.
MSI (s) (24:B8) [16:21:07:207]: PROPERTY CHANGE: Adding SourceDir property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\'.
MSI (s) (24:B8) [16:21:07:207]: PROPERTY CHANGE: Adding SOURCEDIR property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\'.
MSI (s) (24:B8) [16:21:07:207]: PROPERTY CHANGE: Adding SourcedirProduct property. Its value is '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'.
MSI (s) (24:B8) [16:21:07:207]: SOURCEDIR ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\
MSI (s) (24:B8) [16:21:07:207]: SOURCEDIR product ==> {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}
MSI (s) (24:B8) [16:21:07:208]: SECREPAIR: CryptAcquireContext succeeded
MSI (s) (24:B8) [16:21:07:208]: Determining source type
MSI (s) (24:B8) [16:21:07:208]: Source type from package 'SophosSystemProtection.msi': 0
MSI (s) (24:B8) [16:21:07:208]: SECREPAIR: Hash Database: C:\Windows\Installer\SourceHash{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}
MSI (s) (24:B8) [16:21:07:222]: SECREPAIR: filename: SophosSystemProtection.msi Stored Hash Value:DEbTZq02ODv+4zl4Y8Gt6Hoa4mnhIo7s3mGX/DLHvbQ= Current Hash:drONOEoTeveg9+W4Et5aUOHIZR8CL1TRiWUIH6A/nwA=
MSI (s) (24:B8) [16:21:07:222]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (24:B8) [16:21:07:222]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (24:B8) [16:21:07:222]: Source path resolution complete. Dumping Directory table...
MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: TARGETDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath:
MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: WindowsFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath:
MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath:
MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: ProgramFilesFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath:
MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: Sophos , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\ , LongSubPath: Sophos\ , ShortSubPath:
MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: INSTALLDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\ , LongSubPath: Sophos\Sophos System Protection\ , ShortSubPath: Sophos\qgiys5c8\
MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: CommonAppDataFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath:
MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: AppDataSophos , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\ , LongSubPath: Sophos\ , ShortSubPath:
MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: AppDataSsp , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\ , LongSubPath: Sophos\Sophos System Protection\ , ShortSubPath: Sophos\vouvuy1l\
MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: Logs , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Logs\ , LongSubPath: Sophos\Sophos System Protection\Logs\ , ShortSubPath: Sophos\vouvuy1l\Logs\
MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: Config , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Config\ , LongSubPath: Sophos\Sophos System Protection\Config\ , ShortSubPath: Sophos\vouvuy1l\Config\
MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: Data , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Data\ , LongSubPath: Sophos\Sophos System Protection\Data\ , ShortSubPath: Sophos\vouvuy1l\Data\
MSI (s) (24:B8) [16:21:07:224]: Doing action: PublishFeatures
MSI (s) (24:B8) [16:21:07:224]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: RegisterProduct. Return value 1.
Action start 16:21:07: PublishFeatures.
MSI (s) (24:B8) [16:21:07:225]: Doing action: PublishProduct
MSI (s) (24:B8) [16:21:07:225]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: PublishFeatures. Return value 1.
Action start 16:21:07: PublishProduct.
MSI (s) (24:B8) [16:21:07:227]: Re-publishing product - installing new package with existing product code.
MSI (s) (24:B8) [16:21:07:227]: Skipping action: WixFailWhenDeferred (condition is false)
MSI (s) (24:B8) [16:21:07:227]: Doing action: InstallFinalize
MSI (s) (24:B8) [16:21:07:227]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:07: PublishProduct. Return value 1.
MSI (s) (24:B8) [16:21:07:227]: Running Script: C:\Windows\Installer\MSI65AF.tmp
MSI (s) (24:B8) [16:21:07:227]: PROPERTY CHANGE: Adding UpdateStarted property. Its value is '1'.
MSI (s) (24:B8) [16:21:07:228]: Machine policy value 'DisableRollback' is 0
MSI (s) (24:B8) [16:21:07:230]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (24:B8) [16:21:07:234]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1213629092,LangId=1033,Platform=0,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
Action start 16:21:07: InstallFinalize.
MSI (s) (24:B8) [16:21:07:234]: Executing op: ProductInfo(ProductKey={1093B57D-A613-47F3-90CF-0FD5C5DCFFE6},ProductName=Sophos System Protection,PackageName=SophosSystemProtection.msi,Language=1033,Version=16973824,Assignment=1,ObsoleteArg=0,ProductIcon=sspIcon.ico,,PackageCode={8A3EE444-F60F-44F2-B42C-14907395E0A6},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3)
MSI (s) (24:B8) [16:21:07:234]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (24:B8) [16:21:07:234]: Executing op: DialogInfo(Type=1,Argument=Sophos System Protection)
MSI (s) (24:B8) [16:21:07:235]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
MSI (s) (24:B8) [16:21:07:235]: Executing op: SetBaseline(Baseline=0,)
MSI (s) (24:B8) [16:21:07:235]: Executing op: SetBaseline(Baseline=1,)
MSI (s) (24:B8) [16:21:07:235]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,)
MSI (s) (24:B8) [16:21:07:235]: Executing op: ProgressTotal(Total=13,Type=1,ByteEquivalent=24000)
MSI (s) (24:B8) [16:21:07:235]: Executing op: ComponentRegister(ComponentId={96CAB1A6-E3C3-42BC-B1AC-57552F6DE27B},KeyPath=C:\Program Files\Sophos\Sophos System Protection\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (24:B8) [16:21:07:236]: Executing op: ComponentRegister(ComponentId={EE372818-51C3-4B29-B0AD-9AA8740EAA1F},KeyPath=C:\Program Files\Sophos\Sophos System Protection\ssp.exe,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (24:B8) [16:21:07:237]: Executing op: ComponentRegister(ComponentId={EFB99B6F-FB73-4F3E-9FE6-A64F479DF970},KeyPath=C:\Program Files\Sophos\Sophos System Protection\scf.dat,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (24:B8) [16:21:07:238]: Executing op: ComponentRegister(ComponentId={AEA712C0-6555-4FB1-A4CC-1806B1F94B45},KeyPath=02:\Software\Sophos\SystemProtection\PipeName,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (24:B8) [16:21:07:238]: Executing op: ComponentRegister(ComponentId={CD73DBF6-732F-4699-A9B6-968BDB1BC054},KeyPath=02:\Software\Sophos\SystemProtection\LOG\File,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (24:B8) [16:21:07:239]: Executing op: ComponentRegister(ComponentId={5F071C66-51B7-4406-8165-4E3D9E70C42F},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (24:B8) [16:21:07:239]: Executing op: ComponentRegister(ComponentId={46D9C339-FF13-4CE0-B519-E5BFE7F2BC77},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\SSP.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (24:B8) [16:21:07:240]: Executing op: ComponentRegister(ComponentId={89C06DC7-B12C-4311-9BDF-1FDA75734164},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\FBA.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (24:B8) [16:21:07:240]: Executing op: ComponentRegister(ComponentId={F56BEF81-6CB2-4FEE-930F-6C93D6A28E0C},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\PIA.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (24:B8) [16:21:07:241]: Executing op: ComponentRegister(ComponentId={F2B22387-9B39-4788-AEB6-B9551324FF17},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\SXA.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (24:B8) [16:21:07:241]: Executing op: ComponentRegister(ComponentId={BAAE170A-5F93-4FF6-9782-3F017EC4C4B1},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\EPH.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (24:B8) [16:21:07:243]: Executing op: ComponentRegister(ComponentId={216A2A33-1146-472F-9635-107BFE94723A},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Logs\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (24:B8) [16:21:07:243]: Executing op: ComponentRegister(ComponentId={EF1063A8-7B97-4CD0-A2CC-4BA27645908D},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Data\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (24:B8) [16:21:07:244]: Executing op: ActionStart(Name=StopSspServiceRollback,,)
MSI (s) (24:B8) [16:21:07:244]: Executing op: CustomActionSchedule(Action=StopSspServiceRollback,ActionType=1281,Source=BinaryData,Target=StartServiceAndWait,CustomActionData=sophossps)
MSI (s) (24:B8) [16:21:07:245]: Executing op: ActionStart(Name=StopSspService,,)
MSI (s) (24:B8) [16:21:07:245]: Executing op: CustomActionSchedule(Action=StopSspService,ActionType=1025,Source=BinaryData,Target=StopService,CustomActionData=sophossps)
MSI (s) (24:34) [16:21:07:264]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI66BC.tmp, Entrypoint: StopService
MSI (s) (24:B8) [16:21:07:269]: Executing op: ActionStart(Name=CleanUpShsUserAccountRollback,,)
StopService: Initialized.
MSI (s) (24:B8) [16:21:07:270]: Executing op: CustomActionSchedule(Action=CleanUpShsUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupShsUserAccount,CustomActionData=NT SERVICE\sophossps;GENERIC_READ)
MSI (s) (24:B8) [16:21:07:271]: Executing op: ActionStart(Name=CleanUpSsspUserAccountRollback,,)
MSI (s) (24:B8) [16:21:07:271]: Executing op: CustomActionSchedule(Action=CleanUpSsspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sophossps)
MSI (s) (24:B8) [16:21:07:272]: Executing op: ActionStart(Name=ApplyPermissionsToFoldersOnRollback,,)
MSI (s) (24:B8) [16:21:07:272]: Executing op: CustomActionSchedule(Action=ApplyPermissionsToFoldersOnRollback,ActionType=1281,Source=BinaryData,Target=ApplyPermissionsToFolders,CustomActionData=C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\)
MSI (s) (24:B8) [16:21:07:273]: Executing op: ActionStart(Name=RequestUnrestrictedSSPSidOnRollback,,)
MSI (s) (24:B8) [16:21:07:273]: Executing op: CustomActionSchedule(Action=RequestUnrestrictedSSPSidOnRollback,ActionType=1281,Source=BinaryData,Target=RequestUnrestrictedSSPSid,)
MSI (s) (24:B8) [16:21:07:274]: Executing op: ActionStart(Name=RemoveRegistryValues,Description=Removing system registry values,Template=Key: [1], Name: [2])
MSI (s) (24:B8) [16:21:07:274]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
MSI (s) (24:B8) [16:21:07:275]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\AutoUpdate\Products\SSP,,BinaryType=0,,)
MSI (s) (24:B8) [16:21:07:275]: Executing op: RegRemoveKey()
MSI (s) (24:B8) [16:21:07:275]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Sophos\AutoUpdate\Products\SSP 3: 2
MSI (s) (24:B8) [16:21:07:275]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1])
MSI (s) (24:B8) [16:21:07:275]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Data\,Foreign=0,,)
MSI (s) (24:B8) [16:21:07:276]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\Sophos System Protection\,Foreign=0,SecurityDescriptor=BinaryData,)
MSI (s) (24:B8) [16:21:07:276]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\,Foreign=0,,)
MSI (s) (24:B8) [16:21:07:277]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Logs\,Foreign=0,,)
MSI (s) (24:B8) [16:21:07:277]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6])
MSI (s) (24:B8) [16:21:07:277]: Executing op: ProgressTotal(Total=2459795,Type=0,ByteEquivalent=1)
MSI (s) (24:B8) [16:21:07:278]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)
MSI (s) (24:B8) [16:21:07:278]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)
MSI (s) (24:B8) [16:21:07:278]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,,BytesPerTick=65536,CopierType=0,,,,,,IsFirstPhysicalMedia=1)
MSI (s) (24:B8) [16:21:07:278]: Executing op: FileCopy(SourceName=b3y1tuan.con|EPH.conf,SourceCabKey=EPH.conf,DestName=EPH.conf,Attributes=512,FileSize=144,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=1516603993,HashPart2=-1089115480,HashPart3=177560312,HashPart4=-460236261,,)
MSI (s) (24:B8) [16:21:07:278]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\EPH.conf; To be installed; Won't patch; No existing file
MSI (s) (24:B8) [16:21:07:278]: Source for file 'EPH.conf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Config\'.
MSI (s) (24:B8) [16:21:07:280]: Executing op: FileCopy(SourceName=-hs0uyul.con|FBA.conf,SourceCabKey=FBA.conf,DestName=FBA.conf,Attributes=512,FileSize=131,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=541071961,HashPart2=-1557347812,HashPart3=1112832803,HashPart4=-1762817671,,)
MSI (s) (24:B8) [16:21:07:280]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\FBA.conf; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (24:B8) [16:21:07:280]: Executing op: FileCopy(SourceName=gxaaofii.con|PIA.conf,SourceCabKey=PIA.conf,DestName=PIA.conf,Attributes=512,FileSize=184,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=587898439,HashPart2=1822813661,HashPart3=227107488,HashPart4=-1758655495,,)
MSI (s) (24:B8) [16:21:07:281]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\PIA.conf; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (24:B8) [16:21:07:281]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos System Protection\)
MSI (s) (24:B8) [16:21:07:281]: Executing op: SetSourceFolder(Folder=1\Sophos\qgiys5c8\|Sophos\Sophos System Protection\)
MSI (s) (24:B8) [16:21:07:281]: Executing op: FileCopy(SourceName=scf.dat,SourceCabKey=scf.dat,DestName=scf.dat,Attributes=512,FileSize=2871,PerTick=65536,,VerifyMedia=1,,,,SecurityDescriptor=BinaryData,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=1073809623,HashPart2=1456995132,HashPart3=993544906,HashPart4=-315315346,,)
MSI (s) (24:B8) [16:21:07:282]: File: C:\Program Files\Sophos\Sophos System Protection\scf.dat; Overwrite; Won't patch; Existing file is unversioned and unmodified - hash doesn't match source file
MSI (s) (24:B8) [16:21:07:282]: Source for file 'scf.dat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\'.
MSI (s) (24:B8) [16:21:07:284]: Verifying accessibility of file: scf.dat
MSI (s) (24:B8) [16:21:07:287]: File will have security applied from OpCode.
MSI (s) (24:B8) [16:21:07:288]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)
MSI (s) (24:B8) [16:21:07:288]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)
MSI (s) (24:B8) [16:21:07:288]: Executing op: FileCopy(SourceName=fpw3kto9.con|SSP.conf,SourceCabKey=SSP.conf,DestName=SSP.conf,Attributes=512,FileSize=532,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=559106854,HashPart2=-749776755,HashPart3=975504013,HashPart4=-1382116703,,)
MSI (s) (24:B8) [16:21:07:289]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\SSP.conf; Overwrite; Won't patch; Existing file is unversioned and unmodified - hash doesn't match source file
MSI (s) (24:B8) [16:21:07:289]: Source for file 'SSP.conf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Config\'.
MSI (s) (24:B8) [16:21:07:290]: Re-applying security from existing file.
MSI (s) (24:B8) [16:21:07:291]: Verifying accessibility of file: SSP.conf
MSI (s) (24:B8) [16:21:07:292]: File will have security applied from OpCode.
MSI (s) (24:B8) [16:21:07:293]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos System Protection\)
MSI (s) (24:B8) [16:21:07:294]: Executing op: SetSourceFolder(Folder=1\Sophos\qgiys5c8\|Sophos\Sophos System Protection\)
MSI (s) (24:B8) [16:21:07:294]: Executing op: RegisterSharedComponentProvider(,,File=ssp.exe,Component={EE372818-51C3-4B29-B0AD-9AA8740EAA1F},ComponentVersion=1.3.0.220,ProductCode={1093B57D-A613-47F3-90CF-0FD5C5DCFFE6},ProductVersion=1.3.0,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0)
MSI (s) (24:B8) [16:21:07:295]: Executing op: FileCopy(SourceName=ssp.exe,SourceCabKey=ssp.exe,DestName=ssp.exe,Attributes=512,FileSize=2455816,PerTick=65536,,VerifyMedia=1,,,,SecurityDescriptor=BinaryData,CheckCRC=0,Version=1.3.0.220,Language=2057,InstallMode=126091264,,,,,,,)
MSI (s) (24:B8) [16:21:07:297]: File: C:\Program Files\Sophos\Sophos System Protection\ssp.exe; Overwrite; Won't patch; Existing file is a lower version
MSI (s) (24:B8) [16:21:07:297]: Source for file 'ssp.exe' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\'.
MSI (s) (24:B8) [16:21:07:300]: Verifying accessibility of file: ssp.exe
MSI (s) (24:B8) [16:21:07:341]: File will have security applied from OpCode.
MSI (s) (24:B8) [16:21:07:344]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)
MSI (s) (24:B8) [16:21:07:344]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)
MSI (s) (24:B8) [16:21:07:344]: Executing op: FileCopy(SourceName=hy6kgivw.con|SXA.conf,SourceCabKey=SXA.conf,DestName=SXA.conf,Attributes=512,FileSize=117,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=1443997366,HashPart2=1950740203,HashPart3=-1509326715,HashPart4=-1802581291,,)
MSI (s) (24:B8) [16:21:07:345]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\SXA.conf; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (24:B8) [16:21:07:345]: Executing op: CacheSizeFlush(,)
MSI (s) (24:B8) [16:21:07:345]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3])
MSI (s) (24:B8) [16:21:07:346]: Executing op: ProgressTotal(Total=3,Type=1,ByteEquivalent=13200)
MSI (s) (24:B8) [16:21:07:346]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\SystemProtection,SecurityDescriptor=BinaryData,BinaryType=0,,)
MSI (s) (24:B8) [16:21:07:346]: Executing op: RegAddValue(Name=PipeName,Value=\\.\Pipe\phqghumeaylnlfdxfircvscxggbwkfnqduxwfnfozvsrtkjpre,)
MSI (s) (24:B8) [16:21:07:347]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\SystemProtection\LOG,SecurityDescriptor=BinaryData,BinaryType=0,,)
MSI (s) (24:B8) [16:21:07:347]: Executing op: RegAddValue(Name=File,Value=C:\ProgramData\Sophos\Sophos System Protection\Logs\,)
MSI (s) (24:B8) [16:21:07:347]: Executing op: RegAddValue(Name=Level,Value=1,)
MSI (s) (24:B8) [16:21:07:348]: Executing op: ActionStart(Name=InstallServices,Description=Installing new services,Template=Service: [2])
MSI (s) (24:B8) [16:21:07:348]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000)
MSI (s) (24:B8) [16:21:07:348]: Executing op: ServiceInstall(Name=sophossps,DisplayName=Sophos System Protection Service,ImagePath="C:\Program Files\Sophos\Sophos System Protection\ssp.exe",ServiceType=16,StartType=2,ErrorControl=32769,,Dependencies=[~],,StartName=NT AUTHORITY\NetworkService,Password=**********,Description=Sophos System Protection Service,,)
MSI (s) (24:B8) [16:21:07:351]: Executing op: ActionStart(Name=RequestUnrestrictedSSPSid,,)
MSI (s) (24:B8) [16:21:07:352]: Executing op: CustomActionSchedule(Action=RequestUnrestrictedSSPSid,ActionType=1025,Source=BinaryData,Target=RequestUnrestrictedSSPSid,)
MSI (s) (24:B8) [16:21:07:371]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI672B.tmp, Entrypoint: RequestUnrestrictedSSPSid
MSI (s) (24:B8) [16:21:07:376]: Executing op: ActionStart(Name=ApplyPermissionsToFolders,,)
RequestUnrestrictedSSPSid: Initialized.
MSI (s) (24:B8) [16:21:07:376]: Executing op: CustomActionSchedule(Action=ApplyPermissionsToFolders,ActionType=1025,Source=BinaryData,Target=ApplyPermissionsToFolders,CustomActionData=C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\)
MSI (s) (24:8C) [16:21:07:395]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI673B.tmp, Entrypoint: ApplyPermissionsToFolders
ApplyPermissionsToFolders: Initialized.
ApplyPermissionsToFolders: Done: 002CC120Index: 0

ApplyPermissionsToFolders: Done: 002DDE88Index: 1

ApplyPermissionsToFolders: Done: 002E2380Index: 2

MSI (s) (24:B8) [16:21:07:454]: Executing op: ActionStart(Name=RollbackServiceConfig,,)
ApplyPermissionsToFolders: Done: 002E23F8Index: 3

MSI (s) (24:B8) [16:21:07:455]: Executing op: CustomActionSchedule(Action=RollbackServiceConfig,ActionType=3329,Source=BinaryData,Target=RollbackServiceConfig,CustomActionData=SchedServiceConfig)
MSI (s) (24:B8) [16:21:07:457]: Executing op: ActionStart(Name=ExecServiceConfig,,)
MSI (s) (24:B8) [16:21:07:457]: Executing op: CustomActionSchedule(Action=ExecServiceConfig,ActionType=3073,Source=BinaryData,Target=ExecServiceConfig,CustomActionData=SchedServiceConfig€sophossps€1€restart€restart€none€1€120€€)
MSI (s) (24:E0) [16:21:07:490]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI679A.tmp, Entrypoint: ExecServiceConfig
MSI (s) (24:B8) [16:21:07:501]: Executing op: ActionStart(Name=SetupSspUserAccountRollback,,)
MSI (s) (24:B8) [16:21:07:502]: Executing op: CustomActionSchedule(Action=SetupSspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\sophossps)
MSI (s) (24:B8) [16:21:07:504]: Executing op: ActionStart(Name=SetupSspUserAccount,,)
MSI (s) (24:B8) [16:21:07:504]: Executing op: CustomActionSchedule(Action=SetupSspUserAccount,ActionType=1025,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sophossps)
MSI (s) (24:E8) [16:21:07:537]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI67CA.tmp, Entrypoint: SetupSspUserAccount
SetupSspUserAccount: Initialized.
SetupSspUserAccount: LoadAccount(SophosSSPUser) failed (error 1332)
SetupSspUserAccount: Granting permissions to user "NT SERVICE\sophossps"
MSI (s) (24:B8) [16:21:07:939]: Executing op: ActionStart(Name=SetupShsUserAccountRollback,,)
SetupSspUserAccount: User is already authorised
MSI (s) (24:B8) [16:21:07:939]: Executing op: CustomActionSchedule(Action=SetupShsUserAccountRollback,ActionType=1281,Source=BinaryData,Target=CleanUpShsUserAccount,CustomActionData=NT SERVICE\sophossps)
MSI (s) (24:B8) [16:21:07:942]: Executing op: ActionStart(Name=SetupShsUserAccount,,)
MSI (s) (24:B8) [16:21:07:942]: Executing op: CustomActionSchedule(Action=SetupShsUserAccount,ActionType=1025,Source=BinaryData,Target=SetupShsUserAccount,CustomActionData=NT SERVICE\sophossps;GENERIC_READ)
MSI (s) (24:30) [16:21:07:980]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI697F.tmp, Entrypoint: SetupShsUserAccount
SetupShsUserAccount: Initialized.
MSI (s) (24:B8) [16:21:07:988]: Executing op: ActionStart(Name=StartServices,Description=Starting services,Template=Service: [1])
SetupShsUserAccount: Granting permissions to user "NT SERVICE\sophossps"
MSI (s) (24:B8) [16:21:07:988]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000)
MSI (s) (24:B8) [16:21:07:988]: Executing op: ServiceControl(,Name=sophossps,Action=1,Wait=1,)
MSI (s) (24:B8) [16:21:09:259]: Executing op: ActionStart(Name=StartSspServiceRollback,,)
MSI (s) (24:B8) [16:21:09:259]: Executing op: CustomActionSchedule(Action=StartSspServiceRollback,ActionType=1281,Source=BinaryData,Target=StopService,CustomActionData=sophossps)
MSI (s) (24:B8) [16:21:09:262]: Executing op: ActionStart(Name=StartSspService,,)
MSI (s) (24:B8) [16:21:09:263]: Executing op: CustomActionSchedule(Action=StartSspService,ActionType=1025,Source=BinaryData,Target=StartServiceAndWait,CustomActionData=sophossps)
MSI (s) (24:20) [16:21:09:300]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI6E9F.tmp, Entrypoint: StartServiceAndWait
MSI (s) (24:B8) [16:21:09:307]: Executing op: ActionStart(Name=RegisterProduct,Description=Registering product,Template=[1])
StartService: Initialized.
MSI (s) (24:B8) [16:21:09:307]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,,BytesPerTick=0,CopierType=0,,,,,,IsFirstPhysicalMedia=1)
MSI (s) (24:B8) [16:21:09:307]: Executing op: DatabaseCopy(DatabasePath=C:\Windows\Installer\2144f81.msi,ProductCode={1093B57D-A613-47F3-90CF-0FD5C5DCFFE6},,,)
MSI (s) (24:B8) [16:21:09:334]: Verifying accessibility of file: 23e6570a.msi
MSI (s) (24:B8) [16:21:09:375]: File will have security applied from OpCode.
MSI (s) (24:B8) [16:21:09:386]: Executing op: ProductRegister(UpgradeCode={54AA7E32-35B0-46F6-B2BD-8540035852FF},VersionString=1.3.0,HelpLink=www.sophos.com/.../contacting,,InstallSource=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\,Publisher=Sophos Limited,URLInfoAbout=www.sophos.com,URLUpdateInfo=http:/.../updates,,NoModify=1,NoRepair=1,,Comments=Sophos System Protection helps protect your system from threats.,Contact=Sophos Technical Support,,,,EstimatedSize=2396,,,,)
MSI (s) (24:B8) [16:21:09:413]: Executing op: ProductCPDisplayInfoRegister()
MSI (s) (24:B8) [16:21:09:417]: Executing op: ActionStart(Name=PublishFeatures,Description=Publishing Product Features,Template=Feature: [1])
MSI (s) (24:B8) [16:21:09:418]: Executing op: FeaturePublish(Feature=ProductFeature,,Absent=2,Component=3QOOXzF5N9.@OLCytHnO5VkWu]hC1@uq)4_un%3--x$'v{avOAO@![Ax'FBLQwB.a5Q-]AcYWz$eO,?=8ag%kUCdc=UnJrT0P@8CgX'VF}TFr9EYnd7&pyE3EcWj=ix8e@GFFbf3T,QNR~6?TZY9W9H7w+ob@s6HP%`sw+(_cAvjJHW8*'&'yR3!wx_6~=GXwVCwhWe*^pt~db1QdA(4+J!3ZM.bgQqg-KOas=%)zVOiQfk60!{ouX0Qc@+gh1]WZFRU)
MSI (s) (24:B8) [16:21:09:422]: Executing op: ActionStart(Name=PublishProduct,Description=Publishing product information,)
MSI (s) (24:B8) [16:21:09:422]: Executing op: IconCreate(Icon=sspIcon.ico,Data=BinaryData)
MSI (s) (24:B8) [16:21:09:425]: Verifying accessibility of file: sspIcon.ico
MSI (s) (24:B8) [16:21:09:448]: Note: 1: 2318 2:
MSI (s) (24:B8) [16:21:09:458]: Executing op: PackageCodePublish(PackageKey={8A3EE444-F60F-44F2-B42C-14907395E0A6})
MSI (s) (24:B8) [16:21:09:460]: Executing op: CleanupConfigData()
MSI (s) (24:B8) [16:21:09:460]: Executing op: RegisterPatchOrder(Continue=0,SequenceType=1,Remove=0)
MSI (s) (24:B8) [16:21:09:469]: Executing op: ProductPublishUpdate()
MSI (s) (24:B8) [16:21:09:472]: Executing op: SourceListRegisterLastUsed(SourceProduct={1093B57D-A613-47F3-90CF-0FD5C5DCFFE6},LastUsedSource=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\)
MSI (s) (24:B8) [16:21:09:472]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (s) (24:B8) [16:21:09:472]: Specifed source is already in a list.
MSI (s) (24:B8) [16:21:09:472]: User policy value 'SearchOrder' is 'nmu'
MSI (s) (24:B8) [16:21:09:472]: Adding new sources is allowed.
MSI (s) (24:B8) [16:21:09:472]: Set LastUsedSource to: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\.
MSI (s) (24:B8) [16:21:09:472]: Set LastUsedType to: n.
MSI (s) (24:B8) [16:21:09:472]: Set LastUsedIndex to: 1.
MSI (s) (24:B8) [16:21:09:473]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=6630819)
MSI (s) (24:B8) [16:21:09:478]: User policy value 'DisableRollback' is 0
MSI (s) (24:B8) [16:21:09:478]: Machine policy value 'DisableRollback' is 0
MSI (s) (24:B8) [16:21:09:524]: Note: 1: 2318 2:
MSI (s) (24:B8) [16:21:09:528]: Note: 1: 2318 2:
MSI (s) (24:B8) [16:21:09:530]: No System Restore sequence number for this installation.
MSI (s) (24:B8) [16:21:09:530]: Unlocking Server
MSI (s) (24:B8) [16:21:09:538]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
MSI (s) (24:B8) [16:21:09:539]: Doing action: RegisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0
MSI (s) (24:B8) [16:21:09:539]: Note: 1: 2205 2: 3: ActionText
Action ended 16:21:09: InstallFinalize. Return value 1.
MSI (s) (24:88) [16:21:09:568]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI6FBA.tmp, Entrypoint: RegisterWithAutoUpdateMSI
Action start 16:21:09: RegisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0.
MSI (s) (24:B8) [16:21:09:575]: Skipping action: UnregisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 (condition is false)
Action ended 16:21:09: RegisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0. Return value 1.
Action ended 16:21:09: INSTALL. Return value 1.
Property(S): Data = C:\ProgramData\Sophos\Sophos System Protection\Data\
Property(S): UpgradeCode = {54AA7E32-35B0-46F6-B2BD-8540035852FF}
Property(S): INSTALLDIR = C:\Program Files\Sophos\Sophos System Protection\
Property(S): Config = C:\ProgramData\Sophos\Sophos System Protection\Config\
Property(S): Logs = C:\ProgramData\Sophos\Sophos System Protection\Logs\
Property(S): StopSspServiceRollback = sophossps
Property(S): StopSspService = sophossps
Property(S): StartSspServiceRollback = sophossps
Property(S): StartSspService = sophossps
Property(S): ApplyPermissionsToFoldersOnRollback = C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\
Property(S): ApplyPermissionsToFolders = C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\
Property(S): CleanUpSsspUserAccountRollback = NT SERVICE\sophossps
Property(S): SetupSspUserAccount = NT SERVICE\sophossps
Property(S): SetupSspUserAccountRollback = NT SERVICE\sophossps
Property(S): CleanUpShsUserAccountRollback = NT SERVICE\sophossps;GENERIC_READ
Property(S): SetupShsUserAccount = NT SERVICE\sophossps;GENERIC_READ
Property(S): SetupShsUserAccountRollback = NT SERVICE\sophossps
Property(S): RegisterWithAutoUpdate = {F8FFD42E-47AC-4CFF-9E27-EC84ED62128E};ssp;
Property(S): ExecServiceConfig = SchedServiceConfig€sophossps€1€restart€restart€none€1€120€€
Property(S): RollbackServiceConfig = SchedServiceConfig
Property(S): Sophos = C:\Program Files\Sophos\
Property(S): ProgramFilesFolder = C:\Program Files\
Property(S): TARGETDIR = C:\
Property(S): AppDataSsp = C:\ProgramData\Sophos\Sophos System Protection\
Property(S): AppDataSophos = C:\ProgramData\Sophos\
Property(S): CommonAppDataFolder = C:\ProgramData\
Property(S): SourceDir = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\
Property(S): VersionNT = 601
Property(S): Installed = 00:00:00
Property(S): ALLUSERS = 1
Property(S): ARPCOMMENTS = Sophos System Protection helps protect your system from threats.
Property(S): ARPCONTACT = Sophos Technical Support
Property(S): ARPPRODUCTICON = sspIcon.ico
Property(S): ARPHELPLINK = http://www.sophos.com/support
Property(S): ARPURLINFOABOUT = http://www.sophos.com
Property(S): ARPURLUPDATEINFO = www.sophos.com/.../updates
Property(S): ARPHELPTELEPHONE = www.sophos.com/.../contacting
Property(S): ARPNOMODIFY = 1
Property(S): ARPNOREPAIR = 1
Property(S): Manufacturer = Sophos Limited
Property(S): ProductCode = {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}
Property(S): ProductLanguage = 1033
Property(S): ProductName = Sophos System Protection
Property(S): ProductVersion = 1.3.0
Property(S): SecureCustomProperties = WIX_DOWNGRADE_DETECTED;WIX_UPGRADE_DETECTED
Property(S): INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 = C:\
Property(S): MsiLogFileLocation = C:\Windows\TEMP\SophosSystemProtectionSetup_160222_102101.log
Property(S): PackageCode = {8A3EE444-F60F-44F2-B42C-14907395E0A6}
Property(S): ProductState = 5
Property(S): ProductToBeRegistered = 1
Property(S): PackagecodeChanging = 1
Property(S): REINSTALL = ALL
Property(S): REINSTALLMODE = VOMUS
Property(S): INSTALLINGVERSION = 1.3.0
Property(S): REBOOT = ReallySuppress
Property(S): CURRENTDIRECTORY = C:\Windows\system32
Property(S): CLIENTUILEVEL = 3
Property(S): CLIENTPROCESSID = 8444
Property(S): MsiSystemRebootPending = 1
Property(S): PRODUCTLANGUAGE = 1033
Property(S): VersionDatabase = 200
Property(S): VersionMsi = 5.00
Property(S): WindowsBuild = 7601
Property(S): ServicePackLevel = 1
Property(S): ServicePackLevelMinor = 0
Property(S): MsiNTProductType = 1
Property(S): WindowsFolder = C:\Windows\
Property(S): WindowsVolume = C:\
Property(S): SystemFolder = C:\Windows\system32\
Property(S): System16Folder = C:\Windows\system\
Property(S): RemoteAdminTS = 1
Property(S): TempFolder = C:\Windows\TEMP\
Property(S): CommonFilesFolder = C:\Program Files\Common Files\
Property(S): AppDataFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\
Property(S): FavoritesFolder = C:\Windows\system32\config\systemprofile\Favorites\
Property(S): NetHoodFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\
Property(S): PersonalFolder = C:\Windows\system32\config\systemprofile\Documents\
Property(S): PrintHoodFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\
Property(S): RecentFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\
Property(S): SendToFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\
Property(S): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\
Property(S): LocalAppDataFolder = C:\Windows\system32\config\systemprofile\AppData\Local\
Property(S): MyPicturesFolder = C:\Windows\system32\config\systemprofile\Pictures\
Property(S): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\
Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Property(S): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
Property(S): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\
Property(S): DesktopFolder = C:\Users\Public\Desktop\
Property(S): FontsFolder = C:\Windows\Fonts\
Property(S): GPTSupport = 1
Property(S): OLEAdvtSupport = 1
Property(S): ShellAdvtSupport = 1
Property(S): Intel = 6
Property(S): PhysicalMemory = 2954
Property(S): VirtualMemory = 3880
Property(S): AdminUser = 1
Property(S): MsiTrueAdminUser = 1
Property(S): LogonUser = SYSTEM
Property(S): UserSID = S-1-5-18
Property(S): UserLanguageID = 1033
Property(S): ComputerName = 4002X
Property(S): SystemLanguageID = 1033
Property(S): ScreenX = 1024
Property(S): ScreenY = 768
Property(S): CaptionHeight = 22
Property(S): BorderTop = 1
Property(S): BorderSide = 1
Property(S): TextHeight = 16
Property(S): TextInternalLeading = 3
Property(S): ColorBits = 32
Property(S): TTCSupport = 1
Property(S): Time = 16:21:09
Property(S): Date = 2/22/2016
Property(S): MsiNetAssemblySupport = 4.0.30319.18408
Property(S): MsiWin32AssemblySupport = 6.1.7601.17514
Property(S): RedirectedDllSupport = 2
Property(S): MsiRunningElevated = 1
Property(S): Privileged = 1
Property(S): USERNAME = Admin
Property(S): DATABASE = C:\Windows\Installer\2144f81.msi
Property(S): OriginalDatabase = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi
Property(S): UILevel = 2
Property(S): QFEUpgrade = 1
Property(S): Preselected = 1
Property(S): ACTION = INSTALL
Property(S): ROOTDRIVE = C:\
Property(S): CostingComplete = 1
Property(S): OutOfDiskSpace = 0
Property(S): OutOfNoRbDiskSpace = 0
Property(S): PrimaryVolumeSpaceAvailable = 0
Property(S): PrimaryVolumeSpaceRequired = 0
Property(S): PrimaryVolumeSpaceRemaining = 0
Property(S): INSTALLLEVEL = 1
Property(S): GeneratedRandString = phqghumeaylnlfdxfircvscxggbwkfnqduxwfnfozvsrtkjpre
Property(S): SOURCEDIR = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\
Property(S): SourcedirProduct = {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}
MSI (s) (24:B8) [16:21:09:603]: Note: 1: 1728
MSI (s) (24:B8) [16:21:09:604]: Product: Sophos System Protection -- Configuration completed successfully.

MSI (s) (24:B8) [16:21:09:604]: Windows Installer reconfigured the product. Product Name: Sophos System Protection. Product Version: 1.3.0. Product Language: 1033. Manufacturer: Sophos Limited. Reconfiguration success or error status: 0.

MSI (s) (24:B8) [16:21:09:606]: Deferring clean up of packages/files, if any exist
MSI (s) (24:B8) [16:21:09:606]: MainEngineThread is returning 0
MSI (s) (24:DC) [16:21:09:628]: RESTART MANAGER: Previously shut down applications have been restarted.
MSI (s) (24:DC) [16:21:09:629]: RESTART MANAGER: Session closed.
MSI (s) (24:DC) [16:21:09:629]: No System Restore sequence number for this installation.
=== Logging stopped: 2/22/2016 16:21:09 ===
MSI (s) (24:DC) [16:21:09:631]: User policy value 'DisableRollback' is 0
MSI (s) (24:DC) [16:21:09:631]: Machine policy value 'DisableRollback' is 0
MSI (s) (24:DC) [16:21:09:631]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (24:DC) [16:21:09:632]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (24:DC) [16:21:09:633]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (24:DC) [16:21:09:634]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (s) (24:DC) [16:21:09:634]: Restoring environment variables
MSI (s) (24:DC) [16:21:09:635]: Destroying RemoteAPI object.
MSI (s) (24:08) [16:21:09:635]: Custom Action Manager thread ending.
MSI (c) (FC:44) [16:21:09:637]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (FC:44) [16:21:09:638]: MainEngineThread is returning 0
MSI (c) (FC:EC) [16:21:09:648]: RESTART MANAGER: Previously shut down applications have been restarted.
MSI (c) (FC:EC) [16:21:09:649]: RESTART MANAGER: Session closed.
=== Verbose logging stopped: 2/22/2016 16:21:09 ===

2016-02-22 16:21:09 Info: Exit code from MsiInstallProduct: ERROR_SUCCESS