Failed to install SAVXP: The MSI has failed.

Hello MichaelR,

that's not much detail, at least SAV and OS version could make a difference.

Anyway, a few questions:

I assume you are managing the computers with SEC (version?) and the have already been protected for some time, correct? When did the problems start (as 10.0.3 is "out now" - do they perhaps fail to upgrade from 10.0.2)? Was the attempted reinstall done by Protect computers from the console?

Not all errors can be resolved by simply reprotecting/reinstalling, sometimes it is necessary to determine the cause. Interesting logs are Sophos Anti-Virus Install Log_yymmdd_yymmdd.txt and Sophos Anti-Virus CustomActions Log_yymmdd_hhmmss.txt , you should check these first (you should find them in %windir%\Temp). Search for Return value 3 in the install log. If you are unsure how to proceed please post a short snippet from above Return value 3 .

Christian

Hello Christian,

I manange these computer with SEC version 5.0.08.

The problem is on Win XP and Win 7..

I have already tried to reinstall by protect computers from console.

Here is the log file.

MSI (s) (44:9C) [12:30:14:043]: Executing op: CustomActionSchedule(Action=SwiUpdate_install.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=1058,Source=C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\,Target="C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_update.exe" /update,)MSI (s) (44:9C) [12:30:14:590]: Note: 1: 1722 2: SwiUpdate_install.11DACB83_28A7_4FA6_AF5B_C006E340C101 3: C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\ 4: "C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_update.exe" /update MSI (s) (44:9C) [12:30:14:590]: Product: Sophos Anti-Virus -- Error 1722.There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor.  Action SwiUpdate_install.11DACB83_28A7_4FA6_AF5B_C006E340C101, location: C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\, command: "C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_update.exe" /update 
MSI (s) (44:9C) [12:30:14:590]: User policy value 'DisableRollback' is 0MSI (s) (44:9C) [12:30:14:590]: Machine policy value 'DisableRollback' is 0Action ended 12:30:14: InstallFinalize. Return value 3.

Hello Michael,

this is from the SAV Install log, right? What's in the CustomActions log?

Christian

Hello Christian,

2012-04-05 12:31:32 RollbackUpdateSavAdapterDll: Action started2012-04-05 12:31:32 RollbackUpdateSavAdapterDll: Failed to re-add SAVAdapter key (0x2)2012-04-05 12:31:32 RollbackUpdateSavAdapterDll: Action succeeded2012-04-05 12:31:32 DeleteOtherFiles: Action started2012-04-05 12:31:32 Error deleting file: C:\Program Files\Sophos\Sophos Anti-Virus\sophos_detoured.dll.stf00 with error: Toegang geweigerd..2012-04-05 12:31:32 Error deleting file: C:\Program Files\Sophos\Sophos Anti-Virus\sophos_detoured.dll.stf04 with error: Toegang geweigerd..2012-04-05 12:31:32 DeleteOtherFiles: GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\sophos_detoured.dll detoured exists, proceeding to rename it & mark for delete.2012-04-05 12:31:32 DeleteOtherFiles: PROCESSOR_ARCHITECTURE environment variable is: x862012-04-05 12:31:32 DeleteOtherFiles: GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\detoured.dll does not exist, no further action.2012-04-05 12:31:32 DeleteOtherFiles: Deleting config file folder2012-04-05 12:31:32 DeleteOtherFiles: Failed to delete config folder, 32012-04-05 12:31:32 DeleteOtherFiles: Action succeeded2012-04-05 12:31:32 ForceDeleteFiles: Action started2012-04-05 12:31:32 ForceDeleteFiles: Action succeeded2012-04-05 12:31:32 RunErrorScripts: Action started2012-04-05 12:31:32 RunErrorScripts: Action succeeded2012-04-05 12:31:32 RestoreMovedFiles: Action started2012-04-05 12:31:32 RestoreMovedFiles: Action succeeded2012-04-05 12:31:32 SetUpdateFailed: Action started2012-04-05 12:31:32 SetUpdateFailed: Unable to create an instance of ComponentManager - SystemInformation cannot be informed of end of update2012-04-05 12:31:32 SetUpdateFailed: Action succeeded

Toegang geweigerd = access denied.

Michael

Hello Michael,

thanks, but my Dutch just suffices to understand Toegang geweigerd  :smileywink:

If the snippets are from the same set of logs then the error in CustomActions is not the one causing the 1722 though. Are there any other logs from around this time? (should have thought of this in the first place as the logs says that "C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_update.exe" /update has failed).

Christian

No there are nog other logs anymore.

I have deleted the computer in SEC and now i get the following error: Uninstall of Sophos AutoUpdate failed.

Hello Michael,

now i get the following error: Uninstall of Sophos AutoUpdate failed

you see this on the client or did it reappear in the console? Anyway - how many clients are we talking about  (i.e. what's your total number and how many fail)?   

Combing through various saved logs it appears that swi_update.exe isn't very talkative - OTOH it looks it is the failing program (at least in the attempted reinstalls). Can't say where to look next so I'd contact Support (email/support form or phone) - collecting the logs before doing so (both from a client you have attempted to reinstall and if you still have one you have not then this too). Although it is likely possible to remedy the situation by "brute force" it's better to have the problem analyzed (especially if more than a very few clients show this issue).

Sorry that I can't be of more help.

Christian

Hello Christian.

I have this problem on 50 clients.

I have found the following log file.

Property(S): SourcedirProduct = {9ACB414D-9347-40B6-A453-5EFB2DB59DFA}MSI (s) (58:28) [08:38:33:452]: Note: 1: 1729 MSI (s) (58:28) [08:38:33:452]: Product: Sophos Anti-Virus -- Configuration failed.
MSI (s) (58:28) [08:38:33:468]: Het product is opnieuw geconfigureerd. Productnaam: Sophos Anti-Virus. Productversie: 10.0.3. Producttaal: 1033. Status van geslaagd/mislukt opnieuw configureren: 1603.
MSI (s) (58:28) [08:38:33:468]: Cleaning up uninstalled install packages, if any existMSI (s) (58:28) [08:38:33:468]: MainEngineThread is returning 1603MSI (s) (58:9C) [08:38:33:468]: No System Restore sequence number for this installation.=== Logging stopped: 11-4-2012  8:38:33 ===MSI (s) (58:9C) [08:38:33:484]: User policy value 'DisableRollback' is 0MSI (s) (58:9C) [08:38:33:484]: Machine policy value 'DisableRollback' is 0MSI (s) (58:9C) [08:38:33:484]: Incrementing counter to disable shutdown. Counter after increment: 0MSI (s) (58:9C) [08:38:33:484]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (58:9C) [08:38:33:484]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (58:9C) [08:38:33:484]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1MSI (s) (58:9C) [08:38:33:484]: Restoring environment variablesMSI (c) (B4:AC) [08:38:33:484]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1MSI (c) (B4:AC) [08:38:33:484]: MainEngineThread is returning 1603=== Verbose logging stopped: 11-4-2012  8:38:33 ===
2012-04-11 08:38:33 ERROR: Installation failed

Hello Michael,

I'm not sure if this is the same error, combing through some more error logs I've found a Configuration failed error. The reason could be found in the CustomActions log (like the one you posted here) in the lines preceding the one with RollbackUpdateSavAdapterDll . Didn't stand out so it could easily be overlooked. If you're not sure please post the complete CustomActions here.

Christian

Christian,

This is the log file.

2012-04-11 10:16:08 ExtractClassicConfig: Action started2012-04-11 10:16:08 ExtractClassicConfig: Action succeeded2012-04-11 10:16:08 PreInstallChecks: Action started2012-04-11 10:16:08 PreInstallChecks: Action succeeded2012-04-11 10:16:08 SetBootDriverStartupProperty: Action started2012-04-11 10:16:08 SetBootDriverStartupProperty: Boot driver: not installed.2012-04-11 10:16:08 SetBootDriverStartupProperty: Action succeeded2012-04-11 10:16:12 SetClassFilterPresentProperty: Action started2012-04-11 10:16:12 SetClassFilterPresentProperty: Setting class filter present property to: 12012-04-11 10:16:12 SetClassFilterPresentProperty: Action succeeded2012-04-11 10:16:13 SetDriverProperty: Action started2012-04-11 10:16:13 SetDriverProperty: PROCESSOR_ARCHITECTURE environment variable is: x862012-04-11 10:16:13 SetDriverProperty: Action succeeded2012-04-11 10:16:13 SetProcessorProperties: Action started2012-04-11 10:16:13 SetProcessorProperties: Action succeeded2012-04-11 10:16:15 CheckRegForNullDACLs: Action started2012-04-11 10:16:15 CheckRegForNullDACLs: Action succeeded2012-04-11 10:16:17 WaitForSAVService: Action started2012-04-11 10:16:17 WaitForSAVService: WaitForSAVService: Walking system processes...2012-04-11 10:16:17 WaitForSAVService: WaitForSAVService: Finished walking system processes.2012-04-11 10:16:17 WaitForSAVService: Action succeeded2012-04-11 10:16:17 CheckUninstallDrivers: Action started2012-04-11 10:16:17 CheckUninstallDrivers: IsServiceInstalled: Unable to get a handle to requested service SAVOnAccess control. Returning false.2012-04-11 10:16:17 CheckUninstallDrivers: IsServiceInstalled: Unable to get a handle to requested service SAVOnAccess filter. Returning false.2012-04-11 10:16:17 CheckUninstallDrivers: Action succeeded2012-04-11 10:16:17 DeleteIDEs: Action started2012-04-11 10:16:17 DeleteIDEs: Action succeeded2012-04-11 10:16:19 DeleteBDLs: Action started2012-04-11 10:16:19 DeleteBDLs: Action succeeded2012-04-11 10:16:19 DeleteHIPSConfig: Action started2012-04-11 10:16:19 DeleteHIPSConfig: Action succeeded2012-04-11 10:16:19 UpdateSavAdapterDll: Action started2012-04-11 10:16:28 UpdateSavAdapterDll: Action succeeded2012-04-11 10:16:28 CopyOtherFiles: Action started2012-04-11 10:16:28 CopyOtherFiles: CopyOtherFiles custom action - Copying other driver files2012-04-11 10:16:28 CopyOtherFiles: Copying class filter source: C:\Program Files\Sophos\AutoUpdate\cache\savxp\classfilterdrivers\i386\SDCFILTER.INF, target: C:\Program Files\Sophos\Sophos Anti-Virus\2012-04-11 10:16:28 CopyOtherFiles: Copying kms source: C:\Program Files\Sophos\AutoUpdate\cache\savxp\drivers\i386\SKMSCAN.INF, target: C:\Program Files\Sophos\Sophos Anti-Virus\2012-04-11 10:16:28 CopyOtherFiles: GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\sophos_detoured.dll detoured exists, proceeding to rename it & mark for delete.2012-04-11 10:16:28 CopyOtherFiles: PROCESSOR_ARCHITECTURE environment variable is: x862012-04-11 10:16:28 CopyOtherFiles: Action succeeded2012-04-11 10:16:28 RegisterBufferOverflowProtection: Action started2012-04-11 10:16:28 RegisterBufferOverflowProtection: BopsUnregister: could not get short path to DLL. It will not be unregistered.2012-04-11 10:16:28 RegisterBufferOverflowProtection: GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\detoured.dll does not exist, no further action.2012-04-11 10:16:28 RegisterBufferOverflowProtection: BOPS path already exists2012-04-11 10:16:28 RegisterBufferOverflowProtection: PROCESSOR_ARCHITECTURE environment variable is: x862012-04-11 10:16:28 RegisterBufferOverflowProtection: Action succeeded2012-04-11 10:16:31 InstallDriverFromInf: Action started2012-04-11 10:16:31 InstallDriverFromInf: Executing RunInfSection with DefaultInstall and DefaultInstall.Services2012-04-11 10:16:32 InstallDriverFromInf: Action succeeded2012-04-11 10:16:32 StartDriverServices: Action started2012-04-11 10:16:32 StartDriverServices: IsServiceRunning: Unable to get a handle to requested service SAVOnAccess control. Returning false.2012-04-11 10:16:32 StartDriverServices: Legacy control service is running2012-04-11 10:16:32 StartDriverServices: Action succeeded2012-04-11 10:16:36 CreateUserGroups: Action started2012-04-11 10:16:38 CreateUserGroups: Local name of well-known group Administrators is Administrators2012-04-11 10:16:38 CreateUserGroups: Local name of well-known group PowerUsers is Hoofdgebruikers2012-04-11 10:16:38 CreateUserGroups: Local name of well-known group Users is Gebruikers2012-04-11 10:16:38 CreateUserGroups: Failed to add the members of group PowerUsers to SophosPowerUser group2012-04-11 10:16:42 CreateUserGroups: Action succeeded2012-04-11 10:16:42 AddDomainGroups: Action started2012-04-11 10:16:42 AddDomainGroups: Found SophosDomainUser group2012-04-11 10:16:42 AddDomainGroups: Found SophosDomainPowerUser group2012-04-11 10:16:42 AddDomainGroups: Found SophosDomainAdministrator group2012-04-11 10:16:42 AddDomainGroups: Added SophosDomainAdministrator group to SophosAdministrator group2012-04-11 10:16:42 AddDomainGroups: Added SophosDomainPowerUser group to SophosPowerUser group2012-04-11 10:16:43 AddDomainGroups: Added SophosDomainUser group to SophosUser group2012-04-11 10:16:43 AddDomainGroups: Action succeeded2012-04-11 10:16:52 SetSAVAdminUpdateBegin: Action started2012-04-11 10:16:52 SetSAVAdminUpdateBegin: Action succeeded2012-04-11 10:16:52 UpdateSAVI: Action started2012-04-11 10:16:52 UpdateSAVI: About to wait for event Global\!$_SAVI_!$$!_EVENT_$!__ReadyForUpdate2012-04-11 10:16:52 UpdateSAVI: WaitForSAVIEvent: Could not open memory mapped file Global\!$_SAVI_!$$!_MMMF_$!__2012-04-11 10:16:52 UpdateSAVI: Successfully waited for event Global\!$_SAVI_!$$!_EVENT_$!__ReadyForUpdate2012-04-11 10:16:52 UpdateSAVI: UpdateRequest signalled2012-04-11 10:16:52 UpdateSAVI: About to wait for event Global\!$_SAVI_!$$!_EVENT_$!__Suspended2012-04-11 10:16:52 UpdateSAVI: WaitForSAVIEvent: Could not open memory mapped file Global\!$_SAVI_!$$!_MMMF_$!__2012-04-11 10:16:52 UpdateSAVI: Successfully waited for event Global\!$_SAVI_!$$!_EVENT_$!__Suspended2012-04-11 10:17:00 UpdateSAVI: SAVI dll was installed successfully2012-04-11 10:17:00 UpdateSAVI: Action succeeded2012-04-11 10:17:00 SetFolderPermissions: Action started2012-04-11 10:17:00 SetFolderPermissions: We are running on XP or higher - adding LocalService to permissions on config files2012-04-11 10:17:00 SetFolderPermissions: We are running on XP or higher - adding LocalService to permissions on config files2012-04-11 10:17:00 SetFolderPermissions: Action succeeded2012-04-11 10:17:02 SetServiceXP: Action started2012-04-11 10:17:03 SetServiceXP: Action succeeded2012-04-11 10:17:03 SetServiceSecurity: Action started2012-04-11 10:17:03 SetServiceSecurity: Action succeeded2012-04-11 10:17:03 InstallDeviceControl: Action started2012-04-11 10:17:03 InstallDeviceControl: PROCESSOR_ARCHITECTURE environment variable is: x862012-04-11 10:17:03 InstallDeviceControl: Action succeeded2012-04-11 10:17:03 SetAdminGroupDescription: Action started2012-04-11 10:17:04 SetAdminGroupDescription: Action succeeded2012-04-11 10:17:04 SetPowerGroupDescription: Action started2012-04-11 10:17:05 SetPowerGroupDescription: Action succeeded2012-04-11 10:17:05 SetUserGroupDescription: Action started2012-04-11 10:17:05 SetUserGroupDescription: Action succeeded2012-04-11 10:17:05 SetOnAccessGroupDescription: Action started2012-04-11 10:17:05 SetOnAccessGroupDescription: Action succeeded2012-04-11 10:17:05 DisableWebProtection: Action started2012-04-11 10:17:06 DisableWebProtection: DisableWebProtection: OK2012-04-11 10:17:06 DisableWebProtection: Action succeeded2012-04-11 10:17:06 DisableSxlLookups: Action started2012-04-11 10:17:06 DisableSxlLookups: DisableSxlLookups: OK2012-04-11 10:17:06 DisableSxlLookups: Action succeeded2012-04-11 10:17:06 UpdateSXLServerList: Action started2012-04-11 10:17:06 UpdateSXLServerList: LoadSophtainerData: GetSophtainerSection(C:\Program Files\Sophos\Sophos Anti-Virus\SXLConfig.dat) returned 0. (132 bytes returned)
2012-04-11 10:17:06 UpdateSXLServerList: Action succeeded2012-04-11 10:17:06 GenerateSavMachineId: Action started2012-04-11 10:17:06 GenerateSavMachineId: Sav machine id = CC8CADF2-9375-4E1B-B790-6D78E98F3C992012-04-11 10:17:06 GenerateSavMachineId: Action succeeded2012-04-11 10:17:08 SetSAVAdminUpdateComplete: Action started2012-04-11 10:17:08 SetSAVAdminUpdateComplete: Action succeeded2012-04-11 10:17:08 RunPreLaunchScripts: Action started2012-04-11 10:17:08 RunPreLaunchScripts: RunPreLaunchScripts: No entries.2012-04-11 10:17:08 RunPreLaunchScripts: Action succeeded2012-04-11 10:17:08 UninstallSecurityCenter: Action started2012-04-11 10:17:08 UninstallSecurityCenter: Action succeeded2012-04-11 10:17:09 RollbackInstallDeviceControl: Action started2012-04-11 10:17:09 RollbackInstallDeviceControl: Action succeeded2012-04-11 10:17:10 RemoveSAVI: Action started2012-04-11 10:17:11 RemoveSAVI: About to wait for event Global\!$_SAVI_!$$!_EVENT_$!__ReadyForUpdate2012-04-11 10:17:11 RemoveSAVI: WaitForSAVIEvent: Could not open memory mapped file Global\!$_SAVI_!$$!_MMMF_$!__2012-04-11 10:17:11 RemoveSAVI: Successfully waited for event Global\!$_SAVI_!$$!_EVENT_$!__ReadyForUpdate2012-04-11 10:17:11 RemoveSAVI: UpdateRequest signalled2012-04-11 10:17:11 RemoveSAVI: About to wait for event Global\!$_SAVI_!$$!_EVENT_$!__Suspended2012-04-11 10:17:11 RemoveSAVI: WaitForSAVIEvent: Could not open memory mapped file Global\!$_SAVI_!$$!_MMMF_$!__2012-04-11 10:17:11 RemoveSAVI: Successfully waited for event Global\!$_SAVI_!$$!_EVENT_$!__Suspended2012-04-11 10:17:11 RemoveSAVI: Action succeeded2012-04-11 10:17:24 DeleteUserGroups: Action started2012-04-11 10:17:24 DeleteUserGroups: We are not a domain controller: Attempting to delete local user groups2012-04-11 10:17:26 DeleteUserGroups: Action succeeded2012-04-11 10:17:29 RollbackUpdateSavAdapterDll: Action started2012-04-11 10:17:29 RollbackUpdateSavAdapterDll: Action succeeded2012-04-11 10:17:29 DeleteOtherFiles: Action started2012-04-11 10:17:29 Error deleting file: C:\Program Files\Sophos\Sophos Anti-Virus\sophos_detoured.dll.stf00 with error: Toegang geweigerd..2012-04-11 10:17:30 DeleteOtherFiles: GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\sophos_detoured.dll detoured exists, proceeding to rename it & mark for delete.2012-04-11 10:17:30 DeleteOtherFiles: PROCESSOR_ARCHITECTURE environment variable is: x862012-04-11 10:17:30 DeleteOtherFiles: GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\detoured.dll does not exist, no further action.2012-04-11 10:17:30 DeleteOtherFiles: Deleting config file folder2012-04-11 10:17:30 DeleteOtherFiles: Failed to delete config folder, 22012-04-11 10:17:30 DeleteOtherFiles: Action succeeded2012-04-11 10:17:30 ForceDeleteFiles: Action started2012-04-11 10:17:30 ForceDeleteFiles: Error deleting DesktopMessaging registry key. Returned error was: Het systeem kan het opgegeven bestand niet vinden.
2012-04-11 10:17:30 ForceDeleteFiles: Action succeeded2012-04-11 10:17:31 RunErrorScripts: Action started2012-04-11 10:17:31 RunErrorScripts: Action succeeded2012-04-11 10:17:31 RestoreMovedFiles: Action started2012-04-11 10:17:31 RestoreMovedFiles: Action succeeded2012-04-11 10:17:31 SetUpdateFailed: Action started2012-04-11 10:17:31 SetUpdateFailed: Unable to create an instance of ComponentManager - SystemInformation cannot be informed of end of update2012-04-11 10:17:31 SetUpdateFailed: Action succeeded

I have removes Sophos from the client, but i keep the error message when i reinstall Sophos.