Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 1864 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cannot Install 9.5 " The MSI has failed"

Ron83

Hello Everyone,

I am struggling with getting sophos 9.5 to install on one of my clients.  It is a windows XPS SP3 machine. It had Sophos installed but quit updating all at once.  Looking at the log is says " Failed to install SAVXP: The MSI has failed".  I have tried removing all the sophos software and manually deleting every sophos folder I can find. I have tried pushing the install from the console, and installing manually.  I have also re-registered the windows installer service.  Does anyone have any ideas?  Thanks for any assistance you can give!!

I would post the install log, but its beyond the 20,000 character limit. However I read on the forum that the pertinent information is usually near the "value 3" lines so I have posted them below.

(Action=RollbackForceDeleteFiles,ActionType=1281,Source=BinaryData,Target=ForceDeleteFiles,CustomActionData=C:\Program Files\Sophos\Sophos Anti-Virus\)
MSI (s) (3C:D8) [14:22:46:640]: Executing op: ActionStart(Name=RollbackOtherFiles,,)
MSI (s) (3C:D8) [14:22:46:640]: Executing op: CustomActionSchedule(Action=RollbackOtherFiles,ActionType=1281,Source=BinaryData,Target=DeleteOtherFiles,CustomActionData=C:\Program Files\Sophos\Sophos Anti-Virus\)
MSI (s) (3C:D8) [14:22:46:656]: Executing op: ActionStart(Name=RollbackUpdateSavAdapterDll,,)
MSI (s) (3C:D8) [14:22:46:656]: Executing op: CustomActionSchedule(Action=RollbackUpdateSavAdapterDll,ActionType=1281,Source=BinaryData,Target=RollbackUpdateSavAdapterDll,CustomActionData=C:\Program Files\Sophos\Sophos Anti-Virus\)
MSI (s) (3C:D8) [14:22:46:656]: Executing op: ActionStart(Name=UpdateSavAdapterDll,,)
MSI (s) (3C:D8) [14:22:46:671]: Executing op: CustomActionSchedule(Action=UpdateSavAdapterDll,ActionType=1025,Source=BinaryData,Target=UpdateSavAdapterDll,)
MSI (s) (3C:20) [14:22:46:671]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI114.tmp, Entrypoint: UpdateSavAdapterDll
MSI (s) (3C:D8) [14:22:57:000]: Executing op: ActionStart(Name=CopyOtherFiles,,)
MSI (s) (3C:D8) [14:22:57:000]: Executing op: CustomActionSchedule(Action=CopyOtherFiles,ActionType=1025,Source=BinaryData,Target=CopyOtherFiles,CustomActionData="C:\Program Files\Sophos\Sophos Anti-Virus\""C:\Program Files\Sophos\AutoUpdate\cache\savxp\""XP")
MSI (s) (3C:BC) [14:22:57:015]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI115.tmp, Entrypoint: CopyOtherFiles
MSI (s) (3C:D8) [14:22:57:140]: Executing op: ActionStart(Name=RegisterBufferOverflowProtection,,)
MSI (s) (3C:D8) [14:22:57:140]: Executing op: CustomActionSchedule(Action=RegisterBufferOverflowProtection,ActionType=1025,Source=BinaryData,Target=RegisterBufferOverflowProtection,CustomActionData=C:\Program Files\Sophos\Sophos Anti-Virus\)
MSI (s) (3C:14) [14:22:57:156]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI116.tmp, Entrypoint: RegisterBufferOverflowProtection
MSI (s) (3C:D8) [14:22:57:218]: User policy value 'DisableRollback' is 0
MSI (s) (3C:D8) [14:22:57:218]: Machine policy value 'DisableRollback' is 0
Action ended 14:22:57: InstallFinalize. Return value 3.
MSI (s) (3C:D8) [14:22:57:234]: Executing op: Header(Signature=1397708873,Version=301,Timestamp=1045066452,LangId=1033,Platform=0,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)

MSI (s) (3C:D8) [14:22:58:703]: Executing op: ComponentUnregister(ComponentId={FE613E3D-0469-40F8-9A0F-635D16097928},ProductKey={9ACB414D-9347-40B6-A453-5EFB2DB59DFA},BinaryType=0,)
MSI (s) (3C:D8) [14:22:58:703]: Executing op: ComponentUnregister(ComponentId={3276B786-D941-4ABD-810D-5AE5E3106F02},ProductKey={9ACB414D-9347-40B6-A453-5EFB2DB59DFA},BinaryType=0,)
MSI (s) (3C:D8) [14:22:58:703]: Executing op: ComponentUnregister(ComponentId={F4E436FD-FE28-4278-86D5-E3412859F5E5},ProductKey={9ACB414D-9347-40B6-A453-5EFB2DB59DFA},BinaryType=0,)
MSI (s) (3C:D8) [14:22:58:703]: Executing op: ComponentUnregister(ComponentId={A153DC07-D119-4900-B5D1-F671EC25C7EB},ProductKey={9ACB414D-9347-40B6-A453-5EFB2DB59DFA},BinaryType=0,)
MSI (s) (3C:D8) [14:22:58:703]: Executing op: ComponentUnregister(ComponentId={D0457C5C-2602-48AF-9F0D-F73C1A499E8E},ProductKey={9ACB414D-9347-40B6-A453-5EFB2DB59DFA},BinaryType=0,)
MSI (s) (3C:D8) [14:22:58:703]: Executing op: ActionStart(Name=RunErrorScript,,)
MSI (s) (3C:D8) [14:22:58:703]: Executing op: CustomActionRollback(Action=RunErrorScript,ActionType=1345,Source=BinaryData,Target=RunErrorScripts,CustomActionData="C:\Program Files\Sophos\Sophos Anti-Virus\""C:\Program Files\Sophos\AutoUpdate\cache\savxp\""9.5.5")
MSI (s) (3C:10) [14:22:58:703]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI11A.tmp, Entrypoint: RunErrorScripts
MSI (s) (3C:D8) [14:22:58:750]: Executing op: ActionStart(Name=CheckRegForNullDACLs,,)
MSI (s) (3C:D8) [14:22:58:750]: Executing op: ActionStart(Name=RestoreMovedFiles,,)
MSI (s) (3C:D8) [14:22:58:750]: Executing op: CustomActionRollback(Action=RestoreMovedFiles,ActionType=1281,Source=BinaryData,Target=RestoreMovedFiles,CustomActionData=C:\Program Files\Sophos\Sophos Anti-Virus\)
MSI (s) (3C:30) [14:22:58:750]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI11B.tmp, Entrypoint: RestoreMovedFiles
MSI (s) (3C:D8) [14:22:58:781]: Executing op: ActionStart(Name=SetUpdateFailed,,)
MSI (s) (3C:D8) [14:22:58:781]: Executing op: CustomActionRollback(Action=SetUpdateFailed,ActionType=1281,Source=BinaryData,Target=SetUpdateFailed,)
MSI (s) (3C:74) [14:22:58:781]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI11C.tmp, Entrypoint: SetUpdateFailed
MSI (s) (3C:D8) [14:22:58:828]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (3C:D8) [14:22:58:828]: Error in rollback skipped.    Return: 5
MSI (s) (3C:D8) [14:22:58:828]: No System Restore sequence number for this installation.
MSI (s) (3C:D8) [14:22:58:828]: Unlocking Server
MSI (s) (3C:D8) [14:22:58:828]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 14:22:58: INSTALL. Return value 3.

:9005


This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    I wonder if:

    "2011-02-10 14:22:57 Error opening Windows key" and "2011-02-10 14:22:57 Failed to open the AppInit_DLLs key"

    are the problem.  In the MSI log you have:

    MSI (s) (3C:14) [14:22:57:156]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI116.tmp, Entrypoint: RegisterBufferOverflowProtection
    MSI (s) (3C 8) [14:22:57:218]: User policy value 'DisableRollback' is 0
    MSI (s) (3C 8) [14:22:57:218]: Machine policy value 'DisableRollback' is 0
    Action ended 14:22:57: InstallFinalize. Return value 3.

    So there is an "Return value 3" shortly following the custom action RegisterBufferOverflowProtection.  I can only assume this custom action is responsible for adding the AppInit registry key (This key is BOPS related (http://www.sophos.com/support/knowledgebase/article/112099.html)), namely:

    "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs"

    C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL

    I would suggest first of all checking the above key.  possibly the permissions on it, maybe clear out the key of previous entries that maybe Sophos related.  You could check the effective permissions on it for the system account.  I would assume that as AutoUpdate is installing SAV and this is being carried out by alupdate.exe running as system, system would be writing the key.

    If there is nothing obvious. I would suggest letting the install run through again but run Process Monitor (http://technet.microsoft.com/en-us/sysinternals/bb896645) at the same time to log all that the installer is doing.  In there you might see some errors such as "access denied", etc.

    Hope that helps.  

    Thanks,

    Jak

    :9013
Reply
  • 0

    Hi,

    I wonder if:

    "2011-02-10 14:22:57 Error opening Windows key" and "2011-02-10 14:22:57 Failed to open the AppInit_DLLs key"

    are the problem.  In the MSI log you have:

    MSI (s) (3C:14) [14:22:57:156]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI116.tmp, Entrypoint: RegisterBufferOverflowProtection
    MSI (s) (3C 8) [14:22:57:218]: User policy value 'DisableRollback' is 0
    MSI (s) (3C 8) [14:22:57:218]: Machine policy value 'DisableRollback' is 0
    Action ended 14:22:57: InstallFinalize. Return value 3.

    So there is an "Return value 3" shortly following the custom action RegisterBufferOverflowProtection.  I can only assume this custom action is responsible for adding the AppInit registry key (This key is BOPS related (http://www.sophos.com/support/knowledgebase/article/112099.html)), namely:

    "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs"

    C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL

    I would suggest first of all checking the above key.  possibly the permissions on it, maybe clear out the key of previous entries that maybe Sophos related.  You could check the effective permissions on it for the system account.  I would assume that as AutoUpdate is installing SAV and this is being carried out by alupdate.exe running as system, system would be writing the key.

    If there is nothing obvious. I would suggest letting the install run through again but run Process Monitor (http://technet.microsoft.com/en-us/sysinternals/bb896645) at the same time to log all that the installer is doing.  In there you might see some errors such as "access denied", etc.

    Hope that helps.  

    Thanks,

    Jak

    :9013
Children
No Data