Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 1 subscriber
  • Views 7972 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Client pc won't update

Jvuz

I tried to install Sophos on a client pc via the console. It didn't work completely because of the following error message: Failed to install SAVXP. The MSI has failed.

I got the following log from that pc:

12.05.2011 10:20:33 0CD4 I SOF: C:\Documents and Settings\All Users\Application Data/Sophos/Remote Management System/3/Agent/Logs/Agent-20110512-082033.log
12.05.2011 10:20:33 0CD4 I Sophos Management Agent 3.3.0.2059 starting...
12.05.2011 10:20:33 08E8 I SAUAdapter - SAU IPCBase::IPCBase: Connected to shared memory A32951C539924a12B3C8F2FDA5A268E4
12.05.2011 10:20:33 0FEC I SAUAdapter - SAU IPCListener::Wait started
12.05.2011 10:20:33 0FEC I SAUAdapter - SAU IPCListener::Wait received message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSStartUpdate" />
12.05.2011 10:20:33 08D8 I SAUAdapter - SAU AdapterImpl: Notifying agent of configuration change
12.05.2011 10:20:33 08D8 I SAUAdapter - SAU AdapterImpl: Notifying agent of status change: <?xml version="1.0" encoding="utf-8" ?><status xmlns="com.sophos\mansys\status" type="sau"><CompRes 

xmlns="com.sophos\msys\csc" Res="NoRef" policyType="1" /><autoUpdate xmlns="http://www.sophos.com/xml/mansys/AutoUpdateStatus.xsd"><endpoint id="92d3861c-3676-485e-84da-b5379623e5c8" 

/></autoUpdate></status>
12.05.2011 10:20:33 08E8 E Services::GetAdapterData(), data item name SAUPolicy is unknown
12.05.2011 10:20:33 0FEC I SAUAdapter - SAU StartingUpdate has been set
12.05.2011 10:20:33 0FEC I SAUAdapter - SAU IPCListener::Wait Waiting for more messages
12.05.2011 10:20:33 0FEC I SAUAdapter - SAU IPCListener::Wait Waiting for more messages
12.05.2011 10:20:33 08E8 I SAUAdapter - SAU Intelligent updating using port 51235
12.05.2011 10:20:33 08E8 I SAUAdapter - SAU Returning Adapter: 00D53978
12.05.2011 10:20:33 08E8 I SAUAdapter - SAU RegisterStateObserver : 00D53900
12.05.2011 10:20:33 08E8 I SAUAdapter - SAU RegisterConfigStateObserver : 00D53904
12.05.2011 10:20:33 08E8 I SAUAdapter - SAU RegisterEventObserver : 00D53928
12.05.2011 10:20:33 08E8 I ALC adapter loaded
12.05.2011 10:20:37 0F8C W MSClient::Connect: failed to get router's IOR from supplied address and port.
12.05.2011 10:20:37 0F8C E NoRouterIORException: Caught MSClient::Connect: failed to get router's IOR from supplied address and port.
 ClientConnection::Reconnect()

12.05.2011 10:20:43 0F8C I Sent certificate request to CM.
12.05.2011 10:20:44 0F8C I Received certification response with correct correlation ID.
12.05.2011 10:20:44 0F8C I Stored certificate received from CM.
12.05.2011 10:20:45 083C I Connected to router...
12.05.2011 10:20:45 0488 I SAUAdapter - SAU AdapterImpl::GetStatus called
12.05.2011 10:20:45 0488 I SAUAdapter - SAU AdapterImpl::GetConfiguration called
12.05.2011 10:20:45 0AF0 I Got EM-NotifyClientUpdates-Reply message from Router$PC13-158:99013
12.05.2011 10:20:45 0AF0 I Got EM-GetClientStatus-Reply message from Router$PC13-158:99013
12.05.2011 10:20:59 08E8 E AdapterManager::LoadAdapter : Failed to open shared library C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdapter.dll for SAV
12.05.2011 10:20:59 08E8 E Ouch!dll.open: No error!
12.05.2011 10:20:59 08E8 E AdapterManager::LoadAdapter : Failed to open shared library C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdapter.dll for SAV
12.05.2011 10:20:59 08E8 E Ouch!dll.open: No error!
12.05.2011 10:21:02 0FEC I SAUAdapter - SAU IPCListener::Wait received message: <?xml version="1.0" encoding="utf-8" ?><Config 

type="RMSEndUpdate"><ErrorMessage><ID>Install.Failure</ID><StringID>103</StringID><Sender>ALUpdate</Sender><Insert>SAVXP</Insert><Insert>80041f09</Insert></ErrorMessage></Config>
12.05.2011 10:21:02 0FEC I SAUAdapter - SAU ReportError(103): 
12.05.2011 10:21:02 0FEC I SAUAdapter - SAU FinishedUpdate has been set
12.05.2011 10:21:02 0FEC I SAUAdapter - SAU AdapterImpl:: Notifing agent of xml change: <?xml version="1.0" encoding="utf-8" ?><event xmlns="http://www.sophos.com/EE/AUEvent" 

type="sophos.mgt.entityAppEvent"><timestamp>20110512 

082102</timestamp><user><userId></userId><domain></domain></user><appInfo><number>103</number><message><message_inserts><insert>SAVXP</insert><insert>80041f09</insert><insert></insert><insert></inser

t><insert></insert></message_inserts></message></appInfo><entityInfo xmlns="http://www.sophos.com/EntityInfo">AGENT:WIN:1.0.0</entityInfo></event>
12.05.2011 10:21:02 0FEC I ALC event observer received an event: <?xml version="1.0" encoding="utf-8" ?><event xmlns="http://www.sophos.com/EE/AUEvent" 

type="sophos.mgt.entityAppEvent"><timestamp>20110512 

082102</timestamp><user><userId></userId><domain></domain></user><appInfo><number>103</number><message><message_inserts><insert>SAVXP</insert><insert>80041f09</insert><insert></insert><insert></inser

t><insert></insert></message_inserts></message></appInfo><entityInfo xmlns="http://www.sophos.com/EntityInfo">AGENT:WIN:1.0.0</entityInfo></event>
12.05.2011 10:21:02 0488 I computer name is PC13-158
12.05.2011 10:21:02 0FEC I SAUAdapter - SAU Update status information saved to C:\Program Files\Sophos\AutoUpdate\data\status\AUAdapter.xml
12.05.2011 10:21:02 0FEC I SAUAdapter - SAU IPCListener::Wait Waiting for more messages
12.05.2011 10:21:02 0488 I This computer is part of the domain RBINS
12.05.2011 10:21:02 0488 I workgroup/domain name is RBINS
12.05.2011 10:21:02 0488 I NewEvent: Sent EM-EntityEvent to EM
12.05.2011 10:21:05 0488 I computer name is PC13-158
12.05.2011 10:21:05 0488 I This computer is part of the domain RBINS
12.05.2011 10:21:05 0488 I workgroup/domain name is RBINS
12.05.2011 10:21:05 0488 I computer description is Stagiaire PFO
12.05.2011 10:21:05 0488 I SendStatus: Sent EM-GetStatus-Reply (id=01CB9871) to EM
12.05.2011 10:21:05 0AF0 I Got EM-SetConfiguration message from Router$PC20-121.EM
12.05.2011 10:21:05 0488 I Received configuration for ALC
12.05.2011 10:21:05 0488 I SAUAdapter - SAU Intelligent updating using port 51235
12.05.2011 10:21:05 0488 I SAUAdapter - SAU AdapterImpl::SetConfiguration: Configuration applied
12.05.2011 10:21:05 0488 I SAUAdapter - SAU SAUPolicy::Save
12.05.2011 10:21:05 0488 I SAUAdapter - SAU SAUPolicy::Save successful
12.05.2011 10:21:06 08C8 I SAUAdapter - SAU AdapterImpl: Notifying agent of configuration change
12.05.2011 10:21:06 08C8 I ALC state observer received a configuration
12.05.2011 10:21:06 08C8 I SAUAdapter - SAU AdapterImpl: Notifying agent of status change: <?xml version="1.0" encoding="utf-8" ?><status xmlns="com.sophos\mansys\status" type="sau"><CompRes 

xmlns="com.sophos\msys\csc" Res="Same" RevID="{CF951F0A-0B67-425C-AC4E-04EA1F0DB56D}" policyType="1" /><autoUpdate xmlns="http://www.sophos.com/xml/mansys/AutoUpdateStatus.xsd"><endpoint 

id="92d3861c-3676-485e-84da-b5379623e5c8" /></autoUpdate></status>
12.05.2011 10:21:06 08C8 I ALC state observer notified that ALC is running
12.05.2011 10:21:06 08C8 I ALC state observer received a status: <?xml version="1.0" encoding="utf-8" ?><status xmlns="com.sophos\mansys\status" type="sau"><CompRes xmlns="com.sophos\msys\csc" 

Res="Same" RevID="{CF951F0A-0B67-425C-AC4E-04EA1F0DB56D}" policyType="1" /><autoUpdate xmlns="http://www.sophos.com/xml/mansys/AutoUpdateStatus.xsd"><endpoint id="92d3861c-3676-485e-84da-

b5379623e5c8" /></autoUpdate></status>
12.05.2011 10:21:17 0894 I Windows is shutting down...
12.05.2011 10:21:17 0CD4 I Shutting down...
12.05.2011 10:21:20 0CD4 I SAUAdapter - SAU DeRegisterStateObserver : 00D53900
12.05.2011 10:21:20 0CD4 I SAUAdapter - SAU DeRegisterConfigStateObserver : 00D53904
12.05.2011 10:21:20 0CD4 I SAUAdapter - SAU DeRegisterEventObserver : 00D53928
12.05.2011 10:21:20 0CD4 I SAUAdapter - SAU Adapter is being deleted: 00D53978
12.05.2011 10:21:20 0CD4 I SAUAdapter - SAU ~AdapterImpl
12.05.2011 10:21:20 0CD4 I SAUAdapter - SAU SAUPolicy::Save
12.05.2011 10:21:20 0CD4 I SAUAdapter - SAU SAUPolicy::Save successful
12.05.2011 10:21:20 0CD4 I SAUAdapter - SAU Update status information saved to C:\Program Files\Sophos\AutoUpdate\data\status\AUAdapter.xml
12.05.2011 10:21:20 0FEC I SAUAdapter - SAU IPCListener::Wait exiting

 Can you see what the problem is?

Jvuz

:12899


This thread was automatically locked due to age.
  • 0

    Hello Jvuz,

    detailed information on the failure should be in the in the Sophos Anti-Virus Install Log or Sophos Anti-Virus CustomActions Log in %Windir%\Temp.

    Christian

    :12903
  • 0

    Hello Christian,

    and which one would you need: the first one or the latest one, or all?

    Jo

    :12905
  • 0

    This is the latest customaction log:

    2011-05-12 11:30:04 Starting competitor detection...
2011-05-12 11:30:04 Enumerating competitor uninstall keys...
2011-05-12 11:30:04 PROCESSOR_ARCHITECTURE environment variable is: x86
2011-05-12 11:30:05 Boot driver: not installed.
2011-05-12 11:30:09 Setting class filter present property to: 0
2011-05-12 11:30:09 PROCESSOR_ARCHITECTURE environment variable is: x86
2011-05-12 11:30:15 WaitForSAVService: Walking system processes...
2011-05-12 11:30:15 WaitForSAVService: Finished walking system processes.
2011-05-12 11:30:15 IsServiceInstalled: Unable to get a handle to requested service SAVOnAccess control. Returning false.
2011-05-12 11:30:17 IsServiceInstalled: Unable to get a handle to requested service SAVOnAccess filter. Returning false.
2011-05-12 11:30:28 CopyOtherFiles custom action - Copying other driver files
2011-05-12 11:30:28 Copying class filter source: C:\Program Files\Sophos\AutoUpdate\cache\savxp\classfilterdrivers\i386\SDCFILTER.INF, target: C:\Program Files\Sophos\Sophos Anti-Virus2011-05-12 11:30:28 Copying kms source: C:\Program Files\Sophos\AutoUpdate\cache\savxp\drivers\i386\SKMSCAN.INF, target: C:\Program Files\Sophos\Sophos Anti-Virus2011-05-12 11:30:28 GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\sophos_detoured.dll does not exist, no further action.
2011-05-12 11:30:28 PROCESSOR_ARCHITECTURE environment variable is: x86
2011-05-12 11:30:28 Error opening Windows key
2011-05-12 11:30:28 GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\detoured.dll does not exist, no further action.
2011-05-12 11:30:28 Failed to open the AppInit_DLLs key
2011-05-12 11:30:29 GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\sophos_detoured.dll detoured exists, proceeding to rename it & mark for delete.
2011-05-12 11:30:29 PROCESSOR_ARCHITECTURE environment variable is: x86
2011-05-12 11:30:29 GetRidOfExistingDetoured - C:\Program Files\Sophos\Sophos Anti-Virus\detoured.dll does not exist, no further action.
2011-05-12 11:30:29 Deleting config file folder
2011-05-12 11:30:29 Failed to delete config folder, 2
2011-05-12 11:30:29 Error deleting DesktopMessaging registry key. Returned error was: The system cannot find the file specified.

2011-05-12 11:30:29 RestoreMovedFiles(): Unexpected error 0x00000003 when looking for temporary files
2011-05-12 11:30:29 Unable to create an instance of ComponentManager - SystemInformation cannot be informed of end of update

     Can this help?

    :12907
  • 0

    Thanks, Jvuz

    I assume the errors here are only the result of a failure earlier during install. To make sure - could you please search for return value 3 from the bottom of the install log upwards and post the lines above (if you can't make out an error take 30 or so). Check if there are more return value 3 lines and if, do the same.

    Christian

    :12913
  • 0

    I've found the "return value 3" in here. Would you be so kind to look for the return value 3, I'm not sure what to look for. Thanks,

    Jo

    :12915
  • 0

    From the messages in CustomActions log I can't glean  what's there and what's not. Was this a fresh install or did the client have a previous version installed? Does the C:\Program Files\Sophos\Sophos Anti-Virus\ folder exist, what's in it? Can you open the key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows and does it contain a value AppInit_DLLs ?

    Christian

    :12917
  • 0

    Christian,

    this is the log from the first attempt (via the console):

    Install from:[C:\Program Files\Sophos\AutoUpdate\cache\rms]
Install to  :[(null)]
MsiPackagePath: [C:\Program Files\Sophos\AutoUpdate\cache\rms\Sophos Remote Management System.msi].
Result from creating ISauConfig2: [0].
RMS: Current product is not installed.
RMS: Setup Plugin running MsiInstallProduct(C:\Program Files\Sophos\AutoUpdate\cache\rms\Sophos Remote Management System.msi, 
                                            REBOOT=ReallySuppress ALLUSERS=1 SOPHOS_TP_TOKEN=1 TRANSFORMS=1036.mst)

     This is the log after I tried to install it manually (using the unc path to the server):

     The pc just has the c:\program files\sophos, there is no folder Sophos Anti-Virus in it. And I tried to access the registry on that computer remotely, which wasn't a problem, only while trying to connect to the Windows  in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion . I'll try to check tomorrom morning.

    :12919
  • 0

    Christian,

    i checked teh programs files folder and there is no folder Sophos Anti-virus. Also in the registry, Ican open HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows but there is nothing in it

    What should I do?

    Jo

    :12943
  • 0

    Jo,

    in the registry key ... is nothing Strange that this key should be empty. Sophos wants to create or modify the value AppInit_DLLs but there should be some other values. Permissions on this key are not inherited and include SYSTEM and Administrators full access.

    Can't say if the error is with the key though. Checked two of our installs and after the Copying kms source in the CustomActions log I see GetRidOfExistingDetoured ... detoured exists whereas in the log you posted it says does not exist. As I haven't seen a similar problem I only can suggest you call Support. I'd try one thing before - empty the C:\Program Files\Sophos\AutoUpdate\cache\ folder and request an update (or wait for AutoUpdate's next attempt).

    Christian

    :12945
  • 0

    I checked add/remove programs and I saw only Sophos autoupdate and remote management system. Sophos didn't get installed. When I tried to install just the sophos antivirus msi,  the installer didn't finished. I got this message: The wizard was interrupted before sophos antivirus could be completely installed . It seems there is a problem on that pc. If I don't get it solved, I need to reinstall the pc :(

    :12979