Upgrade from Endpoint 10.0 to 10.3 fail

Hello jsfrenette,

please check the uninstall log (C:\WINDOWS\TEMP\Sophos Anti-Virus Uninstall log.txt). I have seen a few cases where the uninstall source couldn't be found. Normally it uses the cached package in C:\WINDOWS\Installer\. If it is missing, the uninstall fails.

If you can't find an appropriate .msi (must match the 10.0 install on the problem machines) on another computer (you can change the name) then the Fix It tool might help. Revert the Endpoint to the 10.0 updating policy and wait for a successful install. Disable AutoUpdate. Use the tool to "uninstall" (actually it just removes the Installer information) Sophos Anti-Virus. Enable AutoUpdate - this should reinstall 10.0 and cache the .msi. After that the upgrade should work.

Christian

I've checked and there's no msi in the folder c:\windows\installer\{9ACB414D-9347-40B6-A453-5EFB2DB59DFA}. Looking at other computer that haven't received the update yet, they don't have it either. Just a bunch of shortcut and 2 .exe (arpproduction.exe and MainGUIShortcut1.exe".

The uninstall log doesn't say much:

=== Verbose logging started: 2014-11-18  08:32:07  Build type: SHIP UNICODE 5.00.7601.00  Calling process: C:\WINDOWS\SysWOW64\msiexec.exe ===
MSI (c) (FC:C0) [08:32:07:330]: Resetting cached policy values
MSI (c) (FC:C0) [08:32:07:330]: Machine policy value 'Debug' is 0
MSI (c) (FC:C0) [08:32:07:330]: ******* RunEngine:
           ******* Product: {9ACB414D-9347-40B6-A453-5EFB2DB59DFA}
           ******* Action: 
           ******* CommandLine: **********
MSI (c) (FC:C0) [08:32:07:330]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (FC:C0) [08:32:07:330]: Grabbed execution mutex.
MSI (c) (FC:C0) [08:32:07:340]: Cloaking enabled.
MSI (c) (FC:C0) [08:32:07:340]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (FC:C0) [08:32:07:340]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (c) (FC:C0) [08:32:07:340]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (FC:C0) [08:32:07:340]: MainEngineThread is returning 1618
=== Verbose logging stopped: 2014-11-18  08:32:07 ===

and that's from Sophos Anti-Virus Major Install Log

2014-11-18 08:32:05 Info: Logging started: installing/upgrading Sophos Anti-Virus
2014-11-18 08:32:05 Info: InstallFromPath is: C:\ProgramData\Sophos\AutoUpdate\cache\savxp2014-11-18 08:32:05 Info: InstallToPath is: 
2014-11-18 08:32:05 Info: Detected version of SAV has major version number: 10
2014-11-18 08:32:05 Info: Detected version of SAV has minor version number: 0
2014-11-18 08:32:05 Info: registryInstallTo [overriding InstallToPath] is: C:\Program Files (x86)\Sophos\Sophos Anti-Virus2014-11-18 08:32:05 Checking for problem versions of SAVI - Install path:C:\Program Files (x86)\Sophos\Sophos Anti-Virus2014-11-18 08:32:05 Veex.dll version '3.55.0.2163'
2014-11-18 08:32:05 INFO: Checking the validity of the VDL manifest file.
2014-11-18 08:32:05 INFO: The manifest file has been successfully validated.
2014-11-18 08:32:05 Info: Error parsing catalogue file - doing a full update
2014-11-18 08:32:05 PROCESSOR_ARCHITECTURE environment variable is: AMD64
2014-11-18 08:32:05 CompareDriverVersions: savonaccessdriv.inf old: 3.21.10.299(01/27/2012) new: 3.23.0.0(06/07/2013)
2014-11-18 08:32:05 CompareDriverVersions: sophosbootdriver.inf old: 1.0.0.101(05/22/2008) new: 1.1.0.0(06/07/2013)
2014-11-18 08:32:05 CompareDriverVersions: sdcfilter.inf old: 1.1.0.274(05/23/2011) new: 1.2.0.0(06/07/2013)
2014-11-18 08:32:05 Info: Managed install
2014-11-18 08:32:05 Info: Performing major update of Sophos Anti-Virus using msi.
2014-11-18 08:32:05 Info: Update is signalled.
2014-11-18 08:32:05 In KB2918614Workaround().
2014-11-18 08:32:05 Leaving KB2918614Workaround().
2014-11-18 08:32:06 Product code of SAV currently installed: {9ACB414D-9347-40B6-A453-5EFB2DB59DFA}
2014-11-18 08:32:06 Product code of SAV to be installed:     {D929B3B5-56C6-46CC-B3A3-A1A784CBB8E4}
2014-11-18 08:32:06 ProductCode change detected
2014-11-18 08:32:06 Info: Detected an older version of SAV, version 10. Doing a major update.
2014-11-18 08:32:06 Info: Set Update Begin
2014-11-18 08:32:06 Info: Stop SAVService
2014-11-18 08:32:06 Info: Convert boot tasks
2014-11-18 08:32:06 Info: CopyFilesToTemp
2014-11-18 08:32:06 Info: Rename user groups
2014-11-18 08:32:06 INFO: Copy group SophosAdministrator to SophosAdministratorTmpRn
2014-11-18 08:32:06 INFO: Copy group SophosPowerUser to SophosPowerUserTmpRn
2014-11-18 08:32:07 INFO: Copy group SophosOnAccess to SophosOnAccessTmpRn
2014-11-18 08:32:07 INFO: Copy group SophosUser to SophosUserTmpRn
2014-11-18 08:32:07 Info: Uninstall old SAV
2014-11-18 08:32:07 Info: Running Uninstall of previous version using command line: msiexec.exe /x {9ACB414D-9347-40B6-A453-5EFB2DB59DFA} REBOOT=ReallySuppress /qn UNINSTALLDRIVERS=1 UNINSTALLCLASSFILTER=0 UNINSTALLBOOTDRIVERS=1 UNINSTALLKMSDRIVERS=1 CHECKFORSCF=0  INSTALLINGVERSION="10.3.11" /Lvp "C:\WINDOWS\TEMP\Sophos Anti-Virus Uninstall log.txt"
2014-11-18 08:32:07 Info: Finished waiting for Uninstallation of previous version. Status returned was 0l.
2014-11-18 08:32:07 Info: Detected version of SAV has major version number: 10
2014-11-18 08:32:07 ERROR: Uninstall of SAV, version = 10, succeeded but IsSAVInstalled is true (10).
2014-11-18 08:32:07 Info: Restore user groups
2014-11-18 08:32:07 Warning: Failed to rename a temp group, continuing (0x80004005)
2014-11-18 08:32:07 ERROR: Upgrade failure
2014-11-18 08:32:07 Info: Set Update Failed

 I'm in the process of changing the version to v10 like it was before. Right now, the computer have sophos installed but disabled, and we can't enabled it.

Thank you

Here's a followup. I just reinstalled 10.0 with success. But there's still no msi in the installation folder.

Tried again to install 10.3 recommended and fail with same error

Hello jsfrenette,

if an Uninstall is (about to be) performed the log says something like:

           ******* Product: {9ACB414D-9347-40B6-A453-5EFB2DB59DFA}
           ******* Action: 
           ******* CommandLine: **********
MSI (s) (00:AC) [13:25:59:515]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (00:AC) [13:25:59:515]: Warning: Local cached package 'C:\WINDOWS\Installer\24af3969.msi' is missing.

the last line of course only if there is an error. The cached .msi has a random name and is in C:\Windows\Installer\.

The Uninstall log you've posted says: MainEngineThread is returning 1618 which indicates that another installer process is already running.

Christian

Yeah, I found out it was a random name and not a particulate folder. For the computer that had this error, a reboot fixed the problem. I'll check if I still have the other error, which isn't the same error code. I still have about 800 computer out of 4000 that didn't upgrade yet...

Thank you

Hello jsfrenette,

feel free to post details of the other error.

Christian