Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 1 subscriber
  • Views 1083 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Failed Upgrade 9.5 to 9.7 - error 00000067 (and 80041f02)

QC

When I switched to 9.7 I found that several computers failed to update/upgrade with message: 00000067  Failed to install SAVXP: A product could not be installed because another product with the same function is already installed . 

Following the link in SEC (or searching the knowledgebase for 00000067) you end with a number of articles and the applicable is hard to spot. Searching for "product with the same function" gives better results and leads to article 33554. Although it mentions W2k3 SBS as OS it applies to all Windows versions.

I had a long exchange with Support (case 2861234 ) and the results are not completely satisfactory . Code 80041f02 indicates a competitor product which prevents the installation. This was somewhat surprising as no such software has been installed on the clients for more than a year. Also the 9.5 updates worked without problems. In several cases the offending product has been on the machine since at least 5 (five!) years.

While CRT runs before the initial install and can remove most of the competitor products there is another "internal" check which runs whenever and upgrade install is done (the reason is obvious: detect new installs of possibly conflicting software) - but it doesn't remove the detected products. It seems that with 9.7 quite a number of items have been added to this list - and some of them for rather old versions so that products are flagged (and prevent the upgrade) which co-existed with SESC/SAV literally for years (since at least 7.6).

If you can use Protect Computers (or script an install) CRT will probably remove these products. As this is not always feasible (e.g. remote computers) you have to provide a 9.5 CID for them until you can resolve the issue. Note that when the upgrade fails threat detection data is also not updated.

Can't say if this is really a problem for most of you though - OTOH after many years now, with 9.7, this is the first time I've encountered this issue.

Christian

:15811


This thread was automatically locked due to age.
Parents
  • 0

    Thank you, ruckus, for looking into this case and updating the article (to which perhaps some explanation could be added).

    ruckus wrote:
    I've also (tried) to read through your support case (the english parts :smileywink:) and can see that the cause is somewhat unexplained.

    Feel free to ask for a translation of the customer's input by the author :smileywink:

    ruckus wrote:
    I mention this only to highlight that it is possible to install two anti-virus products side-by-side *if* the second one isn't on the look out for existing AV software. [...]
    My thoughts on how the issue occurred:  (1) McAfee was installed after Sophos and the two have been running for a while before the 9.7 upgrade occurred or (2) The CRT did not run on these computers or (3) We added a new detection into the CRT to remove the currently installed version of McAfee or (4) The Sophos AutoUpdate check was manually bypassed (as can be done with a couple of registry keys).

     I can rule out (2) and (4):

    For (2) it is very unlikely that the users fiddled with the installer or ran setup.exe directly from the share and unchecked CRT in the GUI. If they did so they'd also have to set the correct value for the -G flag (which we use) - otherwise the computers would have appeared in the Unassigned group.

    If they'd used the registry keys to bypass CRT they'd have to remove them afterwards as they are not present in the SDU logs.

    For a number of computers (1) is indeed the case. Now according to the Uninstall keys of one of these McAfee has been installed 2010-03-26 - as 9.5 has been released mid-2010 9.0 was installed at this time.

    For a large group (where I've initially detected this issue) even (1) doesn't apply. According to the uninstall keys the "offending" product has been installed early 2007 (and it was OEM pre-installed) and obviously quite a number of Sophos versions didn't complain.

    ruckus wrote:
    Since Sophos AutoUpdate doesn't want to degrade the machine's performance by letting two anti-virus products run on the same computer we designed our installer to error out

    Apart from the cases where indeed (1) applies it's (3) for the rest. While I agree with the approach I have some reservations with the actual implementation:

    (a) It is understandable that some time passes from introduction of a new product to inclusion in the CRT lists (both the explicit CRT and the SAV installer internal). But I think they should be updated more frequently than with major version changes (especially the "internal" detect-only).

    (b) Nowadays the ("internal") SAV installer check is almost forgotten - it should be made clearer that it still exists and is important (that's what I'd like to see at least added to 33554, but maybe it should also mentioned in the UG)

    (c) It looks like some generic or catch-all keys have been added in 9.7 which cause the existence of ancient products (or product "shells") to get bemoaned. If these keys have been introduced to "pro-actively" detect also newer version this is a significant change to the logic - but maybe it is just a side-effect. That's why I asked for an explanation (and if I understand you correctly you too think is has not yet been given).

    Again, thanks

    Christian

    :15827
Reply
  • 0

    Thank you, ruckus, for looking into this case and updating the article (to which perhaps some explanation could be added).

    ruckus wrote:
    I've also (tried) to read through your support case (the english parts :smileywink:) and can see that the cause is somewhat unexplained.

    Feel free to ask for a translation of the customer's input by the author :smileywink:

    ruckus wrote:
    I mention this only to highlight that it is possible to install two anti-virus products side-by-side *if* the second one isn't on the look out for existing AV software. [...]
    My thoughts on how the issue occurred:  (1) McAfee was installed after Sophos and the two have been running for a while before the 9.7 upgrade occurred or (2) The CRT did not run on these computers or (3) We added a new detection into the CRT to remove the currently installed version of McAfee or (4) The Sophos AutoUpdate check was manually bypassed (as can be done with a couple of registry keys).

     I can rule out (2) and (4):

    For (2) it is very unlikely that the users fiddled with the installer or ran setup.exe directly from the share and unchecked CRT in the GUI. If they did so they'd also have to set the correct value for the -G flag (which we use) - otherwise the computers would have appeared in the Unassigned group.

    If they'd used the registry keys to bypass CRT they'd have to remove them afterwards as they are not present in the SDU logs.

    For a number of computers (1) is indeed the case. Now according to the Uninstall keys of one of these McAfee has been installed 2010-03-26 - as 9.5 has been released mid-2010 9.0 was installed at this time.

    For a large group (where I've initially detected this issue) even (1) doesn't apply. According to the uninstall keys the "offending" product has been installed early 2007 (and it was OEM pre-installed) and obviously quite a number of Sophos versions didn't complain.

    ruckus wrote:
    Since Sophos AutoUpdate doesn't want to degrade the machine's performance by letting two anti-virus products run on the same computer we designed our installer to error out

    Apart from the cases where indeed (1) applies it's (3) for the rest. While I agree with the approach I have some reservations with the actual implementation:

    (a) It is understandable that some time passes from introduction of a new product to inclusion in the CRT lists (both the explicit CRT and the SAV installer internal). But I think they should be updated more frequently than with major version changes (especially the "internal" detect-only).

    (b) Nowadays the ("internal") SAV installer check is almost forgotten - it should be made clearer that it still exists and is important (that's what I'd like to see at least added to 33554, but maybe it should also mentioned in the UG)

    (c) It looks like some generic or catch-all keys have been added in 9.7 which cause the existence of ancient products (or product "shells") to get bemoaned. If these keys have been introduced to "pro-actively" detect also newer version this is a significant change to the logic - but maybe it is just a side-effect. That's why I asked for an explanation (and if I understand you correctly you too think is has not yet been given).

    Again, thanks

    Christian

    :15827
Children
No Data