An upgrade or an uninstall of Sophos Endpoint Security Control fails with the following error displayed in the console:
Failed to install SAVXP: A previous version could not be uninstalled
The Sophos Anti-Virus Install Log_xxxxxxx.txt on the affected endpoint you find the text at different points:
Warning: Local cached package 'C:\WINDOWS\Installer\xxxxxxxx.msi' is missing.
SOURCEMGMT: Trying source C:\Program Files\Sophos\AutoUpdate\cache\savxp\.
Note: 1: 2203 2: C:\Program Files\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi 3: -2147287037
SOURCEMGMT: Source is invalid due to missing/inaccessible package.
MainEngineThread is returning 1610
MainEngineThread is returning 1612
Attempting the uninstall the product results in the following dialogue(s):
The feature you are trying to use is on a network resource that is unavailable
The installation source for this product is not available. Verify that the source exists and that you can access it
The path 'C:\Program Files\Sophos\AutoUpdate\Cache\savxp\Sophos Anti-Virus.msi' cannot be found. Verify that you have access to this location and try again, or try to find the installation package 'Sophos Anti-Virus.msi' in a folder from which you can install the product Sophos Anti-Virus
First seen in
Sophos Endpoint Security and Control 9.0
The problem occurs when the following conditions are true:
C:\Windows\Installer cached copy of the MSI is missing
- The installation source path is missing, typically this is one of the following locations:
- 2000 to 2003:
- Vista and above:
This scenario can occur if of Sophos AutoUpdate is uninstalled before any other Sophos component or when third party disk cleanup tools remove files from
What To Do
- If the Microsoft Installer (MSI) cache and the source path for Sophos are missing on the endpoint, the original installing MSI must be located to uninstall successfully.
- If an MSI cannot be located on the endpoint or on a server, you may be able to locate on another computer with the same version installed.
- If all attempts to locate the correct MSI fail, a tool can be used to remove the problematic component.
Stage 1: Determine the version of Sophos installed on the endpoint
You need to determine the exact Sophos component and version that is failing to be removed. You can do this either from the Windows Control Panel or via a command prompt.
Note: If you already know which Sophos component and version that is failing to uninstall (e.g., Sophos Anti-Virus (SAV) v9.7, Sophos AutoUpdate (SAU) v2.5.x, etc.) move to stage 2.
From Control Panel
- Open the Add/Remove Programs (Programs and Features) in the Windows Control Panel (Start | Run | Type:
appwiz.cpl | Press return).
- In the installed programs list, select the Sophos application that failing to uninstall or upgrade, note the version from the ‘Version’ column.
From the command line
- Open a command prompt (Start | Run | Type: cmd.exe | Press return).
- Type the following command:
wmic /output:Sophos_All_Installed.txt product where "Caption like 'Sophos%'"
- Open the
Sophos_All_Installed.txt file in a text editor. Each Sophos application and all of it's installation details will be listed horizontally towards the end of the file.
- In the ‘Version’ column note the version of SAV and any other components failing to remove.
Stage 2: Locate a matching version of Sophos
You need to locate a matching version of the Sophos endpoint package in order to uninstall successfully using one of the following methods described below.
From the currently subscribed packages in Sophos Update Manager
- Open the Sophos Console and from the dropdown menu select View | Update managers.
- For each subscription, right click and select ‘View/Edit Subscription’, select details on the Windows package current subscribed.
- Compare the version number for the Sophos component captured in point 3 on the endpoint. If you find a matching version: record the version of SAV in this package. Go to the next section if you do not find any matches.
- Go to Endpoints, select View from the drop down menu, select Bootstrap Locations, using the SAV version captured from the endpoint, navigate to the path in the corresponding Location field.
- Open the sub-folder of the component that is failing to uninstall on the endpoint, typically:
- Right click on the MSI file contained in the folder and select the option 'Uninstall'.
From another Sophos endpoint in the Sophos Console
- Open the Sophos Console in the Endpoints view.
- Select the highest level group (normally the server name).
- Select the Anti-virus Details tab, from here sort by Anti-virus version.
- Locate another endpoint with the same version as the original problem computer.
- On this identified computer, navigate to the following location:
Open the sub-folder of the component that is failing to uninstall on the endpoint, typically: savxp, sau, scf or rms. Copy the MSI file within this folder to the computer that fails to uninstall a component. On the computer that fails to uninstall a component, right-click on the MSI file contained in the folder and select the option 'Uninstall'.
- XP to 2003 (x86):
- XP to 2003 (x64):
C:\Program Files (x86)\Sophos\AutoUpdate\Cache\
- Vista and above (x86 and x64):
What to do if you cannot locate a matching version on your network
KBA 118140 details how to capture the state of the Sophos endpoint installation with Sophos Diagnose, then resolve a problematic upgrade/uninstall, allowing a reinstall to succeed.