Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Cb Defense: Sensor Reinstall Fails With Message "A newer or current version of Cb Defense Sensor 64-bit is already installed"

Cb Defense: Sensor Reinstall Fails With Message "A newer or current version of Cb Defense Sensor 64-bit is already installed"

Environment

  • Cb Defense Sensor: All Versions
  • Microsoft Windows: All Supported Versions
  • Cb Defense Sensor uninstalled
  • Sensor Removal Tool has been run 
  • Subsequent install attempts fail

Symptoms

The verbose MSI log (/L*vx) may show the following message
MSI (s) (XX:XX) [TimeStamp]: Product: Cb Defense Sensor 64-bit -- A newer or current version of Cb Defense Sensor 64-bit is already installed. 
To install this version, uninstall the current version first.

A newer or current version of Cb Defense Sensor 64-bit is already installed. To install this version, uninstall the current version first.
Action ended 16:20:49: LaunchConditions. Return value 3.
Action ended 16:20:49: INSTALL. Return value 3.

Cause

Registry keys identifying Cb Defense as installed were not removed when the Sensor was uninstalled through the Control Panel or when the Sensor Removal Tool was run

Resolution

  1. Backup the registry prior to making any changes
  2. Search for and delete the following keys if found
    HKEY_CLASSES_ROOT\Installer\Products\{Cb Defense GUID} 
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\{Cb Defense GUID} 
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt\{Cb Defense GUID} 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CbDefenseWSC
  3. Search for additional registry keys
    1. HKEY_CLASSES_ROOT\Installer\Products
    2. Search for "confer" (no speech marks)
    3. Delete keys found in that path

Additional Notes

  • Some registry key deletions may fail due to permissions
  • It may be necessary to take ownership of the registry key by changing ownership from System to the logged in administrator account
  • PS Exec (from SysInternals suite) can also be used to launch registry edit in order to delete keys owned by System

Related Content


Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎01-25-2019
Views:
3816
Contributors