Error Code 2324 thanks to Sophos Anti-Virus breaks iTunes update

PROBLEM: Today I wanted to install iOS 6 on my ancient iPhone 3GS which required updating my iTunes (ugggh) to iTunes 10.7 - for some reason the "Check for Updates" feature in iTunes found the update but rather than downloading and installing it, it sent me to the Apple website to download it separately. When I tried installing iTunes 10.7 it got part way through the installation process before it came up with the following error and wouldn't proceed further:

"The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2324."

SOLUTION: So these are the things I tried (skimmed to the end if you want the final solution):

• Googled the error code and iTunes and came up with a few pages, none of which were really relevant (most were just fake page spammy sites) - one suggested running a chkdsk which while odd apparently worked for someone so I tried it - no affect.
• Finally I tried calling Apple support, who had never heard of the error code and didn't have any record of it - a very helpful lady called Katie tried to sort things out without much love.  She finally suggested uninstalling iTunes, but even that wouldn't work!  Yep, when I went to uninstall iTunes I got the same "error code is 2324" error... uggh!
• Apple support suggested turning off my virus scanner - "Hmmphh... how is that going to help, but ok..."... and what do you know... everything started magically working again!

So the final cause of the problem?  Sophos Endpoint Security and Control (Sophos Anti-virus) was updated on the 20th September 2012 with an invalid virus definition file which was blocking critical iTunes update files - details are here: http://nakedsecurity.sophos.com/2012/09/19/sshupdater-b-fsophos-anti-virus-products/ and if you're an administrator here is some more info http://www.sophos.com/en-us/support/knowledgebase/118311.aspx - basically a bunch of exe files were flagged as threats (a threat has been detected by Sophos (“Virus/spyware Shh/Updater-B”)) and had been quarantined - including of course some critical iTunes update files e.g. c:\Program Files\iTunes\iPodUpdaterExt.dll, c:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe.  Ironically their own Sophos update files were also marked as a virus! (so the fix couldn't be downloaded automatically - yeah, pretty big stuff up).

So it just happened to be the perfect storm... a bad update to the virus scanner and an update required of software on the same day.

For those with Sophos who want to know how to turn it off temporarily (so you can do updates to iTunes etc):

• Start Sophos Endpoint Security and Control (from Start menu or right click the icon in the task tray).
• Configure > Anti-virus > On-access scanning... > Scanning tab
• Untick "Enable on-access scanning for this computer".

If you want to leave it enabled but just don't want to receive alerts every time it sees a threat (perhaps because you know it is getting a lot of false positives):

• Start Sophos Endpoint Security and Control (from Start menu or right click the icon in the task tray).
• Configure > Anti-virus > Messaging... > Desktop messaging tab
• Untick Messages to Send - "Virus/spyware detection and cleanup"
• Remember to tick this once you have an updated virus pattern/definition file so you can any real problems.

Some interesting things I learnt while talking to Apple tech support:

• Even though a new version of iTunes can be downloaded and installed while you have an old version (and in theory it will upgrade it/replace it) - Apple don't recommend this - apparently it can result in some file conflicts and general nastiness - they always recommend using the Update within the software if it is working, but otherwise uninstall iTunes totally first.  
• The uninstall process Apple tech support recommend is very methodical (here it is described for Windows 7 64 bit but it would be very similar for other Windows installations) - here are some links I found for Windows 7 - http://support.apple.com/kb/HT1923 and for XP http://support.apple.com/kb/HT1925
• Uninstall 6 Apple pieces of software, in order:

1.     iTunes (may want to take note of any iTunes preferences you have first - though my preferences were retained after the uninstall and reinstall).
2.     Quicktime
3.     Apple Software Updater
4.     Apple Mobile Dev Support (or something like that)
5.     Bonjour
6.     Apple Application Support

• Verify that there are no related files left in the file system after the uninstall:

1. c:\Program Files\Bonjour
2. c:\Program Files\Common\Apple
3. c:\Program Files\iTunes
4. c:\Program Files\iPod
5. c:\Program Files\Quicktime
6. c:\Windows\System32\Quicktime
7. c:\Windows\System32\QuickTimeVR
8. c:\Program Files(x86)\Bonjour
9. c:\Program Files(x86)\Common\Apple
10. c:\Program Files(x86)\iTunes
11. c:\Program Files(x86)\iPod
12. c:\Program Files(x86)\Quicktime    
13. c:\Windows\SysWOW64\Quicktime
14. c:\Windows\SysWOW64\QuickTimeVR

•   Reboot machine
•   Redownload iTunes from http://www.apple.com/itunes/
•   Install iTunes!
• After upgrading to iOS 6 on my iPhone (now that iTunes was upgraded) I did have iTunes lock up (probably related to the anti-virus) and I did receive this error: "iTunes was unable to load data class information from Sync Services. Reconnect or try again later."... After restarting iTunes it worked ok (might have been also because the iOS 6 update had just been rolled out and everyone was downloading it/installing it at once).

So lessons learnt?

• The simple solution is often the right solution - think about what might have changed recently because that's likely to be your problem.
• iTunes phone support is surprisingly helpful (much better than their online help which never answers any of my problems) - note, I don't think I was entitled to phone support but if it's an interesting enough case they will hopefully try and sort out your problem.