Avast setup error 0xC0070643: installation fails and rolls back every time

Fix it now

0xC0070643 is a Win32-facility value whose low word, 0x643, is 1603 – ERROR_INSTALL_FAILURE, published as “A fatal error occurred during installation”. Setup got far enough to start making changes, hit something it could not do, and rolled back. On a machine that has had another security product, leftover drivers are the usual something.

fltmc filters

1. Open Windows Security, then Settings, then Manage providers, and read what Windows currently recognises as protecting the machine.
2. Read the fltmc filters output for entries belonging to a product you thought was removed. That is the evidence.
3. Remove any previous security product with that vendor’s own removal tool rather than through Installed apps alone. Avast publishes avastclear.exe; AVG publishes AVG Clear.
4. Restart, and restart again if the removal tool asks for it, then re-run fltmc filters to confirm the entry is gone.
5. Run the Avast offline installer from an elevated prompt, then apply your subscription.

Between removing the old product and finishing the new install this machine is in transition. Do it in one sitting, stay off the web, and confirm Microsoft Defender is active in between.

If Avast installs without rolling back you can stop here. If not, the next section covers the other two codes in this family, which are far more specific than 1603 and much easier to act on.

Why it happens

1603 is Windows Installer’s way of saying a fatal error occurred and it has nothing more specific to offer. It is what you get when a custom action failed, a file could not be written, a service could not be created, or a driver could not be loaded. The rest of 0xC0070643 is a severity and facility prefix – facility 7 is Win32 – so the meaningful part is the 0x643 at the end, which is 1603 in decimal.

Security software fails here more often than other software because of where it installs. Kernel-mode filter drivers sit in defined positions in the file system and network stacks, those positions are limited, and the drivers are protected against removal. A previous product taken out through Installed apps frequently leaves its drivers registered and loaded, and the new product’s driver installation is the custom action that then fails.

The other two codes in this family are much better news, because they are specific. 1622 is ERROR_INSTALL_LOG_FAILURE: there was an error opening the installation log file, and Microsoft’s published text goes on to tell you to verify that the specified log file location exists and is writable. That is a path and permissions problem, not a conflict. 1625 is ERROR_INSTALL_PACKAGE_REJECTED: this installation is forbidden by system policy – which on a managed machine means exactly what it says.

So the first thing to establish is which of the three you actually have. A generic 1603 wrapped in 0xC0070643 needs the driver and leftovers investigation below. A 1622 needs a writeable path. A 1625 needs whoever manages the machine, and is not something to work around on hardware you do not own.

Full reference

The three codes, precisely

Diagnostics worth running first

Removing a previous product properly

1. Identify what was there. Windows Security’s provider list and fltmc filters between them usually name it even after the entry in Installed apps has gone.
2. Download that vendor’s own removal tool from that vendor’s own site.
3. Run it as administrator. Avast’s documented procedure for avastclear.exe is to run it elevated, accept the Safe Mode restart, choose the folder and product, uninstall, and restart.
4. Restart into normal Windows and confirm with fltmc filters and services.msc that nothing remains.
5. Only then install the product you intend to keep, from a full offline installer rather than a web stub.

Reading the real failure instead of the wrapper

1603 is a wrapper by definition, so the useful move is to make the installer tell you what it actually failed at. Run it with verbose logging to a path you know is writeable, open the log, and search for “Return value 3”. That marks the action that failed, and the twenty or so lines above it usually name the file, service or driver involved in plain text.

If the log cannot be created at all, you have your answer already: that is 1622, and the problem is the path or its permissions rather than the package. Point the log somewhere under your own temporary folder and try again.

What is protecting the machine in between

• Microsoft documents that Defender goes into Disabled mode automatically when a third-party antivirus registers on Windows 10 and 11.
• Where it was disabled automatically, it can be re-enabled automatically if that product expires, is uninstalled, or otherwise stops providing real-time protection.
• So removing the old product normally hands protection back to Defender without anyone doing anything.
• Confirm it in Windows Security, then Virus and threat protection, rather than assuming, and do it before you browse.
• Do the removal and the installation in one sitting so the window is minutes rather than days.

Every code this article covers

Confirm the fix worked

1. Avast installs to completion with no rollback.
2. fltmc filters shows only Avast’s filters and Windows’ own.
3. Windows Security shows Avast as the active provider.
4. No services from the previous product remain in services.msc.
5. Restart and confirm Avast starts on its own and reports protection as active.

Questions people ask about this