I did a little more sleuthing, and explored the console. Alas there was an instance of Macaffee hidden and installed (yet never activated from when the initial OS 10.6 was installed a few years ago). found it under /usr/local/...
removed it and rebooted. install went fine after that. wonder why SEP 11 never caught that? this was another user's system, so I was not actively monitoring their logfiles.
Thanks for the input you guys provided.