Endpoint Protection

I have used Symantec AntiVirus Corporate Server 10.1.5.5000 in a Windows 2000 server SP4 for several years. Until Nov 2011, it failed to update the virus definitions. I search the Symantec Support and download the definition file and restart antivirus services. Finally, it can update virus definion file.

However, it happens again.

If run LiveUpdate Now in SSC, get error "Download of virus definition file from LiveUpdate server failed.  00000001".

If run LiveUpdate in AntiVirus UI, it seems that it updates successfully. However, nothing is changed at all.

The definition file still is the old one. It should be 12/12/2011 (as the current one).

Then I download the new definition file "vd371812.xdb" from Symantec website and place it in the"C:\Program Files\SAV". Very soon, this file is disappeared in this folder. Supposedly, Symantec AntiVirus Server process should find this file and do the update process. However, the file is gone but nothing is changed at all. I search around Symantec website and internet but nohting is new and useful.

Can anyone solve this problem? Thanks a lot.

Hi Userforsymantec,

First and foremost: that version of SAV is dangerous out of date!  The most recent release fo SAV 10.1 is SAV 10.1 MR10 - it contains fixes for several known vulnerabilities and hundreds of other enhancements and improvements.  Every SAV system should be running this MR10 for the sake of stability and security.  Please do upgrade! &: )

There is a good chance that upgrading will correct the trouble you are seeing.  SAV 10.1 MR5 was not designed to process today's enormous definition files, but MR10 is pretty good with them. 

If update issues continue after moving to MR10, please do add additional information to this Forum thread. 

Hope this helps!

Mick

Hi Mick,

Thanks for your help.

Is it a known issue for SAV 10.1 MR5? No much information to talk about it that can fix my issue.

From release note of MR10, it is to fix the issue for AMS2. I have not installed AMS2, only AMS. Upgrading may help to solve it or not but it takes a lot of work. Can I just upgrade the server, not client at all?

Or, can we just clean up or clear the existing virus definition files so that we can place the new one to make it refresh by itself?

Thanks for any help.

Glad to assist. &: )

I'd make sure that SAV servers, SSC and SAV clients are all MR8 or above.  That was the first version which is really capable of efficient processing of today's large definition sizes.  If it is not possible to upgarde all of the clients, do be sure that at least all of the servers are updated.

Thanks again.

As I find that the disk space in Drive C: is very few (less than 500M), this may be the reason why it cannot update the definition file (because too larget, but no log for this reason).

Therefore, for the short term, can I manually clean up or delete those definition files /folder? Please list out the paths and any files for this clean up. Thanks.

For the long term, I know it needs to update to EndPoint 12.

under the folder C:\Program Files\SAV , I find some old files

• VD3xxxx.tmp,
• VD36xxxx.vdb
• VD36Fxxx.XDB.

under the folder C:\Program Files\SAV\I2_LDVP.VDB, I find some new folders. I think these 2 folders are not used even with new date.

• "VD36FC02.XDB" 1/12/2011 
• "VD36FC02.vdb" 13/12/2011.

under the folder C:\Program Files\Common Files\Symantec Shared\VirusDefs, I find the following files and information about my current virus definion file.

usage.dat

[20111129.002]
DEFWATCH_10=1
NAVCORP_70=1
NAVCORP_70_2=1

definfo.dat

[DefDates]
CurDefs=20111129.002
LastDefs=20111031.002

As I search this forum, someone said that the updates will get first downloaded to C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads . Can I just clear inside this downloads folder in order to free more disk space?

it's recommended to delete only if you find the corrupt definition.

Finally, I manually delete some old files and folders to free up more space.

• VD3xxxx.tmp,
• VD36xxxx.vdb
• VD36Fxxx.XDB.
• "VD36FC02.XDB" 1/12/2011 
• "VD36FC02.vdb" 13/12/2011

Then SAV 10.1 MR5 can update the new virus definition now. Thanks to all of your help.

I wonder if SEP 12.1 can assign the location of these downloaded virus definition (not in C drive only).