{Original Post has been edited since Paul M provided updated information below.}

JimW

Symantec is aware of this and is currently working on this.

I found the release is updated for 31/12/2009

I have noticed the same issue here, all my clients only have 12/31/2009 rev 041 definition, no defintion updated sicne then. however, I checked the Symantec site, Symantec did release new defintion. The  issue must be on the Symantec site as I even directly connect to Symantec to liveupdate, the log still said all defintion were not to date.
Symantec, please publish this issue on your with progress.

THanks

I was starting to pull my hair out and then noticed that on download that they only had 12/31 avail on the site.

Looking forward to the update BEFORE everything has to become a massive download for the clients :(

checked my machine after writing it, he is correct, we need to wait for the good news.

Same problem here.
Has Symantec provided any press release, support document, blog entry, or anything  that officially states there is a problem?   I need something to provide to my manager to explain why our anti-virus definitions are three days behind  !!!

Neither the SEPM nor manually clicking the LiveUpdate button in the client is able to obtain current definitions.  Ouch!

I update now at 8.00pm ist 3/1/10 and def shows 31/12/09 rev 114 . still can't see 2010 def date.

Once there is an update on this I will update it here.

Dears,
I Have the same problem  i've found that last virus definition on my Symantec End Point Manager is 31/12/2009 .
is there any hotfix to Lveupdate.
this is a critical issue and Symantec Technical  have to solve it.

Omar Delair Mohammed
IT Security Manager
Zain.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010010308571348

{Text Edited by JimW to include up to date.  Also refer to information posted by Paul M.}

If you read the above link from ohio_navigator, I take this to mean that the AV defs are still being updated even though it will appear on the client as from 12/31/2009 rev. "XXX" (greater than 041)

Appears to be an issue with the date change.

Yes, thats correct.

An issue has been identified in the Symantec Endpoint Protection Manager (SEPM) server whereby all types of SEP definition content [AV/AS, IPS] with a date greater than December 31, 2009 11:59pm are considered to be “out of date”.

Customers running SEP are still protected, and we are continuing to release updated definitions as normal.  However, for the time being, SEP definitions will display a date of December 31, 2009, with increasing revision numbers.  Current certified definitions are December 31, 2009 rev 114 and contain updates through January 2, 2010.

Symantec is working on a solution and will update customers when a solution becomes available.

IMPORTANT: This issue does not impact any other enterprise products (e.g. SAV or SCS) or consumer products.

For further information please see Symantec KB:
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010010308571348

Impacted Products:
*     Symantec Endpoint Protection v11.x Product Line
*     Symantec Endpoint Protection v12.x Product Line
 

To day I can see the def date as 2010-01-02 rev. 020 . I think the problem is solved now.

Nope still problem is there

as my SEPM shows latest symantec version is  2010-01-02 rev. 020  and Latest Manager Version: 2009-12-31 rev. 114  after updaing today on 4th jan 2010.

Bijay you are right , the issue is still there we will update  once there is an update on this

Title: 'The date of the definitions in Symantec Endpoint Protection clients and Symantec Endpoint Protection Manager remain at Dec 31 2009'
Document ID: 2010010308571348
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2010010308571348?Open&seg=ent

Me too facing the same issue, if any update on this kinldy update this post !!

thanks..
tanveeer.

Just a quick warning to any of you folks, who, like us, have any network access rules that are based on virus definitions dates.

If Symantec do not get this fixed before your time limit, then your users will shortly fall foul of this.

EG - we block access to all network resources (other than virus update) if virus definitions are older than 7 days....
IE - in 2 days, we will be screwed - we are working on removing the rule now...

@NickF, yes thats correct.  For NAC specific suggestions, please see our official status post here: https://www-secure.symantec.com/connect/forums/official-status-sepm-definitions-stay-31-12-2009-last-updated-04-jan-2010

To everyone else, the latest information on the status of this issue is available in the above post and will updated with the latest information as we get it.

yeah there is a same issue at all regions , but atleast symantec would have intimated this on their WEBSITE , because people who are not at all aware of this , may think their SEPM would have gone bad and may have changed their settings.

Regards
Raghavendra

hi,
this is publicly available

Title: 'The date of the definitions in Symantec Endpoint Protection clients and Symantec Endpoint Protection Manager remain at Dec 31 2009'
Document ID: 2010010308571348
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2010010308571348?Open&seg=ent

@NickF, thats a good point, unless the third party has options like ours then you would be best to temporarily disable the check.

Our engineers are working on the fix around the clock, we have identified the problem and have created a first cut fix which is with QA at the moment.

We plan to deliver the update to the SEPM via LiveUpdate, so there shouldnt be anything for our customers to do when we do release it.

 Hope this issue will resolve very soon, because users are thinking , symantec not able to release antivirus definitions in new year like that......

It's impacting EVERYTHING here, as well. Phone ringing off the hook.
Rapid release wont' work, LU won't work, stuck at 12.31.2009 (USA date format) December 31, 2009

Interesting that the rapid release script I run won't fix it.
This could be a world-wide disaster should something come up that we all need defs for! WOW.

Ah - because our WEB/INTERNET was also down........ I wasn't able to get to the web to do any searches. Now that I see there's some info out there, good to know we're really current, even though the computers state we are not.
Even my unmanaged computers are stating there's issues....... so it's not just managed computers alerting their users

hope its fixed soon!

We know its still working, but tell manager, users who only see the old date :-)

Maybe it is just a nuance of our implementation however it appears that a side effect of this issue is that C:\Program Files\Common Files\Symantec Shared\SymcData is consuming large amounts of disk space and it appears that Liveupdate wants to install the new version of the defs each time it runs. Each time LU checks it thinks there is a new version (which there actually is) however it appears that applying the defs is failing not removing the temp files for the def installation.

We are shutting down Liveupdate enterprise wide. Circuits are running at capacity moving Defs around and boxes are running out of space. Basically it is an ugly situation.

I am also seeing this issue here at our site. I tried using the rapid release JDB file, and the SEPM displays the revision 1/4/2010 Rev. 18.
However, the clients are not being updated. The latest version of defs that clients are reporting is 12/31/2009 Rev. 114.

Mike

I hoped we had overcome stupid date calculation mistakes with the year 2000 bug, but it appears Symantec cant even remember what happened 10 years ago - using a single digit for the year in the defs is an obvious mistake ( YMMDDXXX - where XXX is the revision) and should have been spotted by anyone competent before it became a problem.

I am not impressed with such a stupid shortcoming in what is supposed to be an Enterprise product.

I didn't see this anywhere, but Symantec is aware this is a problem on "UN-managed" SEP clients as well correct?

Any word from anyone at Symantec how long till we will see a fix are we thinking hours, days, or weeks?

Hi,

Yes, we are aware that this issue is impacting client updates as well as SEPM and SPC updates. It is also expected for their to be a mismatch on what is up to date on the Console Home Page. We are working diligently to release a patch that will resolve this. Please continue to monitor the KB referernced for the latest information;

http://service1.symantec.com/support/ent-security.nsf/docid/2010010308571348?Open&seg=ent

At this time there is nothing that needs to be done by you to ensure that your systems are up to date. Symantec is posting new virus definitions with the 12/31/2009 date so that you have continued protection. You should see the revision number increment as new defs are posted.

JimW

Client definitions, both managed and unmanaged, were also initially locked at 12/31/2009 r114+ approach. This was to ensure that managed clients switching back and forth between the SEPM and LiveUpdate would have matching 12/31 schemed definitions. As we rollout the fix via LiveUpdate, we will switch all clients to correctly dated definitions. This is fine for unmanaged clients. However, managed clients that get definitions via both SEPM and LiveUpdate will see the definitions coming from SEPM as old until the server is patched. As such, clients getting updates via a mix of SEPM and LU will start having the behavior of only getting defs via LU as those are the only ones with a 2010 defs currently. When the server patch is deployed, SEPM should start getting 2010 defs and the clients will start doing both SEPM and LU updtes again.

The client software does not have any problems with 2010 definitions that we are aware of.

How often are new defs being posted.  I am still showing rev 114.  Which if I am following this thread correctly was released yesterday.  

They will be posted once each day.

As someone with Platinum Support, it sure would have been nice to get an email about this directly from Symantec, instead of hearing about it from one of our security people that monitors the SANS website... :-(

JimBr - for the server patch you mentioned, is this a manually installed patch or automatic?

 I have Platinum Support and Deepsite, and product notifications all turned on and I did not see anything notifying me of this.   One of these should have atleast given me a heads up to the issue.
 

I've signed up for every alert, every newsletter, etc - and to THIS DAY, the very best I get ever is an email stating that new IPS defs will be posted. I don't need that at all since that is AUTOMATIC via LU anyway.
What I do need is this sort of information, ESPECIALLY when today of all days, our state is suffering from WEB outages due to ICN switches being down.
So I can't easily get to this site to learn this stuff, I can however get email...........

Now I see an issue with only once daily defs, too - with all the nasty stuff out there.......... I use rapid release AND LU due to a necessity that we are current at least every hour due to the risks we seem to get in here doing it any other way, so I feel sort of half-naked right now!
Is there any way around this we can use??

Once daily defs, all SEP endpoints, managed or unmanaged............ I could configure all machines to use LU but since LU is tied down now too, even our unmanaged machines will see this even though they'd normally not - is that correct?
Frankly, I'd rather have seen LU left alone so that we could at the flip of a switch cause all of our computers to update via LU and cause 300 fewer calls to our help desk!   LOL This combined with the ICN Internet outage, wow, double-whammy for us.........

Whatever, do please let us know what to do once things are fixed...........  since our clients for the "most part" get defs not via LU from outside, but from the managers inside.

No bloat on our SEM machines here - I am not seeing a loss of drive space............

PS - Hi, JimW. What a new year, eh?

 @shadows papa-- this new year is 1000 times better than last new year's Downadup..which is still haunting..

Yes. What a new year. It will get better as we get this resolved.

Other than most clients showing the "old" date, 2009-12-31 rev. 114 all seems to be fine

However, I do have 2 clients showing the new date of 2010-01-03 rev. 020. Any idea why only these 2 and not more? The majority of my clients are on 11.0.4 but some are 11.0.5, I have yet to verify if these 2 are.

I called Symantec today because I was concerned with the date glitch as well. I had noticed yesterday when I ran LU, the date stayed the same, however the revision number changed to 114. So I ran LU again today to see if it would change, when I saw it did not thats when I called Symantec.

Another reason I did not follow up sooner is because I have seen definition dates stay the same for a few days at a time.

When I went to the Symantec website to see if there was some explination to it I did not find anything to support the issue, thats why I called.

I would suggest to Symantec to have some type of an "ALERT" tab on the main site so that average end users like myself can easily go to (www.symantec.com) and select the "ALERT" tab and be taken to a page that has this page (http://service1.symantec.com/support/ent-security.nsf/docid/2010010308571348?Open&seg=ent) listed as a click-able link.

I could have avoided all of this and just read the link above.

Is this something that can be implimented into Symantecs website in the future?

When are the virus defs for today going to be released? My clients are still running rev. 114. Thanks!

We are actively working on creating the defs for today. They are planned for release today, unclear exactly when. The delay is to ensure high quality delivery to our customers.

I too wanted to deliver high quality services to my customers and I worked my back for hours with different fixes before I found the post..... lucky I didn't break the SEP server or the clients... :)  Now I'll just sit back and relax waiting for Symantec to deliver the solution.... I know, I know, you'll say that managers and users are coming down on us.... Let them come, we'll fight back :), after all, January10 signatures are in place though SEP's nostalgic on 2009..... However, I pity those that got to put in place access control rules on defs......