Re: AW: Trophie worker processes dying at a high rate: am I alone?

On Tue, Aug 17, 2004 at 08:16:17PM +0200, Stephane Lentz wrote:
> On Tue, Aug 17, 2004 at 05:49:48PM +0200, Vanja Hrustic wrote:
> > On Tue, 17 Aug 2004 17:40:04 +0200
> > Stephane Lentz <[email protected]> wrote:
> > 
> > > > Does it crash for others, using 958 pattern?
> > >
> > > To all PATTERN 958 IS NOT WORKING. 

When was 958 released? Just to know if  that  was  the  cause  of  the
crashes I've experienced.
Oh wait, I have the whatsnew.txt  file.  It  says  "August  16,  2004,
03:55:03 (GMT -08:00)" so I guess that was *after* trouble hit me.
OTOH  the  "bug"  in  the pattern file could well have appeared in the
1.957.xx CPRs before then. I'll check my update log precisely.

> > > Remove it and use 957 instead until a new one is released
> > > Complain to Trend if you can ... Their service is as good
> > > as before ...
> > 
> > Right. I've tried 959 ("controlled release"), and Trophie loaded it okay.
> > It does, indeed, seem 958 is invalid pattern.

My update script installs the new CPRs systematically, so yes, Trophie  is
running with 1.959.04 now and seems happy.

> you're right 959 is a better choice as it identifies TROJ_MULDROP.D .
> 
> To all, 
> 
> what is your feeling about Trend lately regarding to virus patterns release
> and support ?

Their support really sucks. We have a large Officescan license and all
my recent support requests have been treated in an  unacceptable  way.
I'm   raising   hell  with  their  thai  subsidiary  now,
threatening them of not renewing our license.

> Anybody willing to create a Trend user distribution list to
> exchange tips/feelings ?

Afraid  we  don't  have  enough net b/w to manage public mailing lists
here...

> 
> To avoid in the futur the problem experienced with pattern 958, you can 
> try to run vscan in your script before activating/pushing a new pattern : 
> 
> with pattern 958 
> # vscan  
> Virus Scanner v3.1, VSAPI v7.000-1011
> Trend Micro Inc. 1996,1997
> read pattern failed,rc -3
>         -3: invalid pattern file
>         -4: pattern file not found
>         -83: incorrect pattern format
>         -96: read error
>         -98: out of memory
> # echo $?
> 253
> 
> With a normal pattern 
> #vscan
> Virus Scanner v3.1, VSAPI v7.000-1011
> Trend Micro Inc. 1996,1997
>         Pattern version 959
>         Pattern number 69945
> No scan target specified!! do nothing.
> # echo $?
> 0
> 
> Checking exit code of vscan (exit code : 0) could be a good test. 

That's a pretty good  idea.  Wouldn't  'trophie  -v'  serve  the  same
purpose? (although I don't remember seeing it failing at the time I had
my  worker process crashes, maybe it crashed only when actually trying
to scan something).

Anyway I'll think into adding this to trend-update.pl.

> PS : do any of you have bought Premium contract support ? How good is it ? 

Nope. Haven't.

Greets,
_Alain_