Re: Trophie worker processes dying at a high rate: am I alone?

Alain Fauconnet <[email protected]> Thu, 19 Aug 2004 13:57:13 +0700
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Hello,

> Recently,   my   previously   solid-as-a-rock   Trophie   has  started
> misbehaving, worker processes SIGSEGVing at a high  rate.  The  master
> process was staying up though, so Amavisd-new couldn't detect this and
> it effectively brought our mail traffic to a standstill.  And  yes  of
> course, last time it happened on a friday evening...
> 
> This caused a bunch of lines like this in the mail log:
> Aug 13 23:59:59 mail-gate trophie[13034]: SIGNAL [11] caught - cleaning up 
> and exiting.

It just happened again at 12:01 local time = 05:01 TU. At that time
I had VPN 1.958.00 and CPR 1.959.15 installed. 'iscan -v' didn't  show
any error *but* much to my suprise the exact time it happened  matches
the last modification time of libvsapi.so!
That could well explain it, but what the  hell  wrote  to  that  file?
Certainly not my trend-update.pl script (I've double checked).
I've  re-downloaded  engine 7.000-1011 and compared it to the existing
libvsapi.so: md5 checksums match. So what ?!? I'm baffled.

Thinking  about  it,  I've  recently  chmod'ed libvsapi.so 755 (it was
500).   So   'something'  would  be  messing  with  it?  What?  Is  is
self-modifying code or what?

If that happens to any of you, please check the last modification time
of libvsapi.so and its mode please.

Greets,
_Alain_