Re: trend-update.pl question

Alain Fauconnet <[email protected]> Wed, 8 Dec 2004 09:31:15 +0700
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Hi Bill,

[list  [email protected]  Cc'ed as it tends to be the de-facto list for
the  few  questions about trend-update.pl... at least until Vanja asks
me to move elsewhere :-)]

On Mon, Nov 29, 2004 at 11:01:27PM -0800, Bill Landry wrote:
> Hi Alain,
> 
> Yesterday I downloaded and started using your trend-update.pl script, and
> all appears to be working well (I've gotten several updates in the last 24
> hours).  I noticed that the update e-mail notification for the first 12
> hours or so looked like this, with the version info changing with each
> actual update:
> =====
> Trend Micro A-V Pattern/Engine Update v1.02 starting at Mon Nov 29 13:04:34
> 2004
> Checking existing VPN/CPR pattern number/version
> Current VPN: major = 2, number = 267, version = 00
> Current CPR: major = 2, number = 268, version = 04
> Current ENG: version = 7.000-1011
> No update done
> =====
> 
> However, all updates notifications since the one shown above have looked
> like this (probably the last 10 hourly updates):
> =====
> Trend Micro A-V Pattern/Engine Update v1.02 starting at Mon Nov 29 14:03:15
> 2004
> Checking existing VPN/CPR pattern number/version
> Trophie reports pattern number = 269, assumed major = 2, version = 0
> Current VPN: major = 2, number = 269, version = 0
> Current CPR: major = 2, number = ???, version = ???
> Current ENG: version = 7.000-1011
> No update done
> =====
> 
> Note the "???" in the CPR line above.  Is this something that I should be
> concerned about?  All previous updates notification listed numbers, not
> "???".

Yes you should. This isn't normal. It means that the script  has  been
unable to determine which version of CPR you have at this time. It can
normally happen the first time the script is run, but  definitely  not
after successful updates. Something has been messed up.

Please post the contents of the ./update/numver.dat file found under
whatever   $trenddir   is   set   to  e.g.  if  $trenddir  is  set  to
'"/opt/TrendMicro/SProtectLinux" (the default), then the file will be
/opt/TrendMicro/SProtectLinux/update/numver.dat

Also  please post the result of a ls -l in that ./update directory and
a 'ls -l lpt*' in the directory above (the value of $trenddir).

> 
> Also, what do VPN and CPR stand for?
> 

The  VPNs  are the official pattern releases. They tend to have an odd
middle version number and '00' as the minor number.
The  CPRs  are the interim, "beta" pattern releases. They tend to have
an even middle version number and can have several incrementing minor
version numbers. Trend does not recommend them for  production  usage,
but in my opinion, they are quite needed to feed a virus scanning mail
gateway.

See: http://www.trendmicro.com/download/pattern.asp for  the  official
gospel.

Greets,
_Alain_