Re: Sophie Error: "The main body of virus data is out of date"

Regarding updating sophos. If you have a windows network with sophos on 
it and you are using enterprise manager then it can update the linux 
version of sweep.

Make sure your directory em library updates is accessable via http from 
the linux machine.

Then all I do is use the sophos supplied scripts and this is in crontab

/10 * * * * root /usr/local/sav/eminstall.sh -v -r 
"/etc/rc.d/init.d/sophie reload"

so it checks for updates every 10 minutes.

if it updates it reloads sophie so it's using the new definitions.

Jeff


[email protected] wrote:

>
> Well, pretty much.  Do you have any tools that download new .ide files 
> on a schedule?
>
> Hope you don't mind me copying the group, but I'm sure someone else 
> out there would be interested in this as well.  ???
>
> I've found that while Sophos claims that new .ide files will not be 
> compatable with engines 3 months out of date, they do give you a month 
> or so of leeway (although with the number of viruses I get hit by, and 
> the amount of new stuff I see regularly, I normally update my engine 
> every two months or so), even though I get new .ide files several 
> times a day.
> So, even if some .ide files are older than 90 days, they may continue 
> to work, but some newer .ide files won't work with your engine.
>
> Upgrading the engine is pretty simple.
> You want to get the linux version of Sophos Anti Virus, for glibc 2.2 
> (since you have Redhat 9).  The file name is:
> linux.intel.libc6.glibc.2.2.tar.Z    (this file name is the same for 
> every version, so make sure you have the latest one).
> BTW, I have also had no issues with that version on glibc-2.3, which 
> came with Fedora Core 4.
>
> Assuming that everything is in its default location, then untar the 
> file, and it will open into a "sav-install" directory, and in that 
> directory, run "*./install.sh*" (you probably should stop Sophie first 
> though).
> The next thing to do, is to go to /usr/local/sav, and "*/bin/rm 
> *.ide*" to remove all of the old virus identity files, and then 
> download the file:
> http://www.sophos.com/downloads/ide/###_ides.zip     replacing the 
> ###, with the version number of the engine you just installed.
> Then unzip that file into /usr/local/sav, and you will have all of the 
> latest and greatest virus identities.
>
> There are scripts out there to automatically update the .ide files (I 
> use my own, as its a really simple process, and at the time nothing 
> pre-written was available), but you will still want to update your 
> engine every couple of months, manually.
>
> -- Robert
>
>
>
>
>
> 	*Geoff Manning <[email protected]>*
>
> 06/27/2005 03:26 PM
>
> 	       
>         To:        "'[email protected]'" <[email protected]>
>         cc:        
>         Subject:        RE: [vtools] Sophie Error: "The main body of 
> virus data is out of                date"
>
>
>
>
> Also, since the version 3.75a was dates Nov of 2003, does that mean 
> that the engine has been outdated since roughly the beginning of 2004? 
> (90 days past Nov)?
>
>  
>
> We see lots of viruses detected from this server, is that due to the 
> "File ide.name is older than 90 days" ide's are working, but the "File 
> ide.name not loaded (incompatible version number)" are not?
>
>  
>
> Thanks,
> Geoff
>
> -----Original Message-----*
> From:* [email protected] [mailto:[email protected]]*
> Sent:* Monday, June 27, 2005 2:31 PM*
> To:* Discussion about Virge/Sophie/Trophie/...*
> Cc:* 'Discussion about Virge/Sophie/Trophie/...'; 
> [email protected]*
> Subject:* RE: [vtools] Sophie Error: "The main body of virus data is 
> out of date"
>
>
> Sophos officially only supports identity updates for the last three 
> published engines (a new one is released every month).
> So, right now, if you engine is older than 3.92 (which it is way older 
> than), then you will need to get your engine updated.
> So, if you want to keep your virus definitions up to date with Sophos, 
> you will need to update your engine, at least once every three months.
> When you update your engine, you will want to delete all of the .ide 
> files, and get a new set of them, which matches your version number, at:
> http://www.sophos.com/downloads/ide/
>
> If you require more help, LMK.  Some system information (what version 
> of glibc you're running, variant of linux, etc.) would be helpful.
>
> -- Robert
>
>
>
> 	*Geoff Manning <[email protected]>*
> Sent by: [email protected]
>
> 06/27/2005 12:23 PM
> Please respond to "Discussion about Virge/Sophie/Trophie/..."
>
> 	       
>        To:        "'Discussion about Virge/Sophie/Trophie/...'" 
> <[email protected]>
>        cc:        
>        Subject:        RE: [vtools] Sophie Error: "The main body of 
> virus data is out of        date"
>
>
>
>
>
> > <snip>
> > What is the output of sweep -h   ?
>
> Well, this doesn't paint a pretty picture at all:
>
> SWEEP virus detection utility
> Version 3.75A, November 2003 [Linux/Intel]
> Includes detection for 88006 viruses, trojans and worms
> Copyright (c) 1989,2003 Sophos Plc, www.sophos.com
>
> System time 12:29:00 PM, System date 27 June 2005
> Command line qualifiers are: -h
>
> Useful life of SWEEP has been exceeded
>
> IDE directory is: /usr/local/sav
>
> <snip>
>
> File mydoom-w.ide is older than 90 days
>
> <snip several more with older than 90 days>
>
> File bagle-am.ide not loaded (incompatible version number)
>
> <snip several more with incompatible version number>
>
>
> I guess this version is out of date? And perhaps it didn't cause a problem
> until I restarted the service and it realized it was out of date?
>