Issues with NAI uvscan?

Hello all,

Is anyone else using NAI's uvscan product for Linux?

We've got a script that runs nightly to update the latest dat*.tar files
from the NAI servers (ftp.nai.com). For both dat-4474.tar and
dat-4475.tar, downloaded directly from their ftp server, the uvscan
product refuses to run with the dat updates.

After update, if I go to manually run uvscan --version I get the message
"Corrupt or invalid scan.dat" file. "Downgrading" to the 4473 dat file
lets the system work fine.

I manually downlaoded both dat files outside of the shell script and
copied the files and the error persists, so I am sure the tar files are
valid.

Did NAI change the format of the virus definitions so that the uvscan
product is no longer compatable? Maybe I have to update my uvscan to a
newer version to accept the latest definitions, but I was unable to find
any such documentation on their website.

Thanks!

Matt

Hello Matt,

did you already figure out, what the problem is or was? We have
exactly the same problem and no solution yet.

Thanks,
Klaus

I got a few emails, and have since figured this problem out. I will copy
and paste a portion of my email....

I had some time at work today and got our uvscan working away. It's a
bit of an ugly hack, but it works.

The problem is as I suspected, the very latest NAI .dat files need a
newer "scanning engine" than we had loaded on our machines. I went onto
the nai website (I realize they have been purchased by someone else, but
honestly I forget who, www.nai.com will redirect to the new owners...
regardless) and tried to update our scanner engine from their customer
support site. It prompted me for our grant number, which I provided.
Turns out our grant expired. Of course I started fishing around in the
Accounting department getting some money cleared for a new grant (looks
like about $600 for my site).

Being anxious I didn't want to wait and let some viruses slip in, so I
did the following..

I went to the nai "demo/evaluation" portion of their website. I
downloaded the latest evaluation package from their demo page. (You can
probably see where I'm going with this by now.) On a different machine I
decompressed the evaluation package. I then copied the two lib* files
from the evaluation package to the uvscan directory on my e-mail
scanning machine (the machine I actually have licensed). These two lib*
files are the "scanning engine" apparently. After this I tested uvscan
by issuing "uvscan --version" and it showed me a newer scanner engine
version. I then updated the .dat files from ftp.nai.com and viola!
Working uvscan AND the latest virus definitions.

Of course I say all this NOT to encourage people to avoid paying their
licensing. We are still planning on it, we use their software they
deserve their money (we're a software house ourselves) but if you're
like me you want the product up and running NOW, not tomorrow (plus I'm
a programmer, and just the guy that knows the most about administration,
so....)..

Best of luck, let me know if you have any questions!

Matt Fuerst


Matt Fuerst wrote:
> Hello all,
>
> Is anyone else using NAI's uvscan product for Linux?
>
> We've got a script that runs nightly to update the latest dat*.tar files
> from the NAI servers (ftp.nai.com). For both dat-4474.tar and
> dat-4475.tar, downloaded directly from their ftp server, the uvscan
> product refuses to run with the dat updates.
>
> After update, if I go to manually run uvscan --version I get the message
> "Corrupt or invalid scan.dat" file. "Downgrading" to the 4473 dat file
> lets the system work fine.
>
> I manually downlaoded both dat files outside of the shell script and
> copied the files and the error persists, so I am sure the tar files are
> valid.
>
> Did NAI change the format of the virus definitions so that the uvscan
> product is no longer compatable? Maybe I have to update my uvscan to a
> newer version to accept the latest definitions, but I was unable to find
> any such documentation on their website.
>
> Thanks!
>
> Matt

Greetings Klaus,

Writing you both back here and I'll post a message to the newsgroup here
in a little bit.

I had some time at work today and got our uvscan working away. It's a
bit of an ugly hack, but it works.

The problem is as I suspected, the very latest NAI .dat files need a
newer "scanning engine" than we had loaded on our machines. I went onto
the nai website (I realize they have been purchased by someone else, but
honestly I forget who, www.nai.com will redirect to the new owners...
regardless) and tried to update our scanner engine from their customer
support site. It prompted me for our grant number, which I provided.
Turns out our grant expired. Of course I started fishing around in the
Accounting department getting some money cleared for a new grant (looks
like about $600 for my site).

Being anxious I didn't want to wait and let some viruses slip in, so I
did the following..

I went to the nai "demo/evaluation" portion of their website. I
downloaded the latest evaluation package from their demo page. (You can
probably see where I'm going with this by now.) On a different machine I
decompressed the evaluation package. I then copied the two lib* files
from the evaluation package to the uvscan directory on my e-mail
scanning machine (the machine I actually have licensed). These two lib*
files are the "scanning engine" apparently. After this I tested uvscan
by issuing "uvscan --version" and it showed me a newer scanner engine
version. I then updated the .dat files from ftp.nai.com and viola!
Working uvscan AND the latest virus definitions.

Of course I say all this NOT to encourage people to avoid paying their
licensing. We are still planning on it, we use their software they
deserve their money (we're a software house ourselves) but if you're
like me you want the product up and running NOW, not tomorrow (plus I'm
a programmer, and just the guy that knows the most about administration,
so....)..

Best of luck, let me know if you have any questions!

Matt Fuerst



Klaus Baumgartner wrote:
> Hello Matt,
>
> did you already figure out, what the problem is or was? We have
> exactly the same problem and no solution yet.
>
> Thanks,
> Klaus

Well, you don't need to resort to that.

look in ftp://ftp.nai.com/pub/antivirus/engine/4.x/

there are lib-files which are the same (according to diff) as the
evaluation version, and they are free to download.

But I have strange problems anyway. uvscan just doesn't want to do
anything anymore.

What I tried so far:

- uninstall
- reinstall with old & newer & newest dat-files
- reboot inbetween
- upgrade of the libs.

nothing helps, it won't start anymore.

any ideas?

Cheers
Leonard

Matt Fuerst <(E-Mail Removed)> wrote in message news:<d4pj0a$8bq$(E-Mail Removed)>...
> I got a few emails, and have since figured this problem out. I will copy
> and paste a portion of my email....
>
> I had some time at work today and got our uvscan working away. It's a
> bit of an ugly hack, but it works.
>
> The problem is as I suspected, the very latest NAI .dat files need a
> newer "scanning engine" than we had loaded on our machines. I went onto
> the nai website (I realize they have been purchased by someone else, but
> honestly I forget who, www.nai.com will redirect to the new owners...
> regardless) and tried to update our scanner engine from their customer
> support site. It prompted me for our grant number, which I provided.
> Turns out our grant expired. Of course I started fishing around in the
> Accounting department getting some money cleared for a new grant (looks
> like about $600 for my site).
>
> Being anxious I didn't want to wait and let some viruses slip in, so I
> did the following..
>
> I went to the nai "demo/evaluation" portion of their website. I
> downloaded the latest evaluation package from their demo page. (You can
> probably see where I'm going with this by now.) On a different machine I
> decompressed the evaluation package. I then copied the two lib* files
> from the evaluation package to the uvscan directory on my e-mail
> scanning machine (the machine I actually have licensed). These two lib*
> files are the "scanning engine" apparently. After this I tested uvscan
> by issuing "uvscan --version" and it showed me a newer scanner engine
> version. I then updated the .dat files from ftp.nai.com and viola!
> Working uvscan AND the latest virus definitions.
>
> Of course I say all this NOT to encourage people to avoid paying their
> licensing. We are still planning on it, we use their software they
> deserve their money (we're a software house ourselves) but if you're
> like me you want the product up and running NOW, not tomorrow (plus I'm
> a programmer, and just the guy that knows the most about administration,
> so....)..
>
> Best of luck, let me know if you have any questions!
>
> Matt Fuerst
>
>
> Matt Fuerst wrote:
> > Hello all,
> >
> > Is anyone else using NAI's uvscan product for Linux?
> >
> > We've got a script that runs nightly to update the latest dat*.tar files
> > from the NAI servers (ftp.nai.com). For both dat-4474.tar and
> > dat-4475.tar, downloaded directly from their ftp server, the uvscan
> > product refuses to run with the dat updates.
> >
> > After update, if I go to manually run uvscan --version I get the message
> > "Corrupt or invalid scan.dat" file. "Downgrading" to the 4473 dat file
> > lets the system work fine.
> >
> > I manually downlaoded both dat files outside of the shell script and
> > copied the files and the error persists, so I am sure the tar files are
> > valid.
> >
> > Did NAI change the format of the virus definitions so that the uvscan
> > product is no longer compatable? Maybe I have to update my uvscan to a
> > newer version to accept the latest definitions, but I was unable to find
> > any such documentation on their website.
> >
> > Thanks!
> >
> > Matt