Definitions Update

[Guest]

Does any of you notice that when you run update, it keeps updating same
definitions over and over. I run update several times in a row and it appears
like MSAS is not installing updates properly so it keeps installing again the
same definitions when I run it next time.

Maybe I am missing something but it sure doesn't sound right.

 

[Guest]

Hello Dusan,

Try this:
Reboot
1) File, check for updªte
2) Help, abºut

What version number now shºws?
Let us know how it works ºut.

Engel

 

[Dave M]

Hello Dusan;
I had this problem for about three months in a row, every week. Sometimes it
took 12 attempts to download correctly even until the Sunday following the
Thursday release. I was using 56K dial-up. Then I upgraded to cable at 6+Meg,
suddenly no problems for the past several weeks. Does that tell us anything? I
believe the update servers are:

1. overloaded with 18,000,000+ worldwide weekly downloads.
2. forcing a timeout after a certain period of time has elapsed.
3. both of the above.

Check not only your About definition version, but also the Diagnostics to be
sure all 3 Data files are current and that the increment numbers match as in
this weeks 138/138 below:

Spyware Definition Version: 5785
Definitions Increment Version: 138/138
Definitions ThreatAuditThreatData: 1345263
Definitions ThreatAuditScanData: 2963787
Definitions DeterminationData: 744384

Randy Knobloch (MVP) posts these numbers in forum announcements regularly for
each weekly cycle. If your numbers don't match, keep trying, or get a higher
speed connection, or wait for Beta2 where definition updates will be handled
much differently.

 

[Guest]

I checked in About and it says that i have 5785 installed ... even though
when I click on update it starts saying again that it is upgrading from 5783
to 5785.

The problem might be that I am using dial-up. I assume that the upgrade did
occur but for some reason the server tries installing it again. I'll trust
what it says in the About menu ...

Thank you both for your help.

Dusan

 

[Dave M]

Dusan;
Checking just About is NOT enough to be sure... you must check all numbers to
confirm. On the About page Click Diagnostics

 

[Guest]

No Prºblem, I use 56K dial-up (actually 42.6).

Engel

 

[Dave M]

Hi Engle;
I know your on the west coast of the US... Are you near San Francisco or ? I
suspect we're dealing with a whole different set of servers, but there are a ton
of other factors involved too. I know my updates usually come from SF which is
close by, but I don't know where you're positioned. Yes, my 56K modem was
actually running at a max of 46K.

All I do know for sure is that these past three updates were a 180 degree change
from the prior three months...and am I happy about it.
The cable and DSL providers are offering some competitive rates right now.
You'd be thrilled with the difference, even if it doesn't help your already
successful MSAS updates. My whole method of working has totally changed.

 

[Guest]

Hi Dave,

Well I'm far from Frisco, I'm in Catalina Island. Still I have a contract
until June next year, after that, probably change to DSL. Thank you for the
info.

A little bet early, but, Happy Holidays and Happy New Year 2006 to you and
all your family.

Engel

 

[Guest]

Ok well this really doesn't make sense ...

This morning when I turned on my computer, I went to check the definitions
version and it said 5783. So I went to the diagnostics in About and this is
what it said ...

Definitions Increment Version: 136/138
Definitions ThreatAuditThreatData: 1345263
Definitions ThreatAuditScanData: 2963787
Definitions DeterminationData: 744384

So then I went to update again and I got a message that I already have
installed latest version of definitions. So I went back to the
About/Diagnostics and this is what it says now ...

Definitions Increment Version: 138/138
Definitions ThreatAuditThreatData: 1345263
Definitions ThreatAuditScanData: 2963787
Definitions DeterminationData: 744384

And I swear it didn't do any upgrade in the meantime. It's either a software
or a server issue. Looks like the software has some issue with recognizing
definitions upgrade.

 

[Bill Sanderson]

Here's a check on what you are seeing--don't trust the numbers!

In addition to going to help, about, also hit the Diagnostics button. Look
down the list for a line ending like this: 138/138

I'd bet that you are seeing something like 136/138 (or perhaps the reverse)

In my experience, a mismatch in these numbers indicates that the update is
not, in fact, complete. In my case, I usually just do another file, check
for updates, and the issue is corrected. Occasionally, early in the def
distribution timeline--it has taken multiple tries.



--

 

[Bill Sanderson]

You've just posted what I expected--see my earlier post of today.

This is a typical experience with a definition update failure. On the
second File, check for updates, you didn't see the messages that indicate an
update occurring--but something did change.

I don't know the details of what is happening here, but if in doubt, look
for the 138/138 (next time it will be 140/140--and if the numbers aren't
equal, do another file, check for update.

Beta2 won't have this issue.

--

 

[Guest]

Yes, that's exactly what's happening ...

I will just keep updating and wait for beta 2.

Thanks.

 

[Guest]

Lets just put you guys of with all the numbers and things your talking
about (LOL)

explain this

Definitions Increment Version: 126/138
Definitions ThreatAuditThreatData: 1345263
Definitions ThreatAuditScanData: 2963787
Definitions DeterminationData: 744384

I'm Perfectly up to date
Got 10 meg broadband though lol

 

[Guest]

and then you run update again and it will not update (i got the latest ...
Doh)
.... then it will update the version numbers

 

[Dave M]

Oh, you had to ask, LOL;

Well, I'm not sure I can explain all or any of it, but the three Data files are
parts of any new signature definitions that form the database that MSAS uses for
detecting footprints of malicious code. As to the numbers behind each...
nothing magic about that, it's just the size of each file being downloaded from
Spynet as a .gcd file extension. As to why the Versions 126 and 138 don't
match, when you seem to be up to date otherwise, all I can say is... Good
Question. I think maybe we need to make up a new rule, hahaha.

Rolf's rule #1: If you're on close to a T-1 connection, all of the above may
not apply.

 

[Bill Sanderson]

After the second "update" when apparently nothing happened except the
version number changed, do you now see 138/138?

If those two numbers don't match, it isn't properly updated yet--although I
can't say in detail exactly what is wrong--or how significant it is.

 

[Guest]

It works very simple in these steps ...

Check version (file) --- > update 'About-Diag' to 126/138 --- > Update cos
numbers dont match

UPDATED

next time

Check version (file) --- > update 'About-Diag' to 138/138 --- > No Update
cos numbers match


They simply got the order wrong LOL

Taterataaaaaaa
Thats All Folks

 

[Bill Sanderson]

The mismatch can run either way first number lower or second number
lower--although the first is much more common.

I've not taken the time to work out exactly what it means--I suspect it's
the specific files in the definition set--but with luck, all this will be
history in a short period of time.