Defintions won't install

[Guest]

I just connected to get the new spyware signatures, and it won't install
them. Every time I try, it says it's installing it, then when I update again
it installs the same ones. It has done that over and over. What should I do?

 

[Dave M]

Hi Hkenz, these are the current definitions. What do you have?

-on the About window:
Spyware Definition Version: 5785 (this is current)
-and on the Diagnostics window:
Definitions Increment Version: 138/138 (both numbers match)
Definitions ThreatAuditThreatData: 1345263
Definitions ThreatAuditScanData: 2963787
Definitions DeterminationData: 744384

 

[Guest]

5787 - 140/140 is the cruuent definitions, and I too am seeing the Update
loop.

 

[Dave M]

Thanks for the report dadkins;
Same dadkins as in the Broadband Cable Reports?

I suspect we're in the middle of a signature update... don't everyone go crazy
trying to update you'll overload the servers and we'll all wind up sitting here
waiting... I suggest you try again tomorrow... there are three update files
involved and they may not have all made it out to all servers all over the world
yet. 18,000,000 of you can impact this majorly. Scanning is not a MSAS
strong point anyway... Real Time Protection is much more important in Beta1.

 

[Bill Sanderson]

I agree with Dave--historically, a number of users seem to see this issue
early in the update cycle--give it a few hours or a day.

Retrying Check for Updates until both numbers come out equal is the method
that should work.

--

 

[Guest]

It's been doing it for a day now, and it still continues to do it. Is it
possible that this will stop soon?

 

[Frank Saunders, MS-MVP OE]

It's been doing it for a day now, and it still continues to do it. Is
it possible that this will stop soon?

Sure, but I don't intend to check again until next week unless someone posts
that 5789 is available.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Dave M]

5789... lol

Seriously, I'd suspect the zero day WMF exploit might have put a slight delay
on the updates. As in, hold the presses we gotta try to detect this before we
continue to ship out any more updates... The issue just became known late
yesterday, wouldn't you rather have it included than wait another week? I'm
just speculating of course... who knows. Sending out software in a corporate
environment is a complex change control issue... not just some dude punching a
button... been there, done that.

 

[Bill Sanderson]

It will get fixed eventually. I'd recommend simply retrying at
intervals--preferably hours or days intervals, rather than minutes.

I realize that this is annoying. What I find amazing is that the update
mechanism conceived and programmed by a small startup company has scaled to
18,000,000 installations, and a server mechanism which was unimagined, I
suspect, by the original designers. (perhaps I am selling them short!)

At any rate, there are some issues with how it is working for beta1. This
mechanism will be completely different, and quite well tested, in beta2--so
bear with it for what I hope will be a short time before beta2 is available.

--

 

[Bill Sanderson]

In addition--this is a time period in which Microsoft is short-staffed.
They actually allow people to take time off for the holidays--imagine?

So you may well be quite right about where the effort is going.

--

 

[Guest]

My home computer updates with no problems. At the office on w3ke sp1 running
terminal services, the signatures are from november 5th and won't change.
I've logged in as administrator from the console and tried updating and have
also removed and reinstalled msas without the updates updating. Any
suggestions?

 

[Bill Sanderson]

Remove/reinstall leaves the def files in place.

There are new def files today--haven't had a chance to test yet. This out
of band release probably means they are well worth getting, though. (In
terms of malware defined, not "fixing" this bug.)

You've got a situation with terminal services where you need to work to make
sure the files are not in use by multiple users.

Nov 5 is a long time back--that's earlier than the current code
release--something's definitely broken.

Here's what I'd do--work, on a TS Server, I;m afraid:

1) Uninstall Microsoft Antispyware
2) Delete\program files \microsoft antispyware and all subfolders.
Quarantine, history, and custom settings will be lost.
3) reinstall Microsoft Antispyware, logged in as administrator using the
latest code version.

Then update and see if diagnostics (help, about) shows 142/142


--

 

[Bill Sanderson]

And, fwiw:

I've managed to achieve 142/142 on a Small Business Server 2000 machine.
However, on a client attached to that server, I can't do any better than
140/138 after many tries--deleted local TIF, turned off ISA Server caching,
etc.....

We're at the mercy of the servers, I believe, and it still seems to be
largely luck in hitting a set of servers with the right bits. I think it
took three tries on the server, but after many tries on the workstation,
I've given up--I'm working from home remotely--I'll go in and try from the
office later.

--

 

[Guest]

Thanks. I had reinstalled, but not physically removed the directory from the
server. Deleting the files and then reinstalling worked.

 

[Guest]

I didn't want to become "part of the problem" yesterday, by continuously
trying to update. Updated to #5789 this morning (est) without a problem. It
IS within the realm of possibility.

 

[Bill Sanderson]

Good - my sense of what is happening is file corruption of some sort (at a
logical level--not a level the hardware or OS is responsible for.)

--

 

[Bill Sanderson]

That's good to hear. I've only managed it on one machine out of about 6
I've touched today.

--