7 Replies Latest reply on Dec 3, 2010 10:24 AM by Tony.Inglima

    LD9 AV client updates failing

    tfitzpatrick Apprentice

      We are in the process of moving from LD8.8 to LD9 and currently have several clients where the AV defs will not update.  Here is the log from one of them:

       

      Mon, 19 Apr 2010 08:46:40 Opening existing update event

      Mon, 19 Apr 2010 08:46:41 FILE VERSIONS...

      Mon, 19 Apr 2010 08:46:41 9.0.1.1      C:\Program Files\LANDesk\LDClient\antivirus\avservice.exe

      Mon, 19 Apr 2010 08:46:41 9.0.0.473    C:\Program Files\LANDesk\LDClient\antivirus\ldav.exe

      Mon, 19 Apr 2010 08:46:41 9.0.0.473    C:\Program Files\LANDesk\LDClient\antivirus\ldoutladdin.dll

      Mon, 19 Apr 2010 08:46:41 9.0.1.1      C:\Program Files\LANDesk\LDClient\vulscan.dll

      Mon, 19 Apr 2010 08:46:41 0.9.8.11     C:\Program Files\LANDesk\LDClient\libeay32.dll

      C:\Program Files\LANDesk\LDClient\antivirus\kavehost.exe contains no version information.  Result 1813

       

      Mon, 19 Apr 2010 08:46:41 8.0.2.45     C:\Program Files\LANDesk\LDClient\antivirus\kave8.dll

      Mon, 19 Apr 2010 08:46:41 8.4.0.76     system32\DRIVERS\klif.sys

      Mon, 19 Apr 2010 08:46:41 Update started

      Mon, 19 Apr 2010 08:46:41 Download from core then internet

      Mon, 19 Apr 2010 08:46:41 Core server name found in HKLM\SOFTWARE\Intel\LANDesk\LDWM: LD9

      Core server name found in HKLM\SOFTWARE\Intel\LANDesk\LDWM: LD9

      Mon, 19 Apr 2010 08:46:41 vulscan app path dir: C:\Program Files\LANDesk\LDClient\

      File C:\Program Files\LANDesk\Shared Files\ProxyHost.exe version within specified

      Using proxyhost to communicate with the core

      Loaded 835 custom variables from C:\Documents and Settings\All Users\Application Data\vulScan

       

      \CustomVariables.LD9.ini

      ERROR: lddwnld.dll does not exists.

      Last status: Failed

      Mon, 19 Apr 2010 08:46:41 Download from core then internet

      Updating antivirus settings from core

      vulscan app path dir: C:\Program Files\LANDesk\LDClient\

      vulscan app path dir: C:\Program Files\LANDesk\LDClient\

      Updating settings

      In SendRequest: Action = SOAPAction: "http://tempuri.org/GetHashForFile"

      Mon, 19 Apr 2010 08:46:41 SendRequest: SOAPAction: "http://tempuri.org/GetHashForFile"

      Last status: Contacting server...

      Mon, 19 Apr 2010 08:46:45 Success

      local address: 10.140.4.149

      Last status:

      Self update: files are up to date.

      Last status: Done

      vulscan app path dir: C:\Program Files\LANDesk\LDClient\

      AV - Not scheduling /scancomputer task

      vulscan app path dir: C:\Program Files\LANDesk\LDClient\

      Checking to see if taskID 893748 is already defined....

      Start comparing task filters....

      Filter count: 1

      Filter type = 10

      Checking for auto relay type...

      C:\Program Files\LANDesk\LDClient\antivirus\ldav.exe /update task is up to date

      Mon, 19 Apr 2010 08:46:45 Refreshing C:\Program Files\LANDesk\LDClient\antivirus\Temp_bases8\landesk\...

      Mon, 19 Apr 2010 08:48:36 Refreshing C:\Program Files\LANDesk\LDClient\antivirus\Temp_bases8\landesk\stat\...

      ERROR: lddwnld.dll does not exists.

      Last status: Failed

      Mon, 19 Apr 2010 08:48:36 ERROR: Failed to download the files from core.  Retrying download from core.

      Mon, 19 Apr 2010 08:48:36 Refreshing C:\Program Files\LANDesk\LDClient\antivirus\Temp_bases8\landesk\...

      Mon, 19 Apr 2010 08:48:45 Refreshing C:\Program Files\LANDesk\LDClient\antivirus\Temp_bases8\landesk\stat\...

      ERROR: lddwnld.dll does not exists.

      Last status: Failed

      Mon, 19 Apr 2010 08:48:45 ERROR: Failed to download the files from core.  Retrying download from core.

      Mon, 19 Apr 2010 08:48:45 Updater: Connected to the core, but failed to update the pattern files from the core.  No

       

      internet download will be attempted.

      Mon, 19 Apr 2010 08:48:45 Copying *.key files from C:\Program Files\LANDesk\LDClient\antivirus\bases8\ to C:

       

      \Program Files\LANDesk\LDClient\antivirus\

      Mon, 19 Apr 2010 08:48:45 Update ended : (0x80004005)

      Mon, 19 Apr 2010 08:48:45 ERROR: failed to update from core : (0x80004005)

      Mon, 19 Apr 2010 08:48:45 Exiting channel 0.

       

      The common line that I am finding in all the devices that are failing is the ERROR: lddwnld.dll does not exists.  I have tried removing and re-installing the client but the AV still will not update.

        • 1. Re: LD9 AV client updates failing
          LANDave SupportEmployee

          We are currently investigating this issue.  We should have something within the next few days.

          • 2. Re: LD9 AV client updates failing
            Rookie

            I am currently running into this problem as well. I'm running LDMS 9.0 Fresh install with SP2, no upgrade. Has there been any update to this issue?

            • 3. Re: LD9 AV client updates failing
              LANDave SupportEmployee

              Can you post the following logs? 

               

              Client: (XP) C:\Documents and Settings\All Users\Application Data\LANDeskAV\AVService_Update.log

                         (Vista/7) C:\ProgramData\LANDeskAV\AVService_Update.log

               

              Core: \Program Files (x86)\LANDesk\ManagementSuite\log\WSVulnerabilityCore.dll.log

              • 4. Re: LD9 AV client updates failing
                Rookie

                Unfortunately, I uninstalled and reinstalled LDAV on the machine in question before saving the log file. The reinstall did fix the issue though. I'll see if I can find a second machine with the issue and post the log here. As a side note: This all started with investigating a slow performance issue on the computer after installing the LD Agent w/antivirus. Several days went by before my initial inspection, and today I noticed the virus defs would not update on this particular machine. In my AV settings I have def updates checking every hour. My assumption is that the AV client was stuck in loop trying to update the defs causing the slow performance. Since uninstalling and reinstalling, the client seems to be working beter. Time will tell though. I have since changed the update check from 1 hour to 3 hours since LD doesn't seem to update more than 3/4 times per day. The computer experiencing slow performance are running XP SP3 with 512 megs of ram. I may be looking at upgrading them to a gig to solve the speed issue.  Thanks for your help and suggestions.

                 

                Tony...

                • 5. Re: LD9 AV client updates failing
                  Rookie

                  I found a log file for your review. The strange thing here is that the update appears to succeed according to the log but when you look at the LDAV gui, it still shows 12-1. I have several other clients doing the same thing. I deleted the ldbasesinfo.xml and ran a manual update and now the date shows correct in the gui. Is this normal?

                  • 6. Re: LD9 AV client updates failing
                    Employee

                    stop the landesk av service.

                     

                    go to

                     

                    program files\landesk\ldclient\antivirus

                     

                    delete the bases8 folder and the temp_bases8 folder.

                     

                    restart the av service.

                     

                    Let me know if this updates the date and time.

                    • 7. Re: LD9 AV client updates failing
                      Rookie

                      Hello Ty,

                       

                      Yes, this worked. Strange!