6 Replies Latest reply on Feb 6, 2008 8:38 AM by fribergb

    tERRORble Error message... just hERRORble!!

    Apprentice

       

      We got this one again on multiple stations.   It's the worst ever- it says "LANDesk" on it so it hurts us in our campaign to tell everyone the benefits of LANDesk and it prompts people to call the helpdesk.

       

       

      Also, it doesn't tell you if you are protected or not, or what to do.   Finally, there is nothing that we've been instructed to do or say when the user gets this.   Damn.

       

       

      After our IT director and the Assistant Vice Chancellor (who runs our entire department) got this error message we had a serious problem on our hands.

       

       

      Worst of all, the client LOCKS in the update-signature-file process so you can't fix it by simply repairing the signature file... you have to run a vulscan on the target machine.

       

       

      Is this message or the terminology it uses smarter in 8.8?   If not, please please please fix it right away... sending my users a message directing them to call ME with no solution is a terrible idea... 

       

       

      Is it just me?

       

       

      Here's the message:

       

       

       

       

                               <What repair options???>

       

       

       

       

       

       

      Here's the problem on the server end:

       

       

       

       

       

       

       

      Crap and Damn,

       

       

      -B

       

       

        • 1. Re: tERRORble Error message... just hERRORble!!
          Jared Barneck SupportEmployee

          On the Core Server, run ldlogon\antivirus\updatevirusdefinitions.exe from a command prompt.

           

          I think the Core side error is causing the client side error.  The above command should fix the Core side.  If not, you will maybe see why in the command prompt as the status is output to the screen.

           

          Once it is fixed on the Core Side, run something like vulscan /installav

          • 2. Re: tERRORble Error message... just hERRORble!!
            Apprentice

             

            That's what I'm thinking too.   I think the core server causes the error which leaves many many clients calling.

             

             

            But I do know how to fix it... what I'm asking is "can they fix the error message?" esp. in 8.8.... or an SP??

             

             

            And is there a way that we can get the AV client not to lock when the core has a bad sig. file?   Replacing it on the server doesn't help 'cause for some reason it's not fully interactively healing!!!

             

             

            -B

             

             

            • 3. Re: tERRORble Error message... just hERRORble!!
              Jared Barneck SupportEmployee

              It was mentioned to me that in 8.8 there may be some auto-healing...like it tries to use a backup folder if the bases folder is corrupt.

               

              I haven't tested it or verified it though.

              1 of 1 people found this helpful
              • 4. Re: tERRORble Error message... just hERRORble!!
                Apprentice

                 

                Yes, if you could verify.

                 

                 

                That would probably tip the scale for us going to 8.8 sooner rather than later... that would be a very valuable addition to the software.    Esp... if, like I figure, the user is unprotected while caught in this state.

                 

                 

                Thanks!

                 

                 

                 

                 

                 

                -B

                 

                 

                • 5. Re: tERRORble Error message... just hERRORble!!
                  phoffmann SupportEmployee

                  LANDesk ManagementSuite 8.8 does do a backup of the "last known good" AV-definitions.

                   

                  LANDesk ManagementSuite 8.7 will do this as well, as of SP 5 (we updated the AV-engine accordingly).

                   

                  Note that the # of previous definition backups you make is configurable (open Security and Patch Manager -> click on the "DOWNLOAD UPDATES" and go to the "LANDesk Antivirus"-tab - the option is in the lower half of the window). While that on its own is not quite a "last known good" so to speak, it does give an option to people who have not had a chance yet to upgrade to SP5 to react quicker, in case of problems with their definition download.

                   

                  Running the following script will force clients to install the AV-content on the core. Note that this is NOT bandwidth friendly - and while the task may come back as successful, clients may well need 15-20 minutes to fully update. So you will want to run this in small and controlled groups ! Put the following into the 'MACHINES' or 'MACHINES_NT' section of a custom script.

                   

                  REMEXEC1=<qt/>%LDMS_CLIENT_DIR%\Antivirus\UpdateVirusDefinitions.exe<qt/> /reset, STATUS

                   

                  NOTE: Again - this is NOT bandwidth friendly, so please use with caution

                   

                  Paul Hoffmann

                  LANDesk EMEA Technical Lead

                  • 6. Re: tERRORble Error message... just hERRORble!!
                    Apprentice

                     

                    Paul,

                     

                     

                    Thanks for the reply.

                     

                     

                    Maybe I'm just venting... which is a GOOD think because tomorrow I'm going to the LANDesk regional user's group in Denver and it's better for EVERYONE if I get this out of my system.   But c'mon.... you guys got to look at the questions before you write a quick answer about how you can solve my problem with a script.   First off, I already saw your script example in another thread (and took your advice!     ).... and more importantly, why do I have to do a script every time to compensate for the fact that the software is CAUSING service calls??

                     

                     

                    My goal here is to communicate to you and to the community at large what the experience is in the field... in MY reality.  And hopefully either get acknowledgement or (at the very least) get the developers to consider putting something more intelligent on the error message than "Error code x93848349534 CALL your IT Administrator"

                     

                     

                     

                    (hey- how 'bout we get a script where we can change the error message box to say "Call LANDesk support"- that would be AWESOME)

                    {/rant}

                     

                     

                    Original question 1:  Is this error message any smarter in 8.8?

                     

                     

                    OQ2:  Is it just me?  Does everyone else think this message is OK to send to users when the AV breaks?  It's cryptic, meaningless, alarming and it doesn't even tell you if protection is ON or OFF.

                     

                     

                    OQ3:  What repair options?   It says "contact your IT representative for Repair Options"

                     

                     

                    Then, (sorry, but I guess I do this a lot) I asked a follow-up question:

                     

                     

                    FQ1:  Does the AV self-heal if we replace the damaged signature file on the core?   Jared mentioned that he thinks it might in 8.8.   I'm sure only the developers and testing team would know...  that would help a TON if we could tell people that it will self-correct.

                     

                     

                    If, starting in SP5, the client keeps a copy of the last-known-good signature before it broke, then I'll be WAY more agressive about pushing out SP5... I didn't really care about the other improvements.  But that is a MAJOR improvement that we should have known about!!!

                     

                     

                    If the AV can self-heal in 8.8 then put us down for an early upgrade- we usually wait.  But I can't have broken AV out there- that is totally unacceptable.

                     

                     

                    Thanks for listening...

                     

                     

                     

                     

                     

                    -B