Summary:
Virus Pattern incorrect or not updated. Automatic virus pattern download is not working and/or "update now" feature doesn't work.

Symptom:
- Event Log Error
- Newer Viruses not being detected
- Proxy Server prevents ftp update
- MMS server doesn't have FTP access to Internet (firewall)
- Virus pattern update fails

Detailed Information:
By Default the Virus Manager checks daily to see if a new Virus Pattern is available. This setting can be changed from 1 hour to x weeks. The Monitor Service must be started for this check to occur.

Certain scenarios prevents the MMS Virus Manager from automatically updating its virus signature.

- The Automatically Update check-box is not enabled in the Virus Manager Properties.
- The MMS Server is behind a Firewall that prevents it from using FTP to update the Virus Pattern.
- If MMS should go through a proxy, verify that your FTP proxy settings are correct under Countermeasures->Properties->FTP Proxy.
- If WorldSecure version 3.6.x or 4.0.x is using ODBC Database Logging (default), the x:\..\..\WorldSecure\Database\wss.mdb file might be corrupted. (See article on rebuilding the WSS.MBD Database) This does not apply to 4.3 and later which use SQL databases.
- For MMS 4.x, the MMS Monitor Service (or WorldSecure Monitor Service) is not started (see Control Panel, Services)

MMS 4.7 and later allow for push button Virus Engine Updates. Go to Virus Manager -> Properties. See the online help for additional information.

MMS uses the ftp path stored in the registry to perform updates of virus patterns and virus engines. The default path in the registry is ftp://download.worldtalk.com/antivirus/. You can modify the location that MMS looks for updates by modifying the registry. You should only do this if your MMS server does not directly access the Internet, and you have copied the latest files to a local FTP server.

Warning: Modifying the NT registry can cause permanent damage that may not be recoverable. Changes to the registry should only be performed by administrators familiar with the registry and that understand the possible repercussions.

HKLM\Software\Worldtalk\WorldSecure Server\Monitor Service\VirusPatternUpdate\McAfee\ -> FTP Server

HKLM\Software\Worldtalk\WorldSecure Server\Monitor Service\VirusPatternUpdate\McAfee\ -> FTP Directory

Resolution:
- Check Settings and/or Services.
- Rebuild WSS.MDB database if needed. (4.0.2 and earlier only)

MANUAL UPDATE OF VIRUS PATTERN:
1. Download: DAT-####.zip and EXTRA-####.zip from ftp://download.worldtalk.com/antivirus/ where #### is the highest number available.
2. Extract *.DAT files from both downloaded zip files. (There should be 4 standard and 1 extra)
3. Create a Sub-Folder under ..\WorldSecure\ corresponding to the Pattern number on the DAT-####.zip file.
ex.) c:\program files\Worldtalk\WorldSecure\####
4. Copy *.DAT files to that folder
5. Restart SMTP Relay Service (if needed)
6. Goto Virus Manager Properties, click-on [Update Now...] Button

MANUAL UPDATE OF VIRUS ENGINE:
1. Download VIP-XXXX.zip from ftp://download.worldtalk.com/antivirus/ where #### is the highest number available.
2. Stop the SMTP Relay, Monitor Service and close the configuration utility.
3. Backup the current "mckrnl32.dll" and "McScan32.dll" on in the MMS installation directory if they exist. (4.7 and later does not use the file mckrnl32.dll)
4. Extract the contents of the VIP-XXXX.zip file into the MMS installation directory, overwriting older files where appropriate.
5. Restart the SMTP Relay

Status:
confirmed.

Additional Info:
SEE ALSO ARTICLE TITLED: Automatic Virus Pattern update schedule

Retrieving Virus Pattern from Tumbleweed Server with MANUAL FTP Using Command Prompt

D:\>ftp download.worldtalk.com
User (download.worldtalk.com:(none)): anonymous
Password: guest
ftp> cd antivirus
ftp> bin
ftp> dir
11-18-99 03:27PM 1560769 dat-4052.zip
ftp> get
(remote-file) dat-4052.zip
(local-file) d:\dat-4052.zip
ftp> quit
D:\> exit

Original Author: RSHAFER
Original Submitter: SMEDEIROS
Keywords: VIRUS PATTERN, PROXY, WSS.MDB, VIRUS MANAGER firewall ftp manual update MMS ID#20361