Re: Antivirus scanner definition file update failed

HansRL · ‎2021-05-30

For my situation did the new firmware (6.10.5 and also the beta version of 6.10.5 (t11)) resolve the issue with updating the virus-definitions, but reading the other entries it is still not resolved for everyone.
So for me only the outdated CLAMAV installation is an open item (running version 0.100.2 in stead of the current version 0.103.2)

scrjs · ‎2021-05-30

My RN314 was upgraded to the generally available firmware 6.10.5 two days ago and AV is updating as expected

root@xxxxxReadyNAS:~# systemctl status clamav-freshclam.service
● clamav-freshclam.service - ClamAV virus database updater
   Loaded: loaded (/lib/systemd/system/clamav-freshclam.service; static; vendor preset: disabled)
   Active: inactive (dead) since Sun 2021-05-30 17:26:36 AEST; 1h 18min ago
  Process: 29781 ExecStart=/usr/bin/freshclam --quiet (code=exited, status=0/SUCCESS)
 Main PID: 29781 (code=exited, status=0/SUCCESS)

May 30 17:26:18 xxxxxReadyNAS freshclam[29781]: Your ClamAV installation is OUTDATED!
May 30 17:26:18 xxxxxReadyNAS freshclam[29781]: Local version: 0.100.2 Recommended version: 0.103.2
May 30 17:26:18 xxxxxReadyNAS freshclam[29781]: DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
May 30 17:26:18 xxxxxReadyNAS freshclam[29781]: main.cld is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
May 30 17:26:22 xxxxxReadyNAS freshclam[29781]: Downloading daily-26185.cdiff [100%]
May 30 17:26:26 xxxxxReadyNAS freshclam[29781]: daily.cld updated (version: 26185, sigs: 3984024, f-level: 63, builder: raynman)
May 30 17:26:26 xxxxxReadyNAS freshclam[29781]: bytecode.cld is up to date (version: 333, sigs: 92, f-level: 63, builder: awillia2)
May 30 17:26:35 xxxxxReadyNAS freshclam[29781]: Database updated (8549018 signatures) from database.clamav.net (IP: 104.16.218.84)
May 30 17:26:35 xxxxxReadyNAS freshclam[29781]: Clamd successfully notified about the update.
May 30 17:26:36 xxxxxReadyNAS systemd[1]: Started ClamAV virus database updater.

Prior to this it was running 6.10.4 Hotfix 1 which FIXED the AV not updating for me.

I aslo asked the question regarding "Your ClamAV installation is OUTDATED!" in community post Your-ClamAV-installation-is-OUTDATED to which @B_L responded

The ClamAV version in the latest 6.10.4 firmware and the upcoming 6.10.5 firmware is 0.100.2.  It works well in ReadyNAS device so far.

It is not recommended to upgrade the ClamAV engine manually. 

ReadyNAS engineering team will be looking into the plan of upgrading it to the latest version in the future firmware release.

I have not seen a post that lets the community know if there is any plans to upgrade

@B_L any thoughts?

swehjo · ‎2021-05-31

Hi everyone,

Updated to the new release, 6.10.5, yesterday. I have rebootet and restarted my 424 a few times after that but still get "Antivirus scanner definition file update failed due to download failure. Check your Internet connection." AV version is still "Mar 10, 2021 13:08:51"

Jetlag1 · ‎2021-06-01

I would publically thank Justin @dingjs1421 for remotely fixing this issue on my 526X.

Got a PM from him as soon as I logged on this morning, virus definitions are now current.

Thanks Justin, nice work!

swehjo · ‎2021-06-01

@Marc_V You earlier wrote if anyone had contacted support. Since my AV update still don't work I have to purchase Premium support to get this solved?!

JohnCM_S · ‎2021-06-01

Hi @swehjo,

You may download the system logs of your NAS then provide to me so we can check. You may upload it to a cloud storage site (Google Drive, Dropbox, etc.) then send me the download link via private message.

Regards,

Blaine_ · ‎2021-06-23

I had this same problem and looked at the ClamAV site's troubleshooting tips. SSH'ing to the NetGear box, stopping FreshClam, deleting the daily.cld and mirrors.dat files, and then starting up FreshClam again finally got it working for me (after updating to firmware 6.10.5, but not sure that was necessary):

systemctl stop clamav-freshclam.service
rm /var/lib/clamav/mirrors.dat
rm /var/lib/clamav/daily.cld
systemctl start clamav-freshclam.service
freshclam -v

I think the virus checker updates had stopped working when our old RN3130 died and we swapped the drives into a newly-purchased 2304. Nothing else I'd seen here and tried worked. The ClamAV docs say to delete the daily.cvd file to force a reload of it, and we just had a daily.cld, so the first time I tried this, it didn't work because I didn't delete daily.cld. When I included that step (third step above), FreshClam started up properly and updated to the latest virus definitions.

xingbat · ‎2021-08-27

Greetings,

I recently upgraded from a RN10400 to a used RN42400. Overall went smoothly except now, like many others, the Antivirus does not update. I updated the firmware to 6.10.5 Hotfix 1.

The Antivirus is yellow with a date of Mar 21, 2019 12:52:58AM. Updates fail every 24 hours saying "Antivirus scanner definition file update failed due to download failure. Check your Internet connection." All other indications are the Internet connect is working, including downloading the list of available Apps. I've tried multiple restarts and re-enablements. I've also followed the SSH steps below without luck.

I've seen your most generous offers to assist and wondering if you might help me. I can upload logs and DM you a link if that is where to start.

Thanks

Angel_Infotron · ‎2021-08-31

Muchas gracias:

Esto me solucionó el problema !!

jimk1963 · ‎2021-09-08

RN528X and RN314 AV updates are now working, for unknown reason(s). RN528X has been on 6.10.5 Hotfix 1 for months. RN314 was on 6.10.4 Hotfix and when I upgraded to 6.10.5 Hotfix 1, AV update worked.

RN212 however, still won't update AV (stuck on 9/24/2020) and it's also been on 6.10.5 Hotfix 1 for months. Read through all 300+ posts here, don't see any clear solutions other than possibly hacking in through SSH and playing with ClamAV.

Am I missing a solution?

dweinshel · ‎2021-09-08

What worked for me after the same experience was downloading a "fresh" copy of the finalized 6.10.5 Firmware.

When I flashed the NAS with that, the problem has not recurred.

Good luck.

DW

MaxKublin · ‎2021-09-14

root@MAKUNASWEB:~# freshclam                                                                                                                                                                                                                                                   
ClamAV update process started at Tue Sep 14 12:58:58 2021                                                                                                                                                                                                                      
WARNING: Your ClamAV installation is OUTDATED!                                                                                                                                                                                                                                 
WARNING: Local version: 0.100.2 Recommended version: 0.103.3                                                                                                                                                                                                                   
DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav                                                                                                                                                                                                            
main.cvd is up to date (version: 61, sigs: 6607162, f-level: 90, builder: sigmgr)                                                                                                                                                                                              
Downloading daily-26293.cdiff [100%]                                                                                                                                                                                                                                           
Downloading daily-26294.cdiff [100%]                                                                                                                                                                                                                                           
daily.cld updated (version: 26294, sigs: 1972718, f-level: 90, builder: raynman)                                                                                                                                                                                               
bytecode.cld is up to date (version: 333, sigs: 92, f-level: 63, builder: awillia2)                                                                                                                                                                                            
Database updated (8579972 signatures) from database.clamav.net (IP: 104.16.218.84)                                                                                                                                                                                             
Clamd successfully notified about the update.                                                                                                                                                                                                                                  
root@MAKUNASWEB:~#

I have several 626X/628X

On bad "good" machine, I get:

root@MAKUNASWEB2:~# freshclam                                                                                                                                                                                                                                                 
ClamAV update process started at Tue Sep 14 12:59:19 2021                                                                                                                                                                                                                     
WARNING: Your ClamAV installation is OUTDATED!                                                                                                                                                                                                                                
WARNING: Local version: 0.100.2 Recommended version: 0.103.3                                                                                                                                                                                                                  
DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav                                                                                                                                                                                                           
main.cvd is up to date (version: 61, sigs: 6607162, f-level: 90, builder: sigmgr)                                                                                                                                                                                             
nonblock_connect: connect(): fd=4 errno=101: Network is unreachable                                                                                                                                                                                                           
Can't connect to port 80 of host database.clamav.net (IP: 2606:4700::6810:db54)                                                                                                                                                                                               
Trying host database.clamav.net (2606:4700::6810:da54)...                                                                                                                                                                                                                     
nonblock_connect: connect(): fd=4 errno=101: Network is unreachable                                                                                                                                                                                                           
Can't connect to port 80 of host database.clamav.net (IP: 2606:4700::6810:da54)                                                                                                                                                                                               
WARNING: getpatch: Can't download daily-26276.cdiff from database.clamav.net                                                                                                                                                                                                  
WARNING: getpatch: Can't download daily-26276.cdiff from database.clamav.net                                                                                                                                                                                                  
WARNING: getpatch: Can't download daily-26276.cdiff from database.clamav.net                                                                                                                                                                                                  
WARNING: getpatch: Can't download daily-26276.cdiff from database.clamav.net                                                                                                                                                                                                  
WARNING: getpatch: Can't download daily-26276.cdiff from database.clamav.net                                                                                                                                                                                                  
WARNING: Incremental update failed, trying to download daily.cvd                                                                                                                                                                                                              
nonblock_connect: connect(): fd=4 errno=101: Network is unreachable                                                                                                                                                                                                           
Can't connect to port 80 of host database.clamav.net (IP: 2606:4700::6810:db54)                                                                                                                                                                                               
Trying host database.clamav.net (2606:4700::6810:da54)...                                                                                                                                                                                                                     
nonblock_connect: connect(): fd=4 errno=101: Network is unreachable                                                                                                                                                                                                           
Can't connect to port 80 of host database.clamav.net (IP: 2606:4700::6810:da54)                                                                                                                                                                                               
WARNING: Can't download daily.cvd from database.clamav.net                                                                                                                                                                                                                    
Trying again in 5 secs...

StephenB · ‎2021-09-14

@MaxKublin wrote:

Database updated (8579972 signatures) from database.clamav.net (IP: 104.16.218.84)

Can't connect to port 80 of host database.clamav.net (IP: 2606:4700::6810:da54)

One obvious difference is that the NAS that is failing is trying to connect with ipv6, and the one that succeeds is using ipv4.

Which suggests that you might try disabling ipv6 on the NAS that fails.

MaxKublin · ‎2021-09-14

Hello,

The difference between my "good ReadyNAS" and the bad ones seems to be:
- Good one is online 24x7
- The others are offline (I wake them up with a MAGIC packet)
All NAS boxes are able to ping database.clamav.net - so the Network is NOT the issue.
I guess the issue is that the machines which where offline for several weeks try to
request a daily-26276.cdiff - which no longer exists - so they will never be able
to update 😞
I guess the only remedy is to uninstall and re-install the CLAMAV software on the
ReadyNAS - but I don't want to do a full reset of the NAS ....

Any hints how to uninstall/re-install/or reset the CLAMAV software and/or database
on the ReadyNAS is highly appreciated!

MaxKublin · ‎2021-09-14

Good point with IP V4 vs IP V6.
However, nothing has changed here - all machines succeeded to update the antivirus for a long time.
However, I will give it a try and change to IP V4.
Any hints what needs to be configured on the NAS?

StephenB · ‎2021-09-14

Well, I still suggest a test with ipv6 disabled. You are getting network unreachable errors on the problem NAS

Trying host database.clamav.net (2606:4700::6810:da54)...                                                                                                                                                                                                                
nonblock_connect: connect(): fd=4 errno=101: Network is unreachable

You could also rename /var/lib/clamav/daily.cvd, and then run freshclam. If that works, delete the renamed file. If not, then just rename it back.

StephenB · ‎2021-09-14

@MaxKublin wrote:

Any hints what needs to be configured on the NAS?

Go to the network tab in the NAS web ui, there is a control to disable ipv6 there.

MaxKublin · ‎2021-09-14

Re-installing the latest Firmware 6.10.5 did not help.
CLAMAV still asks for the same daily-26276.cdiff - AND FAILS.
In the WWW I find that the same problem exists on totally different HW,
e.g. on QNAP - so I am meanwhile convinced that this is a problem of CLAMAV.
Other users (e.g. using QNAP) are also desparately looking for a way to
reset/re-install the CLAMAV Software......

Jetlag1 · ‎2021-09-19

Damn, just a few months after it was repaired my antivirus definitions have begun failing again. Last successfull update was 9-5-2021.

scrjs · ‎2021-09-20

I agree there seems to be a new issue. I have changed nothing on my ReadyNAS 314 and AV updates started failing on Sept 17

I am running firmware 6.10.5 Hotfix 1.

What I noted when investigating is that the "clamav-freshclam.service" has failed as noted below

root@XXXXXReadyNAS:~# systemctl status clamav-freshclam.service
● clamav-freshclam.service - ClamAV virus database updater
   Loaded: loaded (/lib/systemd/system/clamav-freshclam.service; static; vendor preset: disabled)
   Active: failed (Result: exit-code) since Mon 2021-09-20 17:05:44 AEST; 20min ago
  Process: 4458 ExecStart=/usr/bin/freshclam --quiet (code=exited, status=1/FAILURE)
 Main PID: 4458 (code=exited, status=1/FAILURE)

Sep 20 17:05:44 XXXXXReadyNAS systemd[1]: Starting ClamAV virus database updater...
Sep 20 17:05:44 XXXXXReadyNAS freshclam[4458]: ClamAV update process started at Mon Sep 20 17:05:44 2021
Sep 20 17:05:44 XXXXXReadyNAS freshclam[4458]: Your ClamAV installation is OUTDATED!
Sep 20 17:05:44 XXXXXReadyNAS freshclam[4458]: Local version: 0.100.2 Recommended version: 0.103.3
Sep 20 17:05:44 XXXXXReadyNAS freshclam[4458]: DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
Sep 20 17:05:44 XXXXXReadyNAS freshclam[4458]: main.cvd is up to date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr)
Sep 20 17:05:44 XXXXXReadyNAS systemd[1]: clamav-freshclam.service: Main process exited, code=exited, status=1/FAILURE
Sep 20 17:05:44 XXXXXReadyNAS systemd[1]: Failed to start ClamAV virus database updater.
Sep 20 17:05:44 XXXXXReadyNAS systemd[1]: clamav-freshclam.service: Unit entered failed state.
Sep 20 17:05:44 XXXXXReadyNAS systemd[1]: clamav-freshclam.service: Failed with result 'exit-code'.

This happens 15 - 20 minutes after I restarted the NAS

Any thoughts @B_L or others?

xingbat · ‎2021-09-20

I'm in the same boat. After a kind person here helped me get mine working a few weeks ago the virus definitions had been updating pretty much daily until recently. The last update I show is Sept 21, 2021 06:59:37 AM.

xingbat · ‎2021-09-21

Update - after yesterday's message my definitions updated from 9/16 to 9/19, still a couple of days old, but at least they updated.

Sandshark · ‎2021-09-21

I see problems of this type also being reported on sites not associated with ReadyNAS, so I think there is an issue with ClamAV, not something under Netgear's control. It's unclear why not everyone seems to be affected.

TerryJColes · ‎2021-10-31

After I fixed this by following advice on this Forum in March, I've had no problems with this until yesterday.

The device is reporting the same problem again.

swehjo · ‎2021-10-31

Same for me. Failed yesterday and today.

Re: Antivirus scanner definition file update failed