VirusScan definition time

[Derek Lawlor]

Hello Using Citrix Receiver 4.9.2000.21 with NetScale gateway and McAfee Total Protection anti-virus - Error message is None of Antispyware installed on your machine has recent virus definition file

The epaHelper_epa_plugin log file report is below and seems to suggest that the product date stamp is a few months before the current date when the virus updates are current.

Has anyone else found this error? Is this because the script is looking at an incorrect location for McAfee?

Derek

--------------------- Scan--------------------------------

09:38:16.578 Successfully parsed tokens

09:38:16.609 Opswat lib init is successful

09:38:16.756 Found a product with product Name : Windows Defender [ID : 362], vendor Name : Microsoft Corporation [ID : 90] which met scan criteria

09:38:16.756 Found a product with product Name : McAfee Total Protection [ID : 566], vendor Name : McAfee, Inc. [ID : 379] which met scan criteria

09:38:16.756 Found 2 product(s) which met the scan criteria

09:38:16.772 Boolean compare failed.  Value false operator ==

09:38:16.778 Time compare failed : product timestamp : 1557615600, current timestamp : 1575625096, Actual difference in minutes : 300158, Expected difference in minutes : 11520

09:38:16.778 But expected diffrence is 11520 (minutes) and operator is '<='

09:38:16.778 scan failed because VirusScan definition time is not updated

09:38:16.778 Lang ID: en

 

09:38:16.778 Scan 'ANTIVIR_0_0_RTP_==_TRUE_VIRDEF-FILE-TIME_<=_11520' failed for method 'VIRDEF-FILE-TIME'

09:38:16.810 Collected error messages from EPA lib

[Rhonda Rowland1709152125]

Are you using the builtin EPA expression rule, your own EPA rule, or an OPSWAT scan.  (FYI - the built in rule is possibly ancient and you would be better of with OPSWAT.)  But there could be other factors at work.

Share your policy expression that you are using to see if there is more information to help you.

[Derek Lawlor]

Thanks - The built in rule

 

[Rhonda Rowland1709152125]

I don't know for sure, but I'm not sure the built in rule has changed since NS 9.x something.  

You can use the built in rule (named expression) as an example of what to look for, but I would definitely try to switch to an OPSWAT rule and build in the necessary details and see if you have different results.