Document ID:2002103012571948 Last Modified:05/05/2004

How to update virus definitions for Symantec AntiVirus Corporate Edition

Situation:
This document describes the procedures to update virus definitions for Symantec AntiVirus Corporate Edition.

Solution:
There are four methods for updating virus definitions:

• The Virus Definition Transport Method (VDTM)
• LiveUpdate
• Copying an .xdb file
• Intelligent Updater

Before you begin: If you are using Norton AntiVirus Corporate Edition 7.x, some of these instructions will not work. For the correct procedures, read the document How to update virus definitions for Norton AntiVirus Corporate Edition.

Read the following descriptions, and choose a method or combination of methods that works best for your environment.

The Virus Definitions Transport Method (VDTM)
The VDTM is a fully automated solution for virus definitions distribution, and is enabled by default between servers and their managed clients. With the VDTM, it is only necessary to update one server in order to update all computers in the network. The server gets definitions updates using LiveUpdate or an .xdb file, and then automatically distributes the definitions to each of its clients on the network. Read the document How to use the Virus Definitions Transport Method (VDTM) in Symantec AntiVirus Corporate Edition for an overview and instructions.

LiveUpdate
LiveUpdate is a program that connects to a server, downloads the latest definitions, and applies the definitions to the computer on which it is running. You can run LiveUpdate from the Symantec System Center (SSC), or within Symantec AntiVirus. LiveUpdate can retrieve definitions files either from the Symantec server (which it does by default) or from an internal Web, FTP, or file server created with the LiveUpdate Administration Utility.
 

To run LiveUpdate from the Symantec System Center Console

1. Right-click the Primary Server, point to All Tasks, then to Symantec AntiVirus, and then click Virus Definition Manager.
2. Click Configure.
3. Click Update Now.
4. LiveUpdate is now running silently in the background on the Primary Server. If the VDTM is enabled, it will distribute virus definitions to any secondary servers and clients when LiveUpdate completes.
    

To run LiveUpdate from the Symantec AntiVirus Corporate Edition interface

1. Open Symantec AntiVirus Corporate Edition.
2. Click LiveUpdate.
3. Follow the on-screen prompts to download the latest definitions. If the computer is a parent server and the VDTM is enabled, it will distribute virus definitions to any subordinate servers and clients when LiveUpdate completes.

Scheduling LiveUpdate
You can schedule LiveUpdate to run periodically, either from the Virus Definition Manager within the SSC, or by clicking File and then Schedule Updates from within Symantec AntiVirus.

The LiveUpdate Administration Utility
On very large or widely distributed networks, it may be desirable to create an internal server and have clients use LiveUpdate to retrieve updates from that server, rather than using the VDTM. For information on determining whether the LiveUpdate Administration Utility is necessary, and instructions for its implementation, read the document How to configure the LiveUpdate Administration Utility.

Copying an .xdb file
You can update any Symantec AntiVirus server or client by downloading the .xdb file from Symantec. You can also copy an .xdb file from the \SAV folder on any Symantec AntiVirus server. The modified date of the .xdb file matches the date of the virus definitions. When using this method, RTVSCAN.EXE checks for new .xdb files, and then initiates the update process. RTVSCAN.EXE checks for new .xdb files about every 10 minutes by default. Restarting (stopping and then starting) the Symantec AntiVirus Server process can be used to manually initiate the update process if you do not want to wait.
 

To download an .xdb file from Symantec

1. Go to the xdb folder on the Symantec FTP site. (You can also find the file from the Symantec Security Response Virus Definitions Download Page.)
2. Click the .xdb file with the latest date, and select "Save to disk" from the dialog box.
3. If the .xdb file downloads with a .zip extension, remove the .zip extension by renaming the file. The file name should be similar to the following: vd12bc02.xdb
4. Copy the .xdb file to the appropriate destination, depending on the version of Symantec AntiVirus and the operating system:
   • For NetWare servers, the default location is SYS:SAV.
   • For Windows servers, the default is C:\Program Files\SAV\.
   • For Windows 2000/XP clients, the default is C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\.
      

     ---

     Note: The Application Data folder may be hidden. To show hidden and system folders, read the document How to show hidden files and protected operating system files in Windows.

     ---

   • For Windows NT 4.0 clients, the default is C:\WinNT\Profiles\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\.
   • For Windows 98/Me clients, the default is C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\.


Automatically updating definitions using the .xdb file
Symantec provides a batch file that you can schedule to update the definitions with the latest .xdb file. This batch file automatically downloads and extracts the latest .xdb file from a statically named executable (Navup8.exe), and copies the .xdb file to the appropriate location. For more information, read the document How to automatically update Symantec AntiVirus Corporate Edition 8.x definitions without using LiveUpdate.
 

Intelligent Updater
The Intelligent Updater file is an executable file that you can use to update virus definitions on legacy (Norton AntiVirus Corporate Edition) servers. If you are updating a Symantec AntiVirus server, then you must download the .xdb file from Symantec, as described in the "Copying an .xdb file" section in this document.
 

To download and apply the Intelligent Updater

1. Go to the Symantec Security Response Virus Definitions Download Page.
2. Select the appropriate Language and Product (Symantec AntiVirus Corporate Edition), and then click Download Updates.
3. Download and run the yyyymmdd-version-x86.exe file (yyyymmdd-version indicates the date and version of the definition file).