Re: Pattern file from hell

Trend Micro Incorporated

ScanMail for Domino and ScanMail for Lotus Notes VSAPI issue on the i5/OS 
// OS/400 operating system

December 11, 2006

On December 4, 2006 Trend Micro received reports indicating that both 
ScanMail for Domino 3.0 for i5/OS //
OS/.400 and ScanMail for Lotus Notes 2.6 SP1 for OS/400, running with 
VSAPI 8.16 or 8.31, failed to correctly load
pattern file 3.973.00.

In ScanMail for Lotus Notes 2.6 SP1 for OS/400, the incorrectly downloaded 
pattern file would be renamed to
“lpt$vpn.XXX.corrupted” and the product/engine would then revert to using 
the previous pattern file. In ScanMail
for Domino 3.0 for i5/OS // OS/400, the problem with the pattern file 
caused ScanMail for Domino to stop working.
Pattern file 3.975.00 running with VSAPI 8.16 or 8.31 created similar 
issues on these systems.

Upon investigation, the source of the problem was found to be the size of 
one pattern file section. As a result, when
the product’s scan engine requested additional memory from the operating 
system to load the pattern files, the
operating system issued a "Not enough Memory" error and the pattern 
loading process could not be completed. A
similar problem occurred on October 23, 2006.

In response, Trend Micro has accelerated the implementation of certain 
process and product improvements
including:

a) Starting with pattern file 3.979.00 running with either VSAPI 8.16 or 
8.31, a formal design requirement
was implemented that places a limitation on pattern file section size, 
defined on the basis of the i5/OS //
OS/400 operating system memory allocation rules;

b) Starting with pattern file 3.979.00 running with either VSAPI 8.16 or 
8.31, two new test gates were added
to the pattern file verification plan for the i5/OS // OS/400 platforms. 
These test gates specifically validate a
pattern file’s compliance with the design requirement and its successful 
utilization of memory resources, and
verify proper operation of the scan engine post-download; and

c) A hot fix (Build 3548) was issued on December 7, 2006 for ScanMail for 
Domino 3.0. This hot fix
ensures that when a new pattern file cannot be loaded properly, the 
previous pattern file will be re-loaded,
so that virus scanning continues.

If you require the hot fix, please contact your Technical Account Manager 
or Technical Support Representative.

Thank you.

Rob Berendt