-----Original Message-----
Anonymous Bob said:
I don't believe this is a cache problem. Here's the errors.log
entry:
"0::Could not verify WinTrust::fileE:\Program Files\Microsoft
AntiSpyware\temp.zip::catalogE:\Program Files\Microsoft
AntiSpyware\temp.cat::gcTCPObjLib:modMain:VerifyCatalog::7/
21/2005
That is the evidence that explains why the definitions update did not work
for you.
Here is how MSAS definitions update works:
MSAS downloads a zipped definitions file into temp.zip.
MSAS then downloads the corresponding cryptographic verification file into
temp.cat.
It then performs a cryptographic checksum of the temp.zip file, and compares
it with the expected checksum in the temp.cat file, which is backed up by
cryptographic certificates verifying that the temp.cat file was signed by
Microsoft and not forged by anyone else.
Only if the checksum check succeeds does the temp.zip files get unzipped
into the .gcd definitions file.
Your error message shows that the cryptographic comparison failed, perhaps
owing to one of these problems:
- the download of the .gcz file was corrupt;
- the download of the .cat file was corrupt;
- the downloaded .gcz file was stale, from a previous version;
- the downloaded .cat file was stale, from a previous version;
- one or both of the .gcz/.cat files was stale because it was taken from a
web cache somewhere in your PC or between your PC and the Microsoft update
servers.
Now for the bad as far as my understanding of the MSAS definitions
update process goes, we will ALWAYS see definition update failures and
repeat cycles for the first day or two after a new definition file is
released, for the following reasons.
When it is about to try updating the definitions, MSAS asks the central
spynet server what the latest definition update number is. MSAS makes this
request with the "no-cache" HTTP request header, so that the request and its
reply punch through all web caches and reach the genuine spynet server, and
the genuine reply from the spynet server comes all the way back to MSAS. As
soon as the spynet central server is updated with new definitions file, the
number will be updated, and all copies of MSAS in the world will get that
new number when they ask for it.
MSAS only fetches the definitions files (.gcz and .cat) themselves if it
sees a version number higher than the ones it has already got.
When MSAS asks for the definitions .gcz and .cat files, the request is
diverted to the world-wide server farm operated by Akamai on behalf of
Microsoft. This server farm does not update itself as fast as the central
spynet server can change the definitions version number. It takes time for
all the Akamai servers to get updated with the new definitions .gcz and .cat
files.
So, the "early adopters" who race to get new definitions files as soon as
the central spynet server signals an update, will almost always fail to get
the update, and will observe the "repeating update cycle" which is so often
reported. We should just wait for the Akamai server farm to propagate the
new definitions files across the world.
There is another problem causing the same update problem: the actual HTTP
requests for the .gcz and .cat files are not sent with the "no-cache" HTTP
request header, so stale versions of the .gcz and .cat files in web caches
between MSAS and the Akamai server farm will return stale versions of the
files. Memo to the MSAS developers: for the definitions files, you should
not make an Unconditional HTTP GET request: you should instead make it a
Conditional GET request, looking for a different "ETag" header, or with an
"if-modified-since" condition. Making the request Conditional will give
intervening web caches (including the MSIE Temporary Internet Files) the
right signal for whether they need to refresh their stale copies.
None of this is helped by the fact that MSAS never indicates to the user if
the Definitions update process has failed in any way: MSAS always appears to
indicate an update success. Users need to be told if the updates have
failed, then they won't be so puzzled that the updates are tried again next
time.
--
Robin Walker [MVP Networking]
(e-mail address removed)
Many thanks for your explanation of the update procedure