Definition file updates failing on systems where both Norman Endpoint Protection (NPro) and Norman Email Protection (NEP) is installed.


Norman Email Protection (NEP) can be installed with any third party anti-virus product as long as exclusions are set to skip scanning the spool folder, its subfolders, the mailbox\@quarantine folder and its subfolders, the Sieve data folder, and the Norman Email Protection root installer folder. i.e: C:\Program Files\Norman\Norman Email Protection

The only exception is When Norman Endpoint Protection coexists on the same server as Norman Email Protection, as an install sequence must be followed otherwise the Norman Email Protection virus updates will fail.

Løsning på problemet

When Norman Email Protection is first installed, it creates a registry key in HKLM\Software\Norman Data Defense Systems\RootPath which points to the Norman Email Protection default folder, typically C:\Program Files\Norman\Norman Email Protection. When Norman Endpoint Protection is installed after, it changes that key to point to its default location, C:\program files\Norman.

ModusAdm.exe service still attempts to download updates in the usual manner but now due to the installation of Norman Endpoint Protection, it will attempt to do this in the wrong location (when Moduscan starts it calls NrmQueryNormanPath which will now point to a Norman folder instead of Norman Email Protection). Thus after the download we cannot unzip the contents, hence we get stuck in a download loop and Norman Email Protection never gets virus updates. In this scenario, you should see the avupdate.exe process running in task manager.

Norman Email Protection has to be reconfigured to let Norman Endpoint Protection do the downloading. This is done by:

  1. Updating HKLM\Software\Vircom\Vopmail\VirusEnginePathNorman to C:\Program Files\Norman\Nse\Bin (i.e. location where Norman Endpoint Protection is downloading the definitions ... there should be nse_w32.dll, nvcbin.def and nvcmacro.def there).
  2. Adding HKLM\Software\Vircom\VopMail\VsOwnNorman DWORD key with a value of 0. This tells ModusAdm.exe to not contact the Vircom update server and that Norman Endpoint Protection will take care of the updates.
  3. Restarting Moduscan.

Publiceringsdato:: 2012.09.14   Opdatere dato: 2012.11.14