Not enough room on ramdrive to update F-PROT virus defs. ?

Message

Constance · #1 Post by **Constance** » Tue Mar 27, 2007 8:22 am

Hello there ^^

I've been trying to test F-PROT and the update system in a virtual machine (with 128 MB RAM).

So I boot on a UBCD 4.01 image, select the menu items until I reached F-PROT, then let the default options until the dialog which gives the UBCDVir option ... then always default option again, and here is what I get after a while :

Seems like the ramdrive gets full ... so I guess something should be done to either free up some space before the update, or create a bigger ramdrive.

Edit : I don't know if it's an available feature, but if it is, we may get some room back by using smaller cluster size for that ramdrive.

#2 Post by **Victor Chew** » Wed Mar 28, 2007 7:01 am

Constance, thanks for letting me know. I will fix this and release a patch soon.

#3 Post by **Victor Chew** » Thu Mar 29, 2007 3:39 am

Just uploaded a patch that increases the RAM disk size from 20MB to 30MB in V4.0.2.

Constance · #4 Post by **Constance** » Thu Mar 29, 2007 6:33 am

Thanks

I'll apply and test it right now.

Edit : Hmm in fact, same problem with McAfee, at least if we uncheck the box not to download the EXE (didn't have the time yet to check without unchecking that box)...

It downloads roughly 18.5 MB, and needs more space to extract all of this.

Yet if you don't want to greatly increase the system requirements to run _any_ app from UBCD, I guess you should create specific images for running AVs, and let the lower sized ramdisk for all other apps which don't require so much.

Also, if possible, deleting an archive once it is extracted and before attempting to extract the next one might help.

#5 Post by **Victor Chew** » Fri Mar 30, 2007 5:47 am

Hmmm, I don't get it. By default, the McAfee update should involve downloading a 1MB ZIP file called "mcafee.zip" to the RAM disk, which expands to about 2.2MB on disk.

Where did the 18MB file come from, and what is its filename?

Constance · #6 Post by **Constance** » Fri Mar 30, 2007 6:24 am

It's not a 18 MB file, there are 2 files, one is about 8.5 MB and the other is about 10.

They are :
ftp.nai.com/pub/datfiles/english/dat-4942.zip
and
ftp.nai.com/pub/datfiles/english/dat-4995.zip

#7 Post by **Victor Chew** » Mon Apr 02, 2007 6:39 am

Constance, I will get back to you on this in another day or two. Apologize for the delay.

Constance · #8 Post by **Constance** » Mon Apr 02, 2007 7:15 am

No problem ^^

#9 Post by **Victor Chew** » Tue Apr 03, 2007 5:43 am

Hi Constance, I discovered there are two parts to the McAfee update problem.

The first part is I did not clean out some non-essential files under \dosapps\mcafee, which resulted in unnecessary files being copied to the RAM disk and reducing the amount of available free space. I can fix this with a patch, and the amount of RAM disk free space should increase to about 14-15MB after McAfee files are copied from UBCD to RAM disk.

Yet, 14-15MB is still not enough to hold your 18MB files, which brings us to the second part of the problem. You see, Erwin was relying on the fact that only the latest virusdef ZIP is available at ftp.nai.com, but when you attempted the download, there were two ZIP files there, one old and one new, which is about 18MB in total. When I looked about 30 mins ago, there were also two ZIP files there, but not the same ones that you saw (also 18MB). Interestingly, when I looked again just now, there was only a 10MB ZIP file called "dat-4998.zip" left, which is the expected case, and that file will fit into the available RAM disk free space.

The obvious way to tackle this issue is to download only the latest virusdef ZIP from ftp.nai.com and ignore the older file(s), instead of the current *.ZIP, but since autovir.bat is a shell script, I am not sure how that can be done. Currently, what it is doing is to download *.ZIP from ftp.nai.com, then extract all the ZIP files it had downloaded to the RAM disk, which is more straightforward. I've checked, and there is no wget switch to say "download only one file with the most recent timestamp".

I will try to discuss this with Erwin when I next catch him. But he seems to be rather busy these days and not returning email, so it could take a while, unless some shell script guru here can help.

#10 Post by **Victor Chew** » Tue Apr 03, 2007 5:51 am

Spoke too soon. Now there are two files there again:

- dat-4942.zip
- dat-4998.zip

Trying to download "dat-4942.zip" to see what it contains.

[EDIT]Looks like it's a really old virusdef release, dated 01/18/2007. Dunno why it is there intermittently.[/EDIT]

#11 Post by **Victor Chew** » Tue Apr 03, 2007 6:41 am

I think what I am going to do is to increase the RAM disk size to 64MB.

This just means that on a machine with insufficient RAM, you won't be able to run ubcdvir/autovir successfully.

This is just a temporary workaround. We will find a way to download only the file we want eventually.

[EDIT]Oops, that didn't work. Increasing the RAM disk to 64MB will prevent machines with only 64MB from running apps that rely on DPMI eg. F-Prot. Looks like the only solution is to find a way to download the latest virusdef ZIP file despite the presence of other ZIP files.[/EDIT]

Constance · #12 Post by **Constance** » Wed Apr 04, 2007 2:40 am

Can't the ramdisk be set to something between 32 and 64 MB ?
Like, I don't know, 50 ?

#13 Post by **Victor Chew** » Wed Apr 04, 2007 6:39 am

Can't the ramdisk be set to something between 32 and 64 MB ? Like, I don't know, 50 ?

Yeah, it can. But that means machines with 32MB RAM won't be able to run apps that uses high memory (since all the high memory are sucked up by the RAM disk). F-Prot is a good example.

Currently, with the RAM disk at 30MB, there is still some high memory left over for such apps to run. For example, F-Prot will run on a 32MB machine, but McAfee Antivirus won't.

I am in the process of uploading patch #3. Interestingly, this patch will actually make the ISO image smaller, since a number of files under \dosapps\mcafee have been removed.

Constance · #14 Post by **Constance** » Wed Apr 04, 2007 8:14 am

Nice ^^

I had not read carefully enough your previous post before posting again about ramdrive size, sorry ^^