Trend Micro: Signature version almost 1 year old

[DavidHK]

Hi, not seen anything specific on this as nothing has 'failed'.

Have a RT-AX56U and firmware keep it updated (currently on 386.1_2).

But the Trend Micro signature is dated "2.220 Updated : 2020/05/04 14:02" and says 'Up to date' when checking.

Considering that is almost a year ago... is there an issue, and if so, how to fix it?

Thank you!
David

 

[dave14305]

SSH into the router and look at the /tmp/sig_*.log files.

cat /tmp/sig_*.log

You can also get some debug output from the update script to see if/where it fails:

sh -x /usr/sbin/sig_update.sh

Spoiler: My output

# sh -x /usr/sbin/sig_update.sh
+ wget_options=-q -t 2 -T 30 --no-check-certificate
+ nvram set sig_state_update=0
+ nvram set sig_state_flag=0
+ nvram set sig_state_error=0
+ nvram+ grep -i nt_center
get rc_support
+ IS_SUPPORT_NOTIFICATION_CENTER=
+ [  !=  ]
+ nvram get bwdpi_sig_ver
+ current_sig_ver=2.220
+ echo 2.220
+ sed s/\.//g
+ current_sig_ver=2220
+ nvram get sig_type
+ sig_type=FULL
+ [ FULL ==  ]
+ nvram get apps_sq
+ forsq=
+ [ -z  ]
+ forsq=0
+ nvram get territory_code
+ tcode=U2/02
+ [ U2/02 ==  ]
+ territory_type=U2/02_FULL
+ echo ---- sig update start: ----
+ [ 0 == 1 ]
+ echo ---- sig update real normal----
+ wget -q -t 2 -T 30 --no-check-certificate https://dlcdnets.asus.com/pub/ASUS/LiveUpdate/Release/Wireless/sig2nd_update.zip -O /tmp/sig_update.txt
+ dlinfo=0
+ echo ---- sig wget exit : 0 ----
+ [ 0 != 0 ]
+ echo Download sig info OK
+ grep U2/02_FULL /tmp/sig_update.txt+ sed s/.*#//

+ sig_ver=
+ [  ==  ]
+ WW_type=WW_FULL
+ grep WW_FULL /tmp/sig_update.txt
+ sed s/.*#//
+ sig_ver=2.220
+ nvram set SKU=WW_FULL
+ nvram get SKU
+ echo WW_FULL
+ echo 2.220
+ echo 2.220+ sed s/\.//g

+ sig_ver=2220
+ nvram set sig_state_info=2220
+ rm -f /tmp/sig_update.txt
+ nvram get sig_state_info
+ update_sig_state_info=2220
+ nvram get sig_last_info
+ last_sig_state_info=
+ echo ---- current sig : 2220 ----
+ echo ---- latest sig : 2220 ----
+ [ 2220 ==  ]
+ [ 2220 -lt 2220 ]
+ echo ---- sig update end ----
+ nvram set sig_state_update=1

 

[Treadler]

Hi, not seen anything specific on this as nothing has 'failed'.

Have a RT-AX56U and firmware keep it updated (currently on 386.1_2).

But the Trend Micro signature is dated "2.220 Updated : 2020/05/04 14:02" and says 'Up to date' when checking.

Considering that is almost a year ago... is there an issue, and if so, how to fix it?

Thank you!
David

2.220 seems to be the latest available. The date reported on your device appears to be the problem?

 

[Wallace_n_Gromit]

2.220 seems to be the latest available. The date reported on your device appears to be the problem?

Maybe the issue is that the router time is not updating. Maybe NTP isn't working? If that's the case maybe 2020/05/04 is the Routers default time after reboot? It's interesting to me that the default date for the RT-AC68U I have is 2018/05/04, exactly 2 years apart.

EDIT: I wonder, when Asus inputs a default date into their routers, if it's always either the 5th or 4th of May and why?

Maybe this: May 4th Movement @ Britannica & @ Wikipedia<< bit of history lesson? ASUSWRT_2020

 

[Wallace_n_Gromit]

Hi, not seen anything specific on this as nothing has 'failed'.

Have a RT-AX56U and firmware keep it updated (currently on 386.1_2).

But the Trend Micro signature is dated "2.220 Updated : 2020/05/04 14:02" and says 'Up to date' when checking.

Considering that is almost a year ago... is there an issue, and if so, how to fix it?

Thank you!
David

What date do you see in [System Log] >> [General Log] >> [System Info] >> [System Time]?

ADD: If you don't see today's date (probably see 2020/05/04--depending on when you last rebooted), then when Trendmicro does it's periodic update(s) and you see "2.220 Updated : 2020/05/04 14:02" that mean Trendmicro properly did it's signature update and then the router improperly time stamped the update with the routers date/time (which is incorrect).

 

[Wallace_n_Gromit]

SSH into the router and look at the /tmp/sig_*.log files.

If you SSH into the router just try "date" at the CLI. See if the date is the current date. If not, your router is NOT updating to the current date from it's default date.

You have helped me before, Dave14305, about 1 1/2 years ago with this very issue when I first joined the forum. If it is a failure for the router to update it's clock then both these Threads could be merged: (@Pezhan)

NTP not sync in RT68U

Hi guys. Since a year my router cant sync hour by NTP server. I try with different NTP servers, different configs without results. By default, router start with Sat, May 05 02:22:02 2018 date. Router have Asus firmware 3.0.0.4.386_41634

www.snbforums.com

 

[DavidHK]

What date do you see in [System Log] >> [General Log] >> [System Info] >> [System Time]?

Hi- Thanks for the reply and will check this weekend as out of town at the moment. I am not tech savvy enough to SSH... but will check in the router settings. Will let you know how it goes.

 

[DavidHK]

2.220 seems to be the latest available. The date reported on your device appears to be the problem?

Yes, last updated May 2020...- if 2.220 is the latest, how to verify the date of that signature?

 

[RMerlin]

Yes, last updated May 2020...- if 2.220 is the latest, how to verify the date of that signature?

Over SSH:

ls -l /jffs/signature/

The webui only reports the date for the last scheduled update AFAIK, or something like that. It's not the actual date of the signature file, so it cannot be relied upon to determine if sigs are really up to date.

 

[Clark Griswald]

Running AiProtection and this is my current TM Signature:

To confirm what @Treadler stated, 2.220 appears to be latest signature.

Stay Safe Everyone

 

[Wallace_n_Gromit]

The webui only reports the date for the last scheduled update AFAIK, or something like that. It's not the actual date of the signature file, so it cannot be relied upon to determine if sigs are really up to date.

So >> "2.220 Updated : 2020/05/04 14:02" << has 2 components. The actual signature file version and a date/time. Both components are being provided by two sources, TrendMicro and (I'm guessing here) likely the router?

My router RT-AC68U has about a 32 second window before the default clock date/time updates to the current date/time via ntpd. I guess if the OP's internal router clock is updating properly, then within his "32 second window" after a reboot, It is possible that TrendMicro was pinging for a updated signature, got it, and the router time-stamped it on 2020/05/04?

Perhaps, a rare coincidence of 1) a signature file being available/downloaded right after; 2) a reboot; and 3) before ntpd can update the routers internal clock to current date/time. (Time to buy a lotto ticket?)

 

[DavidHK]

MI checked the router date settings via [System Log] >> [General Log] >> [System Info] >> [System Time] and it is CORRECT.

I hit the 'check' under signature and now it just says the following without any date:
2.220
Signature is up to date

Problem solved?

 

[Sanna1967]

MI checked the router date settings via [System Log] >> [General Log] >> [System Info] >> [System Time] and it is CORRECT.

I hit the 'check' under signature and now it just says the following without any date:
2.220
Signature is up to date

Problem solved?

Almost , hit it one more time
2.222 Updated : 2021/03/19 02:00

 

[DavidHK]

Logged out and back in- and it is all good and shows correct updated date... thank you everyone...

 

[Wallace_n_Gromit]

Same here
2.222 Updated : 2021/03/19 02:00 << yup, One more time