Resolved DrWeb Antivirus sends many notifications "Your virus bases are obsolete."

[Peter Debik]

Server operating system version

all

Plesk version and microupdate number

18.0.53, 18.0.54

After an update of the antivirus extension last night, DrWeb is caught in a restart loop on many servers. In your system log you can see messages like

Jul 25 09:50:22 shared3 drwebd: Interface binding error (/var/drweb/run/.daemon - Address already in use)!
Jul 25 09:50:22 shared3 drwebd: Interface binding error (127.0.0.1:3000 - Address already in use)!

Also, emails are sent over and over again: "Your virus bases are obsolete".

If you are affected, you can try one of these two solutions to mitigate the issue:

1) You can try to restart DrWeb by running systemctl restart drwebd.service as root.

2) If that does not help, get all PIDs of drweb processes in your process list, e.g.
ps aux | grep drweb
and "kill -9" all these existing drweb processes, e.g.
kill -9 <pid of drweb process>

A hotfix of the extension will be provided soon, too.

 

[gennolo]

@Peter Debik
Thank you as always for the speed of communication.

Just received 2000+ mails due to this issue

 

[kevingl]

Thanks for the update, I've woken up to so many emails

Unfortunately neither of the suggestions have worked, is it possible to stop the service or temporarily stop the crons that are running?

 

[carini]

Same to me, but I never installed this stupid extension

 

[dogsbodytechnology]

We have the same from our Linux servers.
Over 500 tickets each server

 

[mwfr]

Thanks for the update, I've woken up to so many emails

Unfortunately neither of the suggestions have worked, is it possible to stop the service or temporarily stop the crons that are running?

You can stop the service. Just go to the Services management and stop Plesk Premium Antivirus.
For me it stopped the multiple emails. I don't know if it's the best solution.

 

[Peter Debik]

After further analysis, developers are suggesting a new workaround approach:

systemctl stop drwebd
killall -TERM drwebd.real
systemctl start drwebd

 

[carini]

I didn't install this extension. Disabling and removing it works as well, but I didn't understand why i find it as installed. On every server.

 

[LucillaV]

I also didn't install this extension but I receive the email every minute. I tried to launch the command
systemctl stop drwebd
and I get
Failed to stop drwebd.service: Unit drwebd.service not loaded.
I havent Plesk Premium Antivirus in Services Management
In scheduled task nothing about dr.web or Plesk Premium Antivirus.
How I can stop the sending of these email?

 

[EricRB]

After further analysis, developers are suggesting a new workaround approach:

systemctl stop drwebd
killall -TERM drwebd.real
systemctl start drwebd

This method appears to have worked. Previously I tried stopping Plesk Premium Antivirus through the panel and then starting it again through the panel, and that didn't work. Thanks Peter

 

[RPD]

@Peter Debik Thanks, your last suggestion worked!

I hope that the rollout of the faulty update of DrWeb has been stopped.

 

[carini]

I also didn't install this extension but I receive the email every minute. I tried to launch the command
systemctl stop drwebd
and I get
Failed to stop drwebd.service: Unit drwebd.service not loaded.
I havent Plesk Premium Antivirus in Services Management
In scheduled task nothing about dr.web or Plesk Premium Antivirus.
How I can stop the sending of these email?

If you have another antivirus / IPS you can safely disable and unistall DrWeb extension. I also confirm that I found this plugin as a "surprise", even If I have another antivirus in place.

 

[francescokr]

Hi, i have stopped the service and killed the process but email no stop...

 

[Peter Debik]

Update: According to developers after careful consideration there won't be a hotfix as we initially thought there would, because the issue is a one-time issue. The workaround provided in Important - DrWeb Antivirus sends many notifications "Your virus bases are obsolete." (stop - killall -start) is already the final solution.

 

[flaxton]

I removed Plesk Premium Antivirus and the emails stopped.

 

[Peter Debik]

Hi, i have stopped the service and killed the process but email no stop...

There may still be mails in the queue, but in general: When the service is not running, it cannot initialize any new emails. So if you have stopped it, it is not possible that more emails are created.

 

[Dork]

After an update of the antivirus extension last night, DrWeb is caught in a restart loop on many servers. In your system log you can see messages like

The message file is very huge now - is it save to delete it?

 

[LucillaV]

If you have another antivirus / IPS you can safely disable and unistall DrWeb extension. I also confirm that I found this plugin as a "surprise", even If I have another antivirus in place.

My problem is that I havent drweb extension installed so I cannot unistall, I havent Plesk Premium antivirus ... so I cannot unistall nothing but I receive these emails every minute

 

[carini]

My problem is that I havent drweb extension installed so I cannot unistall, I havent Plesk Premium antivirus ... so I cannot unistall nothing but I receive these emails every minute

Can you check for this?

 

[LucillaV]

Can you check for this?

View attachment 23866

I havent this. I have no antivirus