Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 10 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 16296 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Stop anti-virus service

Mariows

Hello everyone,

I need to stop anti-virus service on my XG85 because it consumes too much RAM. While I can't get a bigger firewall, this service needs to be stopped and it's the only workaround at the moment.

The problem is that even when I stop this service via System Services > Services, some hours after the service restarts due to the /scripts/avira_post_update.sh that updates signatures and starts the service again.

I tried to move/rename the file but it is read-only; tried to change permissions via chmod, but didn't work.

Does anyone have some tips on this?

Thanks!



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Mariows

    Mariows,

    the script is launched by the pattern updates which occurs every 2/4 hours (it depends on your pattern update interval). If you disable the anti-virus engine under services from GUI, the service starts again?

    Have you tried from advanced shell:

    service antivirus:stop -ds nosync

    Thanks

  • 0 in reply to lferrara

    Hi Luk,

    I tried both options, but the service starts again because inside this script (avira_post_update.sh) there are instructions to stop and restart the service:

    XG125_XN02_SFOS 17.0.5 MR-5# more avira_post_update.sh  | grep "antivirus:"
    #       service antivirus:stop -ds nosync
    #            service antivirus:restart -ds nosync
    #               service antivirus:restart -ds nosync
     #               service antivirus:restart -ds nosync
    #        service antivirus:restart -ds nosync
                service -ds nosync antivirus:restart
    #       service antivirus:stop -ds nosync
    #            service antivirus:restart -ds nosync
    #               service antivirus:restart -ds nosync
     #           service antivirus:restart -ds nosync
    #        service antivirus:restart -ds nosync
                service -ds nosync antivirus:restart
    #       service antivirus:restart -ds nosync

     

    I don't know if there is some workaround to avoid this script of being ran or something.

  • 0 in reply to Mariows

    Uhm...anyway you are using a Firewall and the Anti-Malware service is crucial. You should move to a bigger appliance.

    Regards

  • 0 in reply to lferrara

    We are moving to a bigger appliance, but it's not possible at the moment, so stopping this service is a workaround since we already have another Anti-virus in the network.

    I'll continue to find something, and if I do, I'll post here.

    Thanks anyway.

  • 0 in reply to Mariows

    Guys,

    I just found that disabling the Pattern auto update solves this problem: Backup and Firmware > Pattern Updates

    So now Avira script will not run anymore (for now) and the service remains stopped by just disabling it from the GUI (as long as the appliance doesn't reboot, because it will start the service again).

  • 0 in reply to Mariows

    Just be aware that Email Proxy and Web Proxy are dead without antivirus.

  • 0 in reply to Michael Dunn

    Yeah, if there is a firewall rule using HTTP/HTTPS scanning enabled with the anti-virus service disabled, some websites won't open due to a "security risk detected". It is important to make it clear. [Y]

    Thanks for remembering it.

  • 0 in reply to Mariows

    did you find a way to disable the engine without disabling all the pattern updates?

  • 0 in reply to l0rdraiden

    Hello,

    Unfortunately the only way I found was the one I mentioned before. Are you facing problems related to high RAM usage?