Linux Plesk Control Panel - Dr.Web Notifications "Your virus bases are obsolete".

Plesk have released an official knowledgebase article for this issue. https://support.plesk.com/hc/en-us/articles/16264720065559-Plesk-Premium-antivirus-sends-a-lot-of-notifications-Your-virus-bases-are-obsolete

If you are having issues with this bug please contact our support team who will be able to assist you.

We have been made aware of an issue with Dr.Web for Plesk Linux whereby an admin receives 100's of notifications. Please raise a ticket with our support team if you need us to assist with resolving the fault.

Plesk Advisory

• Your OS version all
• Plesk version 18.0.53, 18.0.54

After an update of the antivirus extension last night, DrWeb is caught in a restart loop on many servers. In your system log you can see messages like

Jul 25 09:50:22 shared3 drwebd: Interface binding error (/var/drweb/run/.daemon - Address already in use)!
Jul 25 09:50:22 shared3 drwebd: Interface binding error (127.0.0.1:3000 - Address already in use)!

Also, emails are sent over and over again: "Your virus bases are obsolete".

If you are affected, you can try one of these two solutions to mitigate the issue:

1. You can try to restart DrWeb by running systemctl restart drwebd.service as root.

2. If that does not help, get all PIDs of drweb processes in your process list, e.g.

   ps aux | grep drweb
   

   and "kill -9" all these existing drweb processes, e.g.

   kill -9 <pid of drweb process>