This has been an issue that I thought was resolved but started happening again.
We run Symantec Antivirus Corp Edition 9.x here. I have 4 servers, 2 of which are legacy and haven't had managed clients moved off of them. The main server for the organization has not been getting updates from LiveUpdate properly.
The error that showed up regularly in the Event log was "Download of virus definition file from LiveUpdate server failed. 00000001". Try searching for this in Symantec's knowledge base and you will come up empty.
So, I did some digging on their site for just general LiveUpdate issues and found that the next thing to try is to manually run LiveUpdate from the AV client. Did this and kept getting the error "LU1814 error: LiveUpdate could not retrieve the catalog file of available Symantec product and component updates." Looked up this error and there were troubleshooting steps that you could follow.
At this point, I should also mention that originally this server had the LiveUpdate Administrator installed. Read another Symantec article that said that LiveUpdate Administrator was only needed for certain large deployments of Symantec CE and should not be used unless it's needed. So it was removed.
OK, so step one is to make sure you are running latest version of LiveUpdate. Did that. No effect.
Step two was to make sure you can connect to the internet. Oh wait, at this point I read that Corp users should go to the bottom of the page for troubleshooting tips. :)
OK so step two was to check the hosts file on the system. Did that and it was just the default hosts file. No joy with that one.
Step three was to delete the Settings.LiveUpdate files from (this is the default path) c:\documents and settings\all users\application data\symantec\liveupdate\. If you go there, you will see the Settings.LiveUpdate file, the 1.Settings.LiveUpdate, etc. After banging my head against a thick wall for a while going through these steps, doing more research, deleting LiveUpdate Administrator, doing more research and then going through these steps again LiveUpdate started working! Hallelujah!
But wait! Of course there's more to it, or I wouldn't be writing this.
So the problem started up again within the last week (just noticed it yesterday, yeah so I don't look to see if the virus defs get updated every day, shoot me :p). So I start looking at the contents of the Log.LiveUpdate file on that server and on other client/servers that work. I notice that the server is attempting to go to a null address as in FTP://. So I notice that in the Settings.LiveUpdate files on that server that subnet and subnet mask are set to 0. On the other servers/clients it's set to 0.0.0.0.
I change subnet and subnet mask on all the Settings.LiveUpdate files on the server and voila! It works again.
Now I just have to keep monitoring that server to make sure that it updates properly.
This has been another obscure fix brought to you by yours truly. Have a safe and fun Halloween.