Bug#650841: Found a fix / bypass for this problem

[Jeroen N. Witmond [Bahco]]

The file
http://security.debian.org/dists/lenny/updates/main/binary-i386/Packages.gz
now appears to be correct, but it is NOT downloaded automatically.

To force the download, I (as root) removed file
/var/lib/apt/lists/security.debian.org_dists_lenny_updates_main_binary-i386_Packages
(filename depends in your computer's architecture) and started the
update-manager again. At first it reported that my system was up to date,
but when I pressed the Check button, all package lists were downloaded and
package evince was available for update.

After installing this package and stopping the update manager, I had to
remove file /var/lib/apt/lists/lock and reboot my computer to get rid of
the notifier icon in the top right corner of my screen.