The file http://security.debian.org/dists/lenny/updates/main/binary-i386/Packages.gz now appears to be correct, but it is NOT downloaded automatically.
To force the download, I (as root) removed file /var/lib/apt/lists/security.debian.org_dists_lenny_updates_main_binary-i386_Packages (filename depends in your computer's architecture) and started the update-manager again. At first it reported that my system was up to date, but when I pressed the Check button, all package lists were downloaded and package evince was available for update. After installing this package and stopping the update manager, I had to remove file /var/lib/apt/lists/lock and reboot my computer to get rid of the notifier icon in the top right corner of my screen. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org