Symptoms

Data corruption may occur on a computer that has Microsoft Forefront Client Security (FCS) installed. When this data corruption occurs, you may experience the following symptoms.

Symptom 1

If you upload a file to a Microsoft Office SharePoint Server site or to a Web Distributed Authoring and Versioning (WebDAV) site, the uploaded file may be corrupted. This symptom occurs at random times. It may occur with any file types and with any file name extensions. The corrupted files may contain additional zeros at the end of the file or at write-page boundaries.

Symptom 2

The Applicationhost.config file may be corrupted on a computer that is running Internet Information Services (IIS) 7.0. This symptom occurs at random times. It is likely to occur when you change IIS configurations for a Web site. The corrupted file may contain additional zeros at the end of the file or at write-page boundaries. Or, the file may be truncated.In this situation, the Web site configuration cannot load, and the following information is logged in the IIS log: 8:56:16 PM [ERROR] Unable to IISAddVirtualDirectory. ERROR: Error adding virtual directory ' server1' to W3SVC '2904452': The data is invalid.8:56:16 PM [ERROR] Unable to add account filter. ERROR: Exception adding ISAPI filter, DomainMapper, to Metabase path, W3SVC/2904452: The data is invalid.

Symptom 3

On a Windows Server 2008 computer that runs Hyper-V, when you use the New Virtual Machine Wizard to create a virtual machine, the operation fails. Additionally, you receive the following error message:

The server encountered an error while configuring memory on the New Virtual Machine. Wizard Failed in rolling back the created virtual machine. Please delete it manually afterwards.Failed to add device 'Microsoft Synthetic Ethernet Port'The Virtual Machines configuration GUID at 'C:\Program Data\Microsoft\Windows\Hyper-V' is no longer accessible: The requested operation cannot be performed on a file with a user-mapped section open. (0x800704C8)

Cause

This problem occurs because of a known issue of cache coherency between mapped I/O requests and non-cached I/O requests. Forefront Client Security real-time protection uses memory mapped I/O requests for scanning files. This problem affects non-cached I/O requests. It may cause data corruption or cause truncation operations to be unsuccessful.

More Information

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix. Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=supportNote The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.Note This hotfix is available from Microsoft Update and from Windows Server Update Services. If you want to obtain the file for deployment by using a different method, follow these steps:

  1. Visit the following Microsoft Update Catalog Web site:

    http://catalog.update.microsoft.com/v7/site/Home.aspx

  2. Type 952265 in the Search box, and then click Search.

  3. Click Add to add the hotfix to the basket.

  4. Near the search bar at the top, click the view basket link.

  5. Click Download.

  6. Click Browse, specify the folder to which you want to download the hotfix, and then click OK.

  7. Click Continue, and then click I Accept to accept the Microsoft Software License Terms. The hotfix starts to download.

  8. Wait until the hotfix is downloaded to the specified location, and then click Close.

Known issues with this update

  • This hotfix may not be installed when you use Windows Update to install updates on a computer that is running a Server Core installation of Windows Server 2008. For more information about this issue, click the following article number to view the article in the Microsoft Knowledge Base:

    955884The update for Forefront Client Security (update 952265) may not be installed on a Server Core installation of Windows Server 2008 when you use Windows Update

Prerequisites

No prerequisites are required.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix replaces hotfix 938054. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

938054 A hotfix is available to resolve some problems with the Forefront Client Security client

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Forefront Client Security, x86-based versions

File name

File version

File size

Date

Time

Amhelp.chm

Not applicable

65,216

07-Mar-2007

21:43

Mpasbase.vdm

1.0.0.0

572,720

07-Mar-2007

21:44

Mpasdesc.dll

1.5.1955.0

52,272

15-May-2008

21:00

Mpasdlta.vdm

1.0.0.0

9,008

07-Mar-2007

21:44

Mpavbase.vdm

1.0.0.0

204,624

07-Mar-2007

21:44

Mpavdlta.vdm

1.0.0.0

9,040

07-Mar-2007

21:44

Mpavrtm.dll

1.5.1955.0

129,584

15-May-2008

20:40

Mpclient.dll

1.5.1955.0

369,712

15-May-2008

20:40

Mpcmdrun.exe

1.5.1955.0

350,360

15-May-2008

20:37

Mpengine.dll

1.1.3520.0

3,308,624

15-May-2008

20:15

Mpevmsg.dll

1.5.1955.0

26,672

15-May-2008

20:59

Mpfilter.sys

1.5.1954.0

53,168

15-May-2008

20:15

Mpoav.dll

1.5.1955.0

95,280

15-May-2008

20:40

Mprtmon.dll

1.5.1955.0

734,256

15-May-2008

20:40

Mpsigdwn.dll

1.5.1955.0

133,168

15-May-2008

20:40

Mpsoftex.dll

1.5.1955.0

521,264

15-May-2008

20:40

Mpsvc.dll

1.5.1955.0

307,760

15-May-2008

20:40

Mputil.dll

1.5.1955.0

180,272

15-May-2008

20:40

Msascui.exe

1.5.1955.0

1,036,848

15-May-2008

20:40

Msmpcom.dll

1.5.1955.0

224,304

15-May-2008

20:40

Msmpeng.exe

1.5.1955.0

18,704

15-May-2008

20:37

Msmplics.dll

1.5.1955.0

12,336

15-May-2008

20:40

Msmpres.dll

1.5.1955.0

769,584

15-May-2008

21:00

Forefront Client Security, x64-based versions

File name

File version

File size

Date

Time

Amhelp.chm

Not applicable

65,216

07-Mar-2007

21:43

Mpasbase.vdm

1.0.0.0

572,720

07-Mar-2007

21:44

Mpasdesc.dll

1.5.1955.0

52,784

15-May-2008

23:23

Mpasdlta.vdm

1.0.0.0

9,008

07-Mar-2007

21:44

Mpavbase.vdm

1.0.0.0

204,624

07-Mar-2007

21:44

Mpavdlta.vdm

1.0.0.0

9,040

07-Mar-2007

21:44

Mpavrtm.dll

1.5.1955.0

155,696

15-May-2008

23:00

Mpclient.dll

1.5.1955.0

549,936

15-May-2008

23:00

Mpcmdrun.exe

1.5.1955.0

506,432

15-May-2008

22:57

Mpengine.dll

1.1.3520.0

4,431,952

15-May-2008

20:15

Mpevmsg.dll

1.5.1955.0

26,672

15-May-2008

23:22

Mpfilter.sys

1.5.1954.0

67,120

15-May-2008

20:15

Mpoav.dll

1.5.1955.0

120,880

15-May-2008

22:59

Mprtmon.dll

1.5.1955.0

1,184,304

15-May-2008

23:00

Mpsigdwn.dll

1.5.1955.0

182,832

15-May-2008

22:59

Mpsoftex.dll

1.5.1955.0

794,672

15-May-2008

23:00

Mpsvc.dll

1.5.1955.0

419,376

15-May-2008

23:00

Mputil.dll

1.5.1955.0

250,416

15-May-2008

23:00

Msascui.exe

1.5.1955.0

1,639,984

15-May-2008

23:00

Msmpcom.dll

1.5.1955.0

308,784

15-May-2008

23:00

Msmpeng.exe

1.5.1955.0

18,192

15-May-2008

22:57

Msmplics.dll

1.5.1955.0

12,336

15-May-2008

22:59

Msmpres.dll

1.5.1955.0

767,536

15-May-2008

23:23

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.