Description of Hotfix Rollup 1 for Forefront Protection for SharePoint

Issues that are addressed in Hotfix Rollup 1 for Forefront Protection for SharePoint

1. Forefront Protection for SharePoint Rollup 1 provides support for "enhanced deflate" zip files
2. Forefront Protection for SharePoint Rollup 1 supports for the new Kaspersky 8 Scan Engine
3. Manual scans now avoid scanning SharePoint System files
4. The Deletion Text for "EncryptedCompressedFile" and "CorruptedCompressedFile" detections cannot be modified
5. Messages cannot be scanned as FSCController is stuck in a continuous loop
6. The W3WP.exe process crashes while scanning a document
7. Forefront Protection for SharePoint Keyword and File Filter action is set to “Delete” by default
8. A scan process in Forefront Protection for SharePoint may stop responding, and this generates a Dr. Watson crash that references Bucket ID 1211603866
9. You receive the error “Failed to load SharePoint site list” when configuring the Scan Targets for an On Demand Scan

Details of the issues that are addressed in the hotfix rollup

1. Forefront Protection for SharePoint Rollup 1 provides support for "Enhanced deflate" zip files
   
   
   Details
   
   
   Forefront Protection for SharePoint can now scan inside "enhanced deflate" zip files. Previously, such zip files were detected by Forefront Protection for SharePoint as "Corrupted Compressed".
   
   
2. Support for the Kaspersky 8 scan engine
   
   
   
   Details
   
   
   Microsoft will be retiring version 5 of the Kaspersky engine on 1st February 2010. You are required to install Rollup 1 for Forefront Protection for SharePoint beforehand if you wish to continue using the Kaspersky engine after 1st February 2010. You can also apply the workaround described here instead of apply hotfix rollup 1, KB 2284024

   (http://support.microsoft.com/kb/2284024)

   
   
   This rollup does not automatically install the Kaspersky 8 engine. The new engine will be download through the next successful engine update, after installation of the rollup.
   
   If you wish to download the new engine immediately after the rollup installation, you can perform a manual engine update by navigating to Policy Management, Global Settings andthen Advanced Options in the Forefront Protection for Exchange Administrator client. Change the Engine Selection drop-down menu to Manual and right-click the Kaspersky engine under Update scheduling. Select Update Now to trigger an immediate update. Confirm that the engine update completed successfully and Forefront Protection for Exchange will now be using the Kaspersky 8 engine.
   
   
   Link to Kaspersky 8 FAQ blog: Kaspersky Engine Update: Install Rollups by Jan. 31, 2011

   (http://blogs.technet.com/b/fss/archive/2010/07/22/kaspersky-engine-update-install-rollups-by-jan-31-2011.aspx)
3. Manual scans now avoid scanning SharePoint System files
   
   
   
   Details
   
   
   SharePoint System files (.aspx pages) are no longer scanned by Forefront Protection for SharePoint during manual scans.
   
   
   
   More Information
   
   
   This new feature improves manual scan performance and avoids accidental deletion of system files (e.g. due to ill-considered filtering usage).
4. The Deletion Text for "EncryptedCompressedFile" and "CorruptedCompressedFile" detections cannot be modified
   
   
   
   Issue
   You are unable to confirm the detecting server from a Forefront Notification when FPSP makes either an "EncryptedCompressedFile" or a "CorruptedCompressedFile" detection. You are therefore unable to determine from which Quarantine you should retrieve any quarantined mail.
   
   
   Symptoms
   You analyze a Forefront Notification for either an "EncryptedCompressedFile" or a "CorruptedCompressedFile" detection, but it does not display the server name. You are therefore unable to determine upon which server the associated item has been quarantined.
   
   
   Cause
   The Deletion Text for "EncryptedCompressedFile" and "CorruptedCompressedFile" detections is hard-coded in Forefront Protection for SharePoint and cannot be modified.
   
   More Information
   From Rollup 1 for Forefront Protection for SharePoint onwards, the malware Deletion Text will be used instead of the previous hard-coded Deletion Text for "EncryptedCompressedFile" and "CorruptedCompressedFile" detections.
    
   
5. Messages cannot be scanned as FSCController is stuck in a continuous loop
   
   
   
   Issue
   This issue occurs when FSCController is both trying to scan a new message and is trying to save a configuration change at the exact same time. 
   
   Symptoms
   You may notice errors in the application log, stating that “The installed virus scanner is currently unavailable” or you may see other, timeout errors. Mail cannot be scanned until the FSCController service is restarted.
   
   
   Cause
   FSCController is caught in a loop while trying to shut down.
6. The W3WP.exe process crashes while scanning a document
   
   
   
   Issue
   The W3WP.exe process crashes with an Access Violation exception on the CheckSizeAndPromoteSharedFile function while scanning a document.
   Cause
   Occurs due to a cached file contention issue.
7. Forefront Protection for SharePoint Keyword and File Filter action is set to “Delete” by default after a new install
   
   
   
   Issue
   The default action for Keyword and File Filtering, in both Scheduled and On Demand scans, is set to the “Delete” action when installing for the first. The expected behavior for Keyword and File Filtering (as per the product documentation) should be the “Skip: detect only” action. This rollup changes the default action for Keyword and File Filtering, in both Scheduled and On Demand scans, to “Skip: detect only” action.
   More Information
   The default action applies to new installations only. Note: Since Forefront Protection for SharePoint rollups are full product packages, this rollup can also be used to perform a new installation.
8. A scan process in Forefront Protection for SharePoint may stop responding, and this generates a Dr. Watson crash that references bucket ID 1211603866 in the event log as well as the FSCRealtimeScanner.exe and FSCManualScanner.exe processes.
   
   
   
   Issue
   A scan process in Forefront Protection for SharePoint may stop responding and this generates a Dr. Watson crash that references the FSCRealtimeScanner.exe and FSCManualScanner.exe processes.
   
   
   Symptoms
   A Dr. Watson error notification manifests when this issue occurs. The Event log will include a reference to bucket ID 1211603866 stack dump will also begin with references to RARNavigator.dll, for example:
   
   
   Cause
   This crash occurs when RARNavigator.dll does not correctly handle invalid metadata.
9. You receive the error “Failed to load SharePoint site list” when configuring the Scan Targets for an On Demand Scan
   
   
   
   Issue
   You go to Tasks / Task Library / On Demand Scan in the Forefront Administrator console. You attempt to Select Scan Targets. A "Failed to load SharePoint site list" error is returned and you cannot select scan targets.
   Cause
   This occurs when one or more sites is locked (no access) in SharePoint.
   More Information
   This rollup fixes the issue by excluding all locked sites from the Select Scan Targets pane.

Hotfix rollup information

Download information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problems that are described in this article. Apply this hotfix only to systems that are experiencing these specific problems. 

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

How to install the hotfix rollup

 To install the hotfix rollup, follow these steps:

1. Run the installer. To do this, double-click the hotfix rollup executable file.
   
   Note When the installer is running, the Forefront services are stopped.
   
2. After the installation is complete, and the Forefront services are restarted, make sure that Forefront is working correctly. The Forefront services are restarted automatically during the installation
   
   

Prerequisites

This hotfix rollup requires that Forefront Protection for SharePoint is installed. 

File information

This hotfix may not contain all the files that you must have to fully update a product to the latest build. This hotfix contains only the files that you must have to correct the issues that are listed in this article.

The English (United States) version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.