Introduction
This article describes the Microsoft Forefront Client Security (FCS) anti-malware client issues that are resolved in the March 2011 update package.
Issues that this hotfix package resolves
Issue 1
Computers that are running Forefront Client Security (FCS) and that frequently operate on battery power do not update definitions at the scheduled time.
Resolution
This update contains changes for Forefront Client Security (FCS) to let a computer that operates on battery power update definitions at the scheduled time.
Issue 2
You cannot open a file that is encrypted by Prim'X ZoneCentral and that is located in a network shared folder on a computer that is running Forefront Client Security (FCS).
Resolution
The installer for this update package sets the AttachWhenLoaded registry value for the Windows Filter Manager to 1 on certain operating systems. For more information about the AttachWhenLoaded registry value and the applicable operating systems, visit the following MSDN website:
General information about the AttachWhenLoaded registry value and the applicable operating systems
Issue 3
Some real-time protection errors occur on computers that are running Windows 2000 Server and that use Forefront Client Security (FCS).
Resolution
This update changes MpFilter.sys to resolve this issue and to replace the update that is described in the following article:
2459065 Real-time protection fails on Windows 2000 after you apply the Forefront Client Security October 2010 update
More Information
Hotfix information
A supported hotfix is available from Microsoft.
Note This hotfix is available from Microsoft Update and from Windows Server Update Services (WSUS). If you want to obtain the hotfix for deployment by using a different method, follow these steps:
-
Visit the following Microsoft Update Catalog website:
-
Type 2508823 in the Search box, and then click Search.
-
Click Add to add the hotfix to the basket.
-
Click Download.
-
Click Browse, specify a folder for the file that you want to download, and then click OK.
-
Click Continue, and then click I Accept to accept the Microsoft Software License Terms.
-
When the update is downloaded to the folder that you specified, click Close.
Prerequisites
There are no prerequisites for installing this hotfix.
Restart requirement
You must restart the computer after you apply this hotfix.
Hotfix replacement information
This hotfix replaces the anti-malware client that is deployed by using the Forefront Client Security deployment package (1.0.1725.0).
2394439 Forefront Client Security deployment package (1.0.1728.0): October 2010This hotfix replaces the following hotfixes:
2394433 Forefront Client Security antimalware client update: October 2010
2459065 Real-time protection fails on Windows 2000 after you apply the Forefront Client Security October 2010 update
979536 Forefront Client Security anti-malware client update: April 2010
976668 Forefront Client Security anti-malware client update: December 2009
971026 A hotfix is available to resolve some problems with the Forefront Client Security anti-malware client
952265 Data corruption may occur on a computer that has Forefront Client Security installed
938054 A hotfix is available to resolve some problems with the Forefront Client Security client
956280 The Forefront Client Security kernel-mode mini-filter unloads when you browse a network file share that contains many malicious files
File information
The English version of this update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
Forefront Client Security, x86-based versions
|
File name |
File version |
File size |
Date |
Time |
|---|---|---|---|---|
|
Amhelp.chm |
Not Applicable |
65,216 |
19-Jul-2010 |
00:51 |
|
Mpasbase.vhd |
1.0.0.0 |
572,720 |
19-Jul-2010 |
00:52 |
|
Mpasdesc.dll |
1.5.1996.0 |
49,024 |
02-Feb-2011 |
16:42 |
|
Mpasdlta.vhd |
1.0.0.0 |
9,008 |
19-Jul-2010 |
00:52 |
|
Mpavbase.vhd |
1.0.0.0 |
204,624 |
19-Jul-2010 |
00:52 |
|
Mpavdlta.vhd |
1.0.0.0 |
9,040 |
19-Jul-2010 |
00:52 |
|
Mpavrtm.dll |
1.5.1996.0 |
128,384 |
02-Feb-2011 |
16:23 |
|
Mpclient.dll |
1.5.1996.0 |
367,488 |
02-Feb-2011 |
16:23 |
|
Mpcmdrun.exe |
1.5.1996.0 |
349,064 |
08-Jan-2011 |
22:06 |
|
Mpengine.dll |
1.1.3520.0 |
3,308,624 |
19-Jul-2010 |
00:52 |
|
Mpevmsg.dll |
1.5.1996.0 |
23,424 |
02-Feb-2011 |
16:42 |
|
Mpfilter.sys |
1.5.1996.0 |
71,296 |
02-Feb-2011 |
16:14 |
|
Mpoav.dll |
1.5.1996.0 |
92,032 |
02-Feb-2011 |
16:23 |
|
Mprtmon.dll |
1.5.1996.0 |
731,008 |
02-Feb-2011 |
16:23 |
|
Mpsigdwn.dll |
1.5.1996.0 |
129,920 |
02-Feb-2011 |
16:23 |
|
Mpsoftex.dll |
1.5.1996.0 |
518,016 |
02-Feb-2011 |
16:23 |
|
Mpsvc.dll |
1.5.1996.0 |
319,872 |
02-Feb-2011 |
16:23 |
|
Mputil.dll |
1.5.1996.0 |
177,024 |
02-Feb-2011 |
16:23 |
|
Msascui.exe |
1.5.1996.0 |
1,033,600 |
02-Feb-2011 |
16:23 |
|
Msmpcom.dll |
1.5.1996.0 |
221,056 |
02-Feb-2011 |
16:23 |
|
Msmpeng.exe |
1.5.1996.0 |
16,896 |
08-Jan-2011 |
22:06 |
|
Msmplics.dll |
1.5.1996.0 |
9,088 |
02-Feb-2011 |
16:23 |
|
Msmpres.dll |
1.5.1996.0 |
766,336 |
02-Feb-2011 |
16:42 |
Forefront Client Security, x64-based versions
|
File name |
File version |
File size |
Date |
Time |
|---|---|---|---|---|
|
Amhelp.chm |
Not Applicable |
65,216 |
19-Jul-2010 |
00:51 |
|
Mpasbase.vdm |
1.0.0.0 |
572,720 |
19-Jul-2010 |
00:52 |
|
Mpasdesc.dll |
1.5.1996.0 |
49,536 |
02-Feb-2011 |
18:18 |
|
Mpasdesc.dll (x86 directory) |
1.5.1996.0 |
49,024 |
02-Feb-2011 |
16:42 |
|
Mpasdlta.vdm |
1.0.0.0 |
9,008 |
19-Jul-2010 |
00:52 |
|
Mpavbase.vdm |
1.0.0.0 |
204,624 |
19-Jul-2010 |
00:52 |
|
Mpavdlta.vdm |
1.0.0.0 |
9,040 |
19-Jul-2010 |
00:52 |
|
Mpavrtm.dll |
1.5.1996.0 |
155,008 |
02-Feb-2011 |
17:58 |
|
Mpclient.dll |
1.5.1996.0 |
547,712 |
02-Feb-2011 |
17:58 |
|
Mpclient.dll (x86 directory) |
1.5.1996.0 |
367,488 |
02-Feb-2011 |
16:14 |
|
Mpcmdrun.exe |
1.5.1996.0 |
504,624 |
08-Jan-2011 |
23:46 |
|
Mpengine.dll |
1.1.3520.0 |
4,431,952 |
19-Jul-2010 |
00:52 |
|
Mpevmsg.dll |
1.5.1996.0 |
23,424 |
02-Feb-2011 |
18:18 |
|
Mpfilter.sys |
1.5.1996.0 |
91,520 |
02-Feb-2011 |
16:14 |
|
Mpoav.dll |
1.5.1996.0 |
117,632 |
02-Feb-2011 |
17:58 |
|
Mpoav.dll (x86 directory) |
1.5.1996.0 |
92,032 |
02-Feb-2011 |
16:14 |
|
Mprtmon.dll |
1.5.1996.0 |
1,181,056 |
02-Feb-2011 |
17:58 |
|
Mpsigdwn.dll |
1.5.1996.0 |
179,584 |
02-Feb-2011 |
17:58 |
|
Mpsoftex.dll |
1.5.1996.0 |
791,424 |
02-Feb-2011 |
17:58 |
|
Mpsvc.dll |
1.5.1996.0 |
438,656 |
02-Feb-2011 |
17:58 |
|
Mputil.dll |
1.5.1996.0 |
247,168 |
02-Feb-2011 |
17:58 |
|
Mputil.dll (x86 directory) |
1.5.1996.0 |
177,024 |
02-Feb-2011 |
16:14 |
|
Msascui.exe |
1.5.1996.0 |
1,636,736 |
02-Feb-2011 |
17:58 |
|
Msmpcom.dll |
1.5.1996.0 |
305,536 |
02-Feb-2011 |
17:58 |
|
Msmpeng.exe |
1.5.1996.0 |
16,384 |
08-Jan-2011 |
23:46 |
|
Msmplics.dll |
1.5.1996.0 |
9,088 |
02-Feb-2011 |
17:58 |
|
Msmplics.dll (x86 directory) |
1.5.1996.0 |
9,088 |
02-Feb-2011 |
17:58 |
|
Msmpres.dll |
1.5.1996.0 |
764,288 |
02-Feb-2011 |
18:18 |
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
More Information
This update is included in a new slipstream installation package of the Forefront Client Security client software. For more information about the slipstream installation package, click the following article number to view the article in the Microsoft Knowledge Base:
2508824 Forefront Client Security deployment package (1.0.1736.0): March 2011
Known IssuesMicrosoft has identified an issue when this update is installed on Windows Vista, Windows Server 2008, Windows 7, or Windows Server 2008 R2, that may cause the antimalware agent to be removed when using the Windows install updates and shut down feature to apply this update. For more information on this issue see the following article:
2524280 Antimalware agent is removed after you apply Forefront Client Security March 2011 update when using install updates and shut down
