Article ID: 938054 - View products that this article applies to.
You experience the following symptoms when you are using Microsoft Forefront Client Security.
Symptom 1On a computer that is running Microsoft Windows 2000 Service Pack 4, the Anti-malware user interface cannot open when you log on to the computer by using a non-administrator account.
Symptom 2In the notification area, the Forefront Client Security icon becomes orange to indicate that an issue has occurred. When you open the Forefront Client Security client to view the issue, the client incorrectly reports that a product update is available for the Forefront Client Security client. A product update is not available.
Note In this scenario, the new product update notification differs from the new definition update notification.
Symptom 3When you save a Microsoft Office Word document that already exists on a FAT32 volume, the file disappears unexpectedly. This occurs only when antivirus real-time protection (RTP) is enabled.
Symptom 4The Microsoft Forefront Client Security Anti-malware Service stops unexpectedly. Then, this service does not recover automatically. This symptom occurs if the signature or the engine update is invalid.
Cause 1Symptom 1 occurs because of a permission issue that is specific to Windows 2000. In Windows 2000, a non-administrator user is denied access to the RegisterGPNotification function. This function is used to monitor policy changes.
Cause 2Symptom 2 occurs because a registry value is not reset as expected after a successful upgrade. To determine the current state of Forefront Client Security Agent, the Forefront Client Security client queries the following registry entry:
Note A value of 0 indicates that new updates are not needed. A value of 1 indicates that new updates are needed.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Forefront\Client Security\1.0\AM\ProductUpdateAvailable
However, the Forefront Client Security client update package did not reset this registry value to 0 after the last upgrade.
Cause 3Symptom 3 occurs for one of the following reasons:
Cause 4Symptom 4 occurs because the Microsoft Forefront Client Security Anti-malware Service registers with the Service Control Manager (SCM) to automatically start two times after a failure. If an invalid signature causes the service to stop repeatedly, the SCM makes only two restart attempts and does not continue to restart the service.
Hotfix informationA supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.
If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.
Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=supportNote The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
Note This hotfix is available from Microsoft Update or from Windows Server Update Services. If you want to obtain the file for deployment by using a different method, follow these steps:
PrerequisitesThere are no prerequisites for installing this hotfix.
Restart requirementYou have to restart the computer after you apply this hotfix.
Hotfix replacement informationThis hotfix does not replace a previously released hotfix.
File informationThe English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
Forefront Client Security, x64-based versions
Forefront Client Security, x86-based versions
Collapse this tableExpand this table
Collapse this tableExpand this table
Workaround 1To work around symptom 1, log on to the Windows 2000-based computer by using an administrator account.
Workaround 2To work around symptom 2, follow these steps:
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/322756/ )How to back up and restore the registry in Windows
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/824684/LN/ )Description of the standard terminology that is used to describe Microsoft software updates