Description of Hotfix Rollup 1 for Forefront Security for Office Communications Server

Microsoft has released Hotfix Rollup 1 for Microsoft Forefront Security for Office Communications Server. This article contains information about how to obtain the hotfix rollup and about the issues that are fixed by the hotfix rollup.

New feature in the hotfix rollup

Hotfix Rollup 1 for Forefront Security for Office Communications Server adds new functionality by using the registry to set limits on the compressed and uncompressed sizes of a file in an archive or compressed file.

To use the new functionality and set maximum compressed and uncompressed size limits for files that are contained within files that are archived or compressed, follow these steps:

1. Upgrade to Hotfix Rollup 1 for Forefront Security for Office Communications Server.
2. To set the maximum compressed file size, create a new DWORD registry value that is named MaxCompressedArchivedFileSize in the following registry subkey:
   
   For 32-bit versions
   HKEY_LOCAL_MACHINE\Software\Microsoft\Forefront Server Security\Office Communications Server
   For 64-bit versions
   HKEY_LOCAL_MACHINE\Wow6432Node\Software\Microsoft\Forefront Server Security\Office Communications Server
3. Set the MaxCompressedArchivedFileSize value to the desired maximum file size in bytes. For example, a value of 50000000 would equate to approximately 50 megabytes (MB).
4. To set the maximum uncompressed file size, create a new DWORD registry value that is named MaxUncompressedFileSize in the following registry subkey:
   
   For 32-bit versions
   HKEY_LOCAL_MACHINE\Software\Microsoft\Forefront Server Security\Office Communications Server
   For 64-bit versions
   HKEY_LOCAL_MACHINE\Wow6432Node\Software\Microsoft\Forefront Server Security\Office Communications Server
5. Set the MaxUncompressedFileSize value to the desired maximum file size in bytes. For example, a value of 200000000 would equate to approximately 200 megabytes (MB).
6. For the changes to take effect, do one of the following:
   1. Stop and then restart the FSCController Server service in the Service Control Manager.
   2. Open the Forefront Security for Office Communications Server Administrative console, make a change, and then click Save. For example, click to clear one of the check boxes for the scan engines from a scan job, and then click Save. Click to select the check box for the same scan engine, and then click Save.

Note When the MaxCompressedArchivedFileSize and the MaxUncompressedFileSize registry values are not present, the following default values apply:

• MaxCompressedArchivedFileSize: 20MB
• MaxUncompressedFileSize: 100MB

Issues that are fixed in Hotfix Rollup 1 for Forefront Security for Office Communications Server

This hotfix rollup fixes the following issues:

1. You cannot send an instant message that contains a clickable hyperlink from Microsoft Office Communicator 2007 when the Microsoft Office Communications Server 2007 server is running Forefront Security for Office Communications Server
2. When you stop Forefront Security for Office Communications Server by using the Office Communications Server Administrative console, the ForefrontRTCProxy64.exe process memory usage climbs until all available memory is used
3. Memory leak in Forefront Security for Office Communications Server
4. The \SERVERNAME parameter does not work when you use the FSCStarter.exe tool to apply template settings on a remote server in Forefront Security for Office Communications Server
5. The Kaspersky scan engine rolls back when you try to update it in Forefront Security for Office Communications Server
6. A scan engine update fails and logs a warning message in the ProgramLog.txt file
7. Forefront Security for Office Communications Server (FSOCS) may contain the deprecated Computer Associates virus engine (CAVet)
8. Those who use Office Communicator to send a file do not receive a "File Transferred Cancelled" notification if the intended recipient cancels or rejects the file transfer

Details of the issues that are fixed in the hotfix rollup

1. You cannot send an instant message that contains a clickable hyperlink from Microsoft Office Communicator 2007 when the Microsoft Office Communications Server 2007 server is running Forefront Security for Office Communications Server
   Symptoms
   
   When you try to send an instant message that contains a clickable hyperlink from Microsoft Office Communicator 2007, you receive the following error message:

   The following message was not delivered. (ID:400)

   Additionally, the recipient does not receive the instant message.
   
   More information
   
   This issue is fixed in Hotfix Rollup 1 for Forefront Security for Office Communications Server. However, there is a workaround for this problem if you cannot apply the hotfix rollup.
   
   For more information about how to work around this problem, click the following article number to view the article in the Microsoft Knowledge Base:

   971480  (http://support.microsoft.com/kb/971480/ ) You cannot send an instant message that contains a clickable hyperlink when the Office Communications Server 2007 server is running Forefront Security for Office Communications Server
2. When you stop Forefront Security for Office Communications Server by using the Office Communications Server Administrative console, the ForefrontRTCProxy64.exe process memory usage climbs until all available memory is used
   Symptoms
   
   In the Microsoft Office Communications Server Administrative console, you open the Front End Script Properties. Then, you click to clear the check box next to Enabled to disable Forefront Security for Office Communications Server. After you do this, the ForefrontRTCProxy64.exe process memory usage increases until all available memory is used. Additionally, the following error message is logged in the Application event log with an Event ID of 30247:

   OCS Application Module
3. Memory leak in Forefront Security for Office Communications Server
   Symptoms
   
   There is a known memory leak of approximately 10 bytes per message that Forefront Security for Office Communications Server scans. Although this is a small amount, the memory is not released after the message is scanned. Therefore, over time, the memory that is not released increases.
   
   Cause
   
   This problem is because of incorrect internal logic in Forefront Security for Office Communications Server.
4. The \SERVERNAME parameter does not work when you use the FSCStarter.exe tool to apply template settings on a remote server in Forefront Security for Office Communications Server
   Symptoms
   
   You use the FSCStarter.exe tool to apply template settings on a remote server. When you do this, you cannot use the \SERVERNAME parameter together with the t parameter.
   
   For example, you run the following command to apply Filter Lists from a remote template to the remote server that is named MyServer:

   fscstarter.exe tl \MyServer

   When you run this command, the following entries are logged in the ProgramLog.txt file. These entries indicate that the operation was unsuccessful:

   "TEMPLATES: starter called with options (tl \MyServer)"
   "TEMPLATES: starter Option converts to (32)"
   "ERROR: antigenstarter.cpp::ReplaceLocalTemplateFile(): Template replacement file "\MyServer" does not exist."

   Cause
   
   This problem occurs because Forefront Security for Office Communications Server did not target the correct path of the remote server template.
5. The Kaspersky scan engine rolls back when you try to update it in Forefront Security for Office Communications Server
   Symptoms
   
   When you try to update the Kaspersky scan engine in Forefront Security for Office Communications Server, the update is not successful, and Forefront Security for Office Communications Server performs a rollback to the previous engine version. The Kaspersky scan engine is not updated.
   
   Additionally, the following information is logged in the ProgramLog.txt file during the update attempt:

   "INFORMATION: The Kaspersky5 scan engine has been downloaded"
   "ERROR: The Kaspersky5 scan engine update timed out while disabling the scan engine"
   "INFORMATION: The Kaspersky5 scan engine has been rolled back."
6. A scan engine update fails and logs a warning message in the ProgramLog.txt file
   Symptoms
   
   If any of the Forefront Security for Office Communications Server external engine vendors release an engine update, and the update incorporates files that are packaged within subdirectories, the engine update fails. Additionally, a warning message is logged in the ProgramLog.txt file that resembles the following:

   WARNING: A failure was reported by the synchronization observer while installing the scanner. Action = 0x00000001. C:\<FSOCS Installation Directory>\(EngineName)\Bin\bases/stt/

   Cause
   
   This problem occurs because Forefront Security for Office Communications Server cannot update a scan engine when the update contains one or more subdirectories within its update package.
7. Forefront Security for Office Communications Server (FSOCS) may contain the deprecated Computer Associates virus engine (CAVet)
   
   Symptoms
   
   The Computer Associates virus engine (CAVet) no longer updates or scans efficiently.
   
   More information
   
   The CAVet virus engine was deprecated December 1, 2009. The CAVet virus engine is no longer supported, although this virus engine may appear in the administrative console of Forefront Security for Office Communications Server. The Authentium Command virus engine replaces the CAVet virus engine.
8. Those who use Office Communicator to send a file do not receive a "File Transferred Cancelled" notification if the intended recipient cancels or rejects the file transfer
   
   Symptoms
   
   The sender is not notified that the pending file transfer was canceled.
   
   More information
   
   Forefront Security for Office Communications Server may block the cancellation message that is sent to the sender from Office Communicator if the recipient either cancels or rejects the file. Therefore, the sender is not notified that the file transfer was canceled.

Hotfix rollup information

Download information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

How to install the hotfix rollup

To install the hotfix rollup, follow these steps:

1. Run the installer. To do this, double-click the hotfix rollup executable file.
   
   Note When the installer is running, the Forefront services are stopped.
2. After the installation is complete, and the Forefront services are restarted, make sure that Forefront is working correctly.
   
   Notes
   • The Forefront services are restarted automatically during the installation.
   • Forefront service packs or hotfix rollups can be installed by using the FFSMC Deployment job. For more information, see "Deployment Jobs" in the Forefront Server Security Management Console User's Guide. In this case, the installer runs in silent mode, and user input is not required. The rest of the process remains the same as when you double-click the executable file to run the installer .

Prerequisites

This hotfix rollup requires that Microsoft Forefront Security for Office Communications Server build 10.2.308 is installed.

File information

This hotfix may not contain all the files that you must have to fully update a product to the latest build. This hotfix contains only the files that you must have to correct the issues that are listed in this article.

The English (United States) version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.