Forefront Client Security anti-malware client update: December 2009

Issue 1

Client setup for Forefront Client Security fails when Forefront Client Security is installed on a server that is running Windows Server 2008 R2 Core. The following error is found in the FCSAM.log file:

DIFXAPP: ERROR - The operating system you are running on is not supported. Only Windows 2000, Windows XP, Windows Server 2003 and Windows codenamed Longhorn are supported.

This client setup error also occurs on a computer that is running Windows 7 or Windows Server 2008 R2 when Windows Application Compatibility is disabled.


This problem occurs because the earlier versions of the anti-malware client used the Driver Install Frameworks (DIFx) for Applications libraries that were not originally designed for use on Windows 7 or for use on Windows Server 2008 R2. Forefront Client Security installations on these operating systems succeed because of an operating system application compatibility setting. This application compatibility setting is not present on a server that is running Windows Server 2008 R2 Core and is not applied if it is disabled on a computer that is running Windows 7 or Windows Server 2008 R2.

Issue 2

Occasionally scheduled scans are not initiated on certain Forefront Client Security clients that are running Windows 2000 Server.

Issue 3

Generically or heuristically found malware that is detected by a scheduled scan is suspended. However, action may not be automatically taken upon the malware.

Issue 4

After you install the anti-malware update 971026, some managed Forefront Client Security clients on Windows XP and on Windows Server 2003 take longer to log on. This delay occurs after a restart if one or more file or folder path exclusions that are network-based are set.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

971026 A hotfix is available to resolve some problems with the Forefront Client Security anti-malware client

File or folder path exclusions that are network-based are fully resolved into device paths before the scanning worker threads are initialized in the Forefront Client Security startup process. The delay occurs if the kernel mode mini-filter of Forefront Client Security intercepts the file I/O from the logon process while the network-based file or folder paths are being resolved.

Prerequisites

There are no prerequisites for installing this hotfix.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix replaces the following hotfixes:

971026 A hotfix is available to resolve some problems with the Forefront Client Security anti-malware client

952265 Data corruption may occur on a computer that has Forefront Client Security installed

938054 A hotfix is available to resolve some problems with the Forefront Client Security client

956280 The Forefront Client Security kernel-mode mini-filter unloads when you browse a network file share that contains many malicious files

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.