Data corruption may occur on a computer that has Forefront Client Security installed


Data corruption may occur on a computer that has Microsoft Forefront Client Security (FCS) installed. When this data corruption occurs, you may experience the following symptoms.

Symptom 1

If you upload a file to a Microsoft Office SharePoint Server site or to a Web Distributed Authoring and Versioning (WebDAV) site, the uploaded file may be corrupted. This symptom occurs at random times. It may occur with any file types and with any file name extensions. The corrupted files may contain additional zeros at the end of the file or at write-page boundaries.

Symptom 2

The Applicationhost.config file may be corrupted on a computer that is running Internet Information Services (IIS) 7.0. This symptom occurs at random times. It is likely to occur when you change IIS configurations for a Web site. The corrupted file may contain additional zeros at the end of the file or at write-page boundaries. Or, the file may be truncated.

In this situation, the Web site configuration cannot load, and the following information is logged in the IIS log:
8:56:16 PM [ERROR] Unable to IISAddVirtualDirectory. ERROR: Error adding virtual directory ' server1' to W3SVC '2904452': The data is invalid.
8:56:16 PM [ERROR] Unable to add account filter. ERROR: Exception adding ISAPI filter, DomainMapper, to Metabase path, W3SVC/2904452: The data is invalid.

Symptom 3

On a Windows Server 2008 computer that runs Hyper-V, when you use the New Virtual Machine Wizard to create a virtual machine, the operation fails. Additionally, you receive the following error message:
The server encountered an error while configuring memory on the New Virtual Machine. Wizard Failed in rolling back the created virtual machine. Please delete it manually afterwards.

Failed to add device 'Microsoft Synthetic Ethernet Port'

The Virtual Machines configuration GUID at 'C:\Program Data\Microsoft\Windows\Hyper-V' is no longer accessible: The requested operation cannot be performed on a file with a user-mapped section open. (0x800704C8)


This problem occurs because of a known issue of cache coherency between mapped I/O requests and non-cached I/O requests. Forefront Client Security real-time protection uses memory mapped I/O requests for scanning files. This problem affects non-cached I/O requests. It may cause data corruption or cause truncation operations to be unsuccessful.

More Information

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Note This hotfix is available from Microsoft Update and from Windows Server Update Services. If you want to obtain the file for deployment by using a different method, follow these steps:
  1. Visit the following Microsoft Update Catalog Web site:
  2. Type 952265 in the Search box, and then click Search.
  3. Click Add to add the hotfix to the basket.
  4. Near the search bar at the top, click the view basket link.
  5. Click Download.
  6. Click Browse, specify the folder to which you want to download the hotfix, and then click OK.
  7. Click Continue, and then click I Accept to accept the Microsoft Software License Terms. The hotfix starts to download.
  8. Wait until the hotfix is downloaded to the specified location, and then click Close.

Known issues with this update

  • This hotfix may not be installed when you use Windows Update to install updates on a computer that is running a Server Core installation of Windows Server 2008. For more information about this issue, click the following article number to view the article in the Microsoft Knowledge Base:
    955884 The update for Forefront Client Security (update 952265) may not be installed on a Server Core installation of Windows Server 2008 when you use Windows Update


No prerequisites are required.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix replaces hotfix 938054. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

938054 A hotfix is available to resolve some problems with the Forefront Client Security client

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
Forefront Client Security, x86-based versions
File nameFile versionFile sizeDateTime
Amhelp.chmNot applicable65,21607-Mar-200721:43
Forefront Client Security, x64-based versions
File nameFile versionFile sizeDateTime
Amhelp.chmNot applicable65,21607-Mar-200721:43


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.