This article describes the Microsoft Forefront Client Security (FCS) anti-malware client issues that are fixed in this hotfix package for Forefront Client Security.
Issues that this hotfix package fixes
Issue 1Client setup for Forefront Client Security fails when Forefront Client Security is installed on a server that is running Windows Server 2008 R2 Core. The following error is found in the FCSAM.log file:
This client setup error also occurs on a computer that is running Windows 7 or Windows Server 2008 R2 when Windows Application Compatibility is disabled.
DIFXAPP: ERROR - The operating system you are running on is not supported. Only Windows 2000, Windows XP, Windows Server 2003 and Windows codenamed Longhorn are supported.
This problem occurs because the earlier versions of the anti-malware client used the Driver Install Frameworks (DIFx) for Applications libraries that were not originally designed for use on Windows 7 or for use on Windows Server 2008 R2. Forefront Client Security installations on these operating systems succeed because of an operating system application compatibility setting. This application compatibility setting is not present on a server that is running Windows Server 2008 R2 Core and is not applied if it is disabled on a computer that is running Windows 7 or Windows Server 2008 R2.
WorkaroundOn Windows 7 or Windows Server 2008 R2 non-Core editions, re-enable Windows Application Compatibility.
ResolutionThe installation package for this anti-malware client update uses a revised version of the DIFx for Applications libraries that is natively compatible with Windows 7 and with Windows Server 2008 R2. Therefore, the installation package for this anti-malware client update does not require the application compatibility settings.
Issue 2Occasionally scheduled scans are not initiated on certain Forefront Client Security clients that are running Windows 2000 Server.
ResolutionThis problem is caused by a timing issue. This timing issue occurs when the MpCmdRun.exe utility is called for scheduled scans on a computer that is running Windows 2000 Server. This update corrects the timing issue so that scheduled scans are initiated correctly.
Issue 3Generically or heuristically found malware that is detected by a scheduled scan is suspended. However, action may not be automatically taken upon the malware.
ResolutionAfter you apply this update, all malware detected in a scheduled scan is automatically taken action upon regardless of the detection type (concrete, generic, or heuristic) when a Forefront Client Security policy is deployed.
Issue 4After you install the anti-malware update 971026, some managed Forefront Client Security clients on Windows XP and on Windows Server 2003 take longer to log on. This delay occurs after a restart if one or more file or folder path exclusions that are network-based are set.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
971026 A hotfix is available to resolve some problems with the Forefront Client Security anti-malware clientFile or folder path exclusions that are network-based are fully resolved into device paths before the scanning worker threads are initialized in the Forefront Client Security startup process. The delay occurs if the kernel mode mini-filter of Forefront Client Security intercepts the file I/O from the logon process while the network-based file or folder paths are being resolved.
WorkaroundCustomers who are experiencing this issue and who cannot immediately apply this update can work around the issue by removing all file or folder path exclusions that are network-based. Then implement the DisableScanningNetworkFiles policy setting described in Microsoft Knowledge Base (KB) article 971026.
ResolutionAfter you apply this update, only the local exclusions are applied before the scanning worker threads are initialized in the Forefront Client Security startup process. After initialization, the full configuration is refreshed to include file or folder path exclusions that are network-based.
This update also honors the DisableScanningNetworkFiles policy setting. Therefore, the customers who implement this setting do not have to re-create file or folder path exclusions that are network-based after they apply this update.
Hotfix informationA supported hotfix is available from Microsoft.
Note This hotfix is available from Microsoft Update and from Windows Server Update Services. If you want to obtain the file for deployment by using a different method, follow these steps:
- Visit the following Microsoft Update Catalog Web site:
- Type 976668 in the Search box, and then click Search.
Click Add to add the hotfix to the basket.
Near the search bar at the top, click the view basket link.
Click Browse, specify the folder to which you want to download the hotfix, and then click OK.
Click Continue, and then click I Accept to accept the Microsoft Software License Terms.
- When the update is downloaded to the location that you specified, click Close.
PrerequisitesThere are no prerequisites for installing this hotfix.
Restart requirementYou must restart the computer after you apply this hotfix.
Hotfix replacement informationThis hotfix replaces the following hotfixes:
971026 A hotfix is available to resolve some problems with the Forefront Client Security anti-malware client
952265 Data corruption may occur on a computer that has Forefront Client Security installed
938054 A hotfix is available to resolve some problems with the Forefront Client Security client
956280 The Forefront Client Security kernel-mode mini-filter unloads when you browse a network file share that contains many malicious files
File informationThe English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
Forefront Client Security, 32-bit versions
|File name||File version||File size||Date||Time|
Forefront Client Security, 64-bit versions
|File name||File version||File size||Date||Time|
This update is included in a new slipstream installation package of the Forefront Client Security client software. For more information about the slipstream installation package, visit the following Microsoft Knowledge Base article:
976669 Forefront Client Security deployment package (1.0.1725.0): December 2009
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.