Introduction

This article describes the Microsoft Forefront Client Security (FCS) anti-malware client issues that are resolved in the March 2011 update package.

Issues that this hotfix package resolves

Issue 1

Computers that are running Forefront Client Security (FCS) and that frequently operate on battery power do not update definitions at the scheduled time.

Resolution

This update contains changes for Forefront Client Security (FCS) to let a computer that operates on battery power update definitions at the scheduled time.

Issue 2

You cannot open a file that is encrypted by Prim'X ZoneCentral and that is located in a network shared folder on a computer that is running Forefront Client Security (FCS).

Resolution

The installer for this update package sets the AttachWhenLoaded registry value for the Windows Filter Manager to 1 on certain operating systems. For more information about the AttachWhenLoaded registry value and the applicable operating systems, visit the following MSDN website:

General information about the AttachWhenLoaded registry value and the applicable operating systems

Issue 3

Some real-time protection errors occur on computers that are running Windows 2000 Server and that use Forefront Client Security (FCS).

Resolution

This update changes MpFilter.sys to resolve this issue and to replace the update that is described in the following article:

2459065 Real-time protection fails on Windows 2000 after you apply the Forefront Client Security October 2010 update

More Information

Hotfix information

A supported hotfix is available from Microsoft.Note This hotfix is available from Microsoft Update and from Windows Server Update Services (WSUS). If you want to obtain the hotfix for deployment by using a different method, follow these steps:

  1. Visit the following Microsoft Update Catalog website:

    http://catalog.update.microsoft.com/v7/site/Home.aspx

  2. Type 2508823 in the Search box, and then click Search.

  3. Click Add to add the hotfix to the basket.

  4. Click Download.

  5. Click Browse, specify a folder for the file that you want to download, and then click OK.

  6. Click Continue, and then click I Accept to accept the Microsoft Software License Terms.

  7. When the update is downloaded to the folder that you specified, click Close.

Prerequisites

There are no prerequisites for installing this hotfix.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix replaces the anti-malware client that is deployed by using the Forefront Client Security deployment package (1.0.1725.0).

2394439 Forefront Client Security deployment package (1.0.1728.0): October 2010This hotfix replaces the following hotfixes:

2394433 Forefront Client Security antimalware client update: October 2010

2459065 Real-time protection fails on Windows 2000 after you apply the Forefront Client Security October 2010 update

979536 Forefront Client Security anti-malware client update: April 2010

976668 Forefront Client Security anti-malware client update: December 2009

971026 A hotfix is available to resolve some problems with the Forefront Client Security anti-malware client

952265 Data corruption may occur on a computer that has Forefront Client Security installed

938054 A hotfix is available to resolve some problems with the Forefront Client Security client

956280 The Forefront Client Security kernel-mode mini-filter unloads when you browse a network file share that contains many malicious files

File information

The English version of this update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.Forefront Client Security, x86-based versions

File name

File version

File size

Date

Time

Amhelp.chm

Not Applicable

65,216

19-Jul-2010

00:51

Mpasbase.vhd

1.0.0.0

572,720

19-Jul-2010

00:52

Mpasdesc.dll

1.5.1996.0

49,024

02-Feb-2011

16:42

Mpasdlta.vhd

1.0.0.0

9,008

19-Jul-2010

00:52

Mpavbase.vhd

1.0.0.0

204,624

19-Jul-2010

00:52

Mpavdlta.vhd

1.0.0.0

9,040

19-Jul-2010

00:52

Mpavrtm.dll

1.5.1996.0

128,384

02-Feb-2011

16:23

Mpclient.dll

1.5.1996.0

367,488

02-Feb-2011

16:23

Mpcmdrun.exe

1.5.1996.0

349,064

08-Jan-2011

22:06

Mpengine.dll

1.1.3520.0

3,308,624

19-Jul-2010

00:52

Mpevmsg.dll

1.5.1996.0

23,424

02-Feb-2011

16:42

Mpfilter.sys

1.5.1996.0

71,296

02-Feb-2011

16:14

Mpoav.dll

1.5.1996.0

92,032

02-Feb-2011

16:23

Mprtmon.dll

1.5.1996.0

731,008

02-Feb-2011

16:23

Mpsigdwn.dll

1.5.1996.0

129,920

02-Feb-2011

16:23

Mpsoftex.dll

1.5.1996.0

518,016

02-Feb-2011

16:23

Mpsvc.dll

1.5.1996.0

319,872

02-Feb-2011

16:23

Mputil.dll

1.5.1996.0

177,024

02-Feb-2011

16:23

Msascui.exe

1.5.1996.0

1,033,600

02-Feb-2011

16:23

Msmpcom.dll

1.5.1996.0

221,056

02-Feb-2011

16:23

Msmpeng.exe

1.5.1996.0

16,896

08-Jan-2011

22:06

Msmplics.dll

1.5.1996.0

9,088

02-Feb-2011

16:23

Msmpres.dll

1.5.1996.0

766,336

02-Feb-2011

16:42

Forefront Client Security, x64-based versions

File name

File version

File size

Date

Time

Amhelp.chm

Not Applicable

65,216

19-Jul-2010

00:51

Mpasbase.vdm

1.0.0.0

572,720

19-Jul-2010

00:52

Mpasdesc.dll

1.5.1996.0

49,536

02-Feb-2011

18:18

Mpasdesc.dll (x86 directory)

1.5.1996.0

49,024

02-Feb-2011

16:42

Mpasdlta.vdm

1.0.0.0

9,008

19-Jul-2010

00:52

Mpavbase.vdm

1.0.0.0

204,624

19-Jul-2010

00:52

Mpavdlta.vdm

1.0.0.0

9,040

19-Jul-2010

00:52

Mpavrtm.dll

1.5.1996.0

155,008

02-Feb-2011

17:58

Mpclient.dll

1.5.1996.0

547,712

02-Feb-2011

17:58

Mpclient.dll (x86 directory)

1.5.1996.0

367,488

02-Feb-2011

16:14

Mpcmdrun.exe

1.5.1996.0

504,624

08-Jan-2011

23:46

Mpengine.dll

1.1.3520.0

4,431,952

19-Jul-2010

00:52

Mpevmsg.dll

1.5.1996.0

23,424

02-Feb-2011

18:18

Mpfilter.sys

1.5.1996.0

91,520

02-Feb-2011

16:14

Mpoav.dll

1.5.1996.0

117,632

02-Feb-2011

17:58

Mpoav.dll (x86 directory)

1.5.1996.0

92,032

02-Feb-2011

16:14

Mprtmon.dll

1.5.1996.0

1,181,056

02-Feb-2011

17:58

Mpsigdwn.dll

1.5.1996.0

179,584

02-Feb-2011

17:58

Mpsoftex.dll

1.5.1996.0

791,424

02-Feb-2011

17:58

Mpsvc.dll

1.5.1996.0

438,656

02-Feb-2011

17:58

Mputil.dll

1.5.1996.0

247,168

02-Feb-2011

17:58

Mputil.dll (x86 directory)

1.5.1996.0

177,024

02-Feb-2011

16:14

Msascui.exe

1.5.1996.0

1,636,736

02-Feb-2011

17:58

Msmpcom.dll

1.5.1996.0

305,536

02-Feb-2011

17:58

Msmpeng.exe

1.5.1996.0

16,384

08-Jan-2011

23:46

Msmplics.dll

1.5.1996.0

9,088

02-Feb-2011

17:58

Msmplics.dll (x86 directory)

1.5.1996.0

9,088

02-Feb-2011

17:58

Msmpres.dll

1.5.1996.0

764,288

02-Feb-2011

18:18

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More Information

This update is included in a new slipstream installation package of the Forefront Client Security client software. For more information about the slipstream installation package, click the following article number to view the article in the Microsoft Knowledge Base:

2508824 Forefront Client Security deployment package (1.0.1736.0): March 2011

Known IssuesMicrosoft has identified an issue when this update is installed on Windows Vista, Windows Server 2008, Windows 7, or Windows Server 2008 R2, that may cause the antimalware agent to be removed when using the Windows install updates and shut down feature to apply this update. For more information on this issue see the following article:

2524280 Antimalware agent is removed after you apply Forefront Client Security March 2011 update when using install updates and shut down

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.