Forefront Client Security anti-malware client update: December 2009

Issue 2

Occasionally scheduled scans are not initiated on certain Forefront Client Security clients that are running Windows 2000 Server.

Resolution

This problem is caused by a timing issue. This timing issue occurs when the MpCmdRun.exe utility is called for scheduled scans on a computer that is running Windows 2000 Server. This update corrects the timing issue so that scheduled scans are initiated correctly.

Issue 3

Generically or heuristically found malware that is detected by a scheduled scan is suspended. However, action may not be automatically taken upon the malware.

Resolution

After you apply this update, all malware detected in a scheduled scan is automatically taken action upon regardless of the detection type (concrete, generic, or heuristic) when a Forefront Client Security policy is deployed.

Issue 4

After you install the anti-malware update 971026, some managed Forefront Client Security clients on Windows XP and on Windows Server 2003 take longer to log on. This delay occurs after a restart if one or more file or folder path exclusions that are network-based are set.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

971026 A hotfix is available to resolve some problems with the Forefront Client Security anti-malware client

File or folder path exclusions that are network-based are fully resolved into device paths before the scanning worker threads are initialized in the Forefront Client Security startup process. The delay occurs if the kernel mode mini-filter of Forefront Client Security intercepts the file I/O from the logon process while the network-based file or folder paths are being resolved.

Workaround

Customers who are experiencing this issue and who cannot immediately apply this update can work around the issue by removing all file or folder path exclusions that are network-based. Then implement the DisableScanningNetworkFiles policy setting described in Microsoft Knowledge Base (KB) article 971026.

Resolution

After you apply this update, only the local exclusions are applied before the scanning worker threads are initialized in the Forefront Client Security startup process. After initialization, the full configuration is refreshed to include file or folder path exclusions that are network-based.


This update also honors the DisableScanningNetworkFiles policy setting. Therefore, the customers who implement this setting do not have to re-create file or folder path exclusions that are network-based after they apply this update.

Hotfix information

A supported hotfix is available from Microsoft.



Note This hotfix is available from Microsoft Update and from Windows Server Update Services. If you want to obtain the file for deployment by using a different method, follow these steps:

1. Visit the following Microsoft Update Catalog Web site:
   
   http://catalog.update.microsoft.com/v7/site/Home.aspx
2. Type 976668 in the Search box, and then click Search.
3. 
   Click Add to add the hotfix to the basket.
4. 
   Near the search bar at the top, click the view basket link.
5. 
   Click Download.
6. 
   Click Browse, specify the folder to which you want to download the hotfix, and then click OK.
7. 
   Click Continue, and then click I Accept to accept the Microsoft Software License Terms.
8. When the update is downloaded to the location that you specified, click Close.

Prerequisites

There are no prerequisites for installing this hotfix.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix replaces the following hotfixes:

971026 A hotfix is available to resolve some problems with the Forefront Client Security anti-malware client

952265 Data corruption may occur on a computer that has Forefront Client Security installed

938054 A hotfix is available to resolve some problems with the Forefront Client Security client

956280 The Forefront Client Security kernel-mode mini-filter unloads when you browse a network file share that contains many malicious files

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Forefront Client Security, 32-bit versions

Forefront Client Security, 64-bit versions