Forefront Client Security anti-malware client update: April 2010

Workaround

When malware is detected by real-time protection, the malware is suspended and cannot be read or executed by other applications. This behavior occurs both when a user is logged on to the computer and when a user is not logged on to the computer. Therefore, the computer is under protection. However, the malware still resides on the disk.

If a user logs on to the computer after the malware is detected, they are notified in the user interface and the real-time protection delay period begins.

When you deploy a policy to client computers, FCS takes action automatically on malware detected during scheduled scans. If you perform a scheduled full scan of the computer, action is taken against any malware that is detected and suspended after the scan is finished. A full scan includes all hard disk drives on the computer and takes action regardless of whether a user is logged on to the computer during the scan.

Resolution

This update adds an additional timer to the malware protection service. This additional timer implements the real-time protection delay period. Therefore, the default action that is defined either by policy or by definitions is executed when no user is logged on to the computer.

Issue 2

A change to the libraries of the Driver Install Frameworks (DIFx) for Applications is described under the "Issue 1" heading in the "Resolution" section of the following article Knowledge Base (KB) article:

976668 Forefront Client Security anti-malware client update: December 2009

Many automated installation methods install updates by using the LocalSystem account. For example, Automatic Updates and System Center Configuration Manager use the LocalSystem account for updates. When the hotfix 976668 is installed by using the LocalSystem account on a Windows 2000-based computer, the update fails and the following error is logged in the Mp_ambits.log file:

Workaround

To install the update that is described in KB 976668 on a Windows 2000-based Computer, log on the computer as an interactive user, and then run the update. To obtain the update, use the Microsoft Update Web site by using a Web browser, or download and then run the update from the Microsoft Update catalog that is described in KB 976668.

Resolution

This update no longer uses DIFx for Applications during installation. The update uses a custom installation technology that can be used on all currently supported FCS operating systems.

Issue 3

The FCS anti-malware service exits unexpectedly on a computer that is running Windows Vista, Windows Server 2008, Windows 7, or Windows Server 2008 R2.

Resolution

This update corrects a problem in the FCS anti-malware service on the on a computer that is running Windows Vista, Windows Server 2008, Windows 7, or Windows Server 2008 R2.

If you perform the workaround that is described under the "Issue 2" heading by installing hotfix 976668 as an interactive user on a computer that is running Windows 2000, you must also run this update as an interactive user. This requirement is necessary because this update uninstalls the update that is described in KB article 976668 before this update is installed. If you install this update by using the LocalSystem account, the same issues that are described in KB article 976668 occur during that uninstall stage of the update.