Article ID: 938054
Article Last Modified on 10/18/2007
APPLIES TO
- Microsoft Forefront Client Security
Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows registry
SYMPTOMS
You experience the following symptoms when you are using Microsoft Forefront Client Security.
Symptom 1
On a computer that is running Microsoft Windows 2000 Service Pack 4, the Anti-malware user interface cannot open when you log on to the computer by using a non-administrator account.
Symptom 2
In the notification area, the Forefront Client Security icon becomes orange to indicate that an issue has occurred. When you open the Forefront Client Security client to view the issue, the client incorrectly reports that a product update is available for the Forefront Client Security client. A product update is not available.
Note In this scenario, the new product update notification differs from the new definition update notification.
Symptom 3
When you save a Microsoft Office Word document that already exists on a FAT32 volume, the file disappears unexpectedly. This occurs only when antivirus real-time protection (RTP) is enabled.
Symptom 4
The Microsoft Forefront Client Security Anti-malware Service stops unexpectedly. Then, this service does not recover automatically. This symptom occurs if the signature or the engine update is invalid.
CAUSE
Cause 1
Symptom 1 occurs because of a permission issue that is specific to Windows 2000. In Windows 2000, a non-administrator user is denied access to the RegisterGPNotification function. This function is used to monitor policy changes.
Cause 2
Symptom 2 occurs because a registry value is not reset as expected after a successful upgrade. To determine the current state of Forefront Client Security Agent, the Forefront Client Security client queries the following registry entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Forefront\Client Security\1.0\AM\ProductUpdateAvailable
Note A value of 0 indicates that new updates are not needed. A value of 1 indicates that new updates are needed.
However, the Forefront Client Security client update package did not reset this registry value to 0 after the last upgrade.
Cause 3
Symptom 3 occurs for one of the following reasons:
- Word sometimes deletes files when the temporary backup file cannot be accessed.
- The I/O manager does not close a file correctly on a FAT32 volume if the Object Manager rejects the open action during security checks when the file is accessed.
Cause 4
Symptom 4 occurs because the Microsoft Forefront Client Security Anti-malware Service registers with the Service Control Manager (SCM) to automatically start two times after a failure. If an invalid signature causes the service to stop repeatedly, the SCM makes only two restart attempts and does not continue to restart the service.
RESOLUTION
Hotfix information
A hotfix is available to resolve these symptoms. This hotfix is available from Microsoft Update or from Windows Server Update Services. If you want to obtain the file for deployment by using a different method, contact Customer Support Services.
A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Forefront Client Security service pack that contains this hotfix.
To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:
Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:
Prerequisites
There are no prerequisites for installing this hotfix.
Restart requirement
You have to restart the computer after you apply this hotfix.
Hotfix replacement information
This hotfix does not replace a previously released hotfix.
File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
Forefront Client Security, x64-based versions
| FileName | FileSize | Version | Date | Time |
| AMHelp.chm | 65,216 | March 8, 2007 | 1:43:26 AM | |
| Mpasbase.vdm | 572,720 | 1.0.0.0 | March 8, 2007 | 1:44:44 AM |
| MpAsDesc.dll | 53,136 | 1.5.1941.0 | August 2, 2007 | 1:24:14 AM |
| Mpasdlta.vdm | 9,008 | 1.0.0.0 | March 8, 2007 | 1:44:44 AM |
| Mpavbase.vdm | 204,624 | 1.0.0.0 | March 8, 2007 | 1:44:44 AM |
| Mpavdlta.vdm | 9,040 | 1.0.0.0 | March 8, 2007 | 1:44:44 AM |
| MpAvRtm.dll | 154,512 | 1.5.1941.0 | August 2, 2007 | 1:12:12 AM |
| MpClient.dll | 549,264 | 1.5.1941.0 | August 2, 2007 | 1:12:18 AM |
| MpCmdRun.exe | 494,992 | 1.5.1941.0 | August 2, 2007 | 1:12:18 AM |
| MpEngine.dll | 3,758,984 | 1.1.2701.0 | July 4, 2007 | 1:18:14 AM |
| Mpevmsg.dll | 27,024 | 1.5.1941.0 | August 2, 2007 | 1:23:32 AM |
| Mpfilter.cat | 10,672 | July 7, 2007 | 12:09:12 AM | |
| Mpfilter.inf | 2,941 | March 8, 2007 | 1:44:42 AM | |
| Mpfilter.sys | 89,488 | 1.5.1941.0 | July 7, 2007 | 12:09:12 AM |
| MpOAv.dll | 121,232 | 1.5.1941.0 | August 2, 2007 | 1:12:08 AM |
| MpRtMon.dll | 1,184,656 | 1.5.1941.0 | August 2, 2007 | 1:12:22 AM |
| MpSigDwn.dll | 183,184 | 1.5.1941.0 | August 2, 2007 | 1:12:12 AM |
| MpSoftEx.dll | 795,024 | 1.5.1941.0 | August 2, 2007 | 1:12:22 AM |
| MpSvc.dll | 406,928 | 1.5.1941.0 | August 2, 2007 | 1:12:18 AM |
| MpUtil.dll | 250,256 | 1.5.1941.0 | August 2, 2007 | 1:12:14 AM |
| MSASCui.exe | 1,640,336 | 1.5.1941.0 | August 2, 2007 | 1:12:24 AM |
| MsMpCom.dll | 309,136 | 1.5.1941.0 | August 2, 2007 | 1:12:18 AM |
| MsMpEng.exe | 18,320 | 1.5.1941.0 | August 2, 2007 | 1:12:08 AM |
| MsMpLics.dll | 12,688 | 1.5.1941.0 | August 2, 2007 | 1:12:02 AM |
| MsMpRes.dll | 767,888 | 1.5.1941.0 | August 2, 2007 | 1:24:48 AM |
'Forefront Client Security, x86-based versions'
| FileName | FileSize | Version | Date | Time |
| AMHelp.chm | 65,216 | March 8, 2007 | 1:43:26 AM | |
| Mpasbase.vdm | 572,720 | 1.0.0.0 | March 8, 2007 | 1:44:44 AM |
| MpAsDesc.dll | 52,624 | 1.5.1941.0 | August 1, 2007 | 11:52:44 PM |
| Mpasdlta.vdm | 9,008 | 1.0.0.0 | March 8, 2007 | 1:44:44 AM |
| Mpavbase.vdm | 204,624 | 1.0.0.0 | March 8, 2007 | 1:44:44 AM |
| Mpavdlta.vdm | 9,040 | 1.0.0.0 | March 8, 2007 | 1:44:44 AM |
| MpAvRtm.dll | 128,912 | 1.5.1941.0 | August 1, 2007 | 11:19:44 PM |
| MpClient.dll | 369,552 | 1.5.1941.0 | August 1, 2007 | 11:19:54 PM |
| MpCmdRun.exe | 341,904 | 1.5.1941.0 | August 1, 2007 | 11:19:52 PM |
| MpEngine.dll | 2,783,624 | 1.1.2701.0 | July 3, 2007 | 1:18:18 AM |
| Mpevmsg.dll | 27,024 | 1.5.1941.0 | August 1, 2007 | 11:51:40 PM |
| Mpfilter.cat | 10,672 | July 7, 2007 | 12:09:12 AM | |
| Mpfilter.inf | 2,941 | March 8, 2007 | 1:44:42 AM | |
| Mpfilter.sys | 70,928 | 1.5.1941.0 | July 7, 2007 | 12:09:12 AM |
| MpOAv.dll | 95,632 | 1.5.1941.0 | August 1, 2007 | 11:19:42 PM |
| MpRtMon.dll | 734,608 | 1.5.1941.0 | August 1, 2007 | 11:19:56 PM |
| MpSigDwn.dll | 133,520 | 1.5.1941.0 | August 1, 2007 | 11:19:46 PM |
| MpSoftEx.dll | 521,616 | 1.5.1941.0 | August 1, 2007 | 11:19:56 PM |
| MpSvc.dll | 299,920 | 1.5.1941.0 | August 1, 2007 | 11:19:52 PM |
| MpUtil.dll | 180,624 | 1.5.1941.0 | August 1, 2007 | 11:19:46 PM |
| MSASCui.exe | 1,037,200 | 1.5.1941.0 | August 1, 2007 | 11:19:58 PM |
| MsMpCom.dll | 225,168 | 1.5.1941.0 | August 1, 2007 | 11:19:50 PM |
| MsMpEng.exe | 18,832 | 1.5.1941.0 | August 1, 2007 | 11:19:38 PM |
| MsMpLics.dll | 12,688 | 1.5.1941.0 | August 1, 2007 | 11:19:30 PM |
| MsMpRes.dll | 769,936 | 1.5.1941.0 | August 1, 2007 | 11:53:50 PM |
WORKAROUND
Workaround 1
To work around symptom 1, log on to the Windows 2000-based computer by using an administrator account.
Workaround 2
To work around symptom 2, follow these steps:
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
- Click Start, click Run, type regedit, and then click OK.
- Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Forefront\Client Security\1.0\AM - Right-click the AM registry subkey, and then click Permissions.
- Click Advance.
- On the Owner tab, click Other Users or Groups.
- In the Select User, Computer, or Group dialog box, add the Administrators group, and then click OK.
- Click OK to exit the Advanced Security Settings dialog box.
- Click OK to exit the Permissions dialog box.
- Under the AM registry subkey that you located in step 2, right-click the ProductUpdateAvailable registry entry, and then click Modify.
- In the Value data box, type 0, and then click OK.
- Exit Registry Editor.
Note When the next Forefront Client Security client update becomes available, this problem will disappear because the update will reset the ProductUpdateAvailable registry entry to 0. The current resolution is for users who want to resolve the status immediately.
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
MORE INFORMATION
For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates
Keywords: kbbug kbfix kbqfe kbpubtypekc kbexpertiseinter kbprb KB938054
