Forefront Security for Exchange Server: Description of Hotfix Rollup 2 for Microsoft Forefront Security for Exchange Service Pack 2

SUPPORT SOLUTION:
Microsoft has released Hotfix Rollup 2 for Forefront Security for Exchange Service Pack 2. This article contains information about how to obtain the hotfix rollup and about the issues that are fixed by the hotfix rollup…Issues that are fixed in Hotfix Rollup 1 for Forefront Security for Office Communications Server

This hotfix rollup fixes the following issues:The FSCTransportScanner.exe process in Forefront Server Security for Exchange may stop responding, and this generates a Dr. Watson crash that references Bucket ID 1211603866The FSECCRService.exe process in Forefront Server Security for Exchange may stop responding, and this generates a Dr. Watson crash that references Bucket ID 1076269539Forefront Server Security for Exchange fails to write a crypto checkpoint in the RSA\Machine Keys folderThe AntigenService.exe process in Forefront Server Security for Exchange may stop responding, and this generates a Dr. Watson crash that references Bucket ID 1229588505The Forefront Security for Exchange GetEngineFile process crashes and Forefront is unable to perform a scan engine update Kaspersky scan engine in Forefront Security for Exchange does not update on a CCR clusterForefront Security for Exchange does not install on Windows Server 2008 R2Forefront Security for Exchange now supports the Kaspersky 8 engineDetails of the issues that are fixed in the hotfix rollup
3,
The FSCTransportScanner.exe process in Forefront Server Security for Exchange may stop responding, and this generates a Dr. Watson crash that references Bucket ID 1211603866SymptomsDr. Watson reports Bucket ID [1211603866] when this issue occurs. Additionally, the following information may be reported by Dr. Watson:—————–   Stack Dump   ——————Bucket ID                 -> 1211603866Cab ID      -> XXXXXXXXXOS Version              -> XXXXXXXXX[0]           RARNAVIGATOR.DLL!unknown              [unknown][1]           RARNAVIGATOR.DLL!unknown              [unknown][2]           RARNAVIGATOR.DLL!unknown              [unknown][3]           RARNAVIGATOR.DLL!unknown              [unknown][4]           RARNAVIGATOR.DLL!unknown              [unknown][5]           RARNAVIGATOR.DLL!unknown              [unknown][6]           FSCTRANSPORTSCANNER.EXE!unknown               [unknown][7]           FSCTRANSPORTSCANNER.EXE!unknown               [unknown][8]           FSCTRANSPORTSCANNER.EXE!unknown               [unknown][9]           FSCTRANSPORTSCANNER.EXE!unknown               [unknown][10]         FSCTRANSPORTSCANNER.EXE!unknown               [unknown][11]         RPCRT4.DLL!Invoke [unknown][12]         RPCRT4.DLL!NdrStubCall2      [unknown][13]         RPCRT4.DLL!CStdStubBuffer_Invoke      [unknown][14]         OLEAUT32.DLL!CUnivStubWrapper::Invoke           [unknown][15]         OLE32.DLL!SyncStubInvoke     [unknown][16]         OLE32.DLL!StubInvoke            [unknown][17]         OLE32.DLL!CCtxComChnl::ContextInvoke                [unknown][18]         OLE32.DLL!MTAInvoke            [unknown][19]         OLE32.DLL!STAInvoke             [unknown][20]         OLE32.DLL!AppInvoke             [unknown][21]         OLE32.DLL!ComInvokeWithLockAndIPID                [unknown][22]         OLE32.DLL!ComInvoke            [unknown][23]         OLE32.DLL!ThreadDispatch    [unknown][24]         OLE32.DLL!ThreadWndProc    [unknown][25]         USER32.DLL!InternalCallWinProc           [unknown][26]         USER32.DLL!UserCallWinProcCheckWow              [unknown][27]         USER32.DLL!DispatchMessageWorker  [unknown][28]         USER32.DLL!DispatchMessageW           [unknown][29]         FSCTRANSPORTSCANNER.EXE!unknown               [unknown][30]         FSCTRANSPORTSCANNER.EXE!unknown               [unknown][31]         FSCTRANSPORTSCANNER.EXE!unknown               [unknown][32]         NTDLL.DLL!__RtlUserThreadStart          [unknown][33]         NTDLL.DLL!_RtlUserThreadStart            [unknown]CauseThis crash occurs when the RARNavigator.dll does not correctly handle invalid metadata.The FSECCRService.exe process in Forefront Server Security for Exchange may stop responding, and this generates a Dr. Watson crash that references Bucket ID 1076269539SymptomsDr. Watson reports Bucket ID [1076269539] when this issue occurs. Additionally, the following information may be reported by Dr. Watson:—————–   Stack Dump   ——————Bucket ID                 -> 1076269539Cab ID      -> XXXXXXXXXOS Version              -> Windows 2003 Service Pack 2 (build 3790)[0]           FSECCRSERVICE.EXE!unknown               [unknown]CauseThis crash occurs when a resource type string is changed without first checking for API success.TheForefront Server Security for Exchange fails to write a crypto checkpoint in the RSA\Machine Keys folderProblemUpon installation, or upon failover on a SCC or CCR cluster, Forefront Server Security for Exchange fails to write a crypto checkpoint in the RSA\Machine Keys folderSymptomsThe following error may be present in the Forefront Server Security for Exchange installation log (ForefrontInstall.log):szErrorDesc = Error SetupFSEEVS: SetupFSEMSCSEVS: ClusterResourceControl(CLUSCTL_RESOURCE_ADD_CRYPTO_CHECKPOINT, ExchISVirusScan) failed or checkpoint exist already.SetupFSEMSCSEVS: OpenClusterResource(pszRegRep) failedThe following System event log error may occur when the cluster in being brought online:Event Type: ErrorEvent Source: ClusSvcEvent Category: Checkpoint MgrEvent ID: 1121User: N/ADescription: The crypto checkpoint for cluster resource ‘Exchange Information Store Instance could not be restored to the container name ‘C44FBC30-1445-11d3-8CAA-00104B9C5823′. The resource may not function correctly.Additionally, if you use Process Monitor to track this issue, you will see an access denied event on the following machine keys folder:clussvc.exe     CreateFile        C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\47bea955279d0bff4b03ff43cad2cab7_80331190-c9c2-4bc8-b3da-6baffb106058   ACCESS DENIEDCauseThis issue is caused by incorrect permissions on a crypto containerFSCController.exe process in Forefront Server Security for Exchange may stop responding, and this generates a Dr. Watson crash that references Bucket ID 1229588505SymptomsDr. Watson reports Bucket ID [1229588505] when this issue occurs. Additionally, the following information may be reported by Dr. Watson:—————–   Stack Dump   ——————Bucket ID                 -> 1229588505Cab ID      -> XXXXXXXXXOS Version              -> Windows 2003 Service Pack 2 (build 3790)[0]           FSCController.exe!unknown   [unknown]CauseThis crash occurs when an unallocated date is returned from the incidensts database.The Forefront Security for Exchange GetEngineFile process crashes and Forefront is unable to perform a scan engine update SymptomsThe ProgramLog.txt will contain an error indicating the GetEngineFiles process stopped abnormally. The current engine update will fail. The next scheduled update for that engine, or any engine, will succeed.CauseA synchronization issue between two process threads within GetEngineFiles causes the current engine update to fail.The Kaspersky scan engine in Forefront Security for Exchange does not update on a CCR clusterSymptomsKaspersky engine does not update on passive nodeCauseBecause a CCR cluster contains no shared drive, Forefront Security for Exchange copies its own data between nodes. The Kaspersky files within Forefront’s LocalFileMapping.cab are not successfully copies to the passive node. Therefore, the passive node does not update the Kaspersky engine  Forefront Security for Exchange does not install on Windows Server 2008 R2SymptomsError during install: Setup could not find the update.inf file needed to update your system.CauseForefront Security for Exchange is unable to install on Exchange Service Pack 3 on Windows Server 2008 R2. Forefront Security for Exchange is not certified on this platform.Forefront Security for Exchange now supports version 8 of the Kaspersky scan engine.More Info.Forefront Security for Exchange provides version 8 of the Kaspersky scan engine by default upon install.Hotfix rollup information

Download information
3,
A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. If the hotfix is available for download, there is a “Hotfix download available” section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix. Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: http://support.microsoft.com/contactus/?ws=support
(http://support.microsoft.com/contactus/?ws=support)
Note The “Hotfix download available” form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.How to install the hotfix rollup
3,
To install the hotfix rollup, follow these steps: Run the installer. To do this, double-click the hotfix rollup executable file.Note When the installer is running, the Forefront services are stopped. After the installation is complete, and the Forefront services are restarted, make sure that Forefront is working correctly.NotesThe Forefront services are restarted automatically during the installation.Forefront service packs or hotfix rollups can be installed by using the FFSMC Deployment job. For more information, see “Deployment Jobs” in the Forefront Server Security Management Console User’s Guide. In this case, the installer runs in silent mode, and user input is not required. The rest of the process remains the same as when you double-click the executable file to run the installer .Prerequisites
3,
This hotfix rollup requires that Forefront Security for Exchange Service Pack 2 is installed. File information
3,
This hotfix may not contain all the files that you must have to fully update a product to the latest build. This hotfix contains only the files that you must have to correct the issues that are listed in this article.
The English (United States) version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.Collapse this tableExpand this tableFile nameFile versionFile sizeDateTimePlatformAdonavigator.dll10.2.952.0421,23229-Jun-201018:08×86Adonavigator64.dll10.2.952.0716,14429-Jun-201018:13×64Adonavsvc.exe10.2.952.0154,99229-Jun-201018:13×64Aexmladapter.dll10.2.952.0379,76029-Jun-201018:08×86Custominstall.dll10.2.952.0923,50429-Jun-201018:08×86Customuninstall.dll10.2.952.0342,38429-Jun-201018:08×86Eventstrings-en_us.dll10.2.952.0118,64029-Jun-201018:08×86Eventstrings.dll10.2.952.0118,64029-Jun-201018:08×86Extractfiles.exe10.2.952.0338,28829-Jun-201018:08×86Filterengine.dll10.2.952.0332,65629-Jun-201018:08×86Fscadmarksvc.exe10.2.952.089,08829-Jun-201016:27×86Fscappscanner.dll10.2.952.0334,70429-Jun-201018:08×86Fsccodec.dll10.2.952.0195,44029-Jun-201018:08×86Fsccommon.dll10.2.952.018,28829-Jun-201018:08×86Fsccontroller.exe10.2.952.01,607,53629-Jun-201018:08×86Fsccontrollerps.dll10.2.952.085,36029-Jun-201018:08×86Fscdiag.exe10.2.952.0487,79229-Jun-201018:08×86Fscexec.exe10.2.952.057,20029-Jun-201018:08×86Fscmanualscanner.exe10.2.952.0899,95229-Jun-201018:08×86Fscmonitor.exe10.2.952.0265,07229-Jun-201018:08×86Fscmonitorps.dll10.2.952.051,05629-Jun-201018:08×86Fscrealtimescanner.exe10.2.952.0882,54429-Jun-201018:08×86Fscstarter.exe10.2.952.0249,20029-Jun-201018:08×86Fscstatsserv.exe10.2.952.0270,70429-Jun-201018:08×86Fsctransportscanner.exe10.2.952.0903,53629-Jun-201018:08×86Fscutility.exe10.2.952.0494,96029-Jun-201018:08×86Fseccrservice.exe10.2.952.0849,26429-Jun-201018:08×86Fseimc.exe10.2.952.0324,46429-Jun-201018:08×86Fsemailpickup.exe10.2.952.092,01629-Jun-201018:08×86Fsevsapi.dll10.2.952.0616,81629-Jun-201018:13×64Fsevsapiex.dll10.2.952.076,65629-Jun-201018:13×64Fssaclient.exe10.2.952.01,221,48829-Jun-201018:08×86Getenginefiles.exe10.2.952.0714,09629-Jun-201018:08×86Gziparchive.dll10.2.952.0267,12029-Jun-201018:08×86Installservice.exe10.2.952.049,00829-Jun-201018:08×86Installtask.exe10.2.952.0226,67229-Jun-201018:08×86Launcher.exe10.2.952.0400,24029-Jun-201018:13×64Localenginemapping.cabNot Applicable6,39916-Jun-201021:14Not ApplicableMacbinnavigator.dll10.2.952.0241,52029-Jun-201018:08×86Mimenavigator.dll10.2.952.0322,92829-Jun-201018:08×86Multimapper.dll10.2.952.0677,23229-Jun-201018:08×86Openxmlnavigator.dll10.2.952.092,52829-Jun-201018:08×86Perfmonitorsetup.exe10.2.952.0294,76829-Jun-201018:08×86Programlogmsg.dll10.2.952.0111,47229-Jun-201018:08×86Rarnavigator.dll10.2.952.0333,68029-Jun-201018:08×86Remotinglayer.dll10.2.952.082,28829-Jun-201018:08×86Remotinglayer64.dll10.2.952.0115,56829-Jun-201018:13×64Scanengines.dll10.2.952.0562,03229-Jun-201018:08×86Scanenginetest.exe10.2.952.0359,79229-Jun-201018:08×86Semsetup.exe10.2.952.0292,20829-Jun-201018:08×86Sfxcab.exe10.2.952.039,42414-Jul-201015:31×86Smimenavigator.dll10.2.952.0238,44829-Jun-201018:08×86Statisticsmanager.dll10.2.952.0537,45629-Jun-201018:08×86Structstgnavigator.dll10.2.952.0300,40029-Jun-201018:08×86Synchelper.dll10.2.952.0507,24829-Jun-201018:08×86Tararchive.dll10.2.952.0249,20029-Jun-201018:08×86Tnefnavigator.dll10.2.952.0308,08029-Jun-201018:08×86Uuencodenavigator.dll10.2.952.0256,88029-Jun-201018:08×86Version.exe10.2.952.0309,61629-Jun-201018:08×86Ziparchive.dll10.2.952.0304,49629-Jun-201018:08×86Fscperfmonitor.dll10.2.952.0315,76029-Jun-201018:08×86Fscperfmonitor.dll10.2.952.0544,62429-Jun-201018:13×64Custom64.dllNot Applicable105,67224-May-201017:54×64Updspapi.dll6.3.16.0463,72010-Oct-200816:42×64.Note This is a “FAST PUBLISH” article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use
(http://go.microsoft.com/fwlink/?LinkId=151500)
for other considerations..

For File Repair and Data Recovery, visit File Repair / Data Recovery