Forefront Security for SharePoint Forum

Forefront for SharePoint blocks access to MOSS

Sat, 20 Oct 2007 19:49:38 Z

I have installed Forefront for SharePoint (10.0.0700.20 SharePoint) on a MOSS server (12.0.6039.5000) and after the install I can't open the MOSS root site (host header configured site). This is in a server farm config on one server (MOSS and SQL 05 on one box). The account configured is a local admin and a SQL05 sysadmin/DB Creator/Security Admin.

It is reported in the event log that realtime scan can start.

I have tried the install a couple of time after removing Forefront and restoring MOSS. Sometimes the portal will respond with an error Exception from HRESULT: 0x80041051

This installation is on a quad processor machine and I have installed to D:\Program Files not the default C:\Program Files, that is about the only thing that is different from a standard install.

I have been able to install this on a test box but this production server does not successfully install.

Any ideas?

Thanks,

Dan Rosenberg

Exception Error in Mnaul scan job in forefront

Tue, 29 Sep 2009 09:55:46 Z

Hi,

Under manual scan job..none of the web application are listing..insteat getting exception occurred error..i have two web front server

one webfront end server forefront working fine..another WFE forefront showing the exception occurred error..could you please help on this

regards,
Nixon.M

Change the forefront database access account

Mon, 02 Nov 2009 19:00:42 Z

The password for the forefront database access account has been changed. How can I update the password?

Action Required by Dec. 1, 2009: Keep Protections Current

Tue, 03 Nov 2009 03:32:32 Z

As announced on July 1, 2009, AhnLab, CA, and Sophos engines will be retired on December 1, 2009. As of this date, customers will not receive any updates for these retired engines. Any customers running the AhnLab, CA, or Sophos engines must disable these engines before December 1, 2009, and select from the new set of five engines – Authentium, Kaspersky, Microsoft, Norman, and VirusBuster.

While making these changes, customers are also encouraged to upgrade to Forefront Security for SharePoint with Service Pack 3, which include a rollup of the latest software fixes.

For more information on the engine revision strategy, see the Antimalware Engine Notifications and Developments Web page or contact Forefront Contract Administration.

Upgrade to Forefront SP3 now showing signature update error

Thu, 22 Oct 2009 13:21:52 Z

I've upgraded to Forefront SP3 on a single WSS server. Since the upgrade I see the error:

Not all the engines selected in the Forefront Administrator for scanning have been enabled for signature updates.

in the application log every hour.

I have tried rebooting the server, starting and stopping the Forefront services and have disabled the scan engines/unchecked the file scanners and reconfigured them but I am still seeing the error.

I have installed Forefront SP3 on another SharePoint server and on a WSS server but have the same error on all three.
I have tested Forefront and it appears to be working but would like to resolve this error

Many Thanks

Forefront for SharePoint SP3 how to turn off weekly email for "CA Vet has been deprecated as of 7/1/2009 and will be available only until 12/1/2009"

Tue, 13 Oct 2009 19:08:48 Z

CA Vet has been disabled and still weekly emails stating: "CA Vet has been deprecated as of 7/1/2009 and will be available only until 12/1/2009. Updates for this engine will stop after 12/1/2009. For more information, see http://go.microsoft.com/fwlink/?LinkId=152864."

This is not in 'email nofications' and with it disabled is there any way to stop this annoying message every week?

Please help

How to exclude directory from Forefront for SharePoint?

Wed, 20 May 2009 15:25:33 Z

Hi, we are running Forefront 10.1 on our MOSS 2007 server. We have a directory with a javascript utility that encrypts\decrypts a page into an .html page (we have to do this as part of the licensing for this particular content). The content is entirely legit, no virus, but Forefront blocks it thus:

o3-301.htm " contains the following virus: " VIRUS= Trojan.JS.Agent.aaf (Kaspersky5); Tagged ID: 166CB8E0_1D31_42D2_9E69_630EF6007781 ".

If you want to open this file, you'll need to clean the file using your own virus scanning software. Do you want to save the file to your computer and attempt to clean it?"

So, I basically need to exclude the particular directory that hosts these files and am not able to see how I can do this in Forefront?

Thank you,

Chad

Forefront on server with Sharepoint?

Mon, 05 Oct 2009 16:17:26 Z

I'm new to Forefront and was curious, when installing the Forefront for Sharepoint, do you still install the Forefront client security on the server itself or is that not needed?

Thanks,

Publishing a site for anonymous access when my listener is set to use FBA.

Wed, 23 Sep 2009 20:08:40 Z

For some time we’ve been publishing SharePoint sites to the Internet using a listener set for HTML Form Authentication.

We have a new requirement where a SharePoint site to be published to the Internet should have anonymous access. I’m struggling with how to publish that site as I can’t create another listener that uses the same protocol and port.

After reading the docs we’ve tried creating a domain set that includes the ‘exception’ site and assigning that to a SharePoint Publishing Rule that gets processed first, however we still have to use the existing listener so are sent to the FBA page.

Any pointers on what we’re doing wrong and how to configure this?

bwebmasta, MCP

High Memory Utilization

Mon, 20 Jul 2009 11:59:47 Z

After Installing the Forefront Sharepoint on three servers , the utilization of Memory is continuously above than 85% . How can i tune the application ?

Forefront Security for SharePoint w/SP3

Thu, 03 Sep 2009 16:02:57 Z

I currently have Forefront Security for Sharepoint w/SP2 running, and have encountered an issue which compels me to upgrade to SP3. However, it doesn't appear that there is a stand-alone SP3 install, but rather a full install of the entire product with SP3 integrated. Is this the case? If so, can anyone who has installed it give me some insight as to if the install is intelligent enough to see that you already have the product installed and just apply the appropriate updates while retaining your settings, etc. Also, is a reboot/iisreset/etc required following installation?

Forefront and SQl Authenication across untrusted domains

Wed, 18 Mar 2009 20:13:59 Z

We have two network load balanced web servers and an application server in domainA, and the sql server is on a cluster in a different untrusted domain: domainB. SQL is standard 2008 64 bit, the web and application servers are 64 bit windows server 2008. We are using sql authentication for the sql server and sharepoint.

Sharepoint is latest patched and same for the operating system.

Is it possible to install forefront security for sharepoint on the web front ends using sql authentication?

I have been looking for a work around like we had to use for installing MOSS 2007.

thanks for the help.

Installation Query - Account Credentials

Thu, 06 Aug 2009 14:37:23 Z

Hi all,

I'm trying to get to grips with Forefront Security for SharePoint and I'm having problems with my install. An error keeps occuring in my Applications event log stating the following:

"SQL Database 'SharePoint_AdminContent_....' on SQL Server instance '<cluster>' not found
Addition information from SQL Server is included below.
Cannot open database "SharePoint_AdminContent_...' request by the login. The login failed. Login failed for user '<Domain\userid>'."

I believe that the problem may be due to my providing an incorrect account during the installation process. Step 10 in the 'Installing Forefront Security for SharePoint' instructions states the following:

"10. Enter the account to be used for remote SharePoint database access. This account must be a member of the local Administrators group on which SharePoint Portal Server is installed (one who is a local administrator on the web server or who has System Administrator rights on the database server). You cannot use the default 'Administrator' account. The user name must be entered in the following format: <domain or server name\user name>"

To quickly try a different account (that I know is a member of the domain admins group (thus a member of local admins on the servers within the cluster)), is there a quick way to change the account credentials entered in step 10 above following installation or is it a case of having to do a complete reinstall?

Thanks in advance for any comments,
Neil.

Manual Scan not showing sharepoint sites

Thu, 28 May 2009 15:53:03 Z

I have 2 web front ends, 1 app server(doing index and search, this server has central admin on it) and the sql server cluster. All are moss 2007 sp1, windows server 2008 x64

I did a full install on forefront for sharepoint on the web servers, and just the admin console on the app server.

When i click manual scan, it shows the computername:port for central admin on the app server.

When i start a manual scan, it takes 20 seconds and scans no documents.

Do i have to do a full install on the app server as well?

on my testing server, which is just 1 server(has moss, sql, etc) the sharepoint sites show on the manual scan window.

thanks for the help

License for the Forefront Sharepoint

Tue, 09 Jun 2009 09:27:49 Z

I have three servers running MS sharepoint hosting same site . Do i still require three different licenses to secure all three of them , or one license will work for all of them ?
Does we require a single license for a FARM or its according to the application?
My license is covered in MS gold partnership.

VSAPI for sharepoint server

Thu, 28 May 2009 06:51:37 Z

HI,
Can anybody please tell me VSAPI SDK download location. I am trying to plug my AV solution to sharepoint server.

- Vikram S

.doc files quarantined by mistake...how to restore?

Wed, 17 Jun 2009 09:07:41 Z

Hi!

At a customer, a newly installed FSS for Sharepoint scanned and quarantined 195 documents by mistake (bug?). VIRUS = is based on remote template(command).
I have checked out documents to a folder and scanned the folder with FCS and it says it's clean.

Now to the question:
How do i restore these documents to it's original location in SharePoint?

Thanks
/J

MCSE, forefront spec | www.msforefront.com

Now Available – Forefront Security for SharePoint with SP3

Wed, 01 Jul 2009 21:00:27 Z

Microsoft announced today the release of Forefront Security for SharePoint with Service Pack 3, which includes visibility of all actively published engines, alerts and notifications for new engine availability, and a rollup of software fixes.

Forefront Security for Exchange Server with SP2 introduces technology that will notify customers of engine changes – including the addition or elimination of engines – and allow administrators to update their engine configurations without having to deploy any new product updates. This update allows customers to accommodate engine changes effortlessly, helping maintain the high level of security provided in the Forefront server security products.

As with previous releases of Forefront Security for SharePoint, the SP3 release provides a multi-engine protection approach for superior detection of the latest threats when compared to single engine solutions. In fact, AV-Test.org has tested our products with competitors and found our detection rates have an average response time of 3-6 hours for new viruses. In contrast, competitive single-engine solutions average response times are more than 2-9 days.

Microsoft continually monitors antivirus engine quality and detection rates using internal and 3^rd party independent testing organizations. Testing for the last several years has indicated that using more than five malware engines concurrently does not improve overall detection rates. In order to develop stronger technology relationships with our antimalware partners and ensure continued customer value for the longer term, we are making available a set of five antimalware engines, with confidence that this solution will continue to offer industry leading detection rates and response times.

As an example of Microsoft’s commitment to continual improvement of our malware detection leadership, we are investing in new antispam technology through a partnership with Cloudmark that will provide an overall better antispam experience including higher detection rates, lower false positives, and improved submission and service experience. The Cloudmark engine is now included in latest service pack releases of Antigen for Exchange with Antigen Spam Manager 9.0 and Antigen for SMTP Gateways with Antigen Spam Manager 9.0 products as Beta while it undergoes customer trials. Upon the near term completion of the customer trials, it will be released by Microsoft for both the Antigen 9.0 products, as well as be included in the next generation releases of Forefront server security products later this year. More information is available on the Antimalware Engine Notifications and Developments (AMEND) TechNet page.

For more information on the Forefront Security for SharePoint service pack and engine revisions, please visit the AMEND page.

Will there be contention between McAfee on the server and Forefront for SharePoint?

Tue, 02 Jun 2009 18:29:57 Z

Our hosting standard is to have McAfee installed on all the servers. We need to use Forefront for the SharePoint application on MOSS 2007/Win2003.
Will there be a contention between the Host/Server using Macfee and the SharePoint Application hosted on the server using Forefront?

Email Notifications

Wed, 03 Jun 2009 20:20:55 Z

Hi Everyone I'm testing FSSP and I have installed this in a test environment.

Server 1
windows Server 2003 SP2
Active Directory + DNS
Exchange Server 2003 + SP2
Dominio: mycompany.com

Server 2
MOSS with SP2
Forefront for Sharepoint with SP2

I have some questions:

* Email - Notifications » The administrator can receive email notifications in my test enviroment but if there is a infected file I want that users recive email notifications in Real-Time Detection. what can I do? I have availabled Virus Author Notifications but not work.Besides, I have available "send Notification" in both (Sharepoint Real-Time and Manual Detection)

* Incidents or Quarantine » There is a column Heading (Date, File, etc,) These capture data until Incident column but in the AuthorName, Author'sEmail, etc not capture any Data or only show N/A. what should I do?

Thanks for answers

Si la respuesta te ha sido de utilidad marca SI para finalizar la pregunta.

Scan to word

Thu, 15 Feb 2007 18:18:20 Z

How do I scan a Document to word

Robocopy job for distributing Forefront virus updates

Thu, 23 Apr 2009 19:21:59 Z

Hi,
We have three geo locations and three very large MOSS farms. Forefront was chosen for MOSS. Because of reasons beyond our control there is one FSSMC for all the farms. Currently there is lot's of latency to the farms and in the future we plan on deploying remote MOSS servers we will manage as well with even more latency expected to those locations. The Out of the box htttp distribution to the FSSMC and then to the other locations wasn't working until we set the timeout to 30 minutes. We are testing the Redistribution server now but my question is can I just pull the file to the FSSMC and use a robocopy job to send the updates to the other hubs and servers? Before I even started I thought I would ask here.

Administration console für Sharepoint and Exchange

Thu, 07 May 2009 09:57:15 Z

I just want to ask if I can install the Administration-only setting of Forefront for Sharepoint and Forefront for Exchange on the same "management" Server where I can choose the approtriate operation for the specific server !?

thanks

"ScanTimeExceeded" on manual scans : Need to _NOT_ delete files that timeout

Thu, 30 Apr 2009 18:20:24 Z

Hello:

I'm running ForeFront for Sharepoint v 10.1.0802.0, SP2, against an existing series of content datbases that total about 2.5 TB of data. This data was NOT previously protected by any antivirus software, so I would now like to go back through to scan existing documents to be sure we are completely clean. I plan to do this with scheduled Manual scans of the existing data. I also have a requirement to avoid making changes to the data before I know what viruses, if any are present.

What I'm finding is the "ScanTimeExceeded" message for large compressed files. I have the default setting of 10 minutes for Manual scans, I have set the manual scan to "Skip: detect only", and I have disabled all the "Block/Delete" options for compressed files. To my mind, I should only be getting reporting, not action on the data. However, when a large container file exceeds the timeout, it is deleted from the SharePoint site. I do not want this to happen.

I can understand the need for the timeout, since ForeFront does not want DoS from 'zips of death', as they put it. I think 10 minutes is a reasonable time to try, given all the data I need to check,a nd would not want to make it much longer, given the data I have to deal with.

How can I prevent ForeFront from removing files when the time limit is exceeded? I'd like to simply be notified of timeouts, and address them on a case by case basis. I would have thought the "Skip" option would not be disobeyed, but it seems that it is.

Thanks for your help,
Mark Schlegel

ForeFront Security for SharePoint: Scheduling and Pausing Manual Scans

Tue, 28 Apr 2009 21:37:56 Z

Hi all:

I'm running ForeFront for Sharepoint v 10.1.0802.0, SP2, against an existing series of content datbases that total about 2.5 TB of data. This data was NOT previously protected by any antivirus software, so I would now like to go back through to scan existing documents to be sure we are completely clean. I have 4 Web Front Ends available. This raises 2 questions:

1) I'd like to NOT be scanning the old data during normal hours, due to performance considerations. I can already schedule a manual scan: can anyone tell me how to pause it, then have it resume where it left off when peak times are past?
2) Can anyone tell me a good way to confirm when the AV scan of all the old data is complete? I'd hope ForeFront was "smart" enough to not have a web front end re-scan an area another one had already scanned, but I do not see how it would do this--the VirusVendorID; VirusStatus and VirusInfo columns in the content DB do not seem to be consistently updated, based on running a scan and then checking them.

Thanks in advance for the help,
Mark Schlegel

Regarding SP / SQL Interaction And Server Design

Mon, 06 Apr 2009 19:07:02 Z

I am trying to wrap my head around this deployment so I ensure it is correct.

So, from a Forefront standpoint, I know it should be on all production SharePoint WFE's. However, if I have separate farm (a development farm) which uses the same SQL cluster as the production farm do I need to install it there as well? I know I SHOULD since it would protect all my SharePoint stuff, however I am wondering if a user uploads an infected document to my production farm does it put my development farm at risk from a SQL perspective?

In my head, it doesn't...but I wanted to make sure...

XLS file not saving in Sharepoint after Forefront installation

Mon, 23 Mar 2009 15:09:25 Z

The error is: "Integrated Media Calendar filename.xls contains a virus. This file cannot be saved to this document library. You must use an antivirus program to remove the virus before you save this file to the document library".

This file does not contain a virus - in fact it was created by the same people who are trying to save it. There is probably a simple fix, but the only one I found following a google search, was to add the latest service pack to Forefront, but it didn't make a difference.

Any help gratefully received!

files in the Document Library are incorrectly detected as infected documents

Tue, 24 Mar 2009 00:57:15 Z

Hi,

After I installed Microsoft Forefront Security for SharePoint SP2, almost all our files in the Document Library are incorrectly detected as infected documents so every time we open those documents we getting this error

"http://sharepoint/dept/internal/Change Logs/File1.doc contains the following virus: VIRUS= is based on a remote template (Command); Tagged ID: 9806B71_FE20_43E2_A245_D02A44CFDF96

If you want to open this file, you need to clean the file using alternative virus scanning software. Do you want to save the file to your computer and try to clean it?"

and every time we create a document in the document library we are getting this error

"http://sharepoint/dept/internal/Change Logs/File2.doc cannot be saved to the document library because it contains the following virus: VIRUS= is based on a remote template (Command); Tagged ID: 9806B71_FE20_43E2_A245_D02A44CFDF96

If you want to save this file to the document library, clean the file using alternative virus scanning software, and then try saving it again."

I've already installed Rollup 1 for Forefront Security for SharePoint with Service Pack 2 but this does not fix the problem.

Please help to fix this problem, we really need all the files that are in our Document Library.

Thank you,

NET23

Integrating Antivirus tool with SharePoint

Mon, 26 Jan 2009 15:19:14 Z

Hi All,

We have a requirment to integrate an Antivirus tool into SharePoint(MOSS-2007). So when a file / content(CEWP, PublishingHTML, Blogs, Wikis etc) is uploaded or downloaded from SharePoint, it should be scanned for viruses and objectionable content. Additionally if someone is accessing the file/content from the SharePoint UI, via API or webservices and that there should be a option to enforce this across all document libraries, Rich HTML content types in the server.

Has anyone has implemented this before? Can Forefront Security can help us doing this?

Thanks in advance

Implementing WSUS for Forefront Security for Sharepoint

Mon, 23 Mar 2009 02:44:22 Z

Hi All,

I am familiar on how Forefront Security for Sharepoint updates its virus definition files by default by accessing and downloading updates on http://forefrontdl.microsoft.com/server/scanengineupdate and distirbuting to them to spokes server by the UNC path.

Just want to ask if there are any other ways of retrieving updates? Can this be integrated in an existing WSUS server?

Regards,
Kim Carl Filomeno

Do I need to install forefront and Antigen on MOSS 2007 box?

Tue, 31 Mar 2009 11:04:16 Z

Can someone help explain the procedures of installing forefront for MOSS 2007? Also - where does Antigen come into the equation? Do I have to install this also?

thanks in advance

Max Container File Size

Thu, 26 Feb 2009 08:58:51 Z

hi
i have a question concerning this option.
the maximum is 2gb what happen with files in my sharepoint farm when they have a size over 2gb?

thx

TechNet Virtual Lab: Forefront Security for SharePoint

Wed, 18 Feb 2009 21:57:59 Z

Just to let the forum folk know, there's a virtual lab for Forefront Security for SharePoint on the Microsoft Forefront webcasts, virtual labs, and podcasts site.

Emails from a certain sender vanishes

Mon, 02 Feb 2009 10:30:47 Z

We have a configuration with Forefront Security for SharePoint SP1 and WSS 3.0 SP1 where emails from one explicit sender to a sharepoint document archive just vanishes out of thin air. I can send documents from other addresses and they are processed and received in the Sharepoint document archive.

I am not that into Forefront but from what I can see logging is enabled but still I cannot see anything in the Forefront admin console nor in the event viewer logs. Any ideas on how to troubleshoot and get to the bottom of this?

I guess I ought to upgrade Forefront for Sharepointof to SP2, are there any fixes or improvements in there for this kind of issue?

Scan Engines have never updated - Unable to launch ScanEngineTest

Tue, 20 Jan 2009 15:51:09 Z

Hi,

I wonder if anyone has experienced the problem listed below and can offer a solution?

I have just installed Forefront for SharePoint on a new SharePoint server, however I cannot seem to get any of the scan engines to update.
When I run an update of an engine a staging folder and files appear temporarily inside the package folder and then disappear at the end, but no files are created in the bin and package folders which are completely empty.
During the update I am seeing the following in the programlog.txt:

( 3548- 2532), "INFORMATION: Attempting to download the CAVet scan engine package from http://forefrontdl.microsoft.com/server/scanengineupdate/x86/CAVet."
( 3548- 2532), "INFORMATION: The proxy settings will be used for this connection."
( 3548- 2532), "INFORMATION: The CAVet scan engine has been downloaded"
( 3548- 2532), "INFORMATION: The CAVet scan engine has been staged."
( 3548- 2532), "ERROR: (0x00000005) Access is denied. Unable to launch ScanEngineTest for the CAVet scan engine."
( 3548- 2532), "INFORMATION: The CAVet scan engine has been rolled back."

I have copied the proxy settings from another Forefront server, which is updating fine so I'm pretty sure they are right.
The Forefront account has local admin rights on the server and Sysadmin rights on the SQL server.
I have tried reinstalling Forefront but still have the same problem.

Any help would be greatly apprieciated, thanks.

Forefront Realtime Email Notifications Information

Thu, 22 Jan 2009 16:13:51 Z

We use forefront security on our sharepoint farm and when we recieve notifications that a file may contain a virus or a file was blocked the information contained in the message is useless. I have added all the fields available in the help and none of them can tell us the user that tried to upload and to where.

We need to know what user tried to upload the file and to where so we can track them down.

Error Sharepoint Portal Server Required

Thu, 07 Feb 2008 11:48:29 Z

Hi,

I am trying to install Forefront for Sharepoint 2007 and get an error stating "Setup believes that you may not have the required Microsoft SharePoint Portal Server installed"

This system is Windows 2003 Enterprise service pack 2 32 bit with SharePoint 2007 Enterprise. The virtual environment is made up of a seperate SQL 2005 server and another server hosting the WFE.

Any help would be appreciated.

Thanks

Darrel

FCSRealTimeScanner.exe shows up in Task Manager 3 times on one application server

Fri, 09 Jan 2009 19:20:41 Z

Hi,

I have two SharePoint application servers, and they both have Forefront Security for SharePoint installed. The settings (and I have checked them one by one) for Forefront Security for SharePoint are exactly the same on each application server.
However in Task manager, on one server I see on FCSRealTimeScanner.exe process and on the other app server, I see 3 FCSRealTimeScanner processes, all taking up different amounts of memory.
Why is this?

DeploymentAgent Errors--happening every 5 mins

Tue, 30 Dec 2008 19:57:30 Z

I keep getting two errors in my application log on the computer that I have Forefront Security for SharePoint on:

Event Type: Error
Event Source: DeploymentAgent
Event Category: None
Event ID: 100
Date:  12/30/2008
Time:  11:44:23 AM
User:  N/A
Computer: PROJECTSP
Description:
Tue Dec 30 11:44:23 2008 ERROR Error "The RPC server is unavailable." (0x800706ba) creating notifier for "<?xml version="1.0" encoding="utf-16"?><NotificationEngineVersion xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="projectsp_2007t.quadranthr.comfalseCommand0http://www.w3.org/2001/XMLSchema-instance"><Machine>projectsp_2007t.quadranthr.com</Machine><IsPassiveNode>false</IsPassiveNode><ArrayOfFileScanner><FileScanner><Name>Command</Name><LastCheck></LastCheck><LastUpdate></LastUpdate><EngineVersion></EngineVersion><SignatureVersion></SignatureVersion><UpdateVersion>0</UpdateVersion></FileScanner></ArrayOfFileScanner></NotificationEngineVersion>"

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

and

Event Type: Error
Event Source: DeploymentAgent
Event Category: None
Event ID: 100
Date:  12/30/2008
Time:  11:44:18 AM
User:  N/A
Computer: PROJECTSP_2007T
Description:
Tue Dec 30 11:44:18 2008 ERROR CoCreateInstanceEx failed

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Is it a permissions (like DCOM) error?

Kaspersky Engine is not updating successfully on Forefront/Antigen installations on both Exchange and Sharepoint

Thu, 03 Jan 2008 23:18:15 Z

An issue was discovered that is prohibiting the Kaspersky scan engine from updating successfully on Forefront and Antigen installations on both Exchange and Sharepoint.

We are aware of the issue and working diligently to deliver a timely solution to the field.

At this time, we would recommend that you disable the auto updates for Kaspersky to suppress the errors that may begin to be generated on your server(s), see below.

Errors that may be displayed in program log.txt or App log:

Wed Jan 02 03:51:59 2008 (10872-15488), "ERROR: (0x800706be) The remote procedure call failed. Scan engine could not be updated. An error occurred while disabling scan jobs. hr = 0x800706BE."

Wed Jan 02 03:51:59 2008 (10872-15488), "INFORMATION: The Kaspersky5 scan engine has been rolled back."

Wed Jan 02 03:51:59 2008 (10872-15488), "INFORMATION: Sending Signature Update Failed Alert"

Event Type: Error

Event Source: GetEngineFiles

Event Category: Engine Error

Event ID: 6012

Date: 1/2/2008

Time: 9:58:51 AM

User: N/A

Computer: %SERVERNAME%

Description:

Microsoft Forefront Server Security encountered an error while performing a scan engine update.

Scan Engine: Kaspersky5

Error Code: 0x80070102

Description: Unable to acquire the scan engine update mutex within the designated timeout period.

If by chance, Kaspersky is the only scanning engine that you are utilizing please select a different engine so you are assured of proper protection while we work on a solution for delivery.

This thread will be updated ASAP with a status/solution.

Thank you for your patience.

Ryan McGrath