I have just had a few servers that somehow has failed to update their Forefront Client Security client software 🙁 The problem seem to be that Forefront cannot seem to stop the FCSAM service while updating, the service is stuck on “Stopping” and neither taskkill og any other utility seem to be able to kill it.
The errors in the eventlog go something along these lines;
Microsoft Forefront Client Security Antimalware Service Error 1921. Service 'Microsoft Forefront Client Security Antimalware Service' (FCSAM) could not be stopped.
I have tried uninstalling, rebooting and reinstalling but this did not help.
The workaround suggested is to set the service FCSAM to manual, reboot, upgrade and then setting the service back to automatically – however this only works for now and thus only postpones the problem.
I have found this article on a similar problem which I will try tomorrow, this includes some additional cleanup steps;
Eg. issuing the command; sc delete fcsam
I will also try to slipstream the installation of Forefront Client Security before I retry the re-installation, description on how to do here (mind you use the latest update and not the one the article refer to);
If you have ever worked with Microsoft ISA server you may have heard of “GFI WebMonitor”, “GFI WebMonitor” is an add on to the ISA server (it does also exist as a standalone server application) that will allow for Malware, Virus scanning along with traffic analysis and extended logging of HTTP traffic thus protecting workstations against ‘drive by infections’ and other script dangers while surfing.
The A5/1 encryption used to protect GSM phone conversations has long since been broken, actually just last year it was made possible to eavesdrop encrypted GSM in realtime – hence GSM telephony is today to be considered utterly insecure. Scientists have thus begun working on the 3G variant A5/3, and it would appear that a “breakthrough” has been made, not quite allowing for realtime decryption but weakening the cipher quite considerably.
According to the Danish online newsletter/magazine 
Imagine this; You are at a public wifi spot, and they have locked down what pages you may visit by simple DNS or URL filtering, and you just have to visit Rapidshare.com where one of your friends have send you this important file!? What to do? Well actually you have to do this before you wind up in this mess, but once it’s done you can use it anywhere anytime to combat situations like this.
When trying to get rid of a virus it often a good idea to scan using a boot CD, some viruses / rootkits bury themselves so deep that even the best antivirus cant detect them. Sadly very few CD’s are commercially available, and most often requires regular updates to always have the latest definitions.