A new version of the Norman engine was released through the Forefront Server Security Rapid Update system on March 26, 2009. The Norman update package was made available for download at approximately 8:30 am EST on that day.
This is the first new Norman engine release since we rolled back the 220.127.116.11 engine on February 26, 2009 in response to the increase in memory usage by that engine version (see blog entry Update on the recent Norman antivirus engine issue). Since then and up until March 26, we have been distributing the Norman 18.104.22.168 engine and providing daily signature updates for that version.
The Norman 22.214.171.124 engine that was released on March 26, 2009 incorporates several important changes and does so in a way that does not result in a significant increase in memory usage requirements.
§ The engine initialization time has been decreased significantly. In our test environments, we do not see timeouts or delayed load times by the Norman engine.
§ The root cause of many drwatson reports and intermittent Norman engine crashes on engine unload has been resolved in the 126.96.36.199 engine.
Update Package Details
The following information can be used to verify that the update package containing the 188.8.131.52 Norman engine has been successfully downloaded.
Forefront Server Security or Antigen 9 Products and Service Pack Releases
In the Forefront Server Security Admin client, navigate to the SETTINGS…Scanner Updates panel. The following update version or greater should be displayed for the Norman engine:
Update Version: 0903260002
**Due to the engine version formatting in place, the Engine version will still show as 5.93.0. The verification steps described below for Antigen 8.0 customers can be used to verify the correct version of the actual Norman engine file.
In the Forefront Server Security Admin client, navigate to the Overview…Dashboard panel and look for the following information for the Norman Virus Control engine:
Engine Version: 184.108.40.206
The release of the new Norman engine for Antigen 8.0 customers is planned for Monday, March 30, 2009.
Antigen 8.0 customers can check the version properties on the nse_w32.dll after the update has been posted to verify that the new Norman engine has been downloaded. The version should equal 220.127.116.11. The nse_w32.dll file can be found under the product installation folder along the following path:
Other Release Notes
The size of the Norman update package has increased by approximately 30 MB. Customers who have limited network bandwidth between the product installation and the Microsoft download center may experience longer download transmission times. If timeouts occur, the default timeout setting for engine updates can be increased by setting a registry key. The following KB article provides instructions for doing this: http://support.microsoft.com/kb/939411/en-us.
Antigen 9.0 for Exchange, Antigen 9.0 for SMTP Gateways, Forefront Security for Exchange, Forefront Security for SharePoint, Forefront Security for Office Communications Server and the Forefront Security for Exchange and Forefront Security for SharePoint product versions that are part of the Stirling Wave release, Antigen 8.0 for Microsoft Exchange, Antigen 8.0 for Microsoft SharePoint, and Antigen 8.0 for IM.
Program Manager - Forefront Server Security