Bart's Weblog

Just a blog…

Antivirus software exclusions

Posted by bartvdw on 1313/0808/2008

When you configure antivirus software for servers, you need to take exclusions into account. And for MS products, they are fairly good documented. If you don’t add these exclusions, you could get trouble/errors. For applications not listed here (MS or third party), always verify if you need to exclude something to make sure your antivirus software does not affect your application!

Below a summary of such exclusions and references to MS articles describing these exclusions. I will update this post in case I have additional information.

Note: In the list below, default file locations are used. If you have change the location of the files (ex. Ntds.dit), you need to use the altered path obviously!!

General exclusions Windows Server 2003, Windows 2000, Windows XP, or Windows Vista:

  • %windir%\ntfrs
  • %windir%\SoftwareDistribution\Datastore\Datastore.edb
  • %windir%\SoftwareDistribution\Datastore\Logs\Edb*.log
  • %windir%\SoftwareDistribution\Datastore\Logs\Res1.log
  • %windir%\SoftwareDistribution\Datastore\Logs\Res2.log
  • %windir%\SoftwareDistribution\Datastore\Logs\Edb.chk
  • %windir%\SoftwareDistribution\Datastore\Logs\Tmp.edb
  • For Windows 2000 & 2003 DC’s
    • %windir%\ntds\Ntds.dit
    • %windir%\ntds\Ntds.pat
    • %windir%\ntds\EDB*.log
    • %windir%\ntds\Res1.log
    • %windir%\ntds\Res2.log
    • %windir%\ntds\Temp.edb
    • %windir%\ntds\Edb.chk
    • %systemroot%\sysvol (only this folder, not all subfolders!!!)
    • %systemroot%\sysvol\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory
    • %systemroot%\sysvol\staging
    • %systemroot%\sysvol\staging areas
    • %systemroot%\sysvol\sysvol
  • Clusters:
    • %windir%\Cluster
    • Q:\ (quorum)
  • DHCP: %windir%\system32\dhcp
  • DNS: %windir%\system32\dns
  • WINS: %windir%\system32\wins

Exchange Server:

  • Cdb.exe
  • Cidaemon.exe
  • Store.exe
  • Emsmta.exe
  • Mad.exe
  • Mssearch.exe
  • Inetinfo.exe
  • W3wp.exe
  • Exchsrvr\Conndata
  • Exchsrvr\Mailroot
  • Exchsrvr\Mdbdata
  • Exchsrvr\Mtadata
  • Exchsrvr\server_name.log
  • Exchsrvr\Srsdata
  • %systemroot%\IIS Temporary Compressed Files
  • %SystemRoot%\System32\Inetsrv
  • All .edb; .stm (on Exchange 2000 Server); .log Exchange files
  • M: drive (on Exchange 2000 Server)
  • SBS:
    • C:\Program Files\Microsoft Windows Small Business Server\Networking\POP3\Failed Mail
    • C:\Program Files\Microsoft Windows Small Business Server\Networking\POP3\Incoming Mail

SQL Server: SQL Server data files that have the .mdf extension, the .ldf extension, and the .ndf extension

WSUS: MSSQL$WSUS and WSUS content directory

References:

Virus scanning recommendations for computers that are running Windows Server 2003, Windows 2000, Windows XP, or Windows Vista
http://support.microsoft.com/kb/822158

Overview of Exchange Server 2003 and antivirus software
http://support.microsoft.com/kb/823166

Guidelines for choosing antivirus software to run on the computers that are running SQL Server
http://support.microsoft.com/kb/309422

Recommended Forefront Client Security file and folder exclusions for Microsoft products
http://support.microsoft.com/kb/943556

Multiple symptoms occur if an antivirus scan occurs while the Wsusscan.cab file or the Wsusscn2.cab file is copied
http://support.microsoft.com/kb/900638

Advertisements

3 Responses to “Antivirus software exclusions”

  1. Miquel Àngel Daniel said

    Hi!, greath post, you can add this one:

    http://technet.microsoft.com/en-us/library/bb332342(EXCHG.80,printer).aspx

    Is the File-level exclusions for Exchange 2007

  2. Is definitely a really excellent entry, thank you very much. I have stored this unique site to my personal favourites list.

  3. […] Antivirus software exclusions « Bart’s Weblog – Aug 13, 2008 · When you configure antivirus software for servers, you need to take exclusions into account. And for MS products, they are fairly good documented…. […]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: