SharePoint Blogs / SharePoint University
SharePoint Blogs and SharePoint University - all in one place!
Need SharePoint Training? Attend a SharePoint Bootcamp!

Please delete cookies related to sharepointblogs.com and sharepointu.com to resolve login issues!

MOSS AntiVirus Guidelines
I find that a lot of companies implementing MOSS into their organisations are not really thinking about Antivirus software that is running at the Operating System level. There are a number of products out there talking about MOSS Antivirus plug in etc, but these plug in are checking for documents that are being pushed into MOSS for viruses.

MS Fore Front Security for SharePoint:

http://www.microsoft.com/forefront/sharepoint/en/us/product-overview.aspx

McAfee:

http://us.trendmicro.com/us/products/enterprise/portalprotect/index.html

But there seems to be a big area that companies are forgetting about, that can effect the stability of MOSS servers and cause a lot of issues that really confuse IT professionals. The OPERATING SYSTEM ANTIVIRUS. Wink

To rule out any interference that the operating system antivirus software might bring to SharePoint's stability, the following exclusions from the antivirus real-time scan are recommended:

Windows 2003 Server

 

·    The %systemroot% is normally the C:\WINDOWS or C:\WINNT directory depending on your OS·    %systemroot%\System32\Spool (and all the sub-folders and files)·    %systemroot%\SoftwareDistribution\Datastore·    Any Network Drives that are mapped Refer to the following article for information:

KB822158 - Virus scanning recommendations for computers that are running Windows
Server 2003, Windows 2000, or Windows XP http://support.microsoft.com/kb/822158
 

Internet Information Server

• The IIS compression directory (default compression directory is %systemroot%\IIS Temporary Compressed Files)
• %systemroot%\system32\inetsrv folder
• Files that have the .log extension
Refer to the following knowledge base articles for reference:
KB817442 - IIS 6.0: Antivirus Scanning of IIS Compression Directory May Result in 0-Byte File
http://support.microsoft.com/kb/817442
KB821749 - Antivirus software may cause IIS to stop unexpectedly http://support.microsoft.com/kb/821749

SQL Server

• Exclude .MDF, .LDF, .NDF, .TRN, .BAK and .SLS
• Exclude sqlmangr.exe and sqlservr.exe
• SQL folder and databases files (or database file types) from scanning for performance reasons:
KB309422 - Guidelines for choosing antivirus software to run on the computers that are running SQL Server http://support.microsoft.com/kb/309422

WSS 3,0 / MOSS 2007 

• Drive:\Program Files\Microsoft Office Servers\12.0
• Drive:\Program Files\Common Files\Microsoft Shared\web server extensions\12
• Drive:\DOCUME~1\ALLUSE~1\APPLICATION DATA\MICROSOFT\FIREWALL CLIENT\*
• Drive:\WINDOWS\Temp\WebTempDir\*
• Drive:\DOCUMENTS AND SETTINGS\<SPSServiceAccount>\LOCAL SETTINGS\APPLICATION DATA\*
• Drive:\Documents and Settings\\<SPSServiceAccount>\Local Settings\Temp\*
• Drive:\WINDOWS\system32\LogFiles
• W3wp.exe, cbd.exe, cidaemon.exe, owstimer.exe (WSS)
(where Drive: is the drive letter where you installed SharePoint Portal Server)

 

MOM

·    Drive:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Operations Manager

·    Drive:\Program Files\Microsoft Operations Manager 2005

 

If you are using Trend Micro the follow these guide lines:

• Temp folder:  C:\Program Files\Trend Micro\PortalProtect\temp
• Quarantine folder, whose default location is:
Drive:\Program Files\Trend Micro\PortalProtect\Quarantine
• Backup folder, whose default location is:
Drive:\Program Files\Trend Micro\PortalProtect\Backup

The following link will provide you how you can configure MOSS anti-virus, not Operating System Anti-Virus.

http://technet2.microsoft.com/Office/f/?en-us/library/1289e6e2-03e0-4f10-8921-e516187891c61033.mspx

One of my recomendation before logging Microsoft PSS calls is to make sure you have these guidelines applied in your environment, this could save a lot of  time & money with regard to support issues. I hope this helps. Stick out tongue

I thought I would add this to the post; the offical KB article associated to "Folders may have to be excluded from antivirus scanning when you use a file-level antivirus program in Windows SharePoint Services 3.0 or in SharePoint Server 2007": http://support.microsoft.com/kb/952167


Posted 04-22-2008 10:45 AM by bobbyhabib

Comments

lmd wrote re: MOSS AntiVirus Guidelines
on 06-18-2008 1:04 PM

Since you recommend excluding all of the above mentioned directiories, wouldn't they be unprotected.  If an environment has a SharePont add-in antivirus like Forefront, would you still need antivirus for the Windows servers?

bobbyhabib wrote re: MOSS AntiVirus Guidelines
on 07-07-2008 11:38 PM

Hi IMD,

Yes you are right, these area will be unprotected by AV. But you need to exclude the above directories, otherwise your Operating System Anti Virus will start blocking SharePoints calls. SharePoint AV like forefront will only scan files that are being pushed back into the SharePoint database, not at the Operating System level.

Hope this helps.

BH

Internet Security wrote Internet Security
on 07-11-2008 3:05 AM

Good info and well presented, for more quality free info on pc security related issues have a look here.

Add a Comment

(required)  
(optional)
(required)  
Remember Me?
Need SharePoint Training? Attend a SharePoint Bootcamp!
Posts (c) their respective authors. Everything else (c) 2009 SharePoint Experts, Inc.