in

SharePoint Blogs

The Best Place for SharePoint-related Blogs

Bobby Habib SharePoint & MOSS Blogging Space

Bobby Habib - My findings on SharePoint / MOSS, Web Part Developments, etc. Information I think will help the SharePoint Community. All posts are provided "AS IS" with no warranties, and confers no rights. Whats the bloody Point!

MOSS AntiVirus Guidelines

I find that a lot of companies implementing MOSS into their organisations are not really thinking about Antivirus software that is running at the Operating System level. There are a number of products out there talking about MOSS Antivirus plug in etc, but these plug in are checking for documents that are being pushed into MOSS for viruses.

MS Fore Front Security for SharePoint:

http://www.microsoft.com/forefront/sharepoint/en/us/product-overview.aspx

McAfee:

http://us.trendmicro.com/us/products/enterprise/portalprotect/index.html

But there seems to be a big area that companies are forgetting about, that can effect the stability of MOSS servers and cause a lot of issues that really confuse IT professionals. The OPERATING SYSTEM ANTIVIRUS. Wink

To rule out any interference that the operating system antivirus software might bring to SharePoint's stability, the following exclusions from the antivirus real-time scan are recommended:

Windows 2003 Server

 

·    The %systemroot% is normally the C:\WINDOWS or C:\WINNT directory depending on your OS·    %systemroot%\System32\Spool (and all the sub-folders and files)·    %systemroot%\SoftwareDistribution\Datastore·    Any Network Drives that are mapped Refer to the following article for information:

KB822158 - Virus scanning recommendations for computers that are running Windows
Server 2003, Windows 2000, or Windows XP http://support.microsoft.com/kb/822158
 

Internet Information Server

• The IIS compression directory (default compression directory is %systemroot%\IIS Temporary Compressed Files)
• %systemroot%\system32\inetsrv folder
• Files that have the .log extension
Refer to the following knowledge base articles for reference:
KB817442 - IIS 6.0: Antivirus Scanning of IIS Compression Directory May Result in 0-Byte File
http://support.microsoft.com/kb/817442
KB821749 - Antivirus software may cause IIS to stop unexpectedly http://support.microsoft.com/kb/821749

SQL Server

• Exclude .MDF, .LDF, .NDF, .TRN, .BAK and .SLS
• Exclude sqlmangr.exe and sqlservr.exe
• SQL folder and databases files (or database file types) from scanning for performance reasons:
KB309422 - Guidelines for choosing antivirus software to run on the computers that are running SQL Server http://support.microsoft.com/kb/309422

WSS 3,0 / MOSS 2007 

• Drive:\Program Files\Microsoft Office Servers\12.0
• Drive:\Program Files\Common Files\Microsoft Shared\web server extensions\12
• Drive:\DOCUME~1\ALLUSE~1\APPLICATION DATA\MICROSOFT\FIREWALL CLIENT\*
• Drive:\WINDOWS\Temp\WebTempDir\*
• Drive:\DOCUMENTS AND SETTINGS\<SPSServiceAccount>\LOCAL SETTINGS\APPLICATION DATA\*
• Drive:\Documents and Settings\\<SPSServiceAccount>\Local Settings\Temp\*
• Drive:\WINDOWS\system32\LogFiles
• W3wp.exe, cbd.exe, cidaemon.exe, owstimer.exe (WSS)
(where Drive: is the drive letter where you installed SharePoint Portal Server)

 

MOM

·    Drive:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Operations Manager

·    Drive:\Program Files\Microsoft Operations Manager 2005

 

If you are using Trend Micro the follow these guide lines:

• Temp folder:  C:\Program Files\Trend Micro\PortalProtect\temp
• Quarantine folder, whose default location is:
Drive:\Program Files\Trend Micro\PortalProtect\Quarantine
• Backup folder, whose default location is:
Drive:\Program Files\Trend Micro\PortalProtect\Backup

The following link will provide you how you can configure MOSS anti-virus, not Operating System Anti-Virus.

http://technet2.microsoft.com/Office/f/?en-us/library/1289e6e2-03e0-4f10-8921-e516187891c61033.mspx

One of my recomendation before logging Microsoft PSS calls is to make sure you have these guidelines applied in your environment, this could save a lot of  time & money with regard to support issues. I hope this helps. Stick out tongue

I thought I would add this to the post; the offical KB article associated to "Folders may have to be excluded from antivirus scanning when you use a file-level antivirus program in Windows SharePoint Services 3.0 or in SharePoint Server 2007": http://support.microsoft.com/kb/952167

Comments

 

lmd said:

Since you recommend excluding all of the above mentioned directiories, wouldn't they be unprotected.  If an environment has a SharePont add-in antivirus like Forefront, would you still need antivirus for the Windows servers?

June 18, 2008 1:04 PM
 

bobbyhabib said:

Hi IMD,

Yes you are right, these area will be unprotected by AV. But you need to exclude the above directories, otherwise your Operating System Anti Virus will start blocking SharePoints calls. SharePoint AV like forefront will only scan files that are being pushed back into the SharePoint database, not at the Operating System level.

Hope this helps.

BH

July 7, 2008 11:38 PM
 

Internet Security said:

Good info and well presented, for more quality free info on pc security related issues have a look here.

July 11, 2008 3:05 AM

Leave a Comment

(required )  
(optional )
(required )  
Add

About bobbyhabib

I am Currently working as a Freelance Sharepoint Technical Consultant / Developer. I have done Technical Consulting / Development for such companies as BT, Computer Science Coprporation, Sony BPE, GlaxoSmithKline, Media Maker, Business Links, Plumtree Professional Services, Centrica, Hewlett Packard Professional Services, Napp Pharamceuticals, 3i Group plc, Chapter 26 and currently working for Microsoft. Product and Services have included work with C#, .Net, ASP, ADO.Net, XML, SharePoint 2003 to MOSS, SharePoint Migrations, SharePoint UI Customisation, Plumtree. I have been developing in .NET technologies since .NET was first in beta and have been designing and developing software solution for leading companies since 1995. Areas of Interest: MOSS, Collabrative Technologies, AJAX, Web Services, Workflows, MOSS Search, UI SharePoint Customisation, Development Patterns, Web Parts, SharePoint Migrations. During my spare time when I am not being a geek, I love to spend time with my beautiful wife and my two adoreable kids. Love walking, travelling, gardening, reading, pool, rowing, badiminton and running.

Need SharePoint Training? Attend a SharePoint Bootcamp!

Posts (c) their respective authors. Everything else (c) 2007 SharePoint Experts