I was installing Microsoft .NET 3.5 last night. It’s one of those online installers. Meaning the setup.exe file downloads the installation files from Microsoft, then installs it.
Once the download portion was complete, I saw the following screen:
I don’t think anyone disconnects and reconnects to the Internet anymore. This screen might have been OK in 1994, but today?
Funny stuff…
All too often I run into corporate anti virus solutions without any exclusions configured. Exclusions are critical to ensuring that the real time scanners do not interfere with crucial Windows or application functions.
When the real time scanner of any anti virus application scans a file prior to reading or writing it, it locks the file to ensure it has exclusive access. If Windows attempts to access this file while it is locked by AV, seriously bad things can happen. I’ve had to restore more than one Active Directory and Exchange database because of this. Sadly, each case could have been avoided.
What follows are the virus exclusions recommended by Microsoft. Below each list is a reference KB article discussing the topic in greater detail.
Feel free to add your comments or links to other recommended exclusions. I’ll keep this post updated to maintain a comprehensive listing.
All Servers and Workstations
- %windir%\SoftwareDistribution\Datastore
Reference: KB822158
Domain Controllers
- %windir%\ntds
- %windir%\ntfrs
- %systemroot%\sysvol
Reference: KB822158
Exchange Server
- Drive M (Only Exchange 2000)
- Exchsrvr folder
- %SystemRoot%\System32\Inetsrv
Reference: KB328841
IIS
- %systemroot%\IIS Temporary Compressed Files(IIS 6)
- %SystemDrive%\inetpub\temp\IIS Temporary Compressed Files (IIS 7)
Reference: KB817442
ISA Server
- Program Files\Microsoft ISA Server
Reference: KB887311
Sharepoint
- \Program Files\SharePoint Portal Server
- \Program Files\Common Files\Microsoft Shared\Web Storage System
- \Windows\Temp\Frontpagetempdir
Reference: KB320111
SQL Server
- SQL Server data files: *.mdf, *.ldf, *.ndf
- SQL Server backup files: *.bak, *.trn
- Full text catalog files
- Analysis Services: \Program Files\Microsoft SQL Server\MSSQL.X\OLAP\Data
- Analysis Services Backup: \Program Files\Microsoft SQL Server\MSSQL.X\OLAP\Backup
- Analysis Services Logs: \Program Files\Microsoft SQL Server\MSSQL.X\OLAP\Log.
- SQL Server Cluster
- Q:\ (Quorum drive)
- C:\windows\cluster
Reference: KB309422
Virtual Server
- Vssrvc.exe process (Virtual Server 2005
- Virtual PC.exe process (Virtual Server 2004)
- File type exclusions: *.vhd, *.vmc, *.vsv, *.vud, *.vfd, *.iso
Reference: KB840193
MSMQ
References:
You can now disconnect from the Internet
