On-demand and On-access scanning of Exchange servers

In several articles Microsoft recommends to exclude certain files and folders belonging to Exchange from file-level scanners. The issues below concern the NVC modules On-demand scanner and On-access scanner and do not affect the NVC for Exchange plugin.

All customers running Exchange 2000 and 2003 should be aware the following articles from Microsoft:

The first article speaks generally about virus scanners on Exchange. It will tell you about different problems you may run into if you don't follow Microsoft recommendations on what to exclude from scanning.
The second article deals specifically with scanning of the M drive.

You should note that possible problems are not limited to those described in the articles. All kinds of unusual situations may occur if your file level scanner blocks or deletes a file that is being used by Exchange.

Recommendations:

Exclude the following folders from both On-demand and On-access scanning:

  • Exchange databases and log files. By default, these are located in the Exchsrvr\Mdbdata folder.
  • Exchange MTA files in the Exchsrvr\Mtadata folder.
  • Additional LOG files such as the Exchsrvr\server_name.log file.
  • The Exchsrvr\Mailroot virtual server folder.
  • The working folder that is used to store streaming temporary files that are used for message conversion. By default, this folder is located at \Exchsrvr\MDBData, but you can configure the location
  • The temporary folder that is used in conjunction with offline maintenance utilities such as Eseutil.exe. By default, this folder is the location where the .exe file is run from, but you can configure where you run the file from when you run the utility.
  • Site Replication Service (SRS) files in the Exchsrvr\Srsdata folder
  • Microsoft Internet Information Service (IIS) system files in the %SystemRoot%\System32\Inetsrv folder.

NOTE: You may want to exclude the whole Exchsrvr folder from both "on-demand" and "memory resident" file-level scanners.

Exclude the following file types from both "on-demand" and "memory resident" file-level scanners:
* .edb
* .stm (on Exchange 2000 Server)
* .log"