Antivirus and Exchange

[reynolwi]

I have sophos antivirus for windows server installed along with sophos puremessage for exchange server. do i need to have the antivirus exclude certain exchange directories? And if yes which ones?

Thanks

Wm. Reynolds
RRWDS | TxPSS

http://www.rrwds.com

http://www.txpubsafety.com

- - - - - - - - - - - - -
Network Error:
Hit any user to continue

 

[58sniper]

Have the file level AV software exclude the mdbdata folder.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[paulha]

And the M Drive

 

[58sniper]

You won't have an M: drive in Exchange 2003 unless you manually turned it on.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[reynolwi]

what is the m: drive? i dont have that on i dont think. Exchange is on part of the c: drive (C:\Program Files\Exchsrvr), Transaction logs are on D:\, System Path is on E:\, and Queue is on G:\. The mailbox store and public store are still on the c:\

so i should exclude the MDBDATA folder is that it?

Wm. Reynolds
RRWDS | TxPSS

http://www.rrwds.com

http://www.txpubsafety.com

- - - - - - - - - - - - -
Network Error:
Hit any user to continue

 

[58sniper]

That should do it. Although I'd be trying to get those stores off of the C: drive.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[reynolwi]

can i let antivirus scan d:\, e:\, and g:\ or should i exclude those as well?

Wm. Reynolds
RRWDS | TxPSS

http://www.rrwds.com

http://www.txpubsafety.com

- - - - - - - - - - - - -
Network Error:
Hit any user to continue

 

[kbing]

There is a bit more to be worried about for exclusions that mdbdata folder..... See the support document from SOPHOS.

http://www.sophos.com/support/knowledgebase/article/12214.html

Sophos Anti-Virus for Windows: file exclusions for Microsoft Exchange Server 2000 and 2003
Sophos Anti-Virus can be installed on Windows 2000 and Windows 2003 computers with Microsoft Exchange 2000 or Microsoft Exchange 2003, but care must be taken to ensure that certain files and folders are not scanned by either on-demand or on-access scanning. Sophos Anti-Virus should also be temporarily disabled during Exchange and Windows upgrades.

What to do
Files and folders to exclude
This list gives the default locations for the relevant files and folders. It is easiest to exclude the whole Exchsrvr folder and any other relevant items.

These exclusions apply to on-access and on-demand scanning.

Exclude the whole Exchsrvr folder and its sub-folders.
The Exchange server Installable File System (IFS), usually the M: drive (a different drive letter may be used)
Internet Information Server (IIS) system files (usually in \%systemroot%\system32\inetsrv)
Any temporary folder used in conjunction with ESEUTIL.EXE or another offline maintenance utility (usually the same folder as the executable)
All Exchange database and log files (if they are not in \Exchsrvr\Mdbdata)
Virtual server folders (if they are not in \Exchsrvr\Mailroot)
Message tracking logs (if they are not in \Exchsrvr\<servername>.log)
Exchange files with the extension .MTA (if they are not in \Exchsrvr\Mtadata)
Site Replication Services (SRS) files (if they are not in \Exchsrvr\Srsdata)
The working folder for streaming temporary files (if they are not in \Exchsrvr\Mdbdata)
The folder Exchsrvr\Imcdata (see Microsoft Knowledge Base Article 328667).
For more information, see the Microsoft Knowledge Base Articles on anti-virus software and Microsoft Exchange

Exchange 2000 and anti-virus software: 328841
Exchange 2003 and anti-virus software: 823166
Disabling on-access scanning
Sophos Anti-Virus on-access scanning should be temporarily disabled when

updating the Windows operating system
updating Microsoft Exchange.
This includes when applying service packs, version upgrades and hotfixes.

If you need more information or guidance, then please contact technical support.

 

[SKent]

Would these exclusions apply to McAfee AV as well?

 

[58sniper]

AV exceptions would apply to any AV product you're using.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[blakey2]

Hi,

What is the M: Drive - drive letter mappings are arbitrary no? Is this a standard practice to put mdbdata / info. store on a physical disk and label it as m:?

Cheers.

 

[58sniper]

No - with Exchange 2000, there was an IFS drive, labeled M:

It caused more problems than it was worth, and was dropped in Exchange 2003.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[blakey2]

Aha - that would explain it. I went from 5.5 to 2003 skipping 2000.

Cheers.