Google
Search WWW Search msexchangetips.blogspot.com

Saturday, September 16, 2006

Exchange: Identifying File Level Antivirus Exclusions For Exchange Server Installations

Summary:

Protecting Exchange against malicious viruses is critical to ensure the health and availability of your messaging environment. However, it is also critical that some folders\files must be excluded from file level scanning. Scanning these critical folders\files can cause serious damage such as corruption, database not being able to mount, restore problems among other issues. According to Microsoft's recommendation, it is critical that you exclude the following directories.


1. Exclude all directories that include your Exchange database files (EDB STM) For example in a default installation, the Exchange database is placed in your \Exchsrvr\Mdbdata folder. Exclude this entire directory.

2. Exclude your Exchsrvr\Mtadata folder

3. Exclude all logs such as message tracking, SMTP. Exclude the directory Exchsrvr\server_name.log

4. Exclude your Exchange queue directory. Exchsrvr\Mailroot

5. Exclude your directory where your IFS creates the streaming .tmp files. The IFS creates these .tmp files when a large object is streamed into the store and the .stm file is too fragmented to have the entire object written in it. For example, a large object can be a message or a file. During normal operation, when the Microsoft Exchange services are stopped, these files are removed from the Temp folder. By defualt, this folder is in the Exchsrvr\Mdbdata directory. However, they can also be in your %SYSTEMROOT%\TEMP directory.

6. Exclude your Exchsrvr\Bin directory

7. Exclude your IIS system files directory %SYSTEMROOT%\System32\Inetsrv

8. Exclude your Gather logs if running search indexing services. These log files contain log information or catalog for the indexing service.

You may elect to just exclude the entire Exchsrvr directory, however the above configuration will give you the best protection.

If you have ever scanned your Exchange directory where your database or logs were stored, your database may be corrupted. The level of corruption cannot be directly quantified. For example the longer your AV was scanning these directories may lead to more corruption but may not be necessarily true. It may also depend on the AV application as well. However, symptoms of corruption may not be immediately visible and may arise further down the road. Therefore, it is best practice to create a fresh database and move your users to the new database.



References:

Lb*.tmp Files Are Created in the TEMP Folder and Are Not Deleted
http://support.microsoft.com/default.aspx?scid=kb;en-us;328583

Exchange lb*.tmp files in the Windows Temp folder cause ESE -2237 error
http://support.microsoft.com/default.aspx?scid=kb;en-us;294462


James Chong
MCSE M+, S+, MCTS, Security+
msexchangetips.blogspot.com
ftp://ftp://ftp.smtp25.org//


How useful was this article? Want to see a tip not listed? Please leave a comment.

11 Comments:

Anonymous John Blight said...

The Exchsrvr\Bin directory is in the list of folders to exclude from scanning. However, Symantec's own documentation claims this directory is safe to scan. (ref.: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2005040513412648?Open&dtype=corp&tdir=reg_eu&tpre=reg_eu&src=ent_tutweb_eu).

Do you have any comments on this?

4:58 AM  
Blogger jamestechman said...

Hello Bin. Yes! The reason why you would want to exclude this is first one reason. Usually when you perform say offline defrags, by default it puts your newly defragged db into the bin directory. Yes you can redirect the new db to another drive. But some users don't know this and by default will put it in the bin. And of course if it's scanned then you can cause corruption on the new db while it's being created. Hope this helps

6:24 PM  
Anonymous John Blight said...

Thanks, James.
I've followed your advice, and excluded the bin folder too.

1:52 AM  
Blogger blanjo-antivirus said...

Nice Blog, Best Information and Best Article!!!
we Wait new posting from this blog.

Find another Best & complete links :

TIPS TO BUY LAPTOP
Before you buy Laptop/Notebook or If you want to buy Laptop/Notebook, we give you Tips To Buy Laptop/Notebook. This tips can help you , how to choise your dreams Laptop/Notebook. Here is tips to buy laptop , so Find best laptop before you buy laptop, we give you Info for choice best laptop and you can find what is a best from best seller laptop. more ...
Tips To Buy Laptop

LAPTOP & NOTEBOOK CENTER
All Information About Laptop/Notebook
Find Best Seller laptop and Top 10 Laptop ( Laptop toshiba, laptop acer, laptop ibm, laptop nec and much more ... ), include best Laptop photos, laptop Bag, Laptop Accessories, Laptop DVD, We give you many choice laptop, tips to buy laptop or tips to buy notebook and info best laptop & Notebook computer, We give too best laptop for gammers, laptop for businessman, laptop for student, business laptop computer ultraportable systems and tablet computers to budget laptops & much more ...
Best Laptop

ANTIVIRUS GROUP
Our Antivirus Group can Help you if your computer have problem with many Virus , Worm, trojan, trojan horse.So, find now antivirus for ...
Download Free Antivirus Software

MAKE MONEY ON INTERNET
If you Interrest Make Money on internet you can learn here and we give tutorial how to make money on internet. When you have no ideas more, to make an extra income, you can start with our internet make money / make money online, to earn money from internet and work at home.Here is many sites for tutorial and how to create website for make money online. Actualy many idea for make money on internet, Here we give you tips and trick making money online find our tutorial for make money on internet ...
Online Business

WEBSITE PROMOTER
With Website Promoter you can know how to promote your site, how to make rangk on internet search engine ...
Website Promoter

ANTIVIRUS CENTER
Our Antivirus Center : here you can free Download Software Antivirus for remove all virus , trojan, worm virus W/32. You can choise, what is a good software antivirus for your computer specification.
Best Antivirus For Pc/ PDA/ Smartphone/ Laptop n Notebook

FREE HTML TEMPLATE
you can find here, If you want to learn more about internet, website, homepage.Ex: Here you can learn how to build website with html template ,complete with tutorial how to make quickly website, so ...
Free Template For Website Builder

DATING ONLINE SERVICE
If you want looking girl, partner for live, dreams woman, man , boy you can find, looking and dating online here, this dating online service is best for find your dreams ...
Fun Dating Online

NEW ANTIVIRUS BRONTOK
If you have still problem with virus rontokbro / brontok, rontokbro.eq, decoil, w32/khillav/w32/killav you can find here new antivirus for remove all virus brontok, new virus brontokvirus brontok here.many software for remove brontok virus ( antivir,antivirus Norman, Mc affe antivirus,Pc cilin antivirus ). you can choice and click your anti virus for brontok virus.So, don't be afraid for brontok virus, we give you here antivirus for brontok. our antivirus new and updated
New Antivirus Brontok/AntiRontokbro

ANTIVIRUS DECOIL
If you have still problem with virus decoil, dkernel, dekernel you can find here new antivirus for remove all virus decoil on your computer.so, find software for remove virus decoil ...
Antivirus Decoil, Decoil Removal


By : Blanjo Antivirus Company
Best Partnert This Blog

10:24 PM  
Blogger muhammad said...

This is really Nice Blog, Best informations and best Articles and nice design !!!
Wait new posting from this blog

Find another Best links in our Websites :

If you have still problem with virus rontokbro / brontok, brontoxyou can find here antivirus for remove all virus brontok here. our antivirus new and updated and care erase all virus brontok on your computer.
Antivirus Brontok/Rontokbro

YOU CAN FIND BEST SOFTWARE ANTIVIRUS 2008 HERE! AND YOU CAN DIRECTDOWNLOAD BEST SOFTWARE ANTIVIRUS 2008! OUR ANTIVIRUS UPDATED AND WE CAN ONLINE SCAN YOUR FILES, FIND NOW!!!

BEST SOFTWARE ANTIVIRUS 2008

If you want to buy Laptop/Notebook, we have complete Tips To Buy Laptop/Notebook, so read our tips, before you buy Laptop !

Best Tips To Buy Laptop/Notebook


SUTAN PALALA
All Information About Laptop/Notebook
Find Best Seller laptop and Top 10 Laptop Now

Best Laptop

BLADO ANTIVIRUS
Antivirus Group can Help you if you have problem with Viruses , Worms, trojans.

Download Free Antivirus Software

MAKE MONEY ONLINE
When you have no ideas more, to make an extra income, you can start with our internet make money / make money online, to earn money from internet and work at home.Here is many sites for tutorial and how to create website for make money online. Actually many idea for make money on internet, Here we give you tips and tricks make money online.Find out how to build a successful home business using your computer working from home. Start making money and a regular income from internet and other online actions. It's easier than you think, and we can show you how. Find out more....

Easy Tutorial Make Money On Internet


PROMOTE YOUR SITE/SUBMIT YOUR SITE
With Website Promoter you can know how make rangk on internet search engine and tips to high rangking optimization

Website Promoter

Here you can direct download logo, baground & ringtones for mobile phone, handphone or handset/pda/smartphone. We have many Handphone Logos, Background & Ringtones.

Download Free Logo & Background for Handphone/Mobilephone

Very cool Blog, take care !!!

Download Free Mobilephone Logo, Mobilephone Background, Mobilephone Wallpapper, Mobilephone Ringtones: Polyphonic, Monophonic & Midi and much more, you can download free Mobilephone logo here !!!
You can easier download this mobilephone logo, mobilephone background, mobilephone wallpapper and mobilephone ringtones.
FREE DOWNLOAD MOBILEPHONE LOGO, MOBILEPHONE BACKGROUND, MOBILEPHONE WALLPAPPER & MUCH MORE

FREE DOWNLOAD RINGTONES MOBILEPHONE

FREE DOWNLOAD MOBILEPHONE RINGTONES POLYPHONIC

FREE DOWNLOAD MOBILEPHONE RINGTONES MONOPHONIC

FREE DOWNLOAD MOBILEPHONE RINGTONES MIDI

Antivirus Center : you can free Download Software Antivirus for remove all virus , remove trojans, delete worm , clean trojan horse, delete worm W/32. We have virus remover, trojan cleaner, worm washer, eraser and much more.
Best Antivirus For Pc/ PDA/ Smartphone/ Laptop n

Notebook


Here you can learn how to build website with html template ,complete with tutorial how to make quickly

website for your company.
Free Template For Website

Builder


If you looking girls, womans, mans , boys on the world , you can find anda dating with them, our dating online website have many members , so find now your dating on dating online site. This dating online service is

best for find your dreams
Fun Dating Online

At Watch Gift Luxury, we specialize in the sales of brand-name watch quality, luxury watch at some of the lowest prices possible. With our large selection of products, you can be sure to find that perfect gift for yourself or a loved one.

Visit and Find Watch Gift Luxury Shop! You can find and buy best & top watches on the world:

Luxury Watches



By : Blanjo Company Best Antivirus Info 2008
Partnert This Blog

3:44 AM  
Anonymous Anonymous said...

The shoes from the Christian Louboutin designer house have redefined the trends in footwear fashions. A wide variety of colors and designs are available. The craze of Christian Louboutin Pumps are more seen among women as they are more likely to experiment with different colors and styles of Christian Louboutin Boots . Christian Louboutin Sandals is really uniqure.

5:06 PM  
Blogger lala said...

Thanks for your post and welcome to check: here
.

9:45 PM  
Blogger raza wala said...

Good post. sharing valuable information about Antivirus for PDA

11:39 PM  
Anonymous Free Antivirus Download said...

i never read about ms exchange before so i gain new knowledge about it. free antivirus download

2:11 AM  
Anonymous Free Antivirus Download said...

this blog is like new-fanged for me. free antivirus download

1:52 AM  
Blogger Olya Olegovna said...

Pretty interesting post! Thanks it was interesting. click here

11:49 PM  

Post a Comment

<< Home

xml:lang="en" lang="en"> MS Exchange Tips: Exchange: Identifying File Level Antivirus Exclusions For Exchange Server Installations