Google
Search WWW Search msexchangetips.blogspot.com

Saturday, September 16, 2006

Exchange: Identifying File Level Antivirus Exclusions For Exchange Server Installations

Summary:

Protecting Exchange against malicious viruses is critical to ensure the health and availability of your messaging environment. However, it is also critical that some folders\files must be excluded from file level scanning. Scanning these critical folders\files can cause serious damage such as corruption, database not being able to mount, restore problems among other issues. According to Microsoft's recommendation, it is critical that you exclude the following directories.


1. Exclude all directories that include your Exchange database files (EDB STM) For example in a default installation, the Exchange database is placed in your \Exchsrvr\Mdbdata folder. Exclude this entire directory.

2. Exclude your Exchsrvr\Mtadata folder

3. Exclude all logs such as message tracking, SMTP. Exclude the directory Exchsrvr\server_name.log

4. Exclude your Exchange queue directory. Exchsrvr\Mailroot

5. Exclude your directory where your IFS creates the streaming .tmp files. The IFS creates these .tmp files when a large object is streamed into the store and the .stm file is too fragmented to have the entire object written in it. For example, a large object can be a message or a file. During normal operation, when the Microsoft Exchange services are stopped, these files are removed from the Temp folder. By defualt, this folder is in the Exchsrvr\Mdbdata directory. However, they can also be in your %SYSTEMROOT%\TEMP directory.

6. Exclude your Exchsrvr\Bin directory

7. Exclude your IIS system files directory %SYSTEMROOT%\System32\Inetsrv

8. Exclude your Gather logs if running search indexing services. These log files contain log information or catalog for the indexing service.

You may elect to just exclude the entire Exchsrvr directory, however the above configuration will give you the best protection.

If you have ever scanned your Exchange directory where your database or logs were stored, your database may be corrupted. The level of corruption cannot be directly quantified. For example the longer your AV was scanning these directories may lead to more corruption but may not be necessarily true. It may also depend on the AV application as well. However, symptoms of corruption may not be immediately visible and may arise further down the road. Therefore, it is best practice to create a fresh database and move your users to the new database.



References:

Lb*.tmp Files Are Created in the TEMP Folder and Are Not Deleted
http://support.microsoft.com/default.aspx?scid=kb;en-us;328583

Exchange lb*.tmp files in the Windows Temp folder cause ESE -2237 error
http://support.microsoft.com/default.aspx?scid=kb;en-us;294462


James Chong
MCSE M+, S+, MCTS, Security+
msexchangetips.blogspot.com
ftp://ftp://ftp.smtp25.org//


How useful was this article? Want to see a tip not listed? Please leave a comment.

14 Comments:

Anonymous Anonymous said...

The Exchsrvr\Bin directory is in the list of folders to exclude from scanning. However, Symantec's own documentation claims this directory is safe to scan. (ref.: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2005040513412648?Open&dtype=corp&tdir=reg_eu&tpre=reg_eu&src=ent_tutweb_eu).

Do you have any comments on this?

4:58 AM  
Blogger jamestechman said...

Hello Bin. Yes! The reason why you would want to exclude this is first one reason. Usually when you perform say offline defrags, by default it puts your newly defragged db into the bin directory. Yes you can redirect the new db to another drive. But some users don't know this and by default will put it in the bin. And of course if it's scanned then you can cause corruption on the new db while it's being created. Hope this helps

6:24 PM  
Anonymous Anonymous said...

Thanks, James.
I've followed your advice, and excluded the bin folder too.

1:52 AM  
Anonymous Anonymous said...

This is really Nice Blog, Best informations and best Articles and nice design !!!
Wait new posting from this blog

Find another Best links in our Websites :

If you have still problem with virus rontokbro / brontok, brontoxyou can find here antivirus for remove all virus brontok here. our antivirus new and updated and care erase all virus brontok on your computer.
Antivirus Brontok/Rontokbro

YOU CAN FIND BEST SOFTWARE ANTIVIRUS 2008 HERE! AND YOU CAN DIRECTDOWNLOAD BEST SOFTWARE ANTIVIRUS 2008! OUR ANTIVIRUS UPDATED AND WE CAN ONLINE SCAN YOUR FILES, FIND NOW!!!

BEST SOFTWARE ANTIVIRUS 2008

If you want to buy Laptop/Notebook, we have complete Tips To Buy Laptop/Notebook, so read our tips, before you buy Laptop !

Best Tips To Buy Laptop/Notebook


SUTAN PALALA
All Information About Laptop/Notebook
Find Best Seller laptop and Top 10 Laptop Now

Best Laptop

BLADO ANTIVIRUS
Antivirus Group can Help you if you have problem with Viruses , Worms, trojans.

Download Free Antivirus Software

MAKE MONEY ONLINE
When you have no ideas more, to make an extra income, you can start with our internet make money / make money online, to earn money from internet and work at home.Here is many sites for tutorial and how to create website for make money online. Actually many idea for make money on internet, Here we give you tips and tricks make money online.Find out how to build a successful home business using your computer working from home. Start making money and a regular income from internet and other online actions. It's easier than you think, and we can show you how. Find out more....

Easy Tutorial Make Money On Internet


PROMOTE YOUR SITE/SUBMIT YOUR SITE
With Website Promoter you can know how make rangk on internet search engine and tips to high rangking optimization

Website Promoter

Here you can direct download logo, baground & ringtones for mobile phone, handphone or handset/pda/smartphone. We have many Handphone Logos, Background & Ringtones.

Download Free Logo & Background for Handphone/Mobilephone

Very cool Blog, take care !!!

Download Free Mobilephone Logo, Mobilephone Background, Mobilephone Wallpapper, Mobilephone Ringtones: Polyphonic, Monophonic & Midi and much more, you can download free Mobilephone logo here !!!
You can easier download this mobilephone logo, mobilephone background, mobilephone wallpapper and mobilephone ringtones.
FREE DOWNLOAD MOBILEPHONE LOGO, MOBILEPHONE BACKGROUND, MOBILEPHONE WALLPAPPER & MUCH MORE

FREE DOWNLOAD RINGTONES MOBILEPHONE

FREE DOWNLOAD MOBILEPHONE RINGTONES POLYPHONIC

FREE DOWNLOAD MOBILEPHONE RINGTONES MONOPHONIC

FREE DOWNLOAD MOBILEPHONE RINGTONES MIDI

Antivirus Center : you can free Download Software Antivirus for remove all virus , remove trojans, delete worm , clean trojan horse, delete worm W/32. We have virus remover, trojan cleaner, worm washer, eraser and much more.
Best Antivirus For Pc/ PDA/ Smartphone/ Laptop n

Notebook


Here you can learn how to build website with html template ,complete with tutorial how to make quickly

website for your company.
Free Template For Website

Builder


If you looking girls, womans, mans , boys on the world , you can find anda dating with them, our dating online website have many members , so find now your dating on dating online site. This dating online service is

best for find your dreams
Fun Dating Online

At Watch Gift Luxury, we specialize in the sales of brand-name watch quality, luxury watch at some of the lowest prices possible. With our large selection of products, you can be sure to find that perfect gift for yourself or a loved one.

Visit and Find Watch Gift Luxury Shop! You can find and buy best & top watches on the world:

Luxury Watches



By : Blanjo Company Best Antivirus Info 2008
Partnert This Blog

3:44 AM  
Anonymous Anonymous said...

The shoes from the Christian Louboutin designer house have redefined the trends in footwear fashions. A wide variety of colors and designs are available. The craze of Christian Louboutin Pumps are more seen among women as they are more likely to experiment with different colors and styles of Christian Louboutin Boots . Christian Louboutin Sandals is really uniqure.

5:06 PM  
Blogger Unknown said...

Good post. sharing valuable information about Antivirus for PDA

11:39 PM  
Anonymous Free Antivirus Download said...

i never read about ms exchange before so i gain new knowledge about it. free antivirus download

2:11 AM  
Anonymous Free Antivirus Download said...

this blog is like new-fanged for me. free antivirus download

1:52 AM  
Blogger xjd7410@gmail.com said...

20151012 junda
Abercrombie & Fitch Factory Outlet
michael kors outlet
coach factory outlet
michael kors outlet
Louis Vuitton Handbags Factory Store
louis vuitton
Cheap Jordans For Sale Wholesale
oakley sunglasses,oakley vault,prescription sunglasses,polarized sunglasses,aviator sunglasses,spy sunglasses,oakleys,oakley canada,cheap oakley sunglasses,oakley frogskins,oakley holbrook,cheap sunglasses,wayfarer sunglasses,oakley standard issue,fake oakleys,oakley glasses,oakley.com,oakley prescription glasses,oakley goggles,sunglasses for men,oakley gascan,oakley store,oakleys sunglasses
uggs australia
ugg boots
cheap ugg boots
michael kors handbag
Coach Factory Outlet Online Sale
Louis Vuitton Outlet USA
Air Jordan 4 Toro Bravo
canada goose outlet
toms outlet
New Louis Vuitton Handbags Outlet
Michael Kors Handbags Outlet Deals
michael kors outlet
Wholesale Authentic Designer Handbags
Ugg Boots,Ugg Boots Outlet,Ugg Outlet,Cheap Uggs,Uggs On Sale,Ugg Boots Clearance,Uggs For Women
cheap jordan shoes
michael kors outlet online
louis vuitton handbags
Coach Factory Outlet Private Sale
true religion jeans
Louis Vuitton Bags On Sale
Jordan 13 Shoes For Sale
Ralph Lauren Outlet Clothing

6:07 AM  
Blogger oakleyses said...

louis vuitton outlet, oakley sunglasses, michael kors handbags, cheap jordans, prada handbags, uggs outlet, michael kors outlet, oakley sunglasses, uggs on sale, ray ban sunglasses, burberry outlet, tiffany jewelry, uggs on sale, kate spade, gucci handbags, ray ban sunglasses, prada outlet, longchamp outlet, louboutin uk, burberry factory outlet, tory burch outlet, nike air max, tiffany jewelry, christian louboutin, louboutin shoes, oakley sunglasses, cheap oakley sunglasses, chanel handbags, michael kors outlet store, louis vuitton outlet, nike outlet, ralph lauren polo, louis vuitton, christian louboutin, michael kors outlet online, longchamp outlet, uggs outlet, michael kors outlet online, nike air max, longchamp bags, replica watches, ralph lauren outlet, oakley sunglasses, ray ban sunglasses, louis vuitton outlet online, nike free, michael kors

6:30 PM  
Blogger Unknown said...

adidas outlet
soccer jerseys wholesale
michael kors handbags
mulberry outlet store
prada outlet
cheap nba jerseys
ralph lauren uk
swarovski crystal
oakley sunglasses wholesale
chanel handbags outlet
ralph lauren outlet
cheap jordan shoes
canada goose coats
toms outlet store
puma outlet
north face outlet store
ugg boots
black friday deals
ugg outlet
toms outlet
1128minko

6:45 PM  
Blogger chenlina said...

instyler curling iron
pandora jewelry
christian louboutin
toms shoes outlet
coach outlet
michael kors outlet online
ralph lauren uk
coach factory outlet
jordan retro
adidas yeezy 350
tiffany outlet
coach factory outlet
michael kors handbags
adidas ultra boost
tory burch outlet
celine outlet
ray ban sunglasses
nike outlet
true religion outlet
coach outlet store online clearances
louis vuitton handbags
christian louboutin shoes
fitflops sale clearance
adidas shoes
christian louboutin shoes
michael kors outlet
michael kors purses
adidas trainers
christian louboutin outlet
jordan shoes
vans shoes
cheap nfl jerseys
ralph lauren
mont blanc
oakley sunglasses
toms shoes
louis vuitton outlet
supra shoes
replica watches
tods outlet
chenlina20160803

5:42 PM  
Blogger Unknown said...

HOW MIKE LARRY LOAN FIRM GRANTED ME A BUSINESS LOAN!!!
Hello everyone, I am Evans Torttor from USA and want to use this medium to express gratitude to MIKE LARRY for fulfilling his promise by granting me a loan, i was stuck in a financial situation and needed to refinance and pay my bills as well as start up a Business. I tried seeking for loans from various loan firms both private and corporate organizations but never succeeded and most banks declined my credit request. But as God would have it, i was introduced by a friend named Esther to MIKE LARRY LOAN FIRM and undergone the due process of obtaining a loan from the company, to my greatest surprise within 48hrs just like my friend Esther said, i was also granted a loan of $387,000.00 USD; So my advise to everyone who desires a loan, "if you must contact any firm with reference to securing a loan online with low interest rate of 3% and better repayment plans/schedule, please contact MIKE LARRY LOAN FIRM. Besides, he doesn't know that am doing this but due to the joy in me, i'm so happy and wish to let people know more about this great company whom truly give out loans, it is my prayer that GOD should bless them more as they put smiles on peoples faces. You can contact them via email on {mikelarryloanfirmworldwide@yahoo.com}

8:36 PM  
Blogger tayarelwady said...

طرق مكافحة الذباب

هناك العديد من الطرق التي يلجأ اليها الانسان لكي يتخلص من هذه الحشرة منها استخدام المبيدات الحشرية القاتلة للذباب و استعمال مصائد الذباب الكهربية و اليدوية كما يستخدم البعض منا طرق تقليدية منها زراعة اشجار الليمون و النعناع تعمل روائح هذه الاشجار على طرد الذباب من المكان و كما يقوم البعض بوضع اسلاك على نوافذ المنزل و التي تسمح بمرور الهواء و الضوء و لا تسمح بمرور الحشرات الطائرة
شركة مكافحة حشرات
شركة مكافحة حشرات بالاحساء
شركة مكافحة النمل الابيض بالاحساء
شركة رش مبيدات بالاحساء

11:51 AM  

Post a Comment

<< Home

xml:lang="en" lang="en"> MS Exchange Tips: Exchange: Identifying File Level Antivirus Exclusions For Exchange Server Installations