Cliff Hobbs - FAQShop.com and Microsoft MVP ConfigMgr/ SMS

[MS KBs] Recommendations for antivirus exclusions that relate to MOM 2005 and to Operations Manager 2007

MORE INFORMATION

Exclusions by process executable You must be very careful when you add exclusion...

Exclusions by process executable

You must be very careful when you add exclusions that are based on executables. Incorrect exclusions prevent some potentially dangerous programs from being detected. Therefore, we do not recommend that you rely on exclusions that are based on any process executables for MOM services or for Operations Manager servers. However, if you have to make exclusions that are based on the process executables, use the following processes:

• momhost.exe (MOM 2005)
• monitoringhost.exe (Operations Manager 2007)

Exclusions by Directories

The following directory-specific exclusions for MOM or for Operations Manager include real-time scans, scheduled scans, and local scans. These directories that are listed are default application directories. Therefore, you may have to modify these paths based on your specific environment. Only the following MOM-related directories or the following Operation Manager-related directories should be excluded.
Important When a directory that is to be excluded has a directory name greater than 8 characters long, add both the short and long directory names of the directory to the exclusion list. These names are required by some AV programs to traverse the subdirectories.

SQL Database Servers

These exclusions include the SQL Server database files that are used by Operations Manager components and the system database files for the master database and for the tempdb database. To exclude these files by directory, exclude the directory for the .ldf and .mdf files.
For example:

• C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data
• D:\MSSQL\DATA
• E:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Log

MOM 2005 (management servers and agents)

These exclusions include the queue and log files that are used by MOM 2005.
For Example:
C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Operations Manager\

Operations Manager 2007 (management servers and agents)

These exclusions include the queue and log files that are used by Operations Manager 2007.
For example:
C:\Program Files\System Center Operations Manager 2007\Health Service State\Health Service Store

Exclusion of File Type by Extensions

The following file name extension-specific exclusions for Operations Manager includes real-time scans, scheduled scans, and local scans.

SQL Database Servers

These exclusions include the SQL Server database files that are used by Operations Manager components and the system database files for the master database and for the tempdb database.
For example:

• MDF
• LDF

MOM 2005 (management servers and agents)

These exclusions include the queue and log files that are used by MOM 2005.
For example:

• WKF
• PQF
• PQF0
• PQF1

Operations Manager 2007 (management servers and agents)

These exclusions include the queue and log files that are used by Operations Manager 2007.
For Example:

• EDB
• CHK
• LOG

Note Page files should also be excluded from any real-time scans.

http://support.microsoft.com/default.aspx?scid=kb;en-us;975931