A minha lista de exclusões de ficheiros/ serviços para o antivírus:

1.) %systemroot%\System32\Spool
2.) %systemroot%\SoftwareDistribution\Datastore

3.) Network Drives.
KB822158 - Virus scanning recommendations for computers that are running Windows
Server 2003, Windows 2000, or Windows XP

1.) Domain Controller (DC) / DNS / DHCP
a.) %systemroot%\Sysvol)
b.) %systemroot%\system32\dhcp
c.) %systemroot%\system32\

d.) %systemroot%\ntds

KB822158 - Virus scanning recommendations for computers that are running Windows
Server 2003, Windows 2000, or Windows XP

2.) File Replication (NTFR)

a.) %systemroot%\ntfrs
b.) * .log and *.dit

KB815263 - Antivirus, backup, and disk optimization programs that are compatible
with the File Replication Service

3.) IIS:

a.) %systemroot%\IIS Temporary Compressed Files)
b.) %systemroot%\system32\inetsrv
c.) * .log extension

KB817442 - IIS 6.0: Antivirus Scanning of IIS Compression Directory May Result in 0-Byte File
KB821749 - Antivirus software may cause IIS to stop unexpectedly

4.) SQL

A pasta de SQL, as databases e os logs,

KB309422 - Guidelines for choosing antivirus software to run on the computers that
are running SQL Server

5.) Exchange

A pasta de Exchange, as databases e os logs,

KB328841 - Exchange and antivirus software
KB823166 - Overview of Exchange Server 2003 and antivirus software
KB245822 - Recommendations for troubleshooting an Exchange Server computer with
antivirus software installed

6.) Cluster,
KB250355 - Antivirus Software May Cause Problems with Cluster Services

a.) Q:\ (Quorum drive)
b.) %systemroot%\Cluster
c.) SQL Server data files that have the .mdf extension, the .ldf extension, and
the .ndf extension

7.) Sharepoint
a.):\Program Files\SharePoint Portal Server
b.):\Program Files\Common Files\Microsoft Shared\Web Storage System

KB320111 - Random Errors May Occur When Antivirus Software Scans Microsoft Web Storage System

KB322941 - Microsoft's Position on Antivirus Solutions for Microsoft SharePoint Portal Server
8.) (SMS),
a.) SMS\Inboxes
b.) SMS_CCM\ServiceData

KB327453 - Antivirus programs may contribute to file backlogs in SMS 2.0 and in SMS 2003

9.) MOM (Microsoft Operations Manager).

a.):\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Operations Manager
b.) Drive:\Program Files\Microsoft Operations Manager 2005

10.) Internet Security and Acceleration Server (ISA) Server,

a.) Pasta ISALogs.

KB887311 - Event ID 5, event ID 14079, and event ID 14176 are logged in the Application log on your Internet Security and Acceleration Server 2000 computer
11.) Windows Software Update Services (WSUS).
a.) Drive:\MSSQL$WSUS
b.) Drive:\WSUS
Also refer to the following knowledge base articles for reference:
KB900638 - Multiple symptoms occur if an antivirus scan occurs while the Wsusscan.cab file is copied

11.) HYPER-V

Run AV software on Parent and exclude *.vhd and any snapshot file extensions (no need to scan the vhd if there is av software running inside the vm and not sure if the av software could even READ the vhd anyway)

Run AV software on child partitions with exceptions as needed by role (exchange, sharepoint, sql ,etc)

More generally:

Exclude scanning the directory with VM Disks and directory with VM Configurations.

Exclude scanning the following processes:




Error code when you create or start a virtual machine on a Windows Server

2008-based computer that has Hyper-V or on a Microsoft Hyper-V Server 2008-based

computer: "0x800704C8", "0x80070037" or "0x800703E3"


Planning for Hyper-V Security