Filesystem Virus Scan on SAP NetWeaver Windows Platform

[Former Member]

Hello friends

The virus W32.Sality.AE is spreading on our network. It infects all .exe Files on a machine. Because of the sapmnt shares on our SAP Servers the files in the transport and kernel directories (like tp.exe...) got infected.

My question now is, if there is a risk when we check the whole server on a virus infection. Does the "cleaning" of the virus from the executables cause a damage to these files?

Is there a Virus Scanner certified by SAP? I have seen that Antivir has a SAP Netweaver Adapter Scanner. This product is integrated in the sap system and do a scan of the database and the data exchange between different systems.

But that is not what we need. We need a scan solution that scans and cleans the filesystem without damaging the files.

Thanks a lot for the help.

Best wishes

Marco

[Former Member]

I made a simple filesystem antivirus check and repair with exceptions (no scan to the database).

It's important that the action on infection is "repair" and not "isolate", "delete" or something like that.

[markus_doehr2]

> My question now is, if there is a risk when we check the whole server on a virus infection. Does the "cleaning" of the virus from the executables cause a damage to these files?

Nobody will be able to give you an answer on that because nobody has an insight which AV product you use and how the disinfection algorithms work.

> Is there a Virus Scanner certified by SAP? I have seen that Antivir has a SAP Netweaver Adapter Scanner. This product is integrated in the sap system and do a scan of the database and the data exchange between different systems.

> But that is not what we need. We need a scan solution that scans and cleans the filesystem without damaging the files.

In case of an infection I would

- take a backup of the database and filesystem

- delete the whole system and reinstall by using the backup (homogeneous system copy) but only restore the database.

After the restore:

- restrict access to the SAP shares to only those machines that are in the same landscape for transports (configure firewall!), deny access for all other machines

- restrict incoming connections to the SAP machines to the absolute necessary ports (3200/3300/3600), deny all others

Markus