Windows Server 2003 with SAP installation has been infected by Virus

[Former Member]

Hi, All :

Just today My Windows Server 2003 with SAP installation has been infected by W32/Looke-CQ Virus . Could I install antivirus on my windows server and scan for the Virus as this virus has infected many of exe file located on system disk.

Thanks,

Leon

[Former Member]

yes

Peter

[Former Member]

Is there any impact for SAP application if I install antivirus software on SAP server? Since the implementatiom of our production sap systems , we never install any antivirus software on our system , is there any reason why SAP is not recommended for installing antivirus on SAP system .

Thanks

Leon

[Former Member]

yes, lowering performance if you enable active scan (which means checking every file system access).

In some rare cases we have seen handle and resource leaks in the antivirus software, which will of corse destabilize the complete server.

Peter

[former_member204746]

your server will slowdown, but most antivirus will allow you to use exclude lists, so, I would exclude X:\oracle\SID on each drive as a minimum exclude list.

[Former Member]

Hi, Eric :

This means that you are running antivirus software on your sap system ?What antivirus software that you are using ?

Thanks.

Leon

[former_member204746]

I am using Mcafee VirusScan Enterprise version 8.

with exclude lists, performance degradation is minimal.

anyways, any Windows-based system, even servers MUST have anti-virus solutions, even if it is only available on your local network. with new viruses hitting TCP ports, you need this.

[Former Member]

Hi, Eric :

Could you share with me more about your exclude lists for scanning ? I'm sure we have to exclude the database files from scanning , but is there any others that have to be excluded also ?

Thanks

Leon

[former_member204746]

I worked for 2 different companies and they use different exclude lists:

Company 1 excluded all non-OS drivers... not very safe

Company 2 excludes X:\oracle\SID, also mirrlog* and origlog, offline redo logs. For the rest, you should monitor which files are being scanned and choose if any other files can be excluded, other are mostly OS files and your Windows admin should take care of this.

if you feel that this covers your need, please close the topic.