Антивирус для Windows Server - настраиваем список исключений. Обновлено 11.08.2016

Windows Update files

%windir%\SoftwareDistribution\Datastore\DataStore.edb
%windir%\SoftwareDistribution\Datastore\Logs\edb*.jrs
%windir%\SoftwareDistribution\Datastore\Logs\edb.chk
%windir%\SoftwareDistribution\Datastore\Logs\tmp.edb
%windir%\SoftwareDistribution\Datastore\Logs\*.log

Windows Security files

%windir%\Security\database\*.chk

%windir%\Security\database\*.edb
%windir%\Security\database\*.jrs
%windir%\Security\database\*.log
%windir%\Security\database\*.sdb

Group Policy related files

%AllUsersProfile%\ntuser.pol
%SystemRoot%\System32\GroupPolicy\Machine\Registry.pol

Paging files

pagefile.sys
%SystemDrive%\pagefile.sys

%windir%\NTDS\ntds.dit
%windir%\NTDS\ntds.pat

%windir%\NTDS\edb*.log
%windir%\NTDS\res*.log
%windir%\NTDS\edb*.jrs

%windir%\NTDS\temp.edb
%windir%\NTDS\edb.chk

%windir%\ntfrs\jet\sys\edb.chk
%windir%\ntfrs\jet\ntfrs.jdb
%windir%\ntfrs\jet\log\*.log
%windir%\ntfrs\jet\log\*.jrs

%windir%\SYSVOL_DFSR\domain
%windir%\SYSVOL_DFSR

%SystemDrive%\System Volume Information\DFSR
%SystemDrive%\System Volume Information\DFSR\$db_normal$
%SystemDrive%\System Volume Information\DFSR\FileIDTable_*
%SystemDrive%\System Volume Information\DFSR\SimilarityTable_*
%SystemDrive%\System Volume Information\DFSR\Config\*.XML
%SystemDrive%\System Volume Information\DFSR\database_*

%SystemDrive%\System Volume Information\DFSR\database_*\$db_dirty$

%SystemDrive%\System Volume Information\DFSR\database_*\$db_clean$
%SystemDrive%\System Volume Information\DFSR\database_*\$db_lost$
%SystemDrive%\System Volume Information\DFSR\database_*\dfsr.db

%SystemDrive%\System Volume Information\DFSR\database_*\fsr.chk

%SystemDrive%\System Volume Information\DFSR\database_*\*.frx
%SystemDrive%\System Volume Information\DFSR\database_*\*.log
%SystemDrive%\System Volume Information\DFSR\database_*\fsr*.jrs
%SystemDrive%\System Volume Information\DFSR\Private

%windir%\SYSVOL\domain
%windir%\SYSVOL

%windir%\SYSVOL\staging\domain
%windir%\SYSVOL\staging areas

%windir%\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory

%SystemRoot%\System32\ntfrs.exe
%SystemRoot%\System32\dfsr.exe
%SystemRoot%\System32\dfsrs.exe

Cluster Service files

%QuorumDrive%\MSCS (Например Q:\MSCS)
%QuorumDrive%\Cluster (Например Q:\Cluster)
%SystemRoot%\Cluster

DHCP Server files

%SystemRoot%\System32\dhcp\*.chk

%SystemRoot%\System32\dhcp\*.edb

%SystemRoot%\System32\dhcp\*.jrs

%SystemRoot%\System32\dhcp\*.log

%SystemRoot%\System32\dhcp\dhcp.mdb

%SystemRoot%\System32\dhcp\dhcp.pat
%SystemRoot%\System32\dhcp\backup\*.mdb
%SystemRoot%\System32\dhcp\backup\*.log
%SystemRoot%\System32\dhcp\backup\*.chk

DNS Server files

%SystemRoot%\System32\dns\*.dns
%SystemRoot%\System32\dns\*.log
%SystemRoot%\System32\dns\BOOT
%SystemRoot%\System32\dns.exe

WINS Server files

%SystemRoot%\System32\wins\*.chk
%SystemRoot%\System32\wins\*.log
%SystemRoot%\System32\wins\*.mdb

Certificate Services files

%SystemRoot%\System32\catroot2\*.edb

%SystemRoot%\System32\catroot2\*.chk

%SystemRoot%\System32\catroot2\*.log

%SystemRoot%\System32\catroot2\*.jrs

TS/RDS Licensing files

%SystemRoot%\System32\lserver\*.chk

%SystemRoot%\System32\lserver\*.edb

%SystemRoot%\System32\lserver\*.log

%SystemRoot%\System32\lserver\*.tmp

%SystemRoot%\System32\lserver\*.jrs

Print Server files

%SystemRoot%\System32\spool\PRINTERS\*.SHD

%SystemRoot%\System32\spool\PRINTERS\*.SPL

%SystemRoot%\IIS Temporary Compressed Files
%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files
%SystemDrive%\inetpub\logs
%SystemRoot%\System32\LogFiles
%SystemRoot%\SysWow64\LogFiles
%SystemRoot%\system32\inetsrv\w3wp.exe
%SystemRoot%\SysWOW64\inetsrv\w3wp.exe

%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files
%SystemRoot%\IIS Temporary Compressed Files
%SystemRoot%\System32\Inetsrv
%SystemDrive%\inetpub\logs
%Winnt%\Cluster
%SystemRoot%\Cluster
%SystemDrive%\DAGFileShareWitnesses
%windir%\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files
%windir%\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files

.config
.dia
.wsb
.chk
.log
.edb

.stm
.jrs

.jsl
.que
.lzx
.ci
.wid
.dir
.000
.001
.002
.cfg
.grxml

.dsc
.txt
.bin
.xml

Cdb.exe
Cidaemon.exe
Cluster.exe
Clussvc.exe

ComplianceAuditService.exe
%ExchangeInstallPath%Bin\ComplianceAuditService.exe
Dsamain.exe
%SystemRoot%\System32\Dsamain.exe
EdgeCredentialSvc.exe
Microsoft.Exchange.EdgeCredentialSvc.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.EdgeCredentialSvc.exe
EdgeTransport.exe
%ExchangeInstallPath%Bin\EdgeTransport.exe
ExFBA.exe
GalGrammarGenerator.exe
Inetinfo.exe
%SystemRoot%\System32\inetsrv\inetinfo.exe
W3wp.exe
%SystemRoot%\System32\inetsrv\W3wp.exe
Emsmta.exe
Mssearch.exe
Mad.exe
Microsoft.Exchange.AddressBook.Service.exe
Microsoft.Exchange.AntispamUpdateSvc.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.AntispamUpdateSvc.exe
Microsoft.Exchange.ContentFilter.Wrapper.exe
%ExchangeInstallPath%TransportRoles\agents\Hygiene\Microsoft.Exchange.ContentFilter.Wrapper.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Diagnostics.Service.exe
Microsoft.Exchange.Cluster.Replayservice.exe
Microsoft.Exchange.EdgeSyncSvc.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.EdgeSyncSvc.exe
Microsoft.Exchange.Imap4.exe
%ExchangeInstallPath%FrontEnd\PopImap\Microsoft.Exchange.Imap4.exe
Microsoft.Exchange.Imap4service.exe
%ExchangeInstallPath%ClientAccess\PopImap\Microsoft.Exchange.Imap4service.exe
Microsoft.Exchange.Infoworker.Assistants.exe
Microsoft.Exchange.Monitoring.exe
Microsoft.Exchange.Notifications.Broker.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Notifications.Broker.exe
Microsoft.Exchange.Pop3.exe
%ExchangeInstallPath%FrontEnd\PopImap\Microsoft.Exchange.Pop3.exe
Microsoft.Exchange.Pop3service.exe
%ExchangeInstallPath%ClientAccess\PopImap\Microsoft.Exchange.Pop3service.exe
Microsoft.Exchange.ProtectedServiceHost.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.ProtectedServiceHost.exe
Microsoft.Exchange.RPCClientAccess.Service.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.RPCClientAccess.Service.exe
Microsoft.Exchange.Search.Exsearch.exe
Microsoft.Exchange.Search.Service.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Search.Service.exe
Microsoft.Exchange.Servicehost.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Servicehost.exe
MSExchangeADTopologyService.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Directory.TopologyService.exe
MSExchangeFDS.exe
MSExchangeMailboxAssistants.exe
%ExchangeInstallPath%Bin\MSExchangeMailboxAssistants.exe
MSExchangeMailboxReplication.exe
%ExchangeInstallPath%Bin\MSExchangeMailboxReplication.exe
MSExchangeMigrationWorkflow.exe
%ExchangeInstallPath%Bin\MSExchangeMigrationWorkflow.exe
MSExchangeMailSubmission.exe
%ExchangeInstallPath%Bin\MSExchangeSubmission.exe
MSExchangeRepl.exe
%ExchangeInstallPath%Bin\MSExchangeRepl.exe
MSExchangeTransport.exe
%ExchangeInstallPath%Bin\MSExchangeTransport.exe
MSExchangeTransportLogSearch.exe
%ExchangeInstallPath%Bin\MSExchangeTransportLogSearch.exe
MSExchangeThrottling.exe
%ExchangeInstallPath%Bin\MSExchangeThrottling.exe
Msftefd.exe
Msftesql.exe
Noderunner.exe
%ExchangeInstallPath%Bin\Search\Ceres\Runtime\1.0\Noderunner.exe
OleConverter.exe
%ExchangeInstallPath%Bin\OleConverter.exe
ParserServer.exe
%ExchangeInstallPath%Bin\Search\Ceres\ParserServer\ParserServer.exe
Powershell.exe
%SystemRoot%\System32\WindowsPowerShell\v1.0\Powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
SESWorker.exe
SpeechService.exe
Store.exe
Microsoft.Exchange.Store.Service.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Store.Service.exe
Microsoft.Exchange.Store.Worker.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Store.Worker.exe
TranscodingService.exe
%ExchangeInstallPath%ClientAccess\Owa\Bin\DocumentViewing\TranscodingService.exe
UmService.exe
%ExchangeInstallPath%Bin\UmService.exe
UmWorkerProcess.exe
%ExchangeInstallPath%Bin\UmWorkerProcess.exe
Microsoft.Exchange.UM.CallRouter.exe
%ExchangeInstallPath%FrontEnd\CallRouter\Microsoft.Exchange.UM.CallRouter.exe
%ExchangeInstallPath%FIP-FS\Bin\fms.exe
%ExchangeInstallPath%Bin\Search\Ceres\HostController\hostcontrollerservice.exe
MSExchangeDagMgmt.exe
%ExchangeInstallPath%Bin\MSExchangeDagMgmt.exe
MSExchangeDelivery.exe
%ExchangeInstallPath%Bin\MSExchangeDelivery.exe
MSExchangeFrontendTransport.exe
%ExchangeInstallPath%Bin\MSExchangeFrontendTransport.exe
MSExchangeHMHost.exe
%ExchangeInstallPath%Bin\MSExchangeHMHost.exe
MSExchangeHMWorker.exe
%ExchangeInstallPath%Bin\MSExchangeHMWorker.exe
ScanEngineTest.exe
%ExchangeInstallPath%FIP-FS\Bin\ScanEngineTest.exe
ScanningProcess.exe
%ExchangeInstallPath%FIP-FS\Bin\ScanningProcess.exe
UpdateService.exe
%ExchangeInstallPath%FIP-FS\Bin\UpdateService.exe
MSExchangeCompliance.exe
%ExchangeInstallPath%Bin\MSExchangeCompliance.exe
wsbexchange.exe
%ExchangeInstallPath%Bin\wsbexchange.exe

C:\Program Files\Exchsrvr\Mtadata
C:\Program Files\Exchsrvr\Mtadata\*.mta
C:\Program Files\Exchsrvr\*.log
C:\Program Files\Exchsrvr\Mailroot
C:\Program Files\Exchsrvr\Srsdata
C:\Program Files\Exchsrvr\IMCData
C:\Program Files\Exchsrvr\MDBData
C:\Program Files\Exchsrvr\Address
C:\Program Files\Exchsrvr\Bin
C:\Program Files\Exchsrvr\Exchweb
C:\Program Files\Exchsrvr\Res
C:\Program Files\Exchsrvr\Schema
C:\Program Files\Exchsrvr\Conndata

%ProgramFiles%\Microsoft\Exchange Server\Mailbox
%ProgramFiles%\Microsoft\Exchange Server\Mailbox\MDBTEMP
%ProgramFiles%\Microsoft\Exchange Server\TransportRoles

%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\Logs

%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\Pickup
%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\Replay
%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\Data\Queue
%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\SenderReputation
%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\IpFilter

%ProgramFiles%\Microsoft\Exchange Server\Logging
%ProgramFiles%\Microsoft\Exchange Server\ExchangeOAB
%ProgramFiles%\Microsoft\Exchange Server\Working\OleConverter

%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\Data\Adam

%ProgramFiles%\Microsoft\Exchange Server\ClientAccess

%ProgramFiles%\Microsoft\Exchange Server\UnifiedMessaging\grammars
%ProgramFiles%\Microsoft\Exchange Server\UnifiedMessaging\Prompts
%ProgramFiles%\Microsoft\Exchange Server\UnifiedMessaging\voicemail
%ProgramFiles%\Microsoft\Exchange Server\UnifiedMessaging\badvoicemail

%ExchangeInstallPath%Mailbox
%ExchangeInstallPath%Mailbox\MDBTEMP

%ExchangeInstallPath%GroupMetrics
%ExchangeInstallPath%TransportRoles\Logs
%ExchangeInstallPath%TransportRoles\Logs\Mailbox
%ExchangeInstallPath%TransportRoles\Logs\FrontEnd

%ExchangeInstallPath%TransportRoles\Pickup
%ExchangeInstallPath%TransportRoles\Replay
%ExchangeInstallPath%TransportRoles\Data\Queue
%ExchangeInstallPath%TransportRoles\Data\SenderReputation
%ExchangeInstallPath%TransportRoles\Data\IpFilter
%ExchangeInstallPath%TransportRoles\Data\Temp
%ExchangeInstallPath%TransportRoles\Data\Adam
%ExchangeInstallPath%ClientAccess
%ExchangeInstallPath%ClientAccess\OAB
%ExchangeInstallPath%ExchangeOAB
%ExchangeInstallPath%Working\OleConvertor
%ExchangeInstallPath%Logging
%ExchangeInstallPath%Logging\POP3
%ExchangeInstallPath%Logging\IMAP4
%ExchangeInstallPath%UnifiedMessaging\grammars
%ExchangeInstallPath%UnifiedMessaging\Prompts
%ExchangeInstallPath%UnifiedMessaging\voicemail
%ExchangeInstallPath%UnifiedMessaging\temp
%ExchangeInstallPath%FIP-FS
%SystemRoot%\Temp\ExchangeSetup
%SystemRoot%\Temp\OICE_*

%ProgramFiles(x86)%\Microsoft Forefront Protection for Exchange Server

%ProgramFiles(x86)%\Microsoft Forefront Protection for Exchange Server\Data\Archive

%ProgramFiles(x86)%\Microsoft Forefront Protection for Exchange Server\Data\Quarantine
%ProgramFiles(x86)%\Microsoft Forefront Protection for Exchange Server\Data\Engines\x86

%ProgramFiles(x86)%\Microsoft Forefront Protection for Exchange Server\Data\Engines\amd64

%ProgramFiles(x86)%\Microsoft Forefront Protection for Exchange Server\Data

Adonavsvc.exe
FscController.exe
FscDiag.exe
FscExec.exe
FscImc.exe
FscManualScanner.exe
FscMonitor.exe
FscRealtimeScanner.exe
FscStarter.exe
FscStatsServ.exe
FscTransportScanner.exe
FscUtility.exe
FsEmailPickup.exe
FssaClient.exe
GetEngineFiles.exe
PerfmonitorSetup.exe
ScanEngineTest.exe
SemSetup.exe

FSCConfigurationServer.exe
FSCEventing.exe
FSCScheduledScanner.exe
MultiEngineScanner.exe
Kavehost.exe
FSCVSSWriter.exe

.avc
.cab
.cfg
.config
.da1
.dat
.def
.dt
.fdb
.fdm
.ide
.key
.klb
.kli
.lst
.mdb
.ppl
.set
.v3d
.vdb
.vdm

ABServer.exe
AcpMcuSvc.exe
ASMCUSvc.exe
AVMCUSvc.exe
ChannelService.exe
ClsAgent.exe
ComplianceService.exe
DataMCUSvc.exe
DataProxy.exe
FileTransferAgent.exe
HealthAgent.exe
IMMCUSvc.exe
LysSvc.exe
MasterReplicatorAgent.exe
MediaRelaySvc.exe
MediationServerSvc.exe
MRASSvc.exe
OcsAppServerHost.exe
ReplicaReplicatorAgent.exe
ReplicationApp.exe
RtcHost.exe
RTCSrv.exe
XmppProxy.exe
XmppTGW.exe
Fabric.exe
FabricDCA.exe
FabricHost.exe

%SystemRoot%\System32\LogFiles
%SystemRoot%\SysWow64\LogFiles
%SystemRoot%\Microsoft.NET\assembly\GAC_MSIL
%ProgramFiles%\Skype for Business Server 2015
%ProgramFiles%\Common Files\Skype for Business Server 2015\Watcher Node
%ProgramFiles%\Common Files\Skype for Business Server 2015
%ProgramFiles%\Common Files\Skype for Business Online
%SystemDrive%\RtcReplicaRoot

%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions
%SystemDrive%\inetpub\wwwroot\wss\VirtualDirectories
%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files
%ProgramData%\Microsoft\SharePoint
%ProgramData%\Microsoft\SharePoint\Config
%SystemDrive%\Documents and Settings\All Users\Application Data\Microsoft\SharePoint\Config
%SystemRoot%\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files
%SystemRoot%\Microsoft.NET\Framework64\v2.0.50727\Config
%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files
%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\Config
%SystemRoot%\System32\LogFiles
%SystemRoot%\Syswow64\LogFiles
%SystemRoot%\Temp\WebTempDir
%SystemRoot%\Temp\FrontPageTempDir
%SystemDrive%\Users\Default\AppData\Local\Temp
%SystemDrive%\Documents and Settings\Default User\Local Settings\Temp
%SystemDrive%\Users\<ServiceAccount>\Local
%SystemDrive%\Users\<ServiceAccount>\Local\Temp
%SystemDrive%\Documents and Settings\<ServiceAccount>\Local Settings\Application Data
%SystemDrive%\Users\<ServiceAccount>\AppData\Local\Temp
%SystemDrive%\Users\<ServiceAccount>\AppData\Local\Temp\WebTempDir
%SystemDrive%\Users\<account that the search service is running as>\AppData\Local\Temp
%SystemDrive%\Documents and Settings\<account that the search service is running as>\Local Settings\Temp

%ProgramFiles%\SharePoint Portal Server
%ProgramFiles%\Common Files\Microsoft Shared\Web Storage System

%ProgramFiles%\Microsoft Office Servers\12.0\Data
%ProgramFiles%\Microsoft Office Servers\12.0\Logs
%ProgramFiles%\Microsoft Office Servers\12.0\Bin
%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\12\Logs
%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\12\Data\Applications

%ProgramFiles%\Microsoft Office Servers\14.0\Data
%ProgramFiles%\Microsoft Office Servers\14.0\Logs
%ProgramFiles%\Microsoft Office Servers\14.0\Bin
%ProgramFiles%\Microsoft Office Servers\14.0\Synchronization Service
%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\14\Logs
%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\14\Data\Applications

%ProgramFiles%\Microsoft Office Servers\15.0\Data
%ProgramFiles%\Microsoft Office Servers\15.0\Logs
%ProgramFiles%\Microsoft Office Servers\15.0\Bin
%ProgramFiles%\Microsoft Office Servers\15.0\Synchronization Service
%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\15\Logs
%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\15\Data\Applications

%ProgramFiles%\Microsoft ISA Server
%ProgramFiles%\Microsoft ISA Server\ISALogs
%ProgramFiles%\Microsoft SQL Server
%ProgramFiles(x86)%\Microsoft ISA Server
%ProgramFiles(x86)%\Microsoft SQL Server
%SystemRoot%\Temp\ScanStorage
%ProgramFiles(x86)%\Microsoft ISA Server\Logs
D:\urlcache
%SystemDrive%\InetPub

dsamain.exe
%WinDir%\System32\dsamain.exe

dailysum.exe

%ProgramFiles%\Microsoft ISA Server\dailysum.exe
%ProgramFiles(x86)%\Microsoft ISA Server\dailysum.exe
repgen.exe
%ProgramFiles%\Microsoft ISA Server\repgen.exe
isarepgen.exe
%ProgramFiles%\Microsoft ISA Server\isarepgen.exe
%ProgramFiles(x86)%\Microsoft ISA Server\isarepgen.exe

isadlviewer.exe
%ProgramFiles%\Microsoft ISA Server\isadlviewer.exe
%ProgramFiles(x86)%\Microsoft ISA Server\isadlviewer.exe
wspsrv.exe
%ProgramFiles%\Microsoft ISA Server\wspsrv.exe
%ProgramFiles(x86)%\Microsoft ISA Server\wspsrv.exe
mspadmin.exe
%ProgramFiles%\Microsoft ISA Server\mspadmin.exe
%ProgramFiles(x86)%\Microsoft ISA Server\mspadmin.exe
isastg.exe
%ProgramFiles%\Microsoft ISA Server\isastg.exe
%ProgramFiles(x86)%\Microsoft ISA Server\isastg.exe
w3prefch.exe
%ProgramFiles%\Microsoft ISA Server\w3prefch.exe
%ProgramFiles(x86)%\Microsoft ISA Server\w3prefch.exe
sqlsvr.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL$MSFW\sqlservr.exe
%ProgramFiles(x86)%\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
%ProgramFiles(x86)%\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe

sqlmangr.exe

%ProgramFiles%\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
sqlwriter.exe
%ProgramFiles(x86)%\Microsoft SQL Server\90\Shared\sqlwriter.exe
%WinDir%\System32\inetsrv\inetinfo.exe
%WinDir%\System32\inetsrv\w3wp.exe

%ProgramFiles%\Microsoft Forefront Threat Management Gateway
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\Logs
%ProgramFiles%\Microsoft Forefront Unified Access Gateway
%ProgramFiles%\Microsoft SQL Server\MSSQL10.ISARS
%ProgramFiles%\Microsoft SQL Server\MSSQL10.MSFW
%SystemRoot%\Temp\ScanStorage
D:\urlcache (каталог файлов веб-кеша TMG может располагаться в другом месте)

dailysum.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\dailysum.exe
isarepgen.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\isarepgen.exe
isadlviewer.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\isadlviewer.exe
IsaManagedCtrl.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\IsaManagedCtrl.exe
isastg.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\isastg.exe
mspadmin.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\mspadmin.exe
wspsrv.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\wspsrv.exe
w3prefch.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\w3prefch.exe
DnsAlgSrv.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\DnsAlgSrv.exe
MonitorMgrCom.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\MonitorMgrCom.exe
SessionMgrCom.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\SessionMgrCom.exe
ShareAccess.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\ShareAccess.exe
uagqessvc.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\uagqessvc.exe
uagrdpsvc.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\uagrdpsvc.exe
UserMgrCom.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\UserMgrCom.exe
WatchDogSrv.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\WatchDogSrv.exe
whlerrsrv.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\whlerrsrv.exe
whlios.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\whlios.exe
sqlservr.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL10.ISARS\MSSQL\Binn\sqlservr.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL10.MSFW\MSSQL\Binn\sqlservr.exe
ReportingServicesService.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL10.ISARS\MSSQL\Binn\ReportingServicesService.exe
dsamain.exe
%WinDir%\System32\dsamain.exe

IsaApplianceInit.exe
IsaMgmt.exe
MsFpcSqmAgent.exe
NicsRestorer.exe
NLBClear.exe
UpdateAgent.exe
VpnHelpr.exe
tmgpolicysuite.exe
tmgbpacmd.exe
tmgbpa.exe
bpa2visio.exe
tmgbpapack.exe
tmgdatapackager.exe

TMG cache files

.cdat

SQLServr.exe
ReportingServicesService.exe
MSMDSrv.exe

.mdf
.ldf
.ndf
.bak
.trn
.trc
.sqlaudit
.sql

%ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL.2\OLAP\Bin\MSMDSrv.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\Bin\ReportingServicesService.exe

%ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\Data
%ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\FTData
%ProgramFiles%\Microsoft SQL Server\MSSQL.2\OLAP\Log
%ProgramFiles%\Microsoft SQL Server\MSSQL.2\OLAP\Backup
%ProgramFiles%\Microsoft SQL Server\MSSQL.2\OLAP\Data

%ProgramFiles%\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\Bin\MSMDSrv.exe
%ProgramFiles%\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\Bin\ReportingServicesService.exe

%ProgramFiles%\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Data
%ProgramFiles%\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\FTData
%ProgramFiles%\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\Log
%ProgramFiles%\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\Backup
%ProgramFiles%\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\Data

%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSAS10_50.MSSQLSERVER\OLAP\Bin\MSMDSrv.exe
%ProgramFiles%\Microsoft SQL Server\MSRS10_50.MSSQLSERVER\Reporting Services\ReportServer\Bin\ReportingServicesService.exe

%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Data
%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\FTData
%ProgramFiles%\Microsoft SQL Server\MSAS10_50.MSSQLSERVER\OLAP\Log
%ProgramFiles%\Microsoft SQL Server\MSAS10_50.MSSQLSERVER\OLAP\Backup
%ProgramFiles%\Microsoft SQL Server\MSAS10_50.MSSQLSERVER\OLAP\Data

%ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSAS11.MSSQLSERVER\OLAP\Bin\MSMDSrv.exe
%ProgramFiles%\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\ReportServer\Bin\ReportingServicesService.exe

%ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Data
%ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\FTData
%ProgramFiles%\Microsoft SQL Server\MSAS11.MSSQLSERVER\OLAP\Log
%ProgramFiles%\Microsoft SQL Server\MSAS11.MSSQLSERVER\OLAP\Backup
%ProgramFiles%\Microsoft SQL Server\MSAS11.MSSQLSERVER\OLAP\Data

%ProgramFiles%\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSAS12.MSSQLSERVER\OLAP\Bin\MSMDSrv.exe
%ProgramFiles%\Microsoft SQL Server\MSRS12.MSSQLSERVER\Reporting Services\ReportServer\Bin\ReportingServicesService.exe

%ProgramFiles%\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\Data
%ProgramFiles%\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\FTData
%ProgramFiles%\Microsoft SQL Server\MSAS12.MSSQLSERVER\OLAP\Log
%ProgramFiles%\Microsoft SQL Server\MSAS12.MSSQLSERVER\OLAP\Backup
%ProgramFiles%\Microsoft SQL Server\MSAS12.MSSQLSERVER\OLAP\Data

%ProgramFiles%\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSAS13.MSSQLSERVER\OLAP\Bin\MSMDSrv.exe
%ProgramFiles%\Microsoft SQL Server\MSRS13.MSSQLSERVER\Reporting Services\ReportServer\Bin\ReportingServicesService.exe

%ProgramFiles%\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\Data
%ProgramFiles%\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\FTData
%ProgramFiles%\Microsoft SQL Server\MSAS13.MSSQLSERVER\OLAP\Log
%ProgramFiles%\Microsoft SQL Server\MSAS13.MSSQLSERVER\OLAP\Backup
%ProgramFiles%\Microsoft SQL Server\MSAS13.MSSQLSERVER\OLAP\Data

Oracle databases files

*.ora

*.ctl

Firebird, dBase, etc files

*.dbf
*.cdx
*.fdb
*.edb
*.ib
*.gdi
*.gdb

SCVMM Common

Processes

vmmAgent.exe
vmmservice.exe

SCVMM Agent 2008 R2

%ProgramFiles%\Microsoft System Center Virtual Machine Manager 2008 R2\bin\vmmAgent.exe

SCVMM Agent 2012

SCVMM Server 2012

SCVMM Agent 2012 R2

SCVMM Server 2012 R2

%WinDir%\Microsoft.net\Framework\v2.0.50727\csc.exe
%WinDir%\Microsoft.net\Framework\v4.0.30319\csc.exe
dpmra.exe

%ProgramFiles%\Microsoft Data Protection Manager\DPM\bin\dpmra.exe

System Center 2007-2010
DPM  Server Files

%ProgramFiles%\Microsoft DPM\DPM\XSD
%ProgramFiles%\Microsoft DPM\DPM\Temp\MTA
%ProgramFiles%\Microsoft DPM\DPM\Volumes
%ProgramFiles%\Microsoft DPM\DPM\bin\dpmra.exe

System Center 2012
DPM Server Files

%ProgramFiles%\Microsoft System Center 2012\DPM\DPM\XSD

%ProgramFiles%\Microsoft System Center 2012\DPM\DPM\Temp\MTA
%ProgramFiles%\Microsoft System Center 2012\DPM\DPM\Volumes
%ProgramFiles%\Microsoft System Center 2012\DPM\DPM\bin\dpmra.exe

System Center 2012 R2
DPM Server Files

%ProgramFiles%\Microsoft System Center 2012 R2\DPM\DPM\XSD

%ProgramFiles%\Microsoft System Center 2012 R2\DPM\DPM\Temp\MTA
%ProgramFiles%\Microsoft System Center 2012 R2\DPM\DPM\Volumes
%ProgramFiles%\Microsoft System Center 2012 R2\DPM\DPM\bin\dpmra.exe

System Center 2016
DPM Server Files

%ProgramFiles%\Microsoft System Center 2016\DPM\DPM\XSD

%ProgramFiles%\Microsoft System Center 2016\DPM\DPM\Temp
%ProgramFiles%\Microsoft System Center 2016\DPM\DPM\Volumes
%ProgramFiles%\Microsoft System Center 2016\DPM\DPM\bin\dpmra.exe
Drive letter of Modern Backup Storage volume
%ProgramFiles%\Microsoft Azure Recovery Services Agent\
%ProgramFiles%\Microsoft Azure Recovery Services Agent\bin\cbengine.exe

SCOM 2005 – 2012 R2 Common File Name Extensions

.chk
.log
.edb
.WKF
.PQF
.PQF0
.PQF1

MomHost.exe
MonitoringHost.exe
HealthService.exe
CShost.exe
Microsoft.Mom.Sdk.ServiceHost.exe

%ProgramFiles%\System Center Operations Manager 2007\HealthService.exe
%ProgramFiles%\System Center Operations Manager 2007\Microsoft.Mom.ConfigServiceHost.exe
%ProgramFiles%\System Center Operations Manager 2007\MonitoringHost.exe

%ProgramFiles%\System Center Operations Manager 2007\Health Service State

%ProgramFiles%\System Center 2012\Operations Manager\Server\monitoringhost.exe
%ProgramFiles%\System Center Operations Manager 2012\Server\monitoringhost.exe

%ProgramFiles%\System Center Operations Manager\Agent\monitoringhost.exe

%ProgramFiles%\System Center 2012\Operations Manager\Server\Health Service State
%ProgramFiles%\System Center Operations Manager 2012\Server\Health Service State

%ProgramFiles%\System Center Operations Manager\Agent\Health Service State

%ProgramFiles%\System Center 2012\Operations Manager\Server\monitoringhost.exe

%ProgramFiles%\System Center Operations Manager\Agent\monitoringhost.exe

%ProgramFiles%\Microsoft System Center 2012 R2\Operations Manager\Server\Health Service State
%ProgramFiles%\System Center Operations Manager\Gateway\

\Health Service State

%ProgramFiles%\Microsoft Monitoring Agent\Agent\Health Service State

%ProgramFiles%\Microsoft Configuration Manager\Install.map
%ProgramFiles%\Microsoft Configuration Manager\inboxes
%ProgramFiles%\Microsoft Configuration Manager\Logs
%ProgramFiles%\SMS_CCM\ServiceData
%ProgramFiles(x86)%\Microsoft Configuration Manager\inboxes
%ProgramFiles(x86)%\Microsoft Configuration Manager\Logs
%ProgramFiles(x86)%\SMS_CCM\ServiceData
%SystemDrive%\SMSPKG
<DriveLetter>:\SMS_CCM\ServiceData
<DriveLetter>:\SMSSIG$
<DriveLetter>:\SMSPKGSIG
<DriveLetter>:\SMSPKG
<DriveLetter>:\SMSPKG<DriveLetter>$
<DriveLetter>:\SCCMContentLib
%SMS_LOG_PATH%
%SMS_ADMIN_UI_PATH%

%SystemRoot%\System32\CCM\Cache
%SystemRoot%\ccmcache
%SystemRoot%\CCM\Logs

Smsexec.exe
Ccmexec.exe
CmRcService.exe
Sitecomp.exe
Smswriter.exe
Smssqlbkup.exe

%PUBLIC%\Documents\Hyper-V\Virtual Hard Disks
%ProgramData%\Microsoft\Windows\Hyper-V
%ProgramData%\Microsoft\Windows\Hyper-V\Snapshots
%SystemDrive%\ClusterStorage

Hyper-V Processes

%SystemRoot%\system32\vmwp.exe
%SystemRoot%\system32\vmms.exe
%SystemRoot%\system32\vmicsvc.exe

Hyper-V File

File Name Extensions

.xml
.vhdx
.vhd
.vfd
.avhd
.avhdx

.iso
.vsv
.bin

%USERPROFILE%\Application Data\SoftGrid Client
%ALLUSERSPROFILE%\Application Data\Microsoft\Application Virtualization Client
%ALLUSERSPROFILE%\Documents\SoftGrid Client

%USERPROFILE%\AppData\Local\SoftGrid Client
%USERPROFILE%\AppData\Roaming\SoftGrid Client
%ProgramData%\Microsoft\Application Virtualization Client\SoftGrid Client
%ProgramData%\Microsoft\AppV\Client\
%USERPROFILE%\AppData\Local\Microsoft\AppV\Client\