Guidelines for choosing antivirus software to run on the computers that are running SQL Server (309422)


The information in this article applies to:

  • Microsoft SQL Server 7.0
  • Microsoft SQL Server 2000 Developer Edition
  • Microsoft SQL Server 2000 Developer Edition 64 bit
  • Microsoft SQL Server 2000 Enterprise Edition
  • Microsoft SQL Server 2000 Enterprise Edition 64-bit
  • Microsoft SQL Server 2000 Enterprise Evaluation Edition
  • Microsoft SQL Server 2000 Personal Edition
  • Microsoft SQL Server 2000 Standard Edition
  • Microsoft SQL Server 2005 Standard Edition
  • Microsoft SQL Server 2005 Developer Edition
  • Microsoft SQL Server 2005 Enterprise Edition
  • Microsoft SQL Server 2005 Express Edition
  • Microsoft SQL Server 2005 Workgroup
This article was previously published under Q309422

SUMMARY

This article provides general guidelines to help you decide which type of antivirus software to run on the computers that are running SQL Server in your environment.

MORE INFORMATION

Microsoft strongly recommends that you individually assess the security risk for each computer that is running SQL Server in your environment and that you select the tools that are appropriate for the security risk level of each computer that is running SQL Server. Additionally, Microsoft recommends that before you roll out any virus protection project, test the whole system under a full load to measure any changes to stability and performance.

Virus protection software requires some system resources to execute. You must perform testing before and after you install your antivirus software to determine if there is performance impact to the computer that is running SQL Server.

Security risk factors

  • The value to your business of the information that is stored on the computer.
  • The required security level for that information.
  • The cost of losing access to that information.
  • The risk of either virus or bad information propagating from that computer.

High-risk servers

Any server is at some risk of infection. The highest risk servers generally meet one or more of the following criteria:
  • The servers are on the public Internet.
  • The servers have open ports to servers that are not behind a firewall.
  • The servers read or execute files from other servers.
  • The servers run HTTP servers, such as Microsoft Internet Information Services (IIS) or Apache. (For example: SQL XML for SQL Server 2000.)
  • The servers are also hosting file shares.
  • The servers use SQL Mail to handle inbound or outbound e-mail messages.
Servers that do not meet the criteria for a high-risk server are generally at a lower risk, although not always.

Virus tool types

  • Active virus scanning: This type of scanning checks incoming and outgoing files for viruses.
  • Virus sweep software: Virus sweep software scans existing files for file infection. It detects files after they are infected with a virus. This type of scanning may cause the following SQL Server database recovery and SQL Server full-text catalog file issues:
    • If the virus sweep has opened a database file and still has it open when SQL Server tries to open the database (such as when SQL Server starts or when SQL Server opens a database that AutoClose has closed), the database to which the file belongs might be marked suspect. The SQL Server database files typically have the .mdf, .ldf, and .ndf file suffixes.
    • If the virus sweep software has a SQL Server full-text catalog file open when the Microsoft Search service (MSSearch) tries to access the file, you may experience problems with the full text catalog.
  • Vulnerability scanning software: The Microsoft Security Tool Kit CD includes best practice guidelines, information about securing your system, and service packs and patches that can protect your system against virus attacks. It also provides Microsoft tools to help you secure your systems and keep them secure. To download it, visit the following Microsoft Web site:

    http://www.microsoft.com/security/

  • Antispyware software: Spyware and unwanted software refers to software that performs certain tasks on your computer, typically without your consent. For more information about how to help protect the computer from spyware and unwanted software, visit the following Microsoft Web site:

    http://www.microsoft.com/athome/security/spyware/default.mspx

    Additionally, Microsoft has released the Microsoft Windows Malicious Software Removal Tool to help remove specific, prevalent malicious software from computers that are running Microsoft Windows Server 2003, Microsoft Windows XP, or Microsoft Windows 2000. For more information about the Microsoft Windows Malicious Software Removal Tool, click the following article number to view the article in the Microsoft Knowledge Base:

    890830 The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000

Considerations for clustering

You can run antivirus software on a SQL Server cluster, but you must make sure that the antivirus software is a cluster-aware version. Contact your antivirus vendor about cluster-aware versions and interoperability.

If you are running antivirus software on a cluster, make sure that you exclude these locations from virus scanning:
  • Q:\ (Quorum drive)
  • c:\Windows\Cluster
  • SQL Server data files that have the .mdf extension, the .ldf extension, and the .ndf extension

REFERENCES

For updated security related information, Microsoft recommends that you subscribe to the security alert alias. To subscribe, visit the following Microsoft Web site, and then view the Security Bulletins section:

http://www.microsoft.com/security/

To find general information regarding SQL Server security, including best practices, various security models, and security bulletins, visit the following Microsoft Web site:

http://www.microsoft.com/sql/techinfo/administration/2000/security/default.asp

For more information about additional antivirus considerations on a cluster, click the following article number to view the article in the Microsoft Knowledge Base:

250355 Antivirus software may cause problems with Cluster services

Modification Type:MajorLast Reviewed:4/7/2006
Keywords:kbsql2005cluster kbinfo KB309422 kbAudITPRO kbAudDeveloper
©2004 Microsoft Corporation. All rights reserved.