Yes, I have read:
What files and directories should I exclude from antivirus protection to ensure adequate file access for Orion products?
It states NOT TO EXCLUDE EXECUTABLE FILES, but then goes ahead and states to exclude all files (including executables) from
c:\Documents and Settings\All Users\Application Data\SolarWinds\c:\Program Files\SolarWinds\
The above would only work for scheduled or sequential Antivirus scan of the hard drive. Also for excluding all scanning form the directory allows to a virus (or root-kit) to reside in the directory.
For correct Antivirus implementation following industry best practices, Real-time or OnAccess, or memory resident (scanning on each disk I/O request to the OS) scanning must be enabled. Both Microsoft and McAfee both discourage file/folder exclusions. Processes (EXE) and sub process and child processes will need to be classified or grouped, then any exclusions applied to that classification of groups explained in
McAfee KB55139: Understanding High-Risk, Low-Risk, and Default processes configuration and usage kc.mcafee.com/.../index
For example, with memory resident scanning enabled classifying the Orion NPM/APM process (EXE) as say Low-Risk will do the following:
On start-up, the system or explorer.exe would start an Orion application binary (EXE), it would be scanned. Once the application binary (EXE) is loaded, exclusions fall into the Low-Risk grouping classifications exclusion lists (either excluding Read or Write scanning or exclude scanning in identified file/directory). If the Low-Risk classified application binary (EXE) calls for a separate EXE to load it would need also classified as "Low-risk" to receive the same treatment, otherwise any disk I/O request could be scanned.
