Exclude folders from antivirus scanning for AVEVA Enterprise SCADA

This is a quick reference list of common folders you will need to exclude from antivirus scanning on an AVEVA Enterprise SCADA system based on specific use cases of the product. Exclusions are required for both realtime/on-access scanning and scheduled daily/weekly scans. Customer-specific applications that layer on top of AVEVA Enterprise SCADA are not specifically covered, such as PI or Skelta. Additional fine-tuning and review will be necessary during project deployment and integration.

Some antivirus applications may detect the files with certain extensions on their first scan of the AVEVA Enterprise SCADA environment as trusted files, such as .exe, .dll, .tmp, .ps1, and .vbs. In this case, the folder where these identified files are stored does not need to be excluded explicitly. It may also prevent the deletion of any binary or script file extension it identifies as a threat. In order to delete extensions identified as threats in SCADA systems, the folder where the file is stored needs to be excluded, along with the Recycle Bin. A workaround to avoid excluding the Recycle Bin is to completely remove the files from the system using Shift + Delete instead of sending them to the Recycle Bin.

For AVEVA Enterprise SCADA, the installation-related files are located under %DNAInstallRoot%\<Product Component Name> (for example, C:\Program Files\AVEVA\DNA\ADE).

Once the installation finishes, any data-related files, including database files and displays, product licenses, customized files, project-specific extensions and layered applications should be located under %DNADataRoot%\<Product Component Name>. In general, the folders under %DNADataRoot% should be added to the exclusions, depending on the installed AVEVA Enterprise SCADA products on the machine. The examples are shown as follows:

• %DNADataRoot%\Shared\temp\cscscripts

• %DNADataRoot%\<product silo>\Mapdir

• %DNADataRoot%\<product silo>\scripts

• %DNADataRoot%\<product silo>\Config

• %DNADataRoot%\<product silo>\bin

• %DNADataRoot%\<product silo>\Log

• %DNADataRoot%\RealTime\database

  Note: Depending on the products installed on the computer, any application development or administrative work done by the customer will write or update files under %DNADataRoot%\<product silo>. If you have any such product suites installed, you may need to add additional folders to the exclusion list.

• <DNAInstallRoot>\Shared\Scripts

• <DNAInstallRoot>\<product silo>\Scripts

• %DNAInstallRoot%\Realtime\database

• C:\Users\<user>\AppData\Local\AVEVA\DNA\ezXOS\<version no.>\db\edit\scripting

• The drive path to the device of SCADA Archive service.

• SQL database exclusions:

  • Exclude by filetype: *.MDF; *.LDF; *.NDF; *.BAK; *.TRN

  • Alternately, exclude the specific drive path where each database is located. For example:

    • <drive letter>:\XISData\XISDisk[1,2,3,4 etc]\MSSQL\*.mdf, *.ldf, *.ndf, *.bak, *.trn

    • Special considerations may exist for databases which exist on clustered storage and Storage Area Networks (SANs). Some antivirus applications will not accept drive letters for network storage exclusions.