the average antivirus soft will just do fine:
from my experience I exclude the folders which contain database files, transaction logs, snapshot files, or other similar files that are unlikely to be infected (and which would entail significant performance penalties if frequently scanned)
//Bart