How Antivirus Scan Works

During the restore session, antivirus scan works in the following way:

1. On the mount server, Veeam Backup & Replication runs the Veeam Mount Service to perform the following steps:

1. Mount machine disks from backups to the mount server under the C:\VeeamFLR\<machinename> folder.
2. Initiate a new scan session.

2. If the antivirus does not detect malware activity, Veeam Backup & Replication will restore the machine to the target location. The malware detection event will not be created.
3. If the antivirus detects malware activity, Veeam Backup & Replication will perform the following steps:

1. Abort the restore process or restore the machine with restrictions depending on secure restore settings.

2. Create the malware detection event and mark objects as Infected.

You can further access the restored machine or its disks in the isolated environment and clean the infection.