How Antivirus Scan Works

During the restore session, antivirus scan works in the following way:

1. On the mount server, Veeam Backup & Replication runs the Veeam Mount Service to perform the following steps:

1. Mount machine disks from backups to the mount server under the C:\VeeamFLR\<machinename> folder.
2. Initiate a new scan session.

2. If the antivirus does not detect malware activity, Veeam Backup & Replication will restore the machine to the target location. The malware detection event will not be created.
3. If the antivirus detects malware activity, Veeam Backup & Replication will perform the following steps:

1. Abort the restore process or restore the machine with restrictions depending on secure restore settings.

2. Create the malware detection event and mark objects as Infected.