Scanning Backups Using Console

In the Veeam Backup & Replication console, you can run a Scan Backup session from the Inventory or Home view. For more information about Scan Backup and its scan engines, see Scan Backup.

To run a Scan Backup session, do the following:

1. Open the Scan Backup window by doing one of the following:

• Open the Inventory view and select the Malware Detection node. Select the required machine and click Scan Backup on the ribbon. Alternatively, right-click the machine and select Scan backup.
• Open the Home view and select the Backups node. Select the backup and the required machine, file share, or object storage restore point, and click Scan Backup on the ribbon. Alternatively, right-click it and select Scan backup.

2. Specify the scan mode you want to use. You can perform one of the following operations:

• Find the last clean restore point.
• Find the last clean restore point in range.
• Scan content of all restore points in range.

3. Specify the scan engine you want to use:

• To use Veeam Threat Hunter as a scan engine, select the Scan restore points with Veeam Threat Hunter check box. For more information, see Veeam Threat Hunter for Scan Backup.

If you use 3rd party antivirus software as an alternative to Veeam Threat Hunter, select the Scan restore points with the existing antivirus software check box. For more information, see Antivirus Scan for Scan Backup.

• To use YARA as a scan engine, select the Scan restore points with the following YARA rule check box and specify the YARA file. For more information, see YARA Scan for Scan Backup.

Place the YARA file with the .yara or .yar extension in the C:\Program Files\Veeam\Backup and Replication\Backup\YaraRules folder (for Veeam Backup & Replication on Microsoft Windows) or in the /var/lib/veeam/yara_rules/ directory (for Veeam Backup & Replication on Linux). You can add the file through the File view in the Veeam Backup & Replication console. For more information, see Copying Files and Folders Manually. To create a YARA rule, see YARA documentation.

• To use YARA and Veeam Threat Hunter or 3rd party antivirus software simultaneously, select both check boxes.

4. Configure the scan range. You can specify the following options:

• Scan all restore points, from the most recent restore point to the oldest one.
• Scan restore points created during a specific time period.

To continue the Scan Backup session after the first malware or the first piece of specific information is found, select the Continue scanning all remaining files after the first occurrence check box.

5. Click OK.