---
title: "Start-VBRScanBackup"
description: "Starts a scan of backups with antivirus or YARA scan. Product Edition: Enterprise, Enterprise Plus, Veeam Universal License This cmdlet starts a scan of backups with antivirus or YARA scan."
canonical: "https://helpcenter.veeam.com/docs/vbr/powershell/start-vbrscanbackup.html"
breadcrumb: "Veeam PowerShell Reference > Veeam PowerShell Reference > Managing Security Settings > Malware Detection > Start-VBRScanBackup"
dateModified: "2026-08-19"
---

# Start-VBRScanBackup

## Short Description
Starts a scan of backups with antivirus or YARA scan.

**Product Edition**: Enterprise, Enterprise Plus, Veeam Universal License

## Syntax
```
Start-VBRScanBackup -Object <VBRBackupObject[]> [-RestorePoint <VBRRestorePoint>]
 -ScanMode <VBRRestorePointScanMode> [-EnableAntivirusScan] [-EnableYARAScan] [-YARARule <String>]
 [-FromPointInTime <DateTime>] [-ToPointInTime <DateTime>] [-EnableEntireImageScan] [-RunAsync] [<CommonParameters>]
```

## Detailed Description
This cmdlet starts a scan of backups with antivirus or YARA scan. You can scan the following types of backups:

- Backups of VMware vSphere virtual machines created by Veeam Backup & Replication.
- Backups of Microsoft Hyper-V virtual machines created by Veeam Backup & Replication.
- Backups created by backup copy jobs.
- Backups of Nutanix AHV virtual machines created by [Veeam Backup for Nutanix AHV](https://helpcenter.veeam.com/docs/vbahv/userguide/overview.html?ver=6).
- Backups of RHV VMs created by [Veeam Backup for RHV](https://helpcenter.veeam.com/docs/vbrhv/userguide/overview.html?ver=6).
- Backups of Windows machines created by Veeam Agent for Microsoft Windows.
- Backup of VMware Cloud Director VMs.

## Parameters

<table style="width:100%;" class="Blue_Table">
      <tr style="vertical-align:top">
        <th style="width:20%;">
          <p>Parameter</p>
        </th>
        <th style="width:20%;">
          <p>Description</p>
        </th>
        <th style="width:20%;">
          <p>Type</p>
        </th>
        <th style="width:10%;">
          <p>Required</p>
        </th>
        <th style="width:10%;">
          <p>Position</p>
        </th>
        <th style="width:10%;">
          <p>Accept Pipeline Input</p>
        </th>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">EnableAntivirusScan</span></p>
        </td>
        <td>
          <p>Enables secure restore.</p><p>If you provide this parameter, Veeam Backup & Replication will trigger the antivirus software to scan selected VMs before the restore.</p><p>Default: <code>False</code>.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">EnableEntireImageScan</span></p>
        </td>
        <td>
          <p>Defines that the cmdlet will scan all restore points in backup even after it finds the first affected restore point.</p><p>Default: <code>False</code>.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">EnableYARAScan</span></p>
        </td>
        <td>
          <p>Defines that Veeam Backup & Replication will scan VMs with the specified YARA rule.</p><p>If you do not provide this parameter, Veeam Backup & Replication will not scan VMs with the YARA rule.</p><p>Use the <code>YARARule</code> parameter to specify the YARA rule.</p><p>Default: <code>False</code>.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">FromPointInTime</span></p>
        </td>
        <td>
          <p>Specifies the date and time. The cmdlet will scan backups that were created starting from this date and time.</p><p>Accepts the <code>DateTime</code> object. To get this object, run the <a href="https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-date?view=powershell-7.1"><code>Get-Date</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><code>DateTime</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Object</span></p>
        </td>
        <td>
          <p>Specifies an array of backups that you want to scan.</p><p>Accepts the <code>VBRBackupObject</code>[] object. To create this object, run the <a href="get-vbrbackupobject.md"><code>Get-VBRBackupObject</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbrbackupobject.md"><code>VBRBackupObject[]</code></a></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">RestorePoint</span></p>
        </td>
        <td>
          <p>Specifies a restore point that you want to scan.</p><p>Accepts the <code>COib</code> object. To get this object, run the <a href="get-vbrrestorepoint.md"><code>Get-VBRRestorePoint</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><code>VBRRestorePoint</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">RunAsync</span></p>
        </td>
        <td>
          <p>Defines that the command returns immediately without waiting for the task to complete.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">ScanMode</span></p>
        </td>
        <td>
          <p>Specifies one of the following scan modes:</p><ul><li><code>AllInInterval</code> — Use this mode to scan backup content with necessary YARA rules. The cmdlet will scan all restore points sequentially and will initiate a malware event. <strong>Note</strong>: If you use this mode, you must provide the <code>EnableYARAScan</code> and <code>YARARule</code> parameters.</li><li><code>FirstInInterval</code> — Use this mode if you are not sure when the attack started. The cmdlet will scan restore points in optimal order until it finds the malware-free restore point.</li><li><code>MostRecent</code> — Use this mode if you consider that a cyber-attack started recently. The cmdlet will scan the restore points sequentially, starting from the most resent restore point, until it finds the latest malware-free restore point.</li></ul>
        </td>
        <td style="width:10%;">
          <p><code>VBRRestorePointScanMode</code></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">ToPointInTime</span></p>
        </td>
        <td>
          <p>Specifies the date and time. The cmdlet will scan backups that were created by this date and time.</p><p>Accepts the <code>DateTime</code> object. To get this object, run the <a href="https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-date?view=powershell-7.1"><code>Get-Date</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><code>DateTime</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">YARARule</span></p>
        </td>
        <td>
          <p>Specifies the YARA rule. Veeam Backup & Replication will scan VMs with this rule.</p><p>Veeam Backup & Replication searches for YARA rules in the <code>YaraRules</code> folder. The default path is: <code>C:\Program Files\Veeam\Backup and Replication\Backup\YaraRules</code>.</p><p>To use a YARA rule, you must specify its name and extension. Veeam Backup & Replication accepts only <code>.yar</code> and <code>.yara</code> extensions.</p>
        </td>
        <td style="width:10%;">
          <p><code>String</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
    </table>

`<CommonParameters>`

This cmdlet supports Microsoft PowerShell common parameters. For more information on common parameters, see [ Microsoft Docs](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_commonparameters?view=powershell-7).

## Output Object
[`VBRSureBackupJobSession`](vbrsurebackupjobsession.md)

## Examples

::: example
### Scanning Backups with YARA Scan

This example shows how scan backups with YARA scan.

```
$yararule = Get-VBRYARARule
$backup = Get-VBRBackup
$vmbackup = Get-VBRBackupObject -Backup $backup[0]
Start-VBRScanBackup -Object $vmbackup[0] -ScanMode FirstInInterval -EnableYARAScan -YARARule $yararule[0]
```

Perform the following steps:

1. Run the [`Get-VBRYARARule`](get-vbryararule.md) cmdlet. Save the result to the `$yararule` variable.
2. Run the [`Get-VBRBackup`](get-vbrbackup.md) cmdlet. Save the result to the `$backup` variable.
3. Run the [`Get-VBRBackupObject`](get-vbrbackupobject.md) cmdlet. Set the `$backup[0]` variable as the `Backup` parameter value. Save the result to the `$vmbackup` variable.

   The `Get-VBRBackupObject` cmdlet will return an array of VM backups. Mind the ordinal number of the necessary VM backup (in our example, it is the first VM backup in the array).

4. Run the `Start-VBRScanBackup` cmdlet. Specify the following settings:

   - Set the `$vmbackup[0]` variable as the `Object` parameter value. 
   - Set the `FirstInInterval` option for the `ScanMode` parameter.
   - Provide the `EnableYARAScan` parameter.
   - Set the `$yararule[0]` variable as the `YARARule` parameter value.

:::

## Related Commands

- [`Get-VBRYARARule`](get-vbryararule.md)
- [`Get-VBRBackup`](get-vbrbackup.md)
- [`Get-VBRBackupObject`](get-vbrbackupobject.md)