How Antivirus Scan Works
During the restore session, the antivirus scan works in the following way:
- On the mount server, Veeam Backup & Replication runs the Veeam Mount Service to perform the following steps:
- Mount machine disks from backups to the mount server under the C:\VeeamFLR\<machinename> folder (for Veeam Backup & Replication on Microsoft Windows) or the /run/media/Veeam.Mount.FS/<id> directory (for Veeam Backup & Replication on Linux).
- Initiate a new scan session.
- If the antivirus does not detect malware activity, Veeam Backup & Replication will restore the machine or its disks to the target location. The malware detection event will not be created.
- If the antivirus detects malware activity, Veeam Backup & Replication will perform the following steps:
- Abort the restore process or restore the machine or its disks with restrictions depending on secure restore settings.
- Create the malware detection event and mark objects as Infected.
