How Malware Detection Works

Malware detection is managed by the Veeam Data Analyzer Service. The service restarts once a day at 12:00 AM and starts a new malware detection session. During the session, the Veeam Data Analyzer Service performs the following operations:

Checks for updates to the list of known suspicious files, extensions, and indicators of compromise. For more information, see File Detection.
Sends an email notification about all malware detection events that were created within the last 24 hours. For more information, see Notifications.
Initiates a scan session using a specific malware detection method if there is new backup data that needs to be scanned. Otherwise, the service waits for new data to appear.

If malware activity is detected, the Veeam Data Analyzer Service does the following:

Creates a malware detection event.
Marks the workload and the restore point where malware activity was detected for the first time as Suspicious or Infected.

Note

Consider the following:

A new malware detection session starts only if all previous scan sessions are finished. In that case, the session may start with a significant delay. Also, an email notification with the latest malware detection events will be created later.
All subsequent restore points created by the original backup job and any additional jobs (backup copy job, backup to tape job, and so on) that include the scanned workload will also be marked as Suspicious or Infected until the workload is marked as clean. For more information, see Managing Malware Status.
The malware status of workloads and restore points is displayed in the Veeam Backup & Replication console and web UI. If you perform restore operations using standalone applications, for example, Veeam Agent for Microsoft Windows, information about the malware status will not be available.