---
title: "Malware Scan"
description: "Orchestrator allows you to scan a machine included in the plan for possible malware either when running the plan or without running the plan by performing on-demand scanning. You can also perform the scan when testing a plan in a DataLab."
canonical: "https://helpcenter.veeam.com/docs/vro/userguide/malware_scan_overview.html"
breadcrumb: "User Guide > Security Guidelines > Malware Scan"
dateModified: "2026-08-26"
---

# Malware Scan

Orchestrator allows you to scan a machine included in the plan for possible malware either when running the plan or without running the plan by performing on-demand scanning. You can also perform the scan when testing a plan in a DataLab.

You can instruct Orchestrator to do the following:

- Check if any of restore points are marked as *Suspicious* or *Infected*. For more information, see the Veeam Backup & Replication User Guide, section [How Malware Detection Works](https://helpcenter.veeam.com/docs/vbr/userguide/malware_detection.html?ver=13). 
- [Applies only to restore and cloud plans] Scan restore points with antivirus software. For more information, see [How Orchestrator Performs Virus Scan](virus_scan_overview.md).
- [Applies only to restore and cloud plans] Perform YARA scan. For more information, see [Managing YARA Rules](managing_yara_rules.md).

<table style="width:100%;" class="Blue_Table">
  <tr style="vertical-align:top">
    <th rowspan="2" style="vertical-align:middle; width:18%;">
      <p>Scan Method</p>
    </th>
    <th colspan="2" style="vertical-align:top; width:24%;">
      <p style="text-align:center;">Restore Plan</p>
    </th>
    <th rowspan="2" style="vertical-align:middle; width:13%;">
      <p style="text-align:center;">Replica Plan</p>
    </th>
    <th rowspan="2" style="vertical-align:middle; width:13%;">
      <p style="text-align:center;">CDP Replica Plan</p>
    </th>
    <th rowspan="2" style="vertical-align:middle; width:13%;">
      <p style="text-align:center;">Storage Plan</p>
    </th>
    <th rowspan="2" style="vertical-align:middle; width:12%;">
      <p style="text-align:center;">Cloud Plan</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <th style="vertical-align:middle; width:12%;">
      <p style="text-align:center;">To VMware</p>
    </th>
    <th style="vertical-align:middle; width:12%;">
      <p style="text-align:center;">To Hyper-V</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td style="vertical-align:top; width:18%;">
      <p>Scan on-demand</p>
    </td>
    <td style="vertical-align:top; width:12%;">
      <p style="text-align:center;"><img border="0" src="images/yes.png"/></p>
    </td>
    <td style="vertical-align:top; width:12%;">
      <p style="text-align:center;"><img border="0" src="images/yes.png"/></p>
    </td>
    <td style="vertical-align:top; width:13%;">
      <p style="text-align:center;">Malware flag check</p>
    </td>
    <td style="vertical-align:top; width:13%;">
      <p style="text-align:center;">Malware flag check</p>
    </td>
    <td style="vertical-align:top; width:13%;">
      <p style="text-align:center;"><img border="0" src="images/no.png"/></p>
    </td>
    <td style="vertical-align:top; width:12%;">
      <p style="text-align:center;"><img border="0" src="images/yes.png"/></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td style="vertical-align:top; width:18%; height:46px;">
      <p>During plan execution</p>
    </td>
    <td style="vertical-align:top; width:12%; height:46px;">
      <p style="text-align:center;"><img border="0" src="images/yes.png"/></p>
    </td>
    <td style="vertical-align:top; width:12%; height:46px;">
      <p style="text-align:center;">Malware flag check</p>
    </td>
    <td style="vertical-align:top; width:13%; height:46px;">
      <p style="text-align:center;">Malware flag check</p>
    </td>
    <td style="vertical-align:top; width:13%; height:46px;">
      <p style="text-align:center;">Malware flag check</p>
    </td>
    <td style="vertical-align:top; width:13%; height:46px;">
      <p style="text-align:center;"><img border="0" src="images/no.png"/></p>
    </td>
    <td style="vertical-align:top; width:12%; height:46px;">
      <p style="text-align:center;"><img border="0" src="images/yes.png"/></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td style="vertical-align:top; width:18%;">
      <p>During a DataLab test</p>
    </td>
    <td style="vertical-align:top; width:12%;">
      <p style="text-align:center;"><img border="0" src="images/yes.png"/></p>
    </td>
    <td style="vertical-align:top; width:12%;">
      <p style="text-align:center;"><img border="0" src="images/no.png"/></p>
    </td>
    <td style="vertical-align:top; width:13%;">
      <p style="text-align:center;">Malware flag check</p>
    </td>
    <td style="vertical-align:top; width:13%;">
      <p style="text-align:center;">Malware flag check</p>
    </td>
    <td style="vertical-align:top; width:13%;">
      <p style="text-align:center;"><img border="0" src="images/no.png"/></p>
    </td>
    <td style="vertical-align:top; width:12%;">
      <p style="text-align:center;"><img border="0" src="images/no.png"/></p>
    </td>
  </tr>
</table>

## Requirements and Limitations for Malware Scan

To allow Orchestrator to perform malware scan, the following prerequisites must be met:

- Virus and YARA scan is supported for restore and cloud plans. However, machines recovered to a Hyper-V environment can be scanned with antivirus software and YARA rules only [when running a malware scan on-demand](scanning_recovery_plans.md), which means that the scan cannot be performed during a DataLab test or plan execution. 
- Only .YAR and .YARA files are supported.
- Scanning storage plans for possible malware is not supported.
- Veeam Backup & Replication server that manages replication jobs protecting machines included in CDP replica plans must run version 13.0.1 or later.
- The Veeam Backup & Replication server that manages the process of recovering machines to Microsoft Azure must run version 12.1 or later.
- Antivirus software must be installed on the mount server and support the command line interface (CLI). For the list of supported antivirus software, see the Veeam Backup & Replication User Guide, section [Antivirus XML Configuration File](https://helpcenter.veeam.com/docs/vbr/userguide/av_scan_xml.html?ver=13).
- For Linux-based machines protected by a Windows-based Veeam Backup & Replication server, antivirus and YARA scans are supported only if you specify a Linux-based server as the default mount backup server in Veeam Backup & Replication. 

  For more information on how to configure the default mount server, see the Veeam Backup & Replication User Guide, section [Mount Servers](https://helpcenter.veeam.com/docs/vbr/userguide/mount_server.html?ver=13).

## Related Topics

[Managing YARA Rules](managing_yara_rules.md)