Step 6. Run Malware Scan

At the Malware Scan step of the wizard, choose whether you want to check restore points created for machines included in the plan for malware flags. You can also decide whether you want to scan these restore points with antivirus software, a YARA rule or both.

By design, Orchestrator checks only the most recently created restore point for each machine and stops plan testing if the restore point is infected. For more information, see Malware Scan.


  • When you connect to a Veeam Backup & Replication server, Orchestrator automatically collects YARA rules that were added to the server. If you have connected multiple Veeam Backup & Replication servers, Orchestrator will display all available YARA rules. If there are multiple YARA rules with the same name, they will be displayed as one rule.
  • Make sure that the selected rule exists on the Veeam Backup & Replication server that will manage the recovery process.

Configuring Test Scheduling


Orchestrator does not scan machines added to lab groups. If you want to perform malware scan for machines included in a lab group, add these machines to a restore plan.