Search <book_title>...

NetBackup™ Release Notes

Last Published: 2022-03-28

Product(s): NetBackup (10.0)

Malware detection in NetBackup

NetBackup now supports scanning of backup images of Standard and MS-Windows policy type backups that are stored on an MSDP storage unit for the occurrence of malware.

You can select one or more backup images of the supported policy types for an on-demand scan using a predefined list of scan hosts. Malware scanning is done by supported third-party scanners such as MS Defender, Symantec Protection Engine, and the NetBackup Malware Scanner, which needs to be preinstalled and configured on the scan host. If malware is detected during the scan, a notification is generated in the NetBackup web UI. A list of on-going and completed scans is also shown in the NetBackup web UI. You are warned about recovery from the affected image. A new command line tool bpcleanrestore is available on primary servers to restore only the clean files from the scanned backups.

The NetBackup Instant Access feature is used for mounting the MSDP backup images on the scan host either as SMB or NFS shares.

Note the following limitations of malware scanning in NetBackup 10.0:

Malware scanning is not available for system state backups of the Active Directory (ALL_LOCAL_DRIVES) and backups of a file's Alternate Data Stream (ADS).
Traditional NetBackup agent and client-side encryption or agent and client-based compressed backups are unavailable for scanning using Instant Access mount points. MSDP KMS-based encryption techniques are recommended and can be configured (See the NetBackup Security and Encryption Guide.)
User archive backups are unavailable for scanning using Instant Access mount points.

For more information on the malware detection, refer to the NetBackup Security and Encryption Guide.