Backup Exec 25 Administrator's Guide

Configuring malware scan for virtual machine backup sets before restore

Malware Detection feature provides the ability to perform a scan on virtual machine backup sets. Malware scan operation can be run as an ad hoc job on a given backup set or it can be run as part of the restore operation.

You can use the feature for the following scenarios:

The scan can be run on VMware and Hyper-V virtual machines and only supports GRT enabled backup sets for disk and deduplication disk devices.

All the previous backup sets in the backup chain of the selected set should be GRT enabled backup sets on supported devices.

Backup Exec now supports Symantec Protection Engine (SPE) that can be used for malware scan. The malware scan settings dialog now provides the option to select the scan engine that can be used to perform malware scan. You can choose either Microsoft Windows Defender or SPE. By default, Backup Exec uses Windows Defender to run the malware scan on the backup set chain. Ensure that you have enabled Microsoft Defender and have the updated antivirus definitions. Backup Exec depends on the output of Windows Defender to determine if a backup set is malware free. Ensure that you have valid license for the SPE and the SPE services are running when you choose SPE for malware scan. Backup Exec depends on the output of the SPE to determine if a backup set is malware free.

For an incremental backup, the previous backup sets in the recovery chain are also used for the scan, but only the selected incremental set is marked as scanned.

To perform a malware scan, the selected backup set and previous sets in its backup chain are mounted. Each volume of the virtual machine from the mounted backup set is scanned for malware using the scan engine that is selected on the Malware scan settings.

You can choose to run malware scan as part of the physical virtual machine restore or GRT restore operation. If you perform a GRT restore, the entire virtual machine backup is scanned before performing the restore.

Backup Exec lets you modify the settings of the malware scan job. Scanning a backup set is CPU intensive and can take significant time if the virtual machine backup has large data to scan. This increases the time taken by the restore job and should be scheduled accordingly. It may affect other applications if you run multiple scan jobs. Go to Backup Exec Settings > Malware Scan to update the settings.

Malware scan is only supported for Backup Exec media server with Windows 2016 or later. Malware scan jobs can be run on an ad hoc basis by selecting the VMware and Hyper-V virtual machine backup sets. An ad hoc malware scan job cannot be run for GRT sets of a virtual machine.

To see the malware scan status, on the Backup and Restore tab or the Storage tab, double-click the server or the storage device that is related to the backup sets that you want to view and then click Backup Sets.

For the selected server or storage view, the Malware Scan Status and Malware Scan Time fields are displayed.

The scan time is the time when malware scan was last run on that set.

The scan operation displays the following malware status for the virtual machine backup set:

Note the following best practices for using malware scan:

Note the following limitation: