AV Scan using Defender or Threat Hunter

[stewsie]

Hi

We are testing the AV scans in v12.3 and have found that when the Threat Hunter scan is used, Defender on the backup server detects the virus/malware and reports that it has been removed. Is this the expected result? I thought the AV scan would simply report in the FLR AV folder what has been detected but not do anything to say the file has been deleted.

I mounted the backup and can see the files that Defender had reported were deleted. I have been assuered that all AV Exclusions have been configured as per KB1999

Any ideas or recommendations?

[rennerstefan]

Hi

To clarify first, are u using the built in threat hunter or are u using veeam malware scanning with Windows defender?

It's correct that it scans the FLR folder and even if defender reports it was removed it won't be removed from the backup file as backup files are read only.

Thanks

[stewsie]

We are using Threat Hunter from the Veeam console 12.3. If I use Threat Hunter, Defender on the Veeam B&R server identifies the virus. If I use Defender as the scan engine Defender on the Veeam B&R server does nothing at all. I then see info in the FLR AntiVirus log file