Antivirus Exclusions for Veeam Backup & Replication

On the Veeam Backup Server:

• C:\Program Files\Veeam\
• C:\Program Files (x86)\Veeam\
• C:\Program Files\Common Files\Veeam\
• C:\Program Files (x86)\Common Files\Veeam\
• VBRCatalog Path
  
  This path can be found in the registry under the value named CatalogPath in the key HKLM\SOFTWARE\Veeam\Veeam Backup Catalog\
• NFS Path
  
  This path can be found in the registry under the value named RootFolder in the key HKLM\SOFTWARE\Wow6432Node\Veeam\Veeam NFS\
• C:\VeeamFLR\  <sup>Optional. See: NoteThe VeeamFLR folder is where Veeam Backup & Replication mounts the disks of machines so that their content can be accessed. Traditionally, it has been advised to exclude this folder from antivirus scans to avoid the risk of interference with Guest OS File Recovery and Disk Publishing restore operations, as such interference could negatively impact the restore process or its performance.
  
  However, with the introduction of features like Scan Backup and the malware scanning component of SureBackup in Veeam Backup & Replication v12.1, antivirus software now requires access to the VeeamFLR folder to perform scans on the content of a machine's backed-up disk.
  
  While most antivirus solutions make a distinction between automatic and on-demand scans in the context of an exclusion, some customers have reported that their antivirus software refused to perform the on-demand scans of an excluded VeeamFLR folder. Consequently, the same exclusion intended to avoid interference with Guest OS File Recovery could inadvertently cause the Scan Backup feature to be unable to perform malware scans correctly.
  
  Therefore, Veeam continues to recommend excluding the C:\VeeamFLR except in scenarios where such exclusion would prevent desired features from operating correctly due to a customer's security software refusing to scan on-demand an excluded folder.</sup>
• C:\Windows\Veeam\
• C:\ProgramData\Veeam\
  This is the default log directory location. If the log directory path has been changed, an additional AV exclusion must be created for the custom log directory.
• C:\Windows\Temp\*\veeamflr-*.flat
• C:\Windows\Temp\VeeamBackup\
• C:\Windows\Temp\VeeamBackupTemp\
• C:\Windows\Temp\veeamdumprecorder\
• C:\Windows\TEMP\VeeamForeignSessionContext*\
  This folder is used to store Malware Detection Inline Entropy Analysis files from guests that are protected.
• %localappdata%\Veeam\Backup\
  This is a per-user folder.
• PostgreSQL Antivirus Exclusion Recommendation 
  When the configuration database is hosted by PostgreSQL, the default for all new deployments of Veeam Backup & Replication 12 and higher.

For Veeam Backup Enterprise Manager:

• C:\Program Files\Veeam\
• C:\Program Files\Common Files\Veeam\
  
• VBRCatalog Path
  Default: C:\VBRCatalog
  This path can be found in the registry under the value named CatalogPath in the key HKLM\SOFTWARE\Veeam\Veeam Backup Catalog\
• C:\ProgramData\Veeam\
  This is the default log directory location. If the log directory path has been changed, an additional AV exclusion must be created for the custom log directory.

For Veeam Backup & Replication Console:

• C:\Program Files\Veeam\
• C:\Program Files (x86)\Veeam\
• C:\Program Files\Common Files\Veeam\
• C:\Program Files (x86)\Common Files\Veeam\
• C:\VeeamFLR\  <sup>Optional. See: NoteThe VeeamFLR folder is where Veeam Backup & Replication mounts the disks of machines so that their content can be accessed. Traditionally, it has been advised to exclude this folder from antivirus scans to avoid the risk of interference with Guest OS File Recovery and Disk Publishing restore operations, as such interference could negatively impact the restore process or its performance.
  
  However, with the introduction of features like Scan Backup and the malware scanning component of SureBackup in Veeam Backup & Replication v12.1, antivirus software now requires access to the VeeamFLR folder to perform scans on the content of a machine's backed-up disk.
  
  While most antivirus solutions make a distinction between automatic and on-demand scans in the context of an exclusion, some customers have reported that their antivirus software refused to perform the on-demand scans of an excluded VeeamFLR folder. Consequently, the same exclusion intended to avoid interference with Guest OS File Recovery could inadvertently cause the Scan Backup feature to be unable to perform malware scans correctly.
  
  Therefore, Veeam continues to recommend excluding the C:\VeeamFLR, except in scenarios where such exclusion would prevent desired features from operating correctly due to a customer's security software refusing to scan on-demand that folder.</sup>
• C:\Windows\Veeam\
• C:\ProgramData\Veeam\
  This is the default log directory location. If the log directory path has been changed, an additional AV exclusion must be created for the custom log directory.
• C:\Windows\Temp\*\veeamflr-*.flat
• C:\Windows\Temp\VeeamBackup\
• C:\Windows\Temp\VeeamBackupTemp\
• C:\Windows\Temp\veeamdumprecorder\
• %localappdata%\Veeam\Backup\
  This is a per-user folder.

In Guest OS of protected Windows Machines:

• If either Application-Aware Processing or Guest File System Indexing is enabled, the following folders will be used:
  • %programdata%\Veeam\
  • %windir%\VeeamVssSupport\
• If the Malware Detection system's Enable inline entropy analysis option is enabled, and the Guest File System Indexing and Malware Detection guest processing option is enabled:
  • C:\Windows\TEMP\*.ridx
• On SQL Servers, when SQL Server Transaction Log Backup is enabled, the following folder will be used:
  • %windir%\VeeamLogShipper\
    
• If using Persistent Agent Components, the Veeam Guest Agent package will be installed.
  • C:\Program Files\Common Files\Veeam\Backup and Replication\Veeam Guest Agent\
• For Domain Controllers, review the "Isolate Anti-Virus Interference" section of KB1697 for details regarding anti-virus "Boot Protection" modules that can impact Application-Aware Processing operations.

In Guest OS of File-Level Restore Target Windows Machines:

When restoring files to the original machine or a different machine, the following folders are used:

• %programdata%\Veeam\
• %windir%\VeeamVssSupport\

Windows-based Backup Infrastructure Components

Below is a list of packages that may be installed on machines assigned Backup Infrastructure Component roles (e.g., VMware Backup Proxy, WAN Accelerator, Windows Repository) and their associated AV exclusion requirements. Review which packages are installed on a given machine and create the AV exclusions based on which packages are installed.

General Folders

All Windows-based components use the following folders:

• C:\ProgramData\Veeam\
  Default Log Folder
• C:\Windows\Temp\Veeam\
• C:\Windows\Temp\VeeamBackupTemp\

Package Specific AV Exclusions

Package names below are as listed within the Programs & Features list (appwiz.cpl).

Veeam Installer Service

• C:\Windows\Veeam\Backup\

Veeam Backup Transport

• C:\Program Files (x86)\Veeam\Backup Transport\

Veeam CDP Proxy

• C:\Program Files\Veeam\CDP Proxy Service\
• Veeam CDP Proxy Cache Folder (For VMware Backup Proxies assigned to act as CDP Proxies)
  Default: C:\VeeamCDP\

Veeam Backup vPowerNFS

• C:\Program Files (x86)\Veeam\vPowerNFS\
• Instant recover write cache folder
  Review each repository's Mount Server setting and add an AV exclusion for the write cache path on the Mount Server specified.

Veeam Hyper-V Integration

• C:\Program Files\Veeam\Hyper-V Integration\

Veeam Mount Service

• C:\Program Files\Common Files\Veeam\Backup and Replication\
• C:\VeeamFLR\  <sup>Optional. See: NoteThe VeeamFLR folder is where Veeam Backup & Replication mounts the disks of machines so that their content can be accessed. Traditionally, it has been advised to exclude this folder from antivirus scans to avoid the risk of interference with Guest OS File Recovery and Disk Publishing restore operations, as such interference could negatively impact the restore process or its performance.
  
  However, with the introduction of features like Scan Backup and the malware scanning component of SureBackup in Veeam Backup & Replication v12.1, antivirus software now requires access to the VeeamFLR folder to perform scans on the content of a machine's backed-up disk.
  
  While most antivirus solutions make a distinction between automatic and on-demand scans in the context of an exclusion, some customers have reported that their antivirus software refused to perform the on-demand scans of an excluded VeeamFLR folder. Consequently, the same exclusion intended to avoid interference with Guest OS File Recovery could inadvertently cause the Scan Backup feature to be unable to perform malware scans correctly.
  
  Therefore, Veeam continues to recommend excluding the C:\VeeamFLR, except in scenarios where such exclusion would prevent desired features from operating correctly due to a customer's security software refusing to scan on-demand that folder.</sup>
• C:\Windows\Temp\*\veeamflr-*.flat
• Backup Files Location or Backup File Extensions
  When the machine is acting as a Windows Backup Repository. 
• Capacity Tier 'ArchiveIndex' Path

Veeam WAN Accelerator Service

• C:\Program Files\Veeam\WAN Accelerator Service\
• *WAN cache Path*

Veeam Remote Tape Access Service

• C:\Program Files (x86)\Veeam\Backup Tape\

Veeam Backup Cloud Gateway

• C:\Program Files (x86)\Veeam\Backup Gate\

Veeam Threat Hunter

• C:\Program Files\Veeam\Backup and Replication\Threat Hunter\

Veeam Transaction Log Backup Service

• C:\Program Files\Common Files\Veeam\Backup and Replication\Log Backup Service\

Repository File Extensions:

• *.erm
• *.flat
• *.vab
• *.vacm
• *.vacm_*tmp
• *.vasm
• *.vasm_*tmp
• *.vbk
• *.vbk.tmp
• *.vblob
• *.vbm
• *.vbm.temp
• *.vbm_*tmp
• *.vcache
• *.vib
• *.vindex
• *.vlb
• *.vmdk
• *.vom
• *.vom_*tmp
• *.vrb
• *.vsb
• *.vslice
• *.vsm
• *.vsm_*tmp
• *.vsource
• *.vsourcecopy
• *.vsourcetemp
• *.vstore
• *.vstorecopy
• *.vstoretemp