Recovery & and recovery verification are not related with a malware scan.
A malware scan is optional.
Recovery:
You restore data back to production. An entire vm, a single item, a sql database.
https://helpcenter.veeam.com/docs/backup/vsphere/data_recovery.html?ver=110
Recovery Verification:
You configure Veeam Sure Backup Jobs to verify your backup data, if it‘s possible todo a recovery in case, you need to do a DR someday.
https://helpcenter.veeam.com/docs/backup/vsphere/surebackup_recovery_verification.html?ver=110
Optional Malware Scan:
This is a feature called Secure Restore. Veeam will use an installed antivirus software on the mount server to check the content of the vm in the backup data before releasing it to the production environment.
This can be done in vm restores or in a surebackup job session. For the entire List, click on the link.
In the surebackup Job session, it will only be tested for malware and never be released onto production storage.
https://helpcenter.veeam.com/docs/backup/vsphere/av_scan_about.html?ver=110
I think, @Mildur did summarize this very well! Additionally you can run some “clearing”-scripts before restore with the Staged Restore feature.
https://helpcenter.veeam.com/docs/backup/vsphere/staged_restore_about.html?ver=110
Thanks for marking a best answer! But @Mildur ‘s post deserves this definitely more than mine! Maybe you want to change this?