I have noticed while i'm deopped and set away quite a few random users doing a .scanall -r in pm windows.
I never get these in pm while i'm opped. Is it another type of new exploit or virus lnfected users looking for something?

I myself have never heard of it, but obviously they are skipping the chanops to avoid detection if you only see this while not opped.
I also have private msgs blocked unless you are on my list of approved people so that might be part of why.

is it a large channel?

yeah, its a fairly large channel on DAlnet.
I've also noticed a few of the ones that have sent the .scanall -r are the infected adbots with the random letter nicks/idents. I've asked around, no one else has any idea. Maybe because it's something fairly new..

if it is sending that in a msg/query window I suspect its bad code in the adbot
scanall -r sounds like "scan all non-registered nicks" as DALnet uses mode +r to show you have identified to a registered nick