backups stay marked as infected

[real_tarantoga]

Hello,
an old issue I never tried to fix in my veeam environment are VMs/backups marked as infected.
Manually rescanning them and deleting the infected flags in the backup properties don't remediate this.
The infection flag reappears every day.
Even settings exclusions under inventory\malware detection doesn't fix it.

How can I get rid of the false infection marks?

Thank You!
Stefan

[david.domask]

Hi Stefan,

Sorry to hear about the challenges here - the behavior is at first blush not expected, as once marked as clean should persist unless marked as infected again.

Do you have a Support Case open yet? If so please share the case number, else please open a case and let the Support Team review. Be sure to include logs for Support to review. (Use the 3rd radio button to export from selected servers, and choose the VBR server to export from. Please mention the name of several machines that Support can use to start their review)

Thanks!

[real_tarantoga]

Hello David,
currently I've marked all jobs as clean, so I have to wait for the next backup run this night.
After then I will open the case and mention it here.

Kind Regards,
Stefan

[vmtech123]

Mine do this as well. Mark as clean, they become infected again. I've ignored it for a while.

Should marking a job as clean avoid those files in future runs? I don't want to exclude file types. Thanks

[real_tarantoga]

Due to prioritized tasks, I couldn't invest any time.
However, after marking the jobs as clean, they were labeled as infected again

have to put this off again, sorry

[david.domask]

Hi everyone,

Sorry to hear that the items are marked as infected unexpectedly. Have you checked the Malware Detection events? Is it triggering on the same items or different?

I think a Support Case is probably best way to go if the logs from the Malware Detection Events don't help you to understand what was the trigger, as depending on what was detected, it may or may not be expected.

[vmtech123]

Same files for me. Many are quite old.
Old video players that have odd file extensions trigger alerts at my company frequently. I’d like to ignore those files and not new files that are created so excluding the file type doesn’t work great.

I’d love to be able to ignore all CURRENT warnings going forward.