Item may have a virus reported ..

[dotdk]

Hi all

We are seeing a number of our customers where we are getting errors like these:

* Processing OneDrive username (https://orgname-my.sharepoint.com/personal/username_com) finished with warning: Failed to backup item: /personal/username_com/Documents/Documents/xxx/xxxx1/199483d564c61b347c.js.download, Item may have a virus reported by the virus scanner plug-in :: 0:01:36
* Processing OneDrive useename (https://orgname-my.sharepoint.com/personal/username_com) finished with warning: Failed to backup item: /personal/username_com/Documents/xxx/xxx1/ANNO 2001.dbx, Item may have a virus reported by the virus scanner plug-in :: 0:00:58

First question is, what virus scanning plugin is being used to scan for virusses?
How do we exclude something from the scan if we confirm that it is a false positive hit?


We are on version 4.0.1.545 with this particular customer.

[Polina]

Hi Thomas,

Virus check is performed on O365 side by SharePoint antivirus. If an item is put on quarantine in SharePoint, VBO cannot access it. To avoid warnings, you can either exclude an entire OneDrive folder or delete the infected item from the source manually.

Thanks!

[dotdk]

Hi Polina,

Thanks for cleating that up for me.

However excluding an entire OneDrive folder would often result in perhaps hundreds of files not being backed up due to a single files being reported virus infected. A feature to either exclude a single file would be very usefull or a way to ignore the warning.

[Mike Resseler]

Hi dotk,

... a way to ignore the warning.

We have some thoughts around it, but are wondering how you see it? I do believe making sure the backups are green (because they should be) is valid, but I also want to make sure that people see that something is going on. So any thoughts from your side how you would like that to be handled?

[dkristek]

Mike,

I think that for usability it would make more sense to be able to exclude the individual items. Could this be suggested in a feature request in the future?

Thank you,
Daniel Kristek

[OmiFreak]

Hi,

we see many virus warnings on our OneDrive backup as well. A lot of them false positive, a option to ignore this warnings, and keep the job green would be really appreciated.

Thank you,
Bernd

[Mike Resseler]

@OmiFreak

If we would make this INFO in the logs, but still make sure it is logged (just to be sure that not important items are missed) would that work? (Thinking out loud now...)

[OmiFreak]

Hello Mike,

Yes, that would be a solution for us.
I think if important files in OneDrive are detected as a virus by Microsoft, I as an administrator have to think of a process to handle it anyway. It should not be the task of the backup software to inform about this.

[dotdk]

+1 to that solution Mike, as for now we advise customer to log a case with MS, in order to get them to check out the false positives, but in reality that doesnt happen and we keep having a job in warning state.

[MarkusN]

Did one of the suggestions make it into V6 ?

[Polina]

Hi Markus,

No, we had to postpone it to vNext.

[staun]

Hi,

We are using at hosted version of Office365 Veeam backup and get a daily warning report for some of our users OneDrive/ sharepoint storage.

Processing OneDrive xxxx finished with warning: Failed to backup item: /personal/USERNAME/Documents/Backup/filename.zip, Item may have a virus reported by the virus scanner plug-in

The file is ok and we can ignore it. But we are getting more and more of these reported files and increasing with other users as well. So my reports are always in warning state.

Is there a method to ignore/ accept files as it is often the same files our users are sharing.
I contacted our support that hosts Office365 backup, but they replied that this is by design and cannot be changed. But if this is true, I will end up with report with 100s of false-positive and we all know where that leads me to....

Can it really be there is no option to have a false-positive list of files?

[Polina]

Hi Jørgen,

I moved your post to an existing thread with a similar discussion.

Currently, there's no mechanism to suspend such warnings. From the above discussion, you may see that we're planning to improve the behavior, but as of now, I cannot provide you with any ETA.

Thanks!

[ND40oz]

Why does this behavior still occur once you've marked the file as safe in Microsoft Defender for Cloud Apps? They no longer show as Files infected with malware in the Defender Dashboard, so Microsoft is no longer alerting on them.

[Pagrossman]

Hi,

the same question...

We released the false positive files in Microsoft Defender but Veeam has still the problem. Now it is not about SharePoint antivirus, now it is about Veeam..

[mit.extrico]

I have the same issue here with an false positive. Are there any solutions to this issue?

[Victor van Hoek SLTN]

Same issue here. Keep getting Warnings in jobs for false positives. It would be great to mark thes files as save and get a Success status at the end of the backup.

[Mike Resseler]

This is weird to be honest. I talked about this with the MSFT defender team. If they are marked as safe, we should not get that warning anymore because that warning is a property which doesn't allow us to download it. So if you guys have marked them as safe, then we should be able to download (backup) them the next run.

Can you confirm that you have "released" them in Defender?

[MaartenA]

Is this still on the roadmap to change like the warning behavior to INFO or something like that?

[Polina]

We had to postpone it in favor of other significant product improvements, but it's not forgotten and will be implemented.

[dali@iae.nl]

+1 for a good solution of this annoying issue.

[utleyab]

+1

[Victor van Hoek SLTN]

Would be great if we would be able to get rid of these warnings (report as save so it would never report a warning for example)

[m.novelli]

+1 to ignore this warning messages about virus (real or false positive)

Marco

[juerg.hirschi]

+1, need this to stop having to go through useless warnings every day and missing perhaps important ones.

[mike.anderson]

+1 for being able to change it from a warning to a INFO Success. This feels like it should be a fairly simple regedit key like we see in other Veeam products.

Has anyone in the thread had success marking the items as false positive? Based on above it's still not releasing the files?

[MaartenA]

Is there any news about this yet? Perhaps a workaround can easily be made, just like with SkipOneNoteTimeoutWarning="True" in the proxy.xml, but for the virus warning so that no more warnings appear in the alerting

[fractalenergy]

+1 want to be able to exclude this warning.

[Ben.online]

+1

[SimonB-GMA]

+1 for a solutions similar to SkipOneNoteTimeoutWarning="True"