Skip to main content
Question

Malware Analysis errors - B&R still referencing old workstation name

  • March 22, 2025
  • 2 comments
  • 314 views

  • B&R 12.3.1.1139
  • VOne 12.3.0.4670
  • Agent for MS 6.3.1.1074

Job managed by agent

A few months ago, I replaced a physical workstation that uses Windows Agent. I reinstalled the old SSD into the new computer. I renamed the PC. Everything works, including Veeam Agent backups but I noticed that email alerts and Malware scan related errors still reference the old computer name even though the new pc name is displayed in the B&R control panel.

Since updating to B&R 12.3 and enabling Veeam Threat Hunter, I get the following email alerts:

  • [Error] Malware analysis session has failed unexpectedly: Action completed with error
  • [Failed] Daily malware detection report (0 malware events for 0 workloads)

Image

On the B&R server, I see the following in: C:\ProgramData\Veeam\Backup\Svc.VeeamDataAnalyzer.log

Code: Select all

[CRansomwareSessionMailer] Sending session failure email report...
[25.01.2025 01:33:13.265] <48> Info (3) [DB] Generating xml report
[25.01.2025 01:33:13.328] <48> Info (3) [DB] Transforming xml report to html report
[25.01.2025 01:33:13.375] <48> Info (3) [CReportMailer] Sending e-mail notification, server 'SMTP Server 'mail.EXAMPLE.com', port '587', timeout '100000', use ssl 'True'', to 'jeff@EXAMPLE.com'
[25.01.2025 01:33:13.468] <48> Info (4) Certificate trusted.
[25.01.2025 01:33:13.531] <48> Info (3) [CRansomwareSessionMailer] Session failure email report was sent successfully
[25.01.2025 01:33:13.531] <48> Error (3) Catalog folder has invalid structure: file C:\VBRCatalog\Index\Machines\PC-7050\2025_0125.0629.4a84dfd48d73414eb22a6c3e049b166f\internal\refs.txt not found (System.Exception)
[25.01.2025 01:33:13.531] <48> Error (3) at Veeam.Backup.Interaction.CatalogClient.CWcfGuestIndexDeltaProxy.RealProxy.WrapMethodCalling[T](Func`1 func)
[25.01.2025 01:33:13.531] <48> Error (3) at Veeam.Backup.Interaction.CatalogClient.CWcfGuestIndexDeltaProxy.<>c__DisplayClass6_0.<GetResult>b__0(RealProxy p)
[25.01.2025 01:33:13.531] <48> Error (3) at Veeam.Backup.Common.CWcfRetryableProxy`1.Invoke[U](Func`2 func)
[25.01.2025 01:33:13.531] <48> Error (3) at Veeam.Backup.RansomwareScanner.CGuestIndexAnalyzer.AnalyzeIndexDelta(CRansomwareAnalysisTask task)
[25.01.2025 01:33:13.531] <48> Error (3) [GuestIndexAnalyzer] Failed to analyze index delta
[25.01.2025 01:33:13.531] <48> Error (3) Catalog folder has invalid structure: file C:\VBRCatalog\Index\Machines\PC-7050\2025_0125.0629.4a84dfd48d73414eb22a6c3e049b166f\internal\refs.txt not found (System.Exception)
[25.01.2025 01:33:13.531] <48> Error (3) at Veeam.Backup.Interaction.CatalogClient.CWcfGuestIndexDeltaProxy.RealProxy.WrapMethodCalling[T](Func`1 func)
[25.01.2025 01:33:13.531] <48> Error (3) at Veeam.Backup.Interaction.CatalogClient.CWcfGuestIndexDeltaProxy.<>c__DisplayClass6_0.<GetResult>b__0(RealProxy p)
[25.01.2025 01:33:13.531] <48> Error (3) at Veeam.Backup.Common.CWcfRetryableProxy`1.Invoke[U](Func`2 func)
[25.01.2025 01:33:13.531] <48> Error (3) at Veeam.Backup.RansomwareScanner.CGuestIndexAnalyzer.AnalyzeIndexDelta(CRansomwareAnalysisTask task)
[25.01.2025 01:33:13.531] <48> Error (3) at Veeam.Backup.RansomwareScanner.ExtensionMethods.AnalyzeWithRetrySafe(IIndexAnalyzer analyzer, CRansomwareAnalysisTask task, ILogScope log)
[25.01.2025 01:33:13.531] <48> Info (3) [GuestIndexAnalyzer] 1:Sleeping between retries for 30 seconds...
[25.01.2025 01:33:43.547] <48> Info (3) [GuestIndexAnalyzer] VM [PC-7050]: analyzing point 1/25/2025 6:29:30 AM\4a84dfd4-8d73-414e-b22a-6c3e049b166f) delta
[25.01.2025 01:33:43.547] <48> Error (3) Catalog folder has invalid structure: file C:\VBRCatalog\Index\Machines\PC-7050\2025_0125.0629.4a84dfd48d73414eb22a6c3e049b166f\internal\refs.txt not found
[25.01.2025 01:33:43.547] <48> Error (3) Catalog folder has invalid structure: file C:\VBRCatalog\Index\Machines\PC-7050\

PC-7050 is the old pc name.

On the B&R server, when I browse to C:\VBRCatalog\Index\Machines, the folder for the workstation has the new name, not PC-7050. I have already tried deleting and recreating the backup job on the PC, after the PC was renamed.

I opened a ticket with Veeam Support back in early February but it was closed due to lack of resources for NFR licensed customers. Has anyone encountered this and/or know how to fix? Thanks!

2 comments

  • New Here
  • December 28, 2025

Hi,
have you found a solution for this?


Chris.Childerhose
Forum|alt.badge.img+21
  • Veeam Legend, Veeam Vanguard
  • January 22, 2026

@jeffshead  - were you able to find the answer to your question asked and if so please mark the best answer even if it happens to be your own.  This will help other community members who may have the same question.