Malware Detected points to the location of the files but the location is empty.

Hi @PrismUser -

There were some issues with the initial release of Veeam's Malware Detection engine. They've implemented some updates to it with the most current release of 12.1.2. Did you install that version? It's supposed to help with false positives. 

Thanks and sorry for the delayed response.

I installed the latest, but I was still presented with warning on the following backup.

I am warned about 2 servers

Potential malware activity detected: too many files have had their names changed since last backup, ensure they were not encrypted by ransomware

Suspicious files can be found on the backup server BackupAndFax at C:\ProgramData\Veeam\Backup\Malware_Detection_Logs\suspicious_files_24-06-12.log

Potential malware activity detected:
*.wallet(Globe 3): 3

we did get compromised about 8 years ago and yes this .wallet was the extension I can’t seem to locate the 3 files they are referring to even with my hidden files visible.

Hi, normally, when you get hit, you remain infected “forever”, 
in so many cases there is impossible to clean up all the extensions and traces of the attack.

In the cases that I suffered, the “best way” was to setup a new server, migrate the data analyzing it deeply with AV and antimalware, and even with that, some junk moved to the new one.

check the info @coolsport00 shared with you, follow your backup points, and test them, test, test, test!

a clean restore point is important, but ensuring that is restorable is even better!

cheers.

Hi @PrismUser - have you performed forensics on this particular system you’re getting Malware Events on? Do you still have questions?...need assistance? If all is ok, and 1 of the provided comments helped you out, we ask you mark which one helped you as ‘Best Answer’ so others with a similar question who come across your post may benefit.

Thank you.