Skip to main content
Solved

Noted Malware file extension not found

M

I am trying to clean up my Veeam Backup environment. Since they launched the Malware detection many of my backup sets are marked as containing files that Veeam thinks are malware. Most file extensions are not and some are files that have been created from our internal Applications Development team. I am either deleting non-relevant files or adding the extension to the Trusted Objects list.

One extension that Veeam marked as Malware is *.kill . It found 2 files on our file server with this extension. Confusingly, I have not been able to find these files when I search the file server.  Can anyone point me to an application or process that could locate these files?

Best answer by matheusgiovanini

There are a few things you can try. First, make sure hidden files are visible in your file explorer, as malware sometimes hides files to avoid detection. Next, open Command Prompt as administrator and run the command dir /s /b *.kill to search for those files across the system. If you can't locate or delete the files, it might be a good idea to isolate the system to prevent the malware from spreading. Also, keep in mind that the .kill extension isn't associated with any widely recognized program or file type, so it could be part of custom software or a malware script.

These steps should help you identify and handle the issue. Let me know if you need further assistance!

View original
Chris.Childerhose
Tommy O'Shea
matheusgiovanini
3 people like this
  • Chris.Childerhose
    Chris.Childerhose
  • Tommy O'Shea
    Tommy O'Shea
  • matheusgiovanini
    matheusgiovanini
Did this topic help you find an answer to your question?

6 comments

matheusgiovanini
Forum|alt.badge.img+5

There are a few things you can try. First, make sure hidden files are visible in your file explorer, as malware sometimes hides files to avoid detection. Next, open Command Prompt as administrator and run the command dir /s /b *.kill to search for those files across the system. If you can't locate or delete the files, it might be a good idea to isolate the system to prevent the malware from spreading. Also, keep in mind that the .kill extension isn't associated with any widely recognized program or file type, so it could be part of custom software or a malware script.

These steps should help you identify and handle the issue. Let me know if you need further assistance!

Matheus Giovanini | Senior Backup & Data Protection Analyst
MarcoLuvisi
Tommy O'Shea
2 people like this
  • MarcoLuvisi
    MarcoLuvisi
  • Tommy O'Shea
    Tommy O'Shea
matheusgiovanini
Forum|alt.badge.img+5

Also, You can check the file extension here. This website allows you to search for file extensions and see what programs or applications might use them.

If you search for .kill, you likely won't find any recognized associations, which suggests that it may be used by custom software or potentially malicious scripts.

Matheus Giovanini | Senior Backup & Data Protection Analyst
MarcoLuvisi
Tommy O'Shea
2 people like this
  • MarcoLuvisi
    MarcoLuvisi
  • Tommy O'Shea
    Tommy O'Shea
M
  • Mike D15
  • Author
  • New Here
  • 4 comments
  • March 25, 2025

I did have the Show Hidden Files option enabled when searching. 

The command that you listed did show the location and file name of the .kill files. These files are not associated with a malware but rather a product that we developed in-house. Apparently the developer chose a terrible file extension.

Thank you for the fast response and insight.

Tommy O'Shea
matheusgiovanini
2 people like this
  • Tommy O'Shea
    Tommy O'Shea
  • matheusgiovanini
    matheusgiovanini
matheusgiovanini
Forum|alt.badge.img+5

For real, that file extension isn’t too good 🤣

However, in Veeam, you can mark a file or, in this case, a extension as a “trusted object.

 

 

 

Thanks for the feedback! 

Matheus Giovanini | Senior Backup & Data Protection Analyst
Tommy O'Shea
1 person likes this
  • Tommy O'Shea
    Tommy O'Shea
M
  • Mike D15
  • Author
  • New Here
  • 4 comments
  • March 25, 2025

I have been adding file extension to the Trusted Object list. This works well but applies to all VM’s. I see that you can add a path to exempt but how do you specify which server the exemption is for? The example is only directed to C: .

Would it be \\SERVER\Folder\File.name? How are different drive letter’s denoted?

Tommy O'Shea
matheusgiovanini
2 people like this
  • Tommy O'Shea
    Tommy O'Shea
  • matheusgiovanini
    matheusgiovanini
matheusgiovanini
Forum|alt.badge.img+5

Veeam does not support specifying exclusions in the format \\ServerName\C$\Path\To\Exclude directly in its settings for file-level exclusions. In Veeam Backup & Replication, exclusions are typically set by selecting file paths or folders for the backup job, but you must use the local path on the server. If you need to apply exclusions for multiple servers in the same job or globally, you’ll need to apply the exclusions per job or as part of your backup infrastructure settings.

Matheus Giovanini | Senior Backup & Data Protection Analyst
Tommy O'Shea
1 person likes this
  • Tommy O'Shea
    Tommy O'Shea

Comment


Terms & Conditions