Veeam Version 12.1 - Malware Detections Query

If you have scanned the servers in question and they are clean you can mark the Malware detection as clean and at the same time exclude the VMs from future detections.

Yes it would.  So I would mark the VM as clean in the Malware Detection section in the console and I believe it updates the metadata for detections.  I have done this and it seems to rectify the recurrence of detection on the VM but still scans it.

I know excluding is not the right way as we want all VMs scanned so that option to me should not be there.

@coolsport00 thank you i'll mark those two VM as clean and run a Microsoft Scan too.

i have scanned the VM with Mcafee / Windows Defender / ESET online tools, none of those tools has found any infection of malware.
i’ve marked the VM as clean, during the weekend backup, the warning has comes back.

Potential malware activity detected: *.ttt (TeslaCrypt 3.0): 40 instances

Another option would be to add this extension to the exclusion list -

Potential malware activity detected: *.ttt (TeslaCrypt 3.0): 40 instances

The *.ttt one noted in the report.

@westBuilding  Veeam is using a multilayered approach for detecting malware. The inline scan doesn't do classic signature based scanning. Rather it searches for hints of an existing infection or on going ransomware encryption. So something an AV might not detect, or in cases where an attacker already disabled the security solution or is attacking from a 3rd party system.​​​​​​ During the backup multiple attributes are getting checked. Known malicious file endings are just one of them. For example Veeam also searches for Onion links, ransomware notes or compares changes to previous backups.

Then the Guest Index is analyzed for suspicious or known malicious files. Here Veeam also searches for malware signatures which get updated and distributed by Veeam.

https://helpcenter.veeam.com/docs/backup/vsphere/malware_detection_guest_index.html?ver=120

And after the backup you have the possibility to scan restore points with a 3rd party antivirus and/or YARA rules. This can be done manually or in a scheduled way. Besides scanning the last restore point, you can also scan all restore points to find the last clean one.

So many different possibilities to find malicious traces 🙂

Thank you for your response, but your answers/steps are not complete. Could you please specify which file, etc.?

This is a great new feature, but I think having the ability to exclude directories instead of just file names would solve some things. As long as your directory paths don’t change where legitimate encrypted files are located, you would have the ability to exclude them without sacrificing excluding wildcard extensions for the entire workload. Just a thought anyways which would maybe help as a feature request.

I was talking about this in another post.

This, or the ability to choose specific files per folder/server, or mark flagged files as clean.   Something along both of those together would make this perfect. 

Hi @MJ_CIP2023 -

That folder only exists for the File System Analysis scans. You appear to be using the Inline Entropy scan. For that scan, the log file to look at is on the VBR server located at:

C:\ProgramData\Veeam\Backup\VeeamDataAnalyzerSvc.log

Even so, there still isn't much info given on what /where to look at for the possible threat. There should be an update to Malware Detection soon which is supposed to help. 

Thanks for the quick response. Found that log to at least point me in a possible direction - It appears the scan had issues with block sizes. This particular server had it’s C drive expanded due to space issues.  

C:\ProgramData\Veeam\Backup\Malware_Detection_Logs