How to add malware exclusion

Question

I understand the basics of how to add Malware Exclusions. However, I cannot figure out how to deal with some false-positives without severely crippling malware detection and basically making me want to just disable it all together because of the amount of time I have to spend dealing with false-positives because of the lack of granularity.

Here’s an example:

C:\Program Files (x86)\App\FileSec.xml.encrypted
C:\Program Files (x86)\App\Bin\FileSec.xml.encrypted

The files above are easy enough to deal with but the app periodically creates a backup of it’s settings and those two files are replicated to a new path, each time a backup is performed. Example:

C:\ProgramData\AppBackup.76\FileSec.xml.encrypted
C:\ProgramData\AppBackup.76\Bin\FileSec.xml.encrypted

The next backup will be:

C:\ProgramData\AppBackup.77\FileSec.xml.encrypted
C:\ProgramData\AppBackup.77\Bin\FileSec.xml.encrypted

How do I deal with this? Since wildcards can’t be used, the only options that I can think of are to exclude the .encrypted extension or exclude the entire C:\ProgramData\ directory. Both of those options seem too aggressive.

coolsport00 · Answer

Hmm...this is a difficult one ​@jeffshead. I’m not sure there’s a resolution here. I’ve dove a bit deep into Malware Detection, but mostly with the Inline Entropy Scan engine; not File System Indexing Scanning. Though Inline doesn’t show explicit files/diretories orhave the ability to add exclusions, etc., it has this same issue as you share that File System Scan does →For Inline Entropy...when some of my Linux VMs are upgraded (kernel or their pkgs), it “trips” the Veeam Malware Detection engine to throw a Malware Alert. Basically, it’s a false pos. I haven’t researched too in depth on why, but my assumption is it happens similar to your case →new pkg directories or the like.Only suggestion I have is either to reach out to Veeam Support to see if there is some workaround, or ping the Veeam Product Manager directly on the Forumsto see if he has a solution for you (Dmitry Popov). But honestly...though I like Malware Detection in Veeam, it’s not perfect, but at least does provide another “layer” in our org’ssecurity posture to help us try to thwart malicious vectors.Let us know what you find out.Best.

Sign up

Login to the community

Scanning file for viruses.

This file cannot be downloaded