Veeam Backup & Replication • Re: Malware Detection - too many files have had their names changed

Hello,

Similar issue here. Case #07107057.

I keep getting detections that I believe are flase positives, but I can't seem to find for information about the alerts to verify.

I get the 2 following messages:
Bulk file renaming Potential malware activity detected: too many files have had their names changed since last backup, ensure they were not encrypted by ransomware

Ransomware note Potential malware activity detected

I can't seem to find anything that gives me any files names or any more information. I checked the log files and that did not seem to help at all.

I did check the server in question manually and did not see any unsual behavior or files.

Veeam engineer reply:
So unfortunately, this specific event, bulk item renaming, currently does not generate a log. This seems to be an oversight on our part as we expected it to based on latest release notes, but we're currently working to resolve this.

Looks like it is not avaiable in the current version best options are to exclude or manually compare

Thanks

Statistics: Posted by zhallman — Feb 07, 2024 1:58 pm

---