Managing List of Suspicious Files and Extensions

To keep the list of suspicious files and extensions up-to-date, select the Update malware definitions automatically check box. If the option is enabled, Veeam Backup & Replication will communicate with the Veeam Update Server (vbr.butler.veeam.com) daily and download the latest version of the SuspiciousFiles.xml file. The Veeam Data Analyzer Service checks the file for updates once a day at 12:00 AM.

Note

If your backup server has limited internet access, you can update the list of suspicious files and extensions manually. For more information, see this Veeam KB article.

Adding Custom Suspicious Files and Extensions

To add custom files and extensions that should be marked as suspicious, perform the following steps:

From the main menu, select Malware Detection > General and click File masks to monitor.
Click Add next to the Suspicious files field.
Specify a file extension or a file name with or without extension. You can also use * and ? wildcard characters. For example:

bot.txt

bot

b?t

*.avi

Note

Malware detection scan is case-insensitive. You do not need to add extensions or file names with different cases, for example, bot and Bot.

Click OK.

Managing List of Suspicious Files and Extensions

Excluding Suspicious Files and Extensions

To exclude a file name or file extension listed in the SuspiciousFiles.xml file and ignore it during the scan, do the following:

From the main menu, select Malware Detection > General and click File masks to monitor.
Click Add next to the Trusted files field.
Specify a file name or file extension as it is listed in the SuspiciousFiles.xml file (the FileMask tag). For example:

*.cryptoboss

Click OK.

Note

You can also add files and extensions to the trusted list from the Event Details window. For more information, see Viewing Malware Detection Events.

Managing List of Suspicious Files and Extensions

Exporting and Importing Custom Lists

You can export and import the list of custom files and extensions to/from a file in the XML format.

To export the list, do the following:

From the main menu, select Malware Detection > General and click File masks to monitor.
Click Export these filters.
Click Browse and select the folder to save the list.
Specify the name of the file and click Save.
Click OK.

Managing List of Suspicious Files and Extensions

To import the list, do the following:

From the main menu, select Malware Detection > General and click File masks to monitor.
Click Import existing list.

Important

The import operation will override files and extensions you specified earlier. It is recommended to export your current list before you import a new one.

Click Browse and select the folder where the file is located.
Select the file and click Open.
Click OK.

Managing List of Suspicious Files and Extensions

A valid XML Schema for the list must contain the following elements:

Element	Description
RansomwareExclusions	Root element.
Includes	Child element of the RansomwareExclusions element. Contains custom files and extensions that must be marked as suspicious. Can be empty.
Excludes	Child element of the RansomwareExclusions element. Contains files and extensions listed in the SuspiciousFiles.xml file that must be ignored during the guest indexing data scan. Can be empty.
Item	Child element of the Includes or Excludes element. Each Item contains a file extension or a file name with or without extension that must be marked as suspicious or ignored. Consider the following: File names and file extensions can include * and ? wildcard characters. File names and file extensions must not contain the following characters: <, >, :, ", \, /, \|. Use & to escape an ampersand (&). Note that files and extensions you want to exclude must be listed in the SuspiciousFiles.xml file.

Example:

</Includes>

<Item>*.cryptoboss</Item>

</Excludes>

</RansomwareExclusions>